{"grype_matches":[{"artifact":{"id":"bca20a7b0a858bf3","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/debian/libssl1.1@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1&upstream=openssl","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1d-0+deb10u7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3711","versionConstraint":"< 1.1.1d-0+deb10u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-3711","fix":{"state":"fixed","versions":["1.1.1d-0+deb10u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1d-0+deb10u7"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3711","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3711","date":"2026-10-08","epss":0.87816,"percentile":0.9976}],"risk":82.54704000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4963-1","link":"https://security-tracker.debian.org/tracker/DSA-4963-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-3711","description":"In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the \"out\" parameter can be NULL and, on exit, the \"outlen\" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the \"out\" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k)."},"relatedVulnerabilities":[{"id":"CVE-2021-3711","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3711","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3711","date":"2026-10-08","epss":0.87816,"percentile":0.9976}],"urls":["http://www.openwall.com/lists/oss-security/2021/08/26/2","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=59f5e75f3bced8fc0e130d72a3f582cf7b480b46","https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1%40%3Cdev.tomcat.apache.org%3E","https://security.gentoo.org/glsa/202209-02","https://security.gentoo.org/glsa/202210-02","https://security.netapp.com/advisory/ntap-20210827-0010/","https://security.netapp.com/advisory/ntap-20211022-0003/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2021/dsa-4963","https://www.openssl.org/news/secadv/20210824.txt","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2021-16","https://www.tenable.com/security/tns-2022-02"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3711","description":"In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the \"out\" parameter can be NULL and, on exit, the \"outlen\" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the \"out\" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k)."}]},{"artifact":{"id":"d308e84bddad0b0f","cpes":["cpe:2.3:a:openssl:openssl:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1d-0+deb10u7"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-3711","versionConstraint":"< 1.1.1d-0+deb10u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-3711","fix":{"state":"fixed","versions":["1.1.1d-0+deb10u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1d-0+deb10u7"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3711","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3711","date":"2026-10-08","epss":0.87816,"percentile":0.9976}],"risk":82.54704000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4963-1","link":"https://security-tracker.debian.org/tracker/DSA-4963-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-3711","description":"In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the \"out\" parameter can be NULL and, on exit, the \"outlen\" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the \"out\" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k)."},"relatedVulnerabilities":[{"id":"CVE-2021-3711","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3711","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3711","date":"2026-10-08","epss":0.87816,"percentile":0.9976}],"urls":["http://www.openwall.com/lists/oss-security/2021/08/26/2","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=59f5e75f3bced8fc0e130d72a3f582cf7b480b46","https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1%40%3Cdev.tomcat.apache.org%3E","https://security.gentoo.org/glsa/202209-02","https://security.gentoo.org/glsa/202210-02","https://security.netapp.com/advisory/ntap-20210827-0010/","https://security.netapp.com/advisory/ntap-20211022-0003/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2021/dsa-4963","https://www.openssl.org/news/secadv/20210824.txt","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2021-16","https://www.tenable.com/security/tns-2022-02"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3711","description":"In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the \"out\" parameter can be NULL and, on exit, the \"outlen\" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the \"out\" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k)."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.13.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0535","versionConstraint":"<1.12.16||>=1.13.0-0,<1.13.7 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0535","fix":{"state":"fixed","versions":["1.12.16","1.13.7"],"available":[{"date":"2020-01-27","kind":"release","version":"1.12.16"},{"date":"2020-01-27","kind":"release","version":"1.13.7"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-0601","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-0601","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-0601","date":"2026-10-08","epss":0.89436,"percentile":0.99784}],"risk":81.9,"urls":["https://go.googlesource.com/go/+/953bc8f391a63adf00bac2515dba62abe8a1e2c2","https://go.dev/issue/36834","https://groups.google.com/g/golang-announce/c/Hsw4mHYc470/m/WJeW5wguEgAJ"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/215905","description":"A Windows vulnerability allows attackers to spoof valid certificate chains when the system root store is in use.\n\nA workaround is present in Go 1.12.6+ and Go 1.13.7+, but affected users should additionally install the Windows security update to protect their system.\n\nSee https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-0601 for details on the Windows vulnerability.","knownExploited":[{"cve":"CVE-2020-0601","cwes":["CWE-295"],"notes":"Reference CISA's ED 20-02 (https://www.cisa.gov/news-events/directives/ed-20-02-mitigate-windows-vulnerabilities-january-2020-patch-tuesday) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 20-02. https://nvd.nist.gov/vuln/detail/CVE-2020-0601","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2020-0601","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-0601","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-0601","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-0601","date":"2026-10-08","epss":0.89436,"percentile":0.99784}],"urls":["http://packetstormsecurity.com/files/155960/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html","http://packetstormsecurity.com/files/155961/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0601"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-0601","description":"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.","knownExploited":[{"cve":"CVE-2020-0601","cwes":["CWE-295"],"notes":"Reference CISA's ED 20-02 (https://www.cisa.gov/news-events/directives/ed-20-02-mitigate-windows-vulnerabilities-january-2020-patch-tuesday) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 20-02. https://nvd.nist.gov/vuln/detail/CVE-2020-0601","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.13.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0535","versionConstraint":"<1.12.16||>=1.13.0-0,<1.13.7 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0535","fix":{"state":"fixed","versions":["1.12.16","1.13.7"],"available":[{"date":"2020-01-27","kind":"release","version":"1.12.16"},{"date":"2020-01-27","kind":"release","version":"1.13.7"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-0601","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-0601","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-0601","date":"2026-10-08","epss":0.89436,"percentile":0.99784}],"risk":81.9,"urls":["https://go.googlesource.com/go/+/953bc8f391a63adf00bac2515dba62abe8a1e2c2","https://go.dev/issue/36834","https://groups.google.com/g/golang-announce/c/Hsw4mHYc470/m/WJeW5wguEgAJ"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/215905","description":"A Windows vulnerability allows attackers to spoof valid certificate chains when the system root store is in use.\n\nA workaround is present in Go 1.12.6+ and Go 1.13.7+, but affected users should additionally install the Windows security update to protect their system.\n\nSee https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-0601 for details on the Windows vulnerability.","knownExploited":[{"cve":"CVE-2020-0601","cwes":["CWE-295"],"notes":"Reference CISA's ED 20-02 (https://www.cisa.gov/news-events/directives/ed-20-02-mitigate-windows-vulnerabilities-january-2020-patch-tuesday) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 20-02. https://nvd.nist.gov/vuln/detail/CVE-2020-0601","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2020-0601","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-0601","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-0601","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-0601","date":"2026-10-08","epss":0.89436,"percentile":0.99784}],"urls":["http://packetstormsecurity.com/files/155960/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html","http://packetstormsecurity.com/files/155961/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0601"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-0601","description":"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.","knownExploited":[{"cve":"CVE-2020-0601","cwes":["CWE-295"],"notes":"Reference CISA's ED 20-02 (https://www.cisa.gov/news-events/directives/ed-20-02-mitigate-windows-vulnerabilities-january-2020-patch-tuesday) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 20-02. https://nvd.nist.gov/vuln/detail/CVE-2020-0601","dueDate":"2022-05-03","product":"Windows","dateAdded":"2021-11-03","vendorProject":"Microsoft","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"0ee3c902a7004593","cpes":["cpe:2.3:a:libnghttp2-14:libnghttp2-14:1.36.0-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2-14:libnghttp2_14:1.36.0-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2_14:libnghttp2-14:1.36.0-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2_14:libnghttp2_14:1.36.0-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2:libnghttp2-14:1.36.0-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2:libnghttp2_14:1.36.0-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libnghttp2-14","purl":"pkg:deb/debian/libnghttp2-14@1.36.0-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=nghttp2","type":"deb","version":"1.36.0-2+deb10u1","language":"","licenses":["BSD-2-clause","Expat","GPL-3","GPL-3+","MIT","SIL-OFL-1.1","all-permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnghttp2-14/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libnghttp2-14/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnghttp2-14:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libnghttp2-14:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nghttp2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.36.0-2+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-44487","versionConstraint":"< 1.36.0-2+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"nghttp2","version":"1.36.0-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-44487","fix":{"state":"fixed","versions":["1.36.0-2+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.36.0-2+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-44487","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-44487","date":"2026-10-08","epss":0.99999,"percentile":0.99998}],"risk":78.75000000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-44487","description":"The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.","knownExploited":[{"cve":"CVE-2023-44487","cwes":["CWE-400"],"urls":["https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/","https://nvd.nist.gov/vuln/detail/CVE-2023-44487"],"notes":"This vulnerability affects a common open-source component, third-party library, or protocol used by different products. For more information, please see: HTTP/2 Rapid Reset Vulnerability, CVE-2023-44487 | CISA: https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","dueDate":"2023-10-31","product":"HTTP/2","dateAdded":"2023-10-10","vendorProject":"IETF","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2023-44487","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-44487","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-44487","date":"2026-10-08","epss":0.99999,"percentile":0.99998}],"urls":["http://www.openwall.com/lists/oss-security/2023/10/10/6","http://www.openwall.com/lists/oss-security/2023/10/10/7","http://www.openwall.com/lists/oss-security/2023/10/13/4","http://www.openwall.com/lists/oss-security/2023/10/13/9","http://www.openwall.com/lists/oss-security/2023/10/18/4","http://www.openwall.com/lists/oss-security/2023/10/18/8","http://www.openwall.com/lists/oss-security/2023/10/19/6","http://www.openwall.com/lists/oss-security/2023/10/20/8","https://access.redhat.com/security/cve/cve-2023-44487","https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/","https://aws.amazon.com/security/security-bulletins/AWS-2023-011/","https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/","https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/","https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/","https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack","https://blog.vespa.ai/cve-2023-44487/","https://bugzilla.proxmox.com/show_bug.cgi?id=4988","https://bugzilla.redhat.com/show_bug.cgi?id=2242803","https://bugzilla.suse.com/show_bug.cgi?id=1216123","https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9","https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/","https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack","https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125","https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715","https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve","https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764","https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088","https://github.com/Azure/AKS/issues/3947","https://github.com/Kong/kong/discussions/11741","https://github.com/advisories/GHSA-qppj-fm5r-hxr3","https://github.com/advisories/GHSA-vx74-f528-fxqg","https://github.com/advisories/GHSA-xpw8-rcwv-8f8p","https://github.com/akka/akka-http/issues/4323","https://github.com/alibaba/tengine/issues/1872","https://github.com/apache/apisix/issues/10320","https://github.com/apache/httpd-site/pull/10","https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113","https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2","https://github.com/apache/trafficserver/pull/10564","https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487","https://github.com/bcdannyboy/CVE-2023-44487","https://github.com/caddyserver/caddy/issues/5877","https://github.com/caddyserver/caddy/releases/tag/v2.7.5","https://github.com/dotnet/announcements/issues/277","https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73","https://github.com/eclipse/jetty.project/issues/10679","https://github.com/envoyproxy/envoy/pull/30055","https://github.com/etcd-io/etcd/issues/16740","https://github.com/facebook/proxygen/pull/466","https://github.com/golang/go/issues/63417","https://github.com/grpc/grpc-go/pull/6703","https://github.com/grpc/grpc/releases/tag/v1.59.2","https://github.com/h2o/h2o/pull/3291","https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf","https://github.com/haproxy/haproxy/issues/2312","https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244","https://github.com/junkurihara/rust-rpxy/issues/97","https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1","https://github.com/kazu-yamamoto/http2/issues/93","https://github.com/kubernetes/kubernetes/pull/121120","https://github.com/line/armeria/pull/5232","https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632","https://github.com/micrictor/http2-rst-stream","https://github.com/microsoft/CBL-Mariner/pull/6381","https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61","https://github.com/nghttp2/nghttp2/pull/1961","https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0","https://github.com/ninenines/cowboy/issues/1615","https://github.com/nodejs/node/pull/50121","https://github.com/openresty/openresty/issues/930","https://github.com/opensearch-project/data-prepper/issues/3474","https://github.com/oqtane/oqtane.framework/discussions/3367","https://github.com/projectcontour/contour/pull/5826","https://github.com/tempesta-tech/tempesta/issues/1986","https://github.com/varnishcache/varnish-cache/issues/3996","https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo","https://istio.io/latest/news/security/istio-security-2023-004/","https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/","https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q","https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html","https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html","https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/","https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html","https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html","https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html","https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487","https://my.f5.com/manage/s/article/K000137106","https://netty.io/news/2023/10/10/4-1-100-Final.html","https://news.ycombinator.com/item?id=37830987","https://news.ycombinator.com/item?id=37830998","https://news.ycombinator.com/item?id=37831062","https://news.ycombinator.com/item?id=37837043","https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/","https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected","https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ","https://security.gentoo.org/glsa/202311-09","https://security.netapp.com/advisory/ntap-20231016-0001/","https://security.netapp.com/advisory/ntap-20240426-0007/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://security.netapp.com/advisory/ntap-20240621-0007/","https://security.paloaltonetworks.com/CVE-2023-44487","https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14","https://ubuntu.com/security/CVE-2023-44487","https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/","https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event","https://www.debian.org/security/2023/dsa-5521","https://www.debian.org/security/2023/dsa-5522","https://www.debian.org/security/2023/dsa-5540","https://www.debian.org/security/2023/dsa-5549","https://www.debian.org/security/2023/dsa-5558","https://www.debian.org/security/2023/dsa-5570","https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487","https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/","https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/","https://www.openwall.com/lists/oss-security/2023/10/10/6","https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack","https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/","http://www.openwall.com/lists/oss-security/2025/08/13/6","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/","https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-341067.html","https://cert-portal.siemens.com/productcert/html/ssa-784301.html","https://cert-portal.siemens.com/productcert/html/ssa-832273.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-44487","https://github.com/envoyproxy/envoy/security/advisories/GHSA-jhv4-f7mr-xx76","https://github.com/kubernetes/ingress-nginx/blob/4b5c5efe2508dc915a48c54de7f23912ff2ec695/changelog/controller-1.9.3.md?plain=1#L15","https://varnish-cache.org/releases/rel6.0.12.html#rel6-0-12","https://varnish-cache.org/releases/rel7.3.1.html#rel7-3-1","https://varnish-cache.org/releases/rel7.4.2.html#rel7-4-2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","description":"The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.","knownExploited":[{"cve":"CVE-2023-44487","cwes":["CWE-400"],"urls":["https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/","https://nvd.nist.gov/vuln/detail/CVE-2023-44487"],"notes":"This vulnerability affects a common open-source component, third-party library, or protocol used by different products. For more information, please see: HTTP/2 Rapid Reset Vulnerability, CVE-2023-44487 | CISA: https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","dueDate":"2023-10-31","product":"HTTP/2","dateAdded":"2023-10-10","vendorProject":"IETF","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"02757d5e36fd6ee1","cpes":["cpe:2.3:a:libsystemd0:libsystemd0:241-7\\~deb10u1:*:*:*:*:*:*:*"],"name":"libsystemd0","purl":"pkg:deb/debian/libsystemd0@241-7~deb10u1?arch=amd64&distro=debian-10.1&upstream=systemd","type":"deb","version":"241-7~deb10u1","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsystemd0/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libsystemd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50387","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"systemd","version":"241-7~deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-50387","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50387","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-50387","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50387","date":"2026-10-08","epss":0.99988,"percentile":0.99984}],"risk":74.991,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-50387","description":"Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the \"KeyTrap\" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records."},"relatedVulnerabilities":[{"id":"CVE-2023-50387","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50387","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-50387","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50387","date":"2026-10-08","epss":0.99988,"percentile":0.99984}],"urls":["http://www.openwall.com/lists/oss-security/2024/02/16/2","http://www.openwall.com/lists/oss-security/2024/02/16/3","https://access.redhat.com/security/cve/CVE-2023-50387","https://bugzilla.suse.com/show_bug.cgi?id=1219823","https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html","https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1","https://kb.isc.org/docs/cve-2023-50387","https://lists.debian.org/debian-lts-announce/2024/02/msg00006.html","https://lists.debian.org/debian-lts-announce/2024/05/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FV5O347JTX7P5OZA6NGO4MKTXRXMKOZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGSLGKUAQTW5JPPZCMF5YPEYALLRUZZ6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEXGOYGW7DBS3N2QSSQONZ4ENIRQEAPG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQESRWMJCF4JEYJEAKLRM6CT55GLJAB7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/","https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-50387","https://news.ycombinator.com/item?id=39367411","https://news.ycombinator.com/item?id=39372384","https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/","https://security.netapp.com/advisory/ntap-20240307-0007/","https://www.athene-center.de/aktuelles/key-trap","https://www.athene-center.de/fileadmin/content/PDF/Technical_Report_KeyTrap.pdf","https://www.isc.org/blogs/2024-bind-security-release/","https://www.securityweek.com/keytrap-dns-attack-could-disable-large-parts-of-internet-researchers/","https://www.theregister.com/2024/02/13/dnssec_vulnerability_internet/","https://lists.debian.org/debian-lts-announce/2024/09/msg00001.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00035.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50387","description":"Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the \"KeyTrap\" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records."}]},{"artifact":{"id":"8899fd13acd75827","cpes":["cpe:2.3:a:libudev1:libudev1:241-7\\~deb10u1:*:*:*:*:*:*:*"],"name":"libudev1","purl":"pkg:deb/debian/libudev1@241-7~deb10u1?arch=amd64&distro=debian-10.1&upstream=systemd","type":"deb","version":"241-7~deb10u1","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50387","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"systemd","version":"241-7~deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-50387","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50387","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-50387","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50387","date":"2026-10-08","epss":0.99988,"percentile":0.99984}],"risk":74.991,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-50387","description":"Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the \"KeyTrap\" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records."},"relatedVulnerabilities":[{"id":"CVE-2023-50387","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50387","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-50387","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50387","date":"2026-10-08","epss":0.99988,"percentile":0.99984}],"urls":["http://www.openwall.com/lists/oss-security/2024/02/16/2","http://www.openwall.com/lists/oss-security/2024/02/16/3","https://access.redhat.com/security/cve/CVE-2023-50387","https://bugzilla.suse.com/show_bug.cgi?id=1219823","https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html","https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1","https://kb.isc.org/docs/cve-2023-50387","https://lists.debian.org/debian-lts-announce/2024/02/msg00006.html","https://lists.debian.org/debian-lts-announce/2024/05/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FV5O347JTX7P5OZA6NGO4MKTXRXMKOZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGSLGKUAQTW5JPPZCMF5YPEYALLRUZZ6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEXGOYGW7DBS3N2QSSQONZ4ENIRQEAPG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQESRWMJCF4JEYJEAKLRM6CT55GLJAB7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/","https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-50387","https://news.ycombinator.com/item?id=39367411","https://news.ycombinator.com/item?id=39372384","https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/","https://security.netapp.com/advisory/ntap-20240307-0007/","https://www.athene-center.de/aktuelles/key-trap","https://www.athene-center.de/fileadmin/content/PDF/Technical_Report_KeyTrap.pdf","https://www.isc.org/blogs/2024-bind-security-release/","https://www.securityweek.com/keytrap-dns-attack-could-disable-large-parts-of-internet-researchers/","https://www.theregister.com/2024/02/13/dnssec_vulnerability_internet/","https://lists.debian.org/debian-lts-announce/2024/09/msg00001.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00035.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50387","description":"Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the \"KeyTrap\" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records."}]},{"artifact":{"id":"bca20a7b0a858bf3","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/debian/libssl1.1@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1&upstream=openssl","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1n-0+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-2068","versionConstraint":"< 1.1.1n-0+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-2068","fix":{"state":"fixed","versions":["1.1.1n-0+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1n-0+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-2068","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-2068","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-2068","date":"2026-10-08","epss":0.95404,"percentile":0.99869}],"risk":70.59896,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5169-1","link":"https://security-tracker.debian.org/tracker/DSA-5169-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-2068","description":"In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze)."},"relatedVulnerabilities":[{"id":"CVE-2022-2068","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-2068","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-2068","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-2068","date":"2026-10-08","epss":0.95404,"percentile":0.99869}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2c9c35870601b4a44d86ddbf512b38df38285cfa","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=7a9c027159fe9e1bbc2cd38a8a2914bff0d5abd9","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9639817dac8bbbaa64d09efad7464ccc405527c7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6WZZBKUHQFGSKGNXXKICSRPL7AMVW5M5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCMNWKERPBKOEBNL7CLTTX3ZZCZLH7XA/","https://security.netapp.com/advisory/ntap-20220707-0008/","https://www.debian.org/security/2022/dsa-5169","https://www.openssl.org/news/secadv/20220621.txt","http://seclists.org/fulldisclosure/2024/Nov/0","https://gitlab.com/fraf0/cve-2022-1292-re_score-analysis"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-2068","description":"In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze)."}]},{"artifact":{"id":"d308e84bddad0b0f","cpes":["cpe:2.3:a:openssl:openssl:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1n-0+deb10u3"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-2068","versionConstraint":"< 1.1.1n-0+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-2068","fix":{"state":"fixed","versions":["1.1.1n-0+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1n-0+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-2068","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-2068","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-2068","date":"2026-10-08","epss":0.95404,"percentile":0.99869}],"risk":70.59896,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5169-1","link":"https://security-tracker.debian.org/tracker/DSA-5169-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-2068","description":"In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze)."},"relatedVulnerabilities":[{"id":"CVE-2022-2068","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-2068","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-2068","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-2068","date":"2026-10-08","epss":0.95404,"percentile":0.99869}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2c9c35870601b4a44d86ddbf512b38df38285cfa","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=7a9c027159fe9e1bbc2cd38a8a2914bff0d5abd9","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9639817dac8bbbaa64d09efad7464ccc405527c7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6WZZBKUHQFGSKGNXXKICSRPL7AMVW5M5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCMNWKERPBKOEBNL7CLTTX3ZZCZLH7XA/","https://security.netapp.com/advisory/ntap-20220707-0008/","https://www.debian.org/security/2022/dsa-5169","https://www.openssl.org/news/secadv/20220621.txt","http://seclists.org/fulldisclosure/2024/Nov/0","https://gitlab.com/fraf0/cve-2022-1292-re_score-analysis"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-2068","description":"In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze)."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.21.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2024-2687","versionConstraint":"<1.21.9||>=1.22.0-0,<1.22.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2024-2687","fix":{"state":"fixed","versions":["1.21.9","1.22.2"],"available":[{"date":"2024-04-03","kind":"release","version":"1.21.9"},{"date":"2024-04-03","kind":"release","version":"1.22.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45288","date":"2026-10-08","epss":0.91969,"percentile":0.99819}],"risk":68.97675,"urls":["https://go.dev/cl/576155","https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/65051","description":"An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames.\n\nMaintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed.\n\nThis permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send.\n\nThe fix sets a limit on the amount of excess header frames we will process before closing a connection."},"relatedVulnerabilities":[{"id":"CVE-2023-45288","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45288","date":"2026-10-08","epss":0.91969,"percentile":0.99819}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/03/16","http://www.openwall.com/lists/oss-security/2024/04/05/4","https://go.dev/cl/576155","https://go.dev/issue/65051","https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT/","https://pkg.go.dev/vuln/GO-2024-2687","https://security.netapp.com/advisory/ntap-20240419-0009/","https://www.kb.cert.org/vuls/id/421644"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45288","description":"An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection."},{"id":"GHSA-4v7x-pqxf-cx7m","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45288","date":"2026-10-08","epss":0.91969,"percentile":0.99819}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-45288","https://go.dev/cl/576155","https://go.dev/issue/65051","https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M","https://pkg.go.dev/vuln/GO-2024-2687","https://nowotarski.info/http2-continuation-flood-technical-details","https://security.netapp.com/advisory/ntap-20240419-0009","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT","http://www.openwall.com/lists/oss-security/2024/04/03/16","http://www.openwall.com/lists/oss-security/2024/04/05/4","https://www.kb.cert.org/vuls/id/421644"],"severity":"Medium","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-4v7x-pqxf-cx7m","description":"net/http, x/net/http2: close connections when receiving too many headers"}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.21.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2024-2687","versionConstraint":"<1.21.9||>=1.22.0-0,<1.22.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2024-2687","fix":{"state":"fixed","versions":["1.21.9","1.22.2"],"available":[{"date":"2024-04-03","kind":"release","version":"1.21.9"},{"date":"2024-04-03","kind":"release","version":"1.22.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45288","date":"2026-10-08","epss":0.91969,"percentile":0.99819}],"risk":68.97675,"urls":["https://go.dev/cl/576155","https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/65051","description":"An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames.\n\nMaintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed.\n\nThis permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send.\n\nThe fix sets a limit on the amount of excess header frames we will process before closing a connection."},"relatedVulnerabilities":[{"id":"CVE-2023-45288","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45288","date":"2026-10-08","epss":0.91969,"percentile":0.99819}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/03/16","http://www.openwall.com/lists/oss-security/2024/04/05/4","https://go.dev/cl/576155","https://go.dev/issue/65051","https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT/","https://pkg.go.dev/vuln/GO-2024-2687","https://security.netapp.com/advisory/ntap-20240419-0009/","https://www.kb.cert.org/vuls/id/421644"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45288","description":"An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection."},{"id":"GHSA-4v7x-pqxf-cx7m","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45288","date":"2026-10-08","epss":0.91969,"percentile":0.99819}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-45288","https://go.dev/cl/576155","https://go.dev/issue/65051","https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M","https://pkg.go.dev/vuln/GO-2024-2687","https://nowotarski.info/http2-continuation-flood-technical-details","https://security.netapp.com/advisory/ntap-20240419-0009","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT","http://www.openwall.com/lists/oss-security/2024/04/03/16","http://www.openwall.com/lists/oss-security/2024/04/05/4","https://www.kb.cert.org/vuls/id/421644"],"severity":"Medium","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-4v7x-pqxf-cx7m","description":"net/http, x/net/http2: close connections when receiving too many headers"}]},{"artifact":{"id":"2d52d7c9fca553cc","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.28-10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.28-10?arch=amd64&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2961","versionConstraint":"< 2.28-10+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2024-2961","fix":{"state":"fixed","versions":["2.28-10+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.3,"impactScore":4.8,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-10-08","epss":0.8833,"percentile":0.99769}],"risk":65.3642,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-2961","description":"The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable."},"relatedVulnerabilities":[{"id":"CVE-2024-2961","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.3,"impactScore":4.8,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-10-08","epss":0.8833,"percentile":0.99769}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/17/9","http://www.openwall.com/lists/oss-security/2024/04/18/4","http://www.openwall.com/lists/oss-security/2024/04/24/2","http://www.openwall.com/lists/oss-security/2024/05/27/1","http://www.openwall.com/lists/oss-security/2024/05/27/2","http://www.openwall.com/lists/oss-security/2024/05/27/3","http://www.openwall.com/lists/oss-security/2024/05/27/4","http://www.openwall.com/lists/oss-security/2024/05/27/5","http://www.openwall.com/lists/oss-security/2024/05/27/6","http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/","https://security.netapp.com/advisory/ntap-20240531-0002/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004","https://www.ambionics.io/blog/iconv-cve-2024-2961-p1","https://www.ambionics.io/blog/iconv-cve-2024-2961-p2","https://www.ambionics.io/blog/iconv-cve-2024-2961-p3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2961","description":"The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable."}]},{"artifact":{"id":"fe0324c22198dabb","cpes":["cpe:2.3:a:libc-l10n:libc-l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc-l10n:libc_l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc-l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc_l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_l10n:2.28-10:*:*:*:*:*:*:*"],"name":"libc-l10n","purl":"pkg:deb/debian/libc-l10n@2.28-10?arch=all&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-l10n/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libc-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libc-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libc-l10n.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2961","versionConstraint":"< 2.28-10+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2024-2961","fix":{"state":"fixed","versions":["2.28-10+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.3,"impactScore":4.8,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-10-08","epss":0.8833,"percentile":0.99769}],"risk":65.3642,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-2961","description":"The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable."},"relatedVulnerabilities":[{"id":"CVE-2024-2961","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.3,"impactScore":4.8,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-10-08","epss":0.8833,"percentile":0.99769}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/17/9","http://www.openwall.com/lists/oss-security/2024/04/18/4","http://www.openwall.com/lists/oss-security/2024/04/24/2","http://www.openwall.com/lists/oss-security/2024/05/27/1","http://www.openwall.com/lists/oss-security/2024/05/27/2","http://www.openwall.com/lists/oss-security/2024/05/27/3","http://www.openwall.com/lists/oss-security/2024/05/27/4","http://www.openwall.com/lists/oss-security/2024/05/27/5","http://www.openwall.com/lists/oss-security/2024/05/27/6","http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/","https://security.netapp.com/advisory/ntap-20240531-0002/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004","https://www.ambionics.io/blog/iconv-cve-2024-2961-p1","https://www.ambionics.io/blog/iconv-cve-2024-2961-p2","https://www.ambionics.io/blog/iconv-cve-2024-2961-p3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2961","description":"The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable."}]},{"artifact":{"id":"4d00fd0f941e584e","cpes":["cpe:2.3:a:libc6:libc6:2.28-10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.28-10?arch=amd64&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2961","versionConstraint":"< 2.28-10+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2024-2961","fix":{"state":"fixed","versions":["2.28-10+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.3,"impactScore":4.8,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-10-08","epss":0.8833,"percentile":0.99769}],"risk":65.3642,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-2961","description":"The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable."},"relatedVulnerabilities":[{"id":"CVE-2024-2961","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.3,"impactScore":4.8,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-10-08","epss":0.8833,"percentile":0.99769}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/17/9","http://www.openwall.com/lists/oss-security/2024/04/18/4","http://www.openwall.com/lists/oss-security/2024/04/24/2","http://www.openwall.com/lists/oss-security/2024/05/27/1","http://www.openwall.com/lists/oss-security/2024/05/27/2","http://www.openwall.com/lists/oss-security/2024/05/27/3","http://www.openwall.com/lists/oss-security/2024/05/27/4","http://www.openwall.com/lists/oss-security/2024/05/27/5","http://www.openwall.com/lists/oss-security/2024/05/27/6","http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/","https://security.netapp.com/advisory/ntap-20240531-0002/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004","https://www.ambionics.io/blog/iconv-cve-2024-2961-p1","https://www.ambionics.io/blog/iconv-cve-2024-2961-p2","https://www.ambionics.io/blog/iconv-cve-2024-2961-p3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2961","description":"The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable."}]},{"artifact":{"id":"c1d71c418353daa4","cpes":["cpe:2.3:a:locales:locales:2.28-10:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/debian/locales@2.28-10?arch=all&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2961","versionConstraint":"< 2.28-10+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2024-2961","fix":{"state":"fixed","versions":["2.28-10+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.3,"impactScore":4.8,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-10-08","epss":0.8833,"percentile":0.99769}],"risk":65.3642,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-2961","description":"The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable."},"relatedVulnerabilities":[{"id":"CVE-2024-2961","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.3,"impactScore":4.8,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-10-08","epss":0.8833,"percentile":0.99769}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/17/9","http://www.openwall.com/lists/oss-security/2024/04/18/4","http://www.openwall.com/lists/oss-security/2024/04/24/2","http://www.openwall.com/lists/oss-security/2024/05/27/1","http://www.openwall.com/lists/oss-security/2024/05/27/2","http://www.openwall.com/lists/oss-security/2024/05/27/3","http://www.openwall.com/lists/oss-security/2024/05/27/4","http://www.openwall.com/lists/oss-security/2024/05/27/5","http://www.openwall.com/lists/oss-security/2024/05/27/6","http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/","https://security.netapp.com/advisory/ntap-20240531-0002/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004","https://www.ambionics.io/blog/iconv-cve-2024-2961-p1","https://www.ambionics.io/blog/iconv-cve-2024-2961-p2","https://www.ambionics.io/blog/iconv-cve-2024-2961-p3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2961","description":"The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable."}]},{"artifact":{"id":"7f19231bca942dc4","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/debian/libldap-2.4-2@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36221","versionConstraint":"< 2.4.47+dfsg-3+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-36221","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36221","cwe":"CWE-191","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36221","date":"2026-10-08","epss":0.84994,"percentile":0.99709}],"risk":63.7455,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4845-1","link":"https://security-tracker.debian.org/tracker/DSA-4845-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-36221","description":"An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssuerCheck)."},"relatedVulnerabilities":[{"id":"CVE-2020-36221","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36221","cwe":"CWE-191","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36221","date":"2026-10-08","epss":0.84994,"percentile":0.99709}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9404","https://bugs.openldap.org/show_bug.cgi?id=9424","https://git.openldap.org/openldap/openldap/-/commit/38ac838e4150c626bbfa0082b7e2cf3a2bb4df31","https://git.openldap.org/openldap/openldap/-/commit/58c1748e81c843c5b6e61648d2a4d1d82b47e842","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36221","description":"An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssuerCheck)."}]},{"artifact":{"id":"7f19231bca942dc4","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/debian/libldap-2.4-2@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36228","versionConstraint":"< 2.4.47+dfsg-3+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-36228","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36228","cwe":"CWE-191","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36228","date":"2026-10-08","epss":0.84994,"percentile":0.99709}],"risk":63.7455,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4845-1","link":"https://security-tracker.debian.org/tracker/DSA-4845-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-36228","description":"An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service."},"relatedVulnerabilities":[{"id":"CVE-2020-36228","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36228","cwe":"CWE-191","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36228","date":"2026-10-08","epss":0.84994,"percentile":0.99709}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9427","https://git.openldap.org/openldap/openldap/-/commit/91dccd25c347733b365adc74cb07d074512ed5ad","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36228","description":"An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service."}]},{"artifact":{"id":"ed53a6639a2640b0","cpes":["cpe:2.3:a:libldap-common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-common","purl":"pkg:deb/debian/libldap-common@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=all&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-common/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.list"}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36221","versionConstraint":"< 2.4.47+dfsg-3+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-36221","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36221","cwe":"CWE-191","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36221","date":"2026-10-08","epss":0.84994,"percentile":0.99709}],"risk":63.7455,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4845-1","link":"https://security-tracker.debian.org/tracker/DSA-4845-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-36221","description":"An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssuerCheck)."},"relatedVulnerabilities":[{"id":"CVE-2020-36221","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36221","cwe":"CWE-191","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36221","date":"2026-10-08","epss":0.84994,"percentile":0.99709}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9404","https://bugs.openldap.org/show_bug.cgi?id=9424","https://git.openldap.org/openldap/openldap/-/commit/38ac838e4150c626bbfa0082b7e2cf3a2bb4df31","https://git.openldap.org/openldap/openldap/-/commit/58c1748e81c843c5b6e61648d2a4d1d82b47e842","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36221","description":"An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssuerCheck)."}]},{"artifact":{"id":"ed53a6639a2640b0","cpes":["cpe:2.3:a:libldap-common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-common","purl":"pkg:deb/debian/libldap-common@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=all&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-common/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.list"}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36228","versionConstraint":"< 2.4.47+dfsg-3+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-36228","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36228","cwe":"CWE-191","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36228","date":"2026-10-08","epss":0.84994,"percentile":0.99709}],"risk":63.7455,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4845-1","link":"https://security-tracker.debian.org/tracker/DSA-4845-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-36228","description":"An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service."},"relatedVulnerabilities":[{"id":"CVE-2020-36228","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36228","cwe":"CWE-191","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36228","date":"2026-10-08","epss":0.84994,"percentile":0.99709}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9427","https://git.openldap.org/openldap/openldap/-/commit/91dccd25c347733b365adc74cb07d074512ed5ad","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36228","description":"An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service."}]},{"artifact":{"id":"c6f08567c3b7bec6","cpes":["cpe:2.3:a:golang:networking:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.0.0-20190404232315-eb5bcb51f2a3","type":"go-module","version":"v0.0.0-20190404232315-eb5bcb51f2a3","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.0.0-20190813141303-74dc4d7220e7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hgr8-6h9x-f7q9","versionConstraint":"<0.0.0-20190813141303-74dc4d7220e7 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.0.0-20190404232315-eb5bcb51f2a3"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-hgr8-6h9x-f7q9","fix":{"state":"fixed","versions":["0.0.0-20190813141303-74dc4d7220e7"],"available":[{"date":"2023-02-26","kind":"first-observed","version":"0.0.0-20190813141303-74dc4d7220e7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9512","cwe":"CWE-400","type":"Secondary","source":"cret@cert.org"},{"cve":"CVE-2019-9512","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9512","date":"2026-10-08","epss":0.83433,"percentile":0.99678}],"risk":62.57475,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-9512","https://access.redhat.com/errata/RHSA-2019:2594","https://access.redhat.com/errata/RHSA-2019:2661","https://access.redhat.com/errata/RHSA-2019:2682","https://access.redhat.com/errata/RHSA-2019:2690","https://access.redhat.com/errata/RHSA-2019:2726","https://access.redhat.com/errata/RHSA-2019:2766","https://access.redhat.com/errata/RHSA-2019:2769","https://access.redhat.com/errata/RHSA-2019:2796","https://access.redhat.com/errata/RHSA-2019:2861","https://access.redhat.com/errata/RHSA-2019:2925","https://access.redhat.com/errata/RHSA-2019:2939","https://access.redhat.com/errata/RHSA-2019:2955","https://access.redhat.com/errata/RHSA-2019:2966","https://access.redhat.com/errata/RHSA-2019:3131","https://access.redhat.com/errata/RHSA-2019:3245","https://access.redhat.com/errata/RHSA-2019:3265","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:3906","https://access.redhat.com/errata/RHSA-2019:4018","https://access.redhat.com/errata/RHSA-2019:4019","https://access.redhat.com/errata/RHSA-2019:4020","https://access.redhat.com/errata/RHSA-2019:4021","https://access.redhat.com/errata/RHSA-2019:4040","https://access.redhat.com/errata/RHSA-2019:4041","https://access.redhat.com/errata/RHSA-2019:4042","https://access.redhat.com/errata/RHSA-2019:4045","https://access.redhat.com/errata/RHSA-2019:4269","https://access.redhat.com/errata/RHSA-2019:4273","https://access.redhat.com/errata/RHSA-2019:4352","https://access.redhat.com/errata/RHSA-2020:0406","https://access.redhat.com/errata/RHSA-2020:0727","https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md","https://kc.mcafee.com/corporate/index?page=content&id=SB10296","https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04@%3Cusers.trafficserver.apache.org%3E","https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19@%3Cannounce.trafficserver.apache.org%3E","https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7@%3Cdev.trafficserver.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00011.html","https://seclists.org/bugtraq/2019/Aug/24","https://seclists.org/bugtraq/2019/Aug/31","https://seclists.org/bugtraq/2019/Aug/43","https://seclists.org/bugtraq/2019/Sep/18","https://support.f5.com/csp/article/K98053339","https://support.f5.com/csp/article/K98053339?utm_source=f5support&amp;utm_medium=RSS","https://www.debian.org/security/2019/dsa-4503","https://www.debian.org/security/2019/dsa-4508","https://www.debian.org/security/2019/dsa-4520","https://www.synology.com/security/advisory/Synology_SA_19_33","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html","http://seclists.org/fulldisclosure/2019/Aug/16","http://www.openwall.com/lists/oss-security/2019/08/20/1","https://go.dev/cl/190137","https://go.dev/issue/33606","https://go.googlesource.com/go/+/145e193131eb486077b66009beb051aba07c52a5","https://groups.google.com/g/golang-announce/c/65QixT3tcmg/m/DrFiG6vvCwAJ","https://pkg.go.dev/vuln/GO-2022-0536","https://kb.cert.org/vuls/id/605641","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ","https://security.netapp.com/advisory/ntap-20190823-0001","https://security.netapp.com/advisory/ntap-20190823-0004","https://security.netapp.com/advisory/ntap-20190823-0005","https://usn.ubuntu.com/4308-1"],"severity":"High","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hgr8-6h9x-f7q9","description":"golang.org/x/net/http vulnerable to ping floods"},"relatedVulnerabilities":[{"id":"CVE-2019-9512","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"cret@cert.org","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9512","cwe":"CWE-400","type":"Secondary","source":"cret@cert.org"},{"cve":"CVE-2019-9512","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9512","date":"2026-10-08","epss":0.83433,"percentile":0.99678}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html","http://seclists.org/fulldisclosure/2019/Aug/16","http://www.openwall.com/lists/oss-security/2019/08/20/1","https://access.redhat.com/errata/RHSA-2019:2594","https://access.redhat.com/errata/RHSA-2019:2661","https://access.redhat.com/errata/RHSA-2019:2682","https://access.redhat.com/errata/RHSA-2019:2690","https://access.redhat.com/errata/RHSA-2019:2726","https://access.redhat.com/errata/RHSA-2019:2766","https://access.redhat.com/errata/RHSA-2019:2769","https://access.redhat.com/errata/RHSA-2019:2796","https://access.redhat.com/errata/RHSA-2019:2861","https://access.redhat.com/errata/RHSA-2019:2925","https://access.redhat.com/errata/RHSA-2019:2939","https://access.redhat.com/errata/RHSA-2019:2955","https://access.redhat.com/errata/RHSA-2019:2966","https://access.redhat.com/errata/RHSA-2019:3131","https://access.redhat.com/errata/RHSA-2019:3245","https://access.redhat.com/errata/RHSA-2019:3265","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:3906","https://access.redhat.com/errata/RHSA-2019:4018","https://access.redhat.com/errata/RHSA-2019:4019","https://access.redhat.com/errata/RHSA-2019:4020","https://access.redhat.com/errata/RHSA-2019:4021","https://access.redhat.com/errata/RHSA-2019:4040","https://access.redhat.com/errata/RHSA-2019:4041","https://access.redhat.com/errata/RHSA-2019:4042","https://access.redhat.com/errata/RHSA-2019:4045","https://access.redhat.com/errata/RHSA-2019:4269","https://access.redhat.com/errata/RHSA-2019:4273","https://access.redhat.com/errata/RHSA-2019:4352","https://access.redhat.com/errata/RHSA-2020:0406","https://access.redhat.com/errata/RHSA-2020:0727","https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md","https://kb.cert.org/vuls/id/605641/","https://kc.mcafee.com/corporate/index?page=content&id=SB10296","https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04%40%3Cusers.trafficserver.apache.org%3E","https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19%40%3Cannounce.trafficserver.apache.org%3E","https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7%40%3Cdev.trafficserver.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ/","https://seclists.org/bugtraq/2019/Aug/24","https://seclists.org/bugtraq/2019/Aug/31","https://seclists.org/bugtraq/2019/Aug/43","https://seclists.org/bugtraq/2019/Sep/18","https://security.netapp.com/advisory/ntap-20190823-0001/","https://security.netapp.com/advisory/ntap-20190823-0004/","https://security.netapp.com/advisory/ntap-20190823-0005/","https://support.f5.com/csp/article/K98053339","https://support.f5.com/csp/article/K98053339?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/4308-1/","https://www.debian.org/security/2019/dsa-4503","https://www.debian.org/security/2019/dsa-4508","https://www.debian.org/security/2019/dsa-4520","https://www.synology.com/security/advisory/Synology_SA_19_33"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9512","description":"Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both."}]},{"artifact":{"id":"727332619043e05d","cpes":["cpe:2.3:a:golang:networking:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.0.0-20190404232315-eb5bcb51f2a3","type":"go-module","version":"v0.0.0-20190404232315-eb5bcb51f2a3","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.0.0-20190813141303-74dc4d7220e7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hgr8-6h9x-f7q9","versionConstraint":"<0.0.0-20190813141303-74dc4d7220e7 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.0.0-20190404232315-eb5bcb51f2a3"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-hgr8-6h9x-f7q9","fix":{"state":"fixed","versions":["0.0.0-20190813141303-74dc4d7220e7"],"available":[{"date":"2023-02-26","kind":"first-observed","version":"0.0.0-20190813141303-74dc4d7220e7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9512","cwe":"CWE-400","type":"Secondary","source":"cret@cert.org"},{"cve":"CVE-2019-9512","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9512","date":"2026-10-08","epss":0.83433,"percentile":0.99678}],"risk":62.57475,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-9512","https://access.redhat.com/errata/RHSA-2019:2594","https://access.redhat.com/errata/RHSA-2019:2661","https://access.redhat.com/errata/RHSA-2019:2682","https://access.redhat.com/errata/RHSA-2019:2690","https://access.redhat.com/errata/RHSA-2019:2726","https://access.redhat.com/errata/RHSA-2019:2766","https://access.redhat.com/errata/RHSA-2019:2769","https://access.redhat.com/errata/RHSA-2019:2796","https://access.redhat.com/errata/RHSA-2019:2861","https://access.redhat.com/errata/RHSA-2019:2925","https://access.redhat.com/errata/RHSA-2019:2939","https://access.redhat.com/errata/RHSA-2019:2955","https://access.redhat.com/errata/RHSA-2019:2966","https://access.redhat.com/errata/RHSA-2019:3131","https://access.redhat.com/errata/RHSA-2019:3245","https://access.redhat.com/errata/RHSA-2019:3265","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:3906","https://access.redhat.com/errata/RHSA-2019:4018","https://access.redhat.com/errata/RHSA-2019:4019","https://access.redhat.com/errata/RHSA-2019:4020","https://access.redhat.com/errata/RHSA-2019:4021","https://access.redhat.com/errata/RHSA-2019:4040","https://access.redhat.com/errata/RHSA-2019:4041","https://access.redhat.com/errata/RHSA-2019:4042","https://access.redhat.com/errata/RHSA-2019:4045","https://access.redhat.com/errata/RHSA-2019:4269","https://access.redhat.com/errata/RHSA-2019:4273","https://access.redhat.com/errata/RHSA-2019:4352","https://access.redhat.com/errata/RHSA-2020:0406","https://access.redhat.com/errata/RHSA-2020:0727","https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md","https://kc.mcafee.com/corporate/index?page=content&id=SB10296","https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04@%3Cusers.trafficserver.apache.org%3E","https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19@%3Cannounce.trafficserver.apache.org%3E","https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7@%3Cdev.trafficserver.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00011.html","https://seclists.org/bugtraq/2019/Aug/24","https://seclists.org/bugtraq/2019/Aug/31","https://seclists.org/bugtraq/2019/Aug/43","https://seclists.org/bugtraq/2019/Sep/18","https://support.f5.com/csp/article/K98053339","https://support.f5.com/csp/article/K98053339?utm_source=f5support&amp;utm_medium=RSS","https://www.debian.org/security/2019/dsa-4503","https://www.debian.org/security/2019/dsa-4508","https://www.debian.org/security/2019/dsa-4520","https://www.synology.com/security/advisory/Synology_SA_19_33","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html","http://seclists.org/fulldisclosure/2019/Aug/16","http://www.openwall.com/lists/oss-security/2019/08/20/1","https://go.dev/cl/190137","https://go.dev/issue/33606","https://go.googlesource.com/go/+/145e193131eb486077b66009beb051aba07c52a5","https://groups.google.com/g/golang-announce/c/65QixT3tcmg/m/DrFiG6vvCwAJ","https://pkg.go.dev/vuln/GO-2022-0536","https://kb.cert.org/vuls/id/605641","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ","https://security.netapp.com/advisory/ntap-20190823-0001","https://security.netapp.com/advisory/ntap-20190823-0004","https://security.netapp.com/advisory/ntap-20190823-0005","https://usn.ubuntu.com/4308-1"],"severity":"High","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hgr8-6h9x-f7q9","description":"golang.org/x/net/http vulnerable to ping floods"},"relatedVulnerabilities":[{"id":"CVE-2019-9512","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"cret@cert.org","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9512","cwe":"CWE-400","type":"Secondary","source":"cret@cert.org"},{"cve":"CVE-2019-9512","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9512","date":"2026-10-08","epss":0.83433,"percentile":0.99678}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html","http://seclists.org/fulldisclosure/2019/Aug/16","http://www.openwall.com/lists/oss-security/2019/08/20/1","https://access.redhat.com/errata/RHSA-2019:2594","https://access.redhat.com/errata/RHSA-2019:2661","https://access.redhat.com/errata/RHSA-2019:2682","https://access.redhat.com/errata/RHSA-2019:2690","https://access.redhat.com/errata/RHSA-2019:2726","https://access.redhat.com/errata/RHSA-2019:2766","https://access.redhat.com/errata/RHSA-2019:2769","https://access.redhat.com/errata/RHSA-2019:2796","https://access.redhat.com/errata/RHSA-2019:2861","https://access.redhat.com/errata/RHSA-2019:2925","https://access.redhat.com/errata/RHSA-2019:2939","https://access.redhat.com/errata/RHSA-2019:2955","https://access.redhat.com/errata/RHSA-2019:2966","https://access.redhat.com/errata/RHSA-2019:3131","https://access.redhat.com/errata/RHSA-2019:3245","https://access.redhat.com/errata/RHSA-2019:3265","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:3906","https://access.redhat.com/errata/RHSA-2019:4018","https://access.redhat.com/errata/RHSA-2019:4019","https://access.redhat.com/errata/RHSA-2019:4020","https://access.redhat.com/errata/RHSA-2019:4021","https://access.redhat.com/errata/RHSA-2019:4040","https://access.redhat.com/errata/RHSA-2019:4041","https://access.redhat.com/errata/RHSA-2019:4042","https://access.redhat.com/errata/RHSA-2019:4045","https://access.redhat.com/errata/RHSA-2019:4269","https://access.redhat.com/errata/RHSA-2019:4273","https://access.redhat.com/errata/RHSA-2019:4352","https://access.redhat.com/errata/RHSA-2020:0406","https://access.redhat.com/errata/RHSA-2020:0727","https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md","https://kb.cert.org/vuls/id/605641/","https://kc.mcafee.com/corporate/index?page=content&id=SB10296","https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04%40%3Cusers.trafficserver.apache.org%3E","https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19%40%3Cannounce.trafficserver.apache.org%3E","https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7%40%3Cdev.trafficserver.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ/","https://seclists.org/bugtraq/2019/Aug/24","https://seclists.org/bugtraq/2019/Aug/31","https://seclists.org/bugtraq/2019/Aug/43","https://seclists.org/bugtraq/2019/Sep/18","https://security.netapp.com/advisory/ntap-20190823-0001/","https://security.netapp.com/advisory/ntap-20190823-0004/","https://security.netapp.com/advisory/ntap-20190823-0005/","https://support.f5.com/csp/article/K98053339","https://support.f5.com/csp/article/K98053339?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/4308-1/","https://www.debian.org/security/2019/dsa-4503","https://www.debian.org/security/2019/dsa-4508","https://www.debian.org/security/2019/dsa-4520","https://www.synology.com/security/advisory/Synology_SA_19_33"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9512","description":"Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both."}]},{"artifact":{"id":"c6f08567c3b7bec6","cpes":["cpe:2.3:a:golang:networking:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.0.0-20190404232315-eb5bcb51f2a3","type":"go-module","version":"v0.0.0-20190404232315-eb5bcb51f2a3","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.0.0-20190813141303-74dc4d7220e7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-39qc-96h7-956f","versionConstraint":"<0.0.0-20190813141303-74dc4d7220e7 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.0.0-20190404232315-eb5bcb51f2a3"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-39qc-96h7-956f","fix":{"state":"fixed","versions":["0.0.0-20190813141303-74dc4d7220e7"],"available":[{"date":"2023-02-25","kind":"first-observed","version":"0.0.0-20190813141303-74dc4d7220e7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9514","cwe":"CWE-400","type":"Secondary","source":"cret@cert.org"},{"cve":"CVE-2019-9514","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9514","date":"2026-10-08","epss":0.82813,"percentile":0.99664}],"risk":62.109750000000005,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-9514","https://access.redhat.com/errata/RHSA-2019:2594","https://access.redhat.com/errata/RHSA-2019:2661","https://access.redhat.com/errata/RHSA-2019:2682","https://access.redhat.com/errata/RHSA-2019:2690","https://access.redhat.com/errata/RHSA-2019:2726","https://access.redhat.com/errata/RHSA-2019:2766","https://access.redhat.com/errata/RHSA-2019:2769","https://access.redhat.com/errata/RHSA-2019:2796","https://access.redhat.com/errata/RHSA-2019:2861","https://access.redhat.com/errata/RHSA-2019:2925","https://access.redhat.com/errata/RHSA-2019:2939","https://access.redhat.com/errata/RHSA-2019:2955","https://access.redhat.com/errata/RHSA-2019:2966","https://access.redhat.com/errata/RHSA-2019:3131","https://access.redhat.com/errata/RHSA-2019:3245","https://access.redhat.com/errata/RHSA-2019:3265","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:3906","https://access.redhat.com/errata/RHSA-2019:4018","https://access.redhat.com/errata/RHSA-2019:4019","https://access.redhat.com/errata/RHSA-2019:4020","https://access.redhat.com/errata/RHSA-2019:4021","https://access.redhat.com/errata/RHSA-2019:4040","https://access.redhat.com/errata/RHSA-2019:4041","https://access.redhat.com/errata/RHSA-2019:4042","https://access.redhat.com/errata/RHSA-2019:4045","https://access.redhat.com/errata/RHSA-2019:4269","https://access.redhat.com/errata/RHSA-2019:4273","https://access.redhat.com/errata/RHSA-2019:4352","https://access.redhat.com/errata/RHSA-2020:0406","https://access.redhat.com/errata/RHSA-2020:0727","https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md","https://kc.mcafee.com/corporate/index?page=content&id=SB10296","https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04@%3Cusers.trafficserver.apache.org%3E","https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19@%3Cannounce.trafficserver.apache.org%3E","https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7@%3Cdev.trafficserver.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00011.html","https://seclists.org/bugtraq/2019/Aug/24","https://seclists.org/bugtraq/2019/Aug/31","https://seclists.org/bugtraq/2019/Aug/43","https://seclists.org/bugtraq/2019/Sep/18","https://support.f5.com/csp/article/K01988340","https://support.f5.com/csp/article/K01988340?utm_source=f5support&amp;utm_medium=RSS","https://www.debian.org/security/2019/dsa-4503","https://www.debian.org/security/2019/dsa-4508","https://www.debian.org/security/2019/dsa-4520","https://www.debian.org/security/2020/dsa-4669","https://www.synology.com/security/advisory/Synology_SA_19_33","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html","http://seclists.org/fulldisclosure/2019/Aug/16","http://www.openwall.com/lists/oss-security/2019/08/20/1","https://go.dev/cl/190137","https://go.dev/issue/33606","https://go.googlesource.com/go/+/145e193131eb486077b66009beb051aba07c52a5","https://groups.google.com/g/golang-announce/c/65QixT3tcmg/m/DrFiG6vvCwAJ","https://pkg.go.dev/vuln/GO-2022-0536","http://www.openwall.com/lists/oss-security/2023/10/18/8","https://kb.cert.org/vuls/id/605641","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ","https://security.netapp.com/advisory/ntap-20190823-0001","https://security.netapp.com/advisory/ntap-20190823-0004","https://security.netapp.com/advisory/ntap-20190823-0005","https://usn.ubuntu.com/4308-1"],"severity":"High","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-39qc-96h7-956f","description":"golang.org/x/net/http vulnerable to a reset flood"},"relatedVulnerabilities":[{"id":"CVE-2019-9514","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"cret@cert.org","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9514","cwe":"CWE-400","type":"Secondary","source":"cret@cert.org"},{"cve":"CVE-2019-9514","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9514","date":"2026-10-08","epss":0.82813,"percentile":0.99664}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html","http://seclists.org/fulldisclosure/2019/Aug/16","http://www.openwall.com/lists/oss-security/2019/08/20/1","http://www.openwall.com/lists/oss-security/2023/10/18/8","https://access.redhat.com/errata/RHSA-2019:2594","https://access.redhat.com/errata/RHSA-2019:2661","https://access.redhat.com/errata/RHSA-2019:2682","https://access.redhat.com/errata/RHSA-2019:2690","https://access.redhat.com/errata/RHSA-2019:2726","https://access.redhat.com/errata/RHSA-2019:2766","https://access.redhat.com/errata/RHSA-2019:2769","https://access.redhat.com/errata/RHSA-2019:2796","https://access.redhat.com/errata/RHSA-2019:2861","https://access.redhat.com/errata/RHSA-2019:2925","https://access.redhat.com/errata/RHSA-2019:2939","https://access.redhat.com/errata/RHSA-2019:2955","https://access.redhat.com/errata/RHSA-2019:2966","https://access.redhat.com/errata/RHSA-2019:3131","https://access.redhat.com/errata/RHSA-2019:3245","https://access.redhat.com/errata/RHSA-2019:3265","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:3906","https://access.redhat.com/errata/RHSA-2019:4018","https://access.redhat.com/errata/RHSA-2019:4019","https://access.redhat.com/errata/RHSA-2019:4020","https://access.redhat.com/errata/RHSA-2019:4021","https://access.redhat.com/errata/RHSA-2019:4040","https://access.redhat.com/errata/RHSA-2019:4041","https://access.redhat.com/errata/RHSA-2019:4042","https://access.redhat.com/errata/RHSA-2019:4045","https://access.redhat.com/errata/RHSA-2019:4269","https://access.redhat.com/errata/RHSA-2019:4273","https://access.redhat.com/errata/RHSA-2019:4352","https://access.redhat.com/errata/RHSA-2020:0406","https://access.redhat.com/errata/RHSA-2020:0727","https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md","https://kb.cert.org/vuls/id/605641/","https://kc.mcafee.com/corporate/index?page=content&id=SB10296","https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04%40%3Cusers.trafficserver.apache.org%3E","https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19%40%3Cannounce.trafficserver.apache.org%3E","https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7%40%3Cdev.trafficserver.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ/","https://seclists.org/bugtraq/2019/Aug/24","https://seclists.org/bugtraq/2019/Aug/31","https://seclists.org/bugtraq/2019/Aug/43","https://seclists.org/bugtraq/2019/Sep/18","https://security.netapp.com/advisory/ntap-20190823-0001/","https://security.netapp.com/advisory/ntap-20190823-0004/","https://security.netapp.com/advisory/ntap-20190823-0005/","https://support.f5.com/csp/article/K01988340","https://support.f5.com/csp/article/K01988340?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/4308-1/","https://www.debian.org/security/2019/dsa-4503","https://www.debian.org/security/2019/dsa-4508","https://www.debian.org/security/2019/dsa-4520","https://www.debian.org/security/2020/dsa-4669","https://www.synology.com/security/advisory/Synology_SA_19_33"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9514","description":"Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both."}]},{"artifact":{"id":"727332619043e05d","cpes":["cpe:2.3:a:golang:networking:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.0.0-20190404232315-eb5bcb51f2a3","type":"go-module","version":"v0.0.0-20190404232315-eb5bcb51f2a3","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.0.0-20190813141303-74dc4d7220e7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-39qc-96h7-956f","versionConstraint":"<0.0.0-20190813141303-74dc4d7220e7 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.0.0-20190404232315-eb5bcb51f2a3"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-39qc-96h7-956f","fix":{"state":"fixed","versions":["0.0.0-20190813141303-74dc4d7220e7"],"available":[{"date":"2023-02-25","kind":"first-observed","version":"0.0.0-20190813141303-74dc4d7220e7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9514","cwe":"CWE-400","type":"Secondary","source":"cret@cert.org"},{"cve":"CVE-2019-9514","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9514","date":"2026-10-08","epss":0.82813,"percentile":0.99664}],"risk":62.109750000000005,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-9514","https://access.redhat.com/errata/RHSA-2019:2594","https://access.redhat.com/errata/RHSA-2019:2661","https://access.redhat.com/errata/RHSA-2019:2682","https://access.redhat.com/errata/RHSA-2019:2690","https://access.redhat.com/errata/RHSA-2019:2726","https://access.redhat.com/errata/RHSA-2019:2766","https://access.redhat.com/errata/RHSA-2019:2769","https://access.redhat.com/errata/RHSA-2019:2796","https://access.redhat.com/errata/RHSA-2019:2861","https://access.redhat.com/errata/RHSA-2019:2925","https://access.redhat.com/errata/RHSA-2019:2939","https://access.redhat.com/errata/RHSA-2019:2955","https://access.redhat.com/errata/RHSA-2019:2966","https://access.redhat.com/errata/RHSA-2019:3131","https://access.redhat.com/errata/RHSA-2019:3245","https://access.redhat.com/errata/RHSA-2019:3265","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:3906","https://access.redhat.com/errata/RHSA-2019:4018","https://access.redhat.com/errata/RHSA-2019:4019","https://access.redhat.com/errata/RHSA-2019:4020","https://access.redhat.com/errata/RHSA-2019:4021","https://access.redhat.com/errata/RHSA-2019:4040","https://access.redhat.com/errata/RHSA-2019:4041","https://access.redhat.com/errata/RHSA-2019:4042","https://access.redhat.com/errata/RHSA-2019:4045","https://access.redhat.com/errata/RHSA-2019:4269","https://access.redhat.com/errata/RHSA-2019:4273","https://access.redhat.com/errata/RHSA-2019:4352","https://access.redhat.com/errata/RHSA-2020:0406","https://access.redhat.com/errata/RHSA-2020:0727","https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md","https://kc.mcafee.com/corporate/index?page=content&id=SB10296","https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04@%3Cusers.trafficserver.apache.org%3E","https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19@%3Cannounce.trafficserver.apache.org%3E","https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7@%3Cdev.trafficserver.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00011.html","https://seclists.org/bugtraq/2019/Aug/24","https://seclists.org/bugtraq/2019/Aug/31","https://seclists.org/bugtraq/2019/Aug/43","https://seclists.org/bugtraq/2019/Sep/18","https://support.f5.com/csp/article/K01988340","https://support.f5.com/csp/article/K01988340?utm_source=f5support&amp;utm_medium=RSS","https://www.debian.org/security/2019/dsa-4503","https://www.debian.org/security/2019/dsa-4508","https://www.debian.org/security/2019/dsa-4520","https://www.debian.org/security/2020/dsa-4669","https://www.synology.com/security/advisory/Synology_SA_19_33","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html","http://seclists.org/fulldisclosure/2019/Aug/16","http://www.openwall.com/lists/oss-security/2019/08/20/1","https://go.dev/cl/190137","https://go.dev/issue/33606","https://go.googlesource.com/go/+/145e193131eb486077b66009beb051aba07c52a5","https://groups.google.com/g/golang-announce/c/65QixT3tcmg/m/DrFiG6vvCwAJ","https://pkg.go.dev/vuln/GO-2022-0536","http://www.openwall.com/lists/oss-security/2023/10/18/8","https://kb.cert.org/vuls/id/605641","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ","https://security.netapp.com/advisory/ntap-20190823-0001","https://security.netapp.com/advisory/ntap-20190823-0004","https://security.netapp.com/advisory/ntap-20190823-0005","https://usn.ubuntu.com/4308-1"],"severity":"High","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-39qc-96h7-956f","description":"golang.org/x/net/http vulnerable to a reset flood"},"relatedVulnerabilities":[{"id":"CVE-2019-9514","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"cret@cert.org","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9514","cwe":"CWE-400","type":"Secondary","source":"cret@cert.org"},{"cve":"CVE-2019-9514","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9514","date":"2026-10-08","epss":0.82813,"percentile":0.99664}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html","http://seclists.org/fulldisclosure/2019/Aug/16","http://www.openwall.com/lists/oss-security/2019/08/20/1","http://www.openwall.com/lists/oss-security/2023/10/18/8","https://access.redhat.com/errata/RHSA-2019:2594","https://access.redhat.com/errata/RHSA-2019:2661","https://access.redhat.com/errata/RHSA-2019:2682","https://access.redhat.com/errata/RHSA-2019:2690","https://access.redhat.com/errata/RHSA-2019:2726","https://access.redhat.com/errata/RHSA-2019:2766","https://access.redhat.com/errata/RHSA-2019:2769","https://access.redhat.com/errata/RHSA-2019:2796","https://access.redhat.com/errata/RHSA-2019:2861","https://access.redhat.com/errata/RHSA-2019:2925","https://access.redhat.com/errata/RHSA-2019:2939","https://access.redhat.com/errata/RHSA-2019:2955","https://access.redhat.com/errata/RHSA-2019:2966","https://access.redhat.com/errata/RHSA-2019:3131","https://access.redhat.com/errata/RHSA-2019:3245","https://access.redhat.com/errata/RHSA-2019:3265","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:3906","https://access.redhat.com/errata/RHSA-2019:4018","https://access.redhat.com/errata/RHSA-2019:4019","https://access.redhat.com/errata/RHSA-2019:4020","https://access.redhat.com/errata/RHSA-2019:4021","https://access.redhat.com/errata/RHSA-2019:4040","https://access.redhat.com/errata/RHSA-2019:4041","https://access.redhat.com/errata/RHSA-2019:4042","https://access.redhat.com/errata/RHSA-2019:4045","https://access.redhat.com/errata/RHSA-2019:4269","https://access.redhat.com/errata/RHSA-2019:4273","https://access.redhat.com/errata/RHSA-2019:4352","https://access.redhat.com/errata/RHSA-2020:0406","https://access.redhat.com/errata/RHSA-2020:0727","https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md","https://kb.cert.org/vuls/id/605641/","https://kc.mcafee.com/corporate/index?page=content&id=SB10296","https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04%40%3Cusers.trafficserver.apache.org%3E","https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19%40%3Cannounce.trafficserver.apache.org%3E","https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7%40%3Cdev.trafficserver.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ/","https://seclists.org/bugtraq/2019/Aug/24","https://seclists.org/bugtraq/2019/Aug/31","https://seclists.org/bugtraq/2019/Aug/43","https://seclists.org/bugtraq/2019/Sep/18","https://security.netapp.com/advisory/ntap-20190823-0001/","https://security.netapp.com/advisory/ntap-20190823-0004/","https://security.netapp.com/advisory/ntap-20190823-0005/","https://support.f5.com/csp/article/K01988340","https://support.f5.com/csp/article/K01988340?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/4308-1/","https://www.debian.org/security/2019/dsa-4503","https://www.debian.org/security/2019/dsa-4508","https://www.debian.org/security/2019/dsa-4520","https://www.debian.org/security/2020/dsa-4669","https://www.synology.com/security/advisory/Synology_SA_19_33"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9514","description":"Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both."}]},{"artifact":{"id":"bca20a7b0a858bf3","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/debian/libssl1.1@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1&upstream=openssl","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1n-0+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-1292","versionConstraint":"< 1.1.1n-0+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-1292","fix":{"state":"fixed","versions":["1.1.1n-0+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1n-0+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-1292","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-1292","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-1292","date":"2026-10-08","epss":0.82612,"percentile":0.99661}],"risk":61.13288,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5139-1","link":"https://security-tracker.debian.org/tracker/DSA-5139-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-1292","description":"The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd)."},"relatedVulnerabilities":[{"id":"CVE-2022-1292","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-1292","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-1292","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-1292","date":"2026-10-08","epss":0.82612,"percentile":0.99661}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-953464.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1ad73b4d27bd8c1b369a3cd453681d3a4f1bb9b2","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=548d3f280a6e737673f5b61fce24bb100108dfeb","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e5fd1728ef4c7a5bf7c7a7163ca60370460a6e23","https://lists.debian.org/debian-lts-announce/2022/05/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VX4KWHPMKYJL6ZLW4M5IU7E5UV5ZWJQU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNU5M7BXMML26G3GPYKFGQYPQDRSNKDD/","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0011","https://security.gentoo.org/glsa/202210-02","https://security.netapp.com/advisory/ntap-20220602-0009/","https://security.netapp.com/advisory/ntap-20220729-0004/","https://www.debian.org/security/2022/dsa-5139","https://www.openssl.org/news/secadv/20220503.txt","https://www.oracle.com/security-alerts/cpujul2022.html","https://gitlab.com/fraf0/cve-2022-1292-re_score-analysis"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-1292","description":"The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd)."}]},{"artifact":{"id":"d308e84bddad0b0f","cpes":["cpe:2.3:a:openssl:openssl:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1n-0+deb10u2"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-1292","versionConstraint":"< 1.1.1n-0+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-1292","fix":{"state":"fixed","versions":["1.1.1n-0+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1n-0+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-1292","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-1292","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-1292","date":"2026-10-08","epss":0.82612,"percentile":0.99661}],"risk":61.13288,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5139-1","link":"https://security-tracker.debian.org/tracker/DSA-5139-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-1292","description":"The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd)."},"relatedVulnerabilities":[{"id":"CVE-2022-1292","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-1292","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-1292","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-1292","date":"2026-10-08","epss":0.82612,"percentile":0.99661}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-953464.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1ad73b4d27bd8c1b369a3cd453681d3a4f1bb9b2","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=548d3f280a6e737673f5b61fce24bb100108dfeb","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e5fd1728ef4c7a5bf7c7a7163ca60370460a6e23","https://lists.debian.org/debian-lts-announce/2022/05/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VX4KWHPMKYJL6ZLW4M5IU7E5UV5ZWJQU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNU5M7BXMML26G3GPYKFGQYPQDRSNKDD/","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0011","https://security.gentoo.org/glsa/202210-02","https://security.netapp.com/advisory/ntap-20220602-0009/","https://security.netapp.com/advisory/ntap-20220729-0004/","https://www.debian.org/security/2022/dsa-5139","https://www.openssl.org/news/secadv/20220503.txt","https://www.oracle.com/security-alerts/cpujul2022.html","https://gitlab.com/fraf0/cve-2022-1292-re_score-analysis"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-1292","description":"The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd)."}]},{"artifact":{"id":"7f19231bca942dc4","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/debian/libldap-2.4-2@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-29155","versionConstraint":"< 2.4.47+dfsg-3+deb10u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-29155","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u7"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-29155","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-29155","date":"2026-10-08","epss":0.64487,"percentile":0.99221}],"risk":60.61778000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5140-1","link":"https://security-tracker.debian.org/tracker/DSA-5140-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-29155","description":"In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping."},"relatedVulnerabilities":[{"id":"CVE-2022-29155","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-29155","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-29155","date":"2026-10-08","epss":0.64487,"percentile":0.99221}],"urls":["https://bugs.openldap.org/show_bug.cgi?id=9815","https://lists.debian.org/debian-lts-announce/2022/05/msg00032.html","https://security.netapp.com/advisory/ntap-20220609-0007/","https://www.debian.org/security/2022/dsa-5140"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-29155","description":"In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping."}]},{"artifact":{"id":"ed53a6639a2640b0","cpes":["cpe:2.3:a:libldap-common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-common","purl":"pkg:deb/debian/libldap-common@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=all&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-common/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.list"}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-29155","versionConstraint":"< 2.4.47+dfsg-3+deb10u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-29155","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u7"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-29155","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-29155","date":"2026-10-08","epss":0.64487,"percentile":0.99221}],"risk":60.61778000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5140-1","link":"https://security-tracker.debian.org/tracker/DSA-5140-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-29155","description":"In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping."},"relatedVulnerabilities":[{"id":"CVE-2022-29155","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-29155","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-29155","date":"2026-10-08","epss":0.64487,"percentile":0.99221}],"urls":["https://bugs.openldap.org/show_bug.cgi?id=9815","https://lists.debian.org/debian-lts-announce/2022/05/msg00032.html","https://security.netapp.com/advisory/ntap-20220609-0007/","https://www.debian.org/security/2022/dsa-5140"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-29155","description":"In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping."}]},{"artifact":{"id":"c6f08567c3b7bec6","cpes":["cpe:2.3:a:golang:networking:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.0.0-20190404232315-eb5bcb51f2a3","type":"go-module","version":"v0.0.0-20190404232315-eb5bcb51f2a3","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.17.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qppj-fm5r-hxr3","versionConstraint":"<0.17.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.0.0-20190404232315-eb5bcb51f2a3"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-qppj-fm5r-hxr3","fix":{"state":"fixed","versions":["0.17.0"],"available":[{"date":"2023-10-14","kind":"first-observed","version":"0.17.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:H","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:A","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-44487","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-44487","date":"2026-10-08","epss":0.99999,"percentile":0.99998}],"risk":58.275,"urls":["https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3","https://nvd.nist.gov/vuln/detail/CVE-2023-44487","https://github.com/alibaba/tengine/issues/1872","https://github.com/caddyserver/caddy/issues/5877","https://github.com/eclipse/jetty.project/issues/10679","https://github.com/haproxy/haproxy/issues/2312","https://github.com/hyperium/hyper/issues/3337","https://github.com/envoyproxy/envoy/pull/30055","https://github.com/grpc/grpc-go/pull/6703","https://github.com/nghttp2/nghttp2/pull/1961","https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61","https://bugzilla.proxmox.com/show_bug.cgi?id=4988","https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9","https://chaos.social/@icing/111210915918780532","https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack","https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764","https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2","https://github.com/bcdannyboy/CVE-2023-44487","https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244","https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0","https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html","https://my.f5.com/manage/s/article/K000137106","https://news.ycombinator.com/item?id=37830987","https://news.ycombinator.com/item?id=37830998","https://news.ycombinator.com/item?id=37831062","https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack","https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf","https://github.com/dotnet/announcements/issues/277","https://github.com/golang/go/issues/63417","https://github.com/apache/trafficserver/pull/10564","https://github.com/facebook/proxygen/pull/466","https://github.com/h2o/h2o/pull/3291","https://github.com/microsoft/CBL-Mariner/pull/6381","https://github.com/nodejs/node/pull/50121","https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve","https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088","https://github.com/advisories/GHSA-vx74-f528-fxqg","https://github.com/micrictor/http2-rst-stream","https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo","https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487","https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected","https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14","https://www.openwall.com/lists/oss-security/2023/10/10/6","https://github.com/opensearch-project/data-prepper/issues/3474","https://github.com/kubernetes/kubernetes/pull/121120","https://github.com/advisories/GHSA-xpw8-rcwv-8f8p","https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73","https://github.com/oqtane/oqtane.framework/discussions/3367","https://netty.io/news/2023/10/10/4-1-100-Final.html","https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487","https://github.com/Azure/AKS/issues/3947","https://github.com/akka/akka-http/issues/4323","https://github.com/apache/apisix/issues/10320","https://github.com/etcd-io/etcd/issues/16740","https://github.com/junkurihara/rust-rpxy/issues/97","https://github.com/kazu-yamamoto/http2/issues/93","https://github.com/ninenines/cowboy/issues/1615","https://github.com/openresty/openresty/issues/930","https://github.com/tempesta-tech/tempesta/issues/1986","https://github.com/varnishcache/varnish-cache/issues/3996","https://github.com/apache/httpd-site/pull/10","https://github.com/line/armeria/pull/5232","https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632","https://github.com/projectcontour/contour/pull/5826","https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1","https://access.redhat.com/security/cve/cve-2023-44487","https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack","https://bugzilla.redhat.com/show_bug.cgi?id=2242803","https://bugzilla.suse.com/show_bug.cgi?id=1216123","https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125","https://github.com/Kong/kong/discussions/11741","https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113","https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487","https://github.com/caddyserver/caddy/releases/tag/v2.7.5","https://go.dev/cl/534215","https://go.dev/cl/534235","https://go.dev/issue/63417","https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ","https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html","https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html","https://news.ycombinator.com/item?id=37837043","https://security.paloaltonetworks.com/CVE-2023-44487","https://ubuntu.com/security/CVE-2023-44487","https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event","https://www.debian.org/security/2023/dsa-5521","https://www.debian.org/security/2023/dsa-5522","http://www.openwall.com/lists/oss-security/2023/10/13/4","http://www.openwall.com/lists/oss-security/2023/10/13/9","https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html","https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html","https://github.com/grpc/grpc-go/releases","https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html","https://www.debian.org/security/2023/dsa-5540","http://www.openwall.com/lists/oss-security/2023/10/18/4","http://www.openwall.com/lists/oss-security/2023/10/18/8","http://www.openwall.com/lists/oss-security/2023/10/19/6","http://www.openwall.com/lists/oss-security/2023/10/20/8","https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715","https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html","https://www.debian.org/security/2023/dsa-5549","https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html","https://security.gentoo.org/glsa/202311-09","https://www.debian.org/security/2023/dsa-5558","https://www.debian.org/security/2023/dsa-5570","https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.0-M12","https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94","https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81","https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size","https://aws.amazon.com/security/security-bulletins/AWS-2023-011","https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack","https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack","https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty","https://blog.vespa.ai/cve-2023-44487","https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps","https://istio.io/latest/news/security/istio-security-2023-004","https://linkerd.io/2023/10/12/linkerd-cve-2023-44487","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4","https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2","https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response","https://security.netapp.com/advisory/ntap-20231016-0001","https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records","https://www.eclipse.org/lists/jetty-announce/msg00181.html","https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487","https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products","https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday","https://github.com/akka/akka-http/pull/4325","https://github.com/akka/akka-http/pull/4324","https://akka.io/security/akka-http-cve-2023-44487.html","https://security.netapp.com/advisory/ntap-20240426-0007","https://security.netapp.com/advisory/ntap-20240621-0006","https://security.netapp.com/advisory/ntap-20240621-0007","https://github.com/apache/tomcat/commit/944332bb15bd2f3bf76ec2caeb1ff0a58a3bc628","https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX","https://github.com/grpc/grpc/releases/tag/v1.59.2","http://www.openwall.com/lists/oss-security/2023/10/10/6","http://www.openwall.com/lists/oss-security/2023/10/10/7","https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-44487","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-341067.html","https://cert-portal.siemens.com/productcert/html/ssa-784301.html","https://cert-portal.siemens.com/productcert/html/ssa-832273.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html","http://www.openwall.com/lists/oss-security/2025/08/13/6"],"severity":"Medium","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qppj-fm5r-hxr3","description":"HTTP/2 Stream Cancellation Attack","knownExploited":[{"cve":"CVE-2023-44487","cwes":["CWE-400"],"urls":["https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/","https://nvd.nist.gov/vuln/detail/CVE-2023-44487"],"notes":"This vulnerability affects a common open-source component, third-party library, or protocol used by different products. For more information, please see: HTTP/2 Rapid Reset Vulnerability, CVE-2023-44487 | CISA: https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","dueDate":"2023-10-31","product":"HTTP/2","dateAdded":"2023-10-10","vendorProject":"IETF","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2023-44487","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-44487","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-44487","date":"2026-10-08","epss":0.99999,"percentile":0.99998}],"urls":["http://www.openwall.com/lists/oss-security/2023/10/10/6","http://www.openwall.com/lists/oss-security/2023/10/10/7","http://www.openwall.com/lists/oss-security/2023/10/13/4","http://www.openwall.com/lists/oss-security/2023/10/13/9","http://www.openwall.com/lists/oss-security/2023/10/18/4","http://www.openwall.com/lists/oss-security/2023/10/18/8","http://www.openwall.com/lists/oss-security/2023/10/19/6","http://www.openwall.com/lists/oss-security/2023/10/20/8","https://access.redhat.com/security/cve/cve-2023-44487","https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/","https://aws.amazon.com/security/security-bulletins/AWS-2023-011/","https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/","https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/","https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/","https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack","https://blog.vespa.ai/cve-2023-44487/","https://bugzilla.proxmox.com/show_bug.cgi?id=4988","https://bugzilla.redhat.com/show_bug.cgi?id=2242803","https://bugzilla.suse.com/show_bug.cgi?id=1216123","https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9","https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/","https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack","https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125","https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715","https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve","https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764","https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088","https://github.com/Azure/AKS/issues/3947","https://github.com/Kong/kong/discussions/11741","https://github.com/advisories/GHSA-qppj-fm5r-hxr3","https://github.com/advisories/GHSA-vx74-f528-fxqg","https://github.com/advisories/GHSA-xpw8-rcwv-8f8p","https://github.com/akka/akka-http/issues/4323","https://github.com/alibaba/tengine/issues/1872","https://github.com/apache/apisix/issues/10320","https://github.com/apache/httpd-site/pull/10","https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113","https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2","https://github.com/apache/trafficserver/pull/10564","https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487","https://github.com/bcdannyboy/CVE-2023-44487","https://github.com/caddyserver/caddy/issues/5877","https://github.com/caddyserver/caddy/releases/tag/v2.7.5","https://github.com/dotnet/announcements/issues/277","https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73","https://github.com/eclipse/jetty.project/issues/10679","https://github.com/envoyproxy/envoy/pull/30055","https://github.com/etcd-io/etcd/issues/16740","https://github.com/facebook/proxygen/pull/466","https://github.com/golang/go/issues/63417","https://github.com/grpc/grpc-go/pull/6703","https://github.com/grpc/grpc/releases/tag/v1.59.2","https://github.com/h2o/h2o/pull/3291","https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf","https://github.com/haproxy/haproxy/issues/2312","https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244","https://github.com/junkurihara/rust-rpxy/issues/97","https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1","https://github.com/kazu-yamamoto/http2/issues/93","https://github.com/kubernetes/kubernetes/pull/121120","https://github.com/line/armeria/pull/5232","https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632","https://github.com/micrictor/http2-rst-stream","https://github.com/microsoft/CBL-Mariner/pull/6381","https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61","https://github.com/nghttp2/nghttp2/pull/1961","https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0","https://github.com/ninenines/cowboy/issues/1615","https://github.com/nodejs/node/pull/50121","https://github.com/openresty/openresty/issues/930","https://github.com/opensearch-project/data-prepper/issues/3474","https://github.com/oqtane/oqtane.framework/discussions/3367","https://github.com/projectcontour/contour/pull/5826","https://github.com/tempesta-tech/tempesta/issues/1986","https://github.com/varnishcache/varnish-cache/issues/3996","https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo","https://istio.io/latest/news/security/istio-security-2023-004/","https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/","https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q","https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html","https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html","https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/","https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html","https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html","https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html","https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487","https://my.f5.com/manage/s/article/K000137106","https://netty.io/news/2023/10/10/4-1-100-Final.html","https://news.ycombinator.com/item?id=37830987","https://news.ycombinator.com/item?id=37830998","https://news.ycombinator.com/item?id=37831062","https://news.ycombinator.com/item?id=37837043","https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/","https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected","https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ","https://security.gentoo.org/glsa/202311-09","https://security.netapp.com/advisory/ntap-20231016-0001/","https://security.netapp.com/advisory/ntap-20240426-0007/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://security.netapp.com/advisory/ntap-20240621-0007/","https://security.paloaltonetworks.com/CVE-2023-44487","https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14","https://ubuntu.com/security/CVE-2023-44487","https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/","https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event","https://www.debian.org/security/2023/dsa-5521","https://www.debian.org/security/2023/dsa-5522","https://www.debian.org/security/2023/dsa-5540","https://www.debian.org/security/2023/dsa-5549","https://www.debian.org/security/2023/dsa-5558","https://www.debian.org/security/2023/dsa-5570","https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487","https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/","https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/","https://www.openwall.com/lists/oss-security/2023/10/10/6","https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack","https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/","http://www.openwall.com/lists/oss-security/2025/08/13/6","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/","https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-341067.html","https://cert-portal.siemens.com/productcert/html/ssa-784301.html","https://cert-portal.siemens.com/productcert/html/ssa-832273.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-44487","https://github.com/envoyproxy/envoy/security/advisories/GHSA-jhv4-f7mr-xx76","https://github.com/kubernetes/ingress-nginx/blob/4b5c5efe2508dc915a48c54de7f23912ff2ec695/changelog/controller-1.9.3.md?plain=1#L15","https://varnish-cache.org/releases/rel6.0.12.html#rel6-0-12","https://varnish-cache.org/releases/rel7.3.1.html#rel7-3-1","https://varnish-cache.org/releases/rel7.4.2.html#rel7-4-2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","description":"The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.","knownExploited":[{"cve":"CVE-2023-44487","cwes":["CWE-400"],"urls":["https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/","https://nvd.nist.gov/vuln/detail/CVE-2023-44487"],"notes":"This vulnerability affects a common open-source component, third-party library, or protocol used by different products. For more information, please see: HTTP/2 Rapid Reset Vulnerability, CVE-2023-44487 | CISA: https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","dueDate":"2023-10-31","product":"HTTP/2","dateAdded":"2023-10-10","vendorProject":"IETF","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"727332619043e05d","cpes":["cpe:2.3:a:golang:networking:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.0.0-20190404232315-eb5bcb51f2a3","type":"go-module","version":"v0.0.0-20190404232315-eb5bcb51f2a3","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.17.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qppj-fm5r-hxr3","versionConstraint":"<0.17.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.0.0-20190404232315-eb5bcb51f2a3"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-qppj-fm5r-hxr3","fix":{"state":"fixed","versions":["0.17.0"],"available":[{"date":"2023-10-14","kind":"first-observed","version":"0.17.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:H","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:A","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-44487","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-44487","date":"2026-10-08","epss":0.99999,"percentile":0.99998}],"risk":58.275,"urls":["https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3","https://nvd.nist.gov/vuln/detail/CVE-2023-44487","https://github.com/alibaba/tengine/issues/1872","https://github.com/caddyserver/caddy/issues/5877","https://github.com/eclipse/jetty.project/issues/10679","https://github.com/haproxy/haproxy/issues/2312","https://github.com/hyperium/hyper/issues/3337","https://github.com/envoyproxy/envoy/pull/30055","https://github.com/grpc/grpc-go/pull/6703","https://github.com/nghttp2/nghttp2/pull/1961","https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61","https://bugzilla.proxmox.com/show_bug.cgi?id=4988","https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9","https://chaos.social/@icing/111210915918780532","https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack","https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764","https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2","https://github.com/bcdannyboy/CVE-2023-44487","https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244","https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0","https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html","https://my.f5.com/manage/s/article/K000137106","https://news.ycombinator.com/item?id=37830987","https://news.ycombinator.com/item?id=37830998","https://news.ycombinator.com/item?id=37831062","https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack","https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf","https://github.com/dotnet/announcements/issues/277","https://github.com/golang/go/issues/63417","https://github.com/apache/trafficserver/pull/10564","https://github.com/facebook/proxygen/pull/466","https://github.com/h2o/h2o/pull/3291","https://github.com/microsoft/CBL-Mariner/pull/6381","https://github.com/nodejs/node/pull/50121","https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve","https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088","https://github.com/advisories/GHSA-vx74-f528-fxqg","https://github.com/micrictor/http2-rst-stream","https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo","https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487","https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected","https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14","https://www.openwall.com/lists/oss-security/2023/10/10/6","https://github.com/opensearch-project/data-prepper/issues/3474","https://github.com/kubernetes/kubernetes/pull/121120","https://github.com/advisories/GHSA-xpw8-rcwv-8f8p","https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73","https://github.com/oqtane/oqtane.framework/discussions/3367","https://netty.io/news/2023/10/10/4-1-100-Final.html","https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487","https://github.com/Azure/AKS/issues/3947","https://github.com/akka/akka-http/issues/4323","https://github.com/apache/apisix/issues/10320","https://github.com/etcd-io/etcd/issues/16740","https://github.com/junkurihara/rust-rpxy/issues/97","https://github.com/kazu-yamamoto/http2/issues/93","https://github.com/ninenines/cowboy/issues/1615","https://github.com/openresty/openresty/issues/930","https://github.com/tempesta-tech/tempesta/issues/1986","https://github.com/varnishcache/varnish-cache/issues/3996","https://github.com/apache/httpd-site/pull/10","https://github.com/line/armeria/pull/5232","https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632","https://github.com/projectcontour/contour/pull/5826","https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1","https://access.redhat.com/security/cve/cve-2023-44487","https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack","https://bugzilla.redhat.com/show_bug.cgi?id=2242803","https://bugzilla.suse.com/show_bug.cgi?id=1216123","https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125","https://github.com/Kong/kong/discussions/11741","https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113","https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487","https://github.com/caddyserver/caddy/releases/tag/v2.7.5","https://go.dev/cl/534215","https://go.dev/cl/534235","https://go.dev/issue/63417","https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ","https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html","https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html","https://news.ycombinator.com/item?id=37837043","https://security.paloaltonetworks.com/CVE-2023-44487","https://ubuntu.com/security/CVE-2023-44487","https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event","https://www.debian.org/security/2023/dsa-5521","https://www.debian.org/security/2023/dsa-5522","http://www.openwall.com/lists/oss-security/2023/10/13/4","http://www.openwall.com/lists/oss-security/2023/10/13/9","https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html","https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html","https://github.com/grpc/grpc-go/releases","https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html","https://www.debian.org/security/2023/dsa-5540","http://www.openwall.com/lists/oss-security/2023/10/18/4","http://www.openwall.com/lists/oss-security/2023/10/18/8","http://www.openwall.com/lists/oss-security/2023/10/19/6","http://www.openwall.com/lists/oss-security/2023/10/20/8","https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715","https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html","https://www.debian.org/security/2023/dsa-5549","https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html","https://security.gentoo.org/glsa/202311-09","https://www.debian.org/security/2023/dsa-5558","https://www.debian.org/security/2023/dsa-5570","https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.0-M12","https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94","https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81","https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size","https://aws.amazon.com/security/security-bulletins/AWS-2023-011","https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack","https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack","https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty","https://blog.vespa.ai/cve-2023-44487","https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps","https://istio.io/latest/news/security/istio-security-2023-004","https://linkerd.io/2023/10/12/linkerd-cve-2023-44487","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4","https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2","https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response","https://security.netapp.com/advisory/ntap-20231016-0001","https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records","https://www.eclipse.org/lists/jetty-announce/msg00181.html","https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487","https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products","https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday","https://github.com/akka/akka-http/pull/4325","https://github.com/akka/akka-http/pull/4324","https://akka.io/security/akka-http-cve-2023-44487.html","https://security.netapp.com/advisory/ntap-20240426-0007","https://security.netapp.com/advisory/ntap-20240621-0006","https://security.netapp.com/advisory/ntap-20240621-0007","https://github.com/apache/tomcat/commit/944332bb15bd2f3bf76ec2caeb1ff0a58a3bc628","https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX","https://github.com/grpc/grpc/releases/tag/v1.59.2","http://www.openwall.com/lists/oss-security/2023/10/10/6","http://www.openwall.com/lists/oss-security/2023/10/10/7","https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-44487","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-341067.html","https://cert-portal.siemens.com/productcert/html/ssa-784301.html","https://cert-portal.siemens.com/productcert/html/ssa-832273.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html","http://www.openwall.com/lists/oss-security/2025/08/13/6"],"severity":"Medium","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qppj-fm5r-hxr3","description":"HTTP/2 Stream Cancellation Attack","knownExploited":[{"cve":"CVE-2023-44487","cwes":["CWE-400"],"urls":["https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/","https://nvd.nist.gov/vuln/detail/CVE-2023-44487"],"notes":"This vulnerability affects a common open-source component, third-party library, or protocol used by different products. For more information, please see: HTTP/2 Rapid Reset Vulnerability, CVE-2023-44487 | CISA: https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","dueDate":"2023-10-31","product":"HTTP/2","dateAdded":"2023-10-10","vendorProject":"IETF","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2023-44487","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-44487","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-44487","date":"2026-10-08","epss":0.99999,"percentile":0.99998}],"urls":["http://www.openwall.com/lists/oss-security/2023/10/10/6","http://www.openwall.com/lists/oss-security/2023/10/10/7","http://www.openwall.com/lists/oss-security/2023/10/13/4","http://www.openwall.com/lists/oss-security/2023/10/13/9","http://www.openwall.com/lists/oss-security/2023/10/18/4","http://www.openwall.com/lists/oss-security/2023/10/18/8","http://www.openwall.com/lists/oss-security/2023/10/19/6","http://www.openwall.com/lists/oss-security/2023/10/20/8","https://access.redhat.com/security/cve/cve-2023-44487","https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/","https://aws.amazon.com/security/security-bulletins/AWS-2023-011/","https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/","https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/","https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/","https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack","https://blog.vespa.ai/cve-2023-44487/","https://bugzilla.proxmox.com/show_bug.cgi?id=4988","https://bugzilla.redhat.com/show_bug.cgi?id=2242803","https://bugzilla.suse.com/show_bug.cgi?id=1216123","https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9","https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/","https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack","https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125","https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715","https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve","https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764","https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088","https://github.com/Azure/AKS/issues/3947","https://github.com/Kong/kong/discussions/11741","https://github.com/advisories/GHSA-qppj-fm5r-hxr3","https://github.com/advisories/GHSA-vx74-f528-fxqg","https://github.com/advisories/GHSA-xpw8-rcwv-8f8p","https://github.com/akka/akka-http/issues/4323","https://github.com/alibaba/tengine/issues/1872","https://github.com/apache/apisix/issues/10320","https://github.com/apache/httpd-site/pull/10","https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113","https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2","https://github.com/apache/trafficserver/pull/10564","https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487","https://github.com/bcdannyboy/CVE-2023-44487","https://github.com/caddyserver/caddy/issues/5877","https://github.com/caddyserver/caddy/releases/tag/v2.7.5","https://github.com/dotnet/announcements/issues/277","https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73","https://github.com/eclipse/jetty.project/issues/10679","https://github.com/envoyproxy/envoy/pull/30055","https://github.com/etcd-io/etcd/issues/16740","https://github.com/facebook/proxygen/pull/466","https://github.com/golang/go/issues/63417","https://github.com/grpc/grpc-go/pull/6703","https://github.com/grpc/grpc/releases/tag/v1.59.2","https://github.com/h2o/h2o/pull/3291","https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf","https://github.com/haproxy/haproxy/issues/2312","https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244","https://github.com/junkurihara/rust-rpxy/issues/97","https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1","https://github.com/kazu-yamamoto/http2/issues/93","https://github.com/kubernetes/kubernetes/pull/121120","https://github.com/line/armeria/pull/5232","https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632","https://github.com/micrictor/http2-rst-stream","https://github.com/microsoft/CBL-Mariner/pull/6381","https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61","https://github.com/nghttp2/nghttp2/pull/1961","https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0","https://github.com/ninenines/cowboy/issues/1615","https://github.com/nodejs/node/pull/50121","https://github.com/openresty/openresty/issues/930","https://github.com/opensearch-project/data-prepper/issues/3474","https://github.com/oqtane/oqtane.framework/discussions/3367","https://github.com/projectcontour/contour/pull/5826","https://github.com/tempesta-tech/tempesta/issues/1986","https://github.com/varnishcache/varnish-cache/issues/3996","https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo","https://istio.io/latest/news/security/istio-security-2023-004/","https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/","https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q","https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html","https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html","https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/","https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html","https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html","https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html","https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487","https://my.f5.com/manage/s/article/K000137106","https://netty.io/news/2023/10/10/4-1-100-Final.html","https://news.ycombinator.com/item?id=37830987","https://news.ycombinator.com/item?id=37830998","https://news.ycombinator.com/item?id=37831062","https://news.ycombinator.com/item?id=37837043","https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/","https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected","https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ","https://security.gentoo.org/glsa/202311-09","https://security.netapp.com/advisory/ntap-20231016-0001/","https://security.netapp.com/advisory/ntap-20240426-0007/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://security.netapp.com/advisory/ntap-20240621-0007/","https://security.paloaltonetworks.com/CVE-2023-44487","https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14","https://ubuntu.com/security/CVE-2023-44487","https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/","https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event","https://www.debian.org/security/2023/dsa-5521","https://www.debian.org/security/2023/dsa-5522","https://www.debian.org/security/2023/dsa-5540","https://www.debian.org/security/2023/dsa-5549","https://www.debian.org/security/2023/dsa-5558","https://www.debian.org/security/2023/dsa-5570","https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487","https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/","https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/","https://www.openwall.com/lists/oss-security/2023/10/10/6","https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack","https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/","http://www.openwall.com/lists/oss-security/2025/08/13/6","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/","https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-341067.html","https://cert-portal.siemens.com/productcert/html/ssa-784301.html","https://cert-portal.siemens.com/productcert/html/ssa-832273.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-44487","https://github.com/envoyproxy/envoy/security/advisories/GHSA-jhv4-f7mr-xx76","https://github.com/kubernetes/ingress-nginx/blob/4b5c5efe2508dc915a48c54de7f23912ff2ec695/changelog/controller-1.9.3.md?plain=1#L15","https://varnish-cache.org/releases/rel6.0.12.html#rel6-0-12","https://varnish-cache.org/releases/rel7.3.1.html#rel7-3-1","https://varnish-cache.org/releases/rel7.4.2.html#rel7-4-2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","description":"The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.","knownExploited":[{"cve":"CVE-2023-44487","cwes":["CWE-400"],"urls":["https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/","https://nvd.nist.gov/vuln/detail/CVE-2023-44487"],"notes":"This vulnerability affects a common open-source component, third-party library, or protocol used by different products. For more information, please see: HTTP/2 Rapid Reset Vulnerability, CVE-2023-44487 | CISA: https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","dueDate":"2023-10-31","product":"HTTP/2","dateAdded":"2023-10-10","vendorProject":"IETF","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"7f19231bca942dc4","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/debian/libldap-2.4-2@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36222","versionConstraint":"< 2.4.47+dfsg-3+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-36222","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36222","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36222","date":"2026-10-08","epss":0.77236,"percentile":0.99545}],"risk":57.92700000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4845-1","link":"https://security-tracker.debian.org/tracker/DSA-4845-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-36222","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service."},"relatedVulnerabilities":[{"id":"CVE-2020-36222","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36222","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36222","date":"2026-10-08","epss":0.77236,"percentile":0.99545}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9406","https://bugs.openldap.org/show_bug.cgi?id=9407","https://git.openldap.org/openldap/openldap/-/commit/02dfc32d658fadc25e4040f78e36592f6e1e1ca0","https://git.openldap.org/openldap/openldap/-/commit/6ed057b5b728b50746c869bcc9c1f85d0bbbf6ed","https://git.openldap.org/openldap/openldap/-/commit/6ed057b5b728b50746c869bcc9c1f85d0bbbf6ed.aa","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36222","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service."}]},{"artifact":{"id":"7f19231bca942dc4","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/debian/libldap-2.4-2@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36227","versionConstraint":"< 2.4.47+dfsg-3+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-36227","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36227","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36227","date":"2026-10-08","epss":0.77236,"percentile":0.99545}],"risk":57.92700000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4845-1","link":"https://security-tracker.debian.org/tracker/DSA-4845-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-36227","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service."},"relatedVulnerabilities":[{"id":"CVE-2020-36227","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36227","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36227","date":"2026-10-08","epss":0.77236,"percentile":0.99545}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9428","https://git.openldap.org/openldap/openldap/-/commit/9d0e8485f3113505743baabf1167e01e4558ccf5","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36227","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service."}]},{"artifact":{"id":"ed53a6639a2640b0","cpes":["cpe:2.3:a:libldap-common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-common","purl":"pkg:deb/debian/libldap-common@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=all&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-common/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.list"}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36222","versionConstraint":"< 2.4.47+dfsg-3+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-36222","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36222","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36222","date":"2026-10-08","epss":0.77236,"percentile":0.99545}],"risk":57.92700000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4845-1","link":"https://security-tracker.debian.org/tracker/DSA-4845-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-36222","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service."},"relatedVulnerabilities":[{"id":"CVE-2020-36222","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36222","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36222","date":"2026-10-08","epss":0.77236,"percentile":0.99545}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9406","https://bugs.openldap.org/show_bug.cgi?id=9407","https://git.openldap.org/openldap/openldap/-/commit/02dfc32d658fadc25e4040f78e36592f6e1e1ca0","https://git.openldap.org/openldap/openldap/-/commit/6ed057b5b728b50746c869bcc9c1f85d0bbbf6ed","https://git.openldap.org/openldap/openldap/-/commit/6ed057b5b728b50746c869bcc9c1f85d0bbbf6ed.aa","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36222","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service."}]},{"artifact":{"id":"ed53a6639a2640b0","cpes":["cpe:2.3:a:libldap-common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-common","purl":"pkg:deb/debian/libldap-common@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=all&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-common/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.list"}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36227","versionConstraint":"< 2.4.47+dfsg-3+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-36227","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36227","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36227","date":"2026-10-08","epss":0.77236,"percentile":0.99545}],"risk":57.92700000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4845-1","link":"https://security-tracker.debian.org/tracker/DSA-4845-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-36227","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service."},"relatedVulnerabilities":[{"id":"CVE-2020-36227","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36227","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36227","date":"2026-10-08","epss":0.77236,"percentile":0.99545}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9428","https://git.openldap.org/openldap/openldap/-/commit/9d0e8485f3113505743baabf1167e01e4558ccf5","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36227","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service."}]},{"artifact":{"id":"02757d5e36fd6ee1","cpes":["cpe:2.3:a:libsystemd0:libsystemd0:241-7\\~deb10u1:*:*:*:*:*:*:*"],"name":"libsystemd0","purl":"pkg:deb/debian/libsystemd0@241-7~deb10u1?arch=amd64&distro=debian-10.1&upstream=systemd","type":"deb","version":"241-7~deb10u1","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsystemd0/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libsystemd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50868","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"systemd","version":"241-7~deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-50868","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50868","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50868","date":"2026-10-08","epss":0.73725,"percentile":0.99466}],"risk":55.293749999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-50868","description":"The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the \"NSEC3\" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations."},"relatedVulnerabilities":[{"id":"CVE-2023-50868","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50868","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50868","date":"2026-10-08","epss":0.73725,"percentile":0.99466}],"urls":["http://www.openwall.com/lists/oss-security/2024/02/16/2","http://www.openwall.com/lists/oss-security/2024/02/16/3","https://access.redhat.com/security/cve/CVE-2023-50868","https://bugzilla.suse.com/show_bug.cgi?id=1219826","https://datatracker.ietf.org/doc/html/rfc5155","https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html","https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1","https://kb.isc.org/docs/cve-2023-50868","https://lists.debian.org/debian-lts-announce/2024/02/msg00006.html","https://lists.debian.org/debian-lts-announce/2024/05/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FV5O347JTX7P5OZA6NGO4MKTXRXMKOZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGSLGKUAQTW5JPPZCMF5YPEYALLRUZZ6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEXGOYGW7DBS3N2QSSQONZ4ENIRQEAPG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQESRWMJCF4JEYJEAKLRM6CT55GLJAB7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/","https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html","https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/","https://security.netapp.com/advisory/ntap-20240307-0008/","https://www.isc.org/blogs/2024-bind-security-release/","https://lists.debian.org/debian-lts-announce/2024/09/msg00001.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00035.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/","https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-1931.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50868","description":"The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the \"NSEC3\" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations."}]},{"artifact":{"id":"8899fd13acd75827","cpes":["cpe:2.3:a:libudev1:libudev1:241-7\\~deb10u1:*:*:*:*:*:*:*"],"name":"libudev1","purl":"pkg:deb/debian/libudev1@241-7~deb10u1?arch=amd64&distro=debian-10.1&upstream=systemd","type":"deb","version":"241-7~deb10u1","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50868","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"systemd","version":"241-7~deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-50868","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50868","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50868","date":"2026-10-08","epss":0.73725,"percentile":0.99466}],"risk":55.293749999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-50868","description":"The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the \"NSEC3\" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations."},"relatedVulnerabilities":[{"id":"CVE-2023-50868","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50868","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50868","date":"2026-10-08","epss":0.73725,"percentile":0.99466}],"urls":["http://www.openwall.com/lists/oss-security/2024/02/16/2","http://www.openwall.com/lists/oss-security/2024/02/16/3","https://access.redhat.com/security/cve/CVE-2023-50868","https://bugzilla.suse.com/show_bug.cgi?id=1219826","https://datatracker.ietf.org/doc/html/rfc5155","https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html","https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1","https://kb.isc.org/docs/cve-2023-50868","https://lists.debian.org/debian-lts-announce/2024/02/msg00006.html","https://lists.debian.org/debian-lts-announce/2024/05/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FV5O347JTX7P5OZA6NGO4MKTXRXMKOZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGSLGKUAQTW5JPPZCMF5YPEYALLRUZZ6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEXGOYGW7DBS3N2QSSQONZ4ENIRQEAPG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQESRWMJCF4JEYJEAKLRM6CT55GLJAB7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/","https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html","https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/","https://security.netapp.com/advisory/ntap-20240307-0008/","https://www.isc.org/blogs/2024-bind-security-release/","https://lists.debian.org/debian-lts-announce/2024/09/msg00001.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00035.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/","https://www.nlnetlabs.nl/downloads/unbound/CVE-2024-1931.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50868","description":"The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the \"NSEC3\" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations."}]},{"artifact":{"id":"bca20a7b0a858bf3","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/debian/libssl1.1@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1&upstream=openssl","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1d-0+deb10u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0778","versionConstraint":"< 1.1.1d-0+deb10u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-0778","fix":{"state":"fixed","versions":["1.1.1d-0+deb10u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1d-0+deb10u8"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0778","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-0778","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-0778","date":"2026-10-08","epss":0.73188,"percentile":0.99448}],"risk":54.891,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5103-1","link":"https://security-tracker.debian.org/tracker/DSA-5103-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-0778","description":"The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc)."},"relatedVulnerabilities":[{"id":"CVE-2022-0778","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0778","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-0778","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-0778","date":"2026-10-08","epss":0.73188,"percentile":0.99448}],"urls":["http://packetstormsecurity.com/files/167344/OpenSSL-1.0.2-1.1.1-3.0-BN_mod_sqrt-Infinite-Loop.html","http://seclists.org/fulldisclosure/2022/May/33","http://seclists.org/fulldisclosure/2022/May/35","http://seclists.org/fulldisclosure/2022/May/38","https://cert-portal.siemens.com/productcert/pdf/ssa-712929.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3118eb64934499d93db3230748a452351d1d9a65","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=380085481c64de749a6dd25cdf0bcf4360b30f83","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=a466912611aa6cbdf550cd10601390e587451246","https://lists.debian.org/debian-lts-announce/2022/03/msg00023.html","https://lists.debian.org/debian-lts-announce/2022/03/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/323SNN6ZX7PRJJWP2BUAFLPUAE42XWLZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GDB3GQVJPXJE7X5C5JN6JAA4XUDWD6E6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6K3PR542DXWLEFFMFIDMME4CWMHJRMG/","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0002","https://security.gentoo.org/glsa/202210-02","https://security.netapp.com/advisory/ntap-20220321-0002/","https://security.netapp.com/advisory/ntap-20220429-0005/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://support.apple.com/kb/HT213255","https://support.apple.com/kb/HT213256","https://support.apple.com/kb/HT213257","https://www.debian.org/security/2022/dsa-5103","https://www.openssl.org/news/secadv/20220315.txt","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.tenable.com/security/tns-2022-06","https://www.tenable.com/security/tns-2022-07","https://www.tenable.com/security/tns-2022-08","https://www.tenable.com/security/tns-2022-09","https://cert-portal.siemens.com/productcert/html/ssa-019200.html","https://cert-portal.siemens.com/productcert/html/ssa-028723.html","https://cert-portal.siemens.com/productcert/html/ssa-108696.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-712929.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0778","description":"The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc)."}]},{"artifact":{"id":"d308e84bddad0b0f","cpes":["cpe:2.3:a:openssl:openssl:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1d-0+deb10u8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-0778","versionConstraint":"< 1.1.1d-0+deb10u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-0778","fix":{"state":"fixed","versions":["1.1.1d-0+deb10u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1d-0+deb10u8"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0778","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-0778","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-0778","date":"2026-10-08","epss":0.73188,"percentile":0.99448}],"risk":54.891,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5103-1","link":"https://security-tracker.debian.org/tracker/DSA-5103-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-0778","description":"The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc)."},"relatedVulnerabilities":[{"id":"CVE-2022-0778","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0778","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-0778","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-0778","date":"2026-10-08","epss":0.73188,"percentile":0.99448}],"urls":["http://packetstormsecurity.com/files/167344/OpenSSL-1.0.2-1.1.1-3.0-BN_mod_sqrt-Infinite-Loop.html","http://seclists.org/fulldisclosure/2022/May/33","http://seclists.org/fulldisclosure/2022/May/35","http://seclists.org/fulldisclosure/2022/May/38","https://cert-portal.siemens.com/productcert/pdf/ssa-712929.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3118eb64934499d93db3230748a452351d1d9a65","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=380085481c64de749a6dd25cdf0bcf4360b30f83","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=a466912611aa6cbdf550cd10601390e587451246","https://lists.debian.org/debian-lts-announce/2022/03/msg00023.html","https://lists.debian.org/debian-lts-announce/2022/03/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/323SNN6ZX7PRJJWP2BUAFLPUAE42XWLZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GDB3GQVJPXJE7X5C5JN6JAA4XUDWD6E6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6K3PR542DXWLEFFMFIDMME4CWMHJRMG/","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0002","https://security.gentoo.org/glsa/202210-02","https://security.netapp.com/advisory/ntap-20220321-0002/","https://security.netapp.com/advisory/ntap-20220429-0005/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://support.apple.com/kb/HT213255","https://support.apple.com/kb/HT213256","https://support.apple.com/kb/HT213257","https://www.debian.org/security/2022/dsa-5103","https://www.openssl.org/news/secadv/20220315.txt","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.tenable.com/security/tns-2022-06","https://www.tenable.com/security/tns-2022-07","https://www.tenable.com/security/tns-2022-08","https://www.tenable.com/security/tns-2022-09","https://cert-portal.siemens.com/productcert/html/ssa-019200.html","https://cert-portal.siemens.com/productcert/html/ssa-028723.html","https://cert-portal.siemens.com/productcert/html/ssa-108696.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-712929.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0778","description":"The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc)."}]},{"artifact":{"id":"524ae46feda9a236","cpes":["cpe:2.3:a:golang:crypto:v0.0.0-20190701094942-4def268fd1a4:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.0.0-20190701094942-4def268fd1a4:*:*:*:*:go:*:*"],"name":"golang.org/x/crypto","purl":"pkg:golang/golang.org/x/crypto@v0.0.0-20190701094942-4def268fd1a4","type":"go-module","version":"v0.0.0-20190701094942-4def268fd1a4","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.0.0-20231218163308-9d2ee975ef9f"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-45x7-px36-x8w8","versionConstraint":"<0.0.0-20231218163308-9d2ee975ef9f (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/crypto","version":"v0.0.0-20190701094942-4def268fd1a4"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-45x7-px36-x8w8","fix":{"state":"fixed","versions":["0.0.0-20231218163308-9d2ee975ef9f"],"available":[{"date":"2025-06-25","kind":"first-observed","version":"0.0.0-20231218163308-9d2ee975ef9f"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-48795","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-48795","cwe":"CWE-354","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-48795","date":"2026-10-08","epss":0.93547,"percentile":0.9984}],"risk":50.983115,"urls":["https://github.com/warp-tech/russh/security/advisories/GHSA-45x7-px36-x8w8","https://nvd.nist.gov/vuln/detail/CVE-2023-48795","https://github.com/paramiko/paramiko/issues/2337","https://github.com/TeraTermProject/teraterm/commit/7279fbd6ef4d0c8bdd6a90af4ada2899d786eec0","https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d","https://github.com/warp-tech/russh/commit/1aa340a7df1d5be1c0f4a9e247aade76dfdd2951","https://github.com/erlang/otp/blob/d1b43dc0f1361d2ad67601169e90a7fc50bb0369/lib/ssh/doc/src/notes.xml#L39-L42","https://github.com/mkj/dropbear/blob/17657c36cce6df7716d5ff151ec09a665382d5dd/CHANGES#L25","https://github.com/openssh/openssh-portable/commits/master","https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst","https://github.com/ronf/asyncssh/tags","https://github.com/warp-tech/russh/releases/tag/v0.40.2","https://gitlab.com/libssh/libssh-mirror/-/tags","https://groups.google.com/g/golang-announce/c/-n5WqVC18LQ","https://groups.google.com/g/golang-announce/c/qA3XtxvMUyg","https://matt.ucc.asn.au/dropbear/CHANGES","https://news.ycombinator.com/item?id=38684904","https://news.ycombinator.com/item?id=38685286","https://twitter.com/TrueSkrillor/status/1736774389725565005","https://www.bitvise.com/ssh-server-version-history","https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html","https://www.openssh.com/openbsd.html","https://www.openssh.com/txt/release-9.6","https://www.openwall.com/lists/oss-security/2023/12/18/2","https://www.terrapin-attack.com","http://www.openwall.com/lists/oss-security/2023/12/18/3","https://github.com/mwiede/jsch/issues/457","https://github.com/mwiede/jsch/pull/461","https://access.redhat.com/security/cve/cve-2023-48795","https://bugs.gentoo.org/920280","https://bugzilla.redhat.com/show_bug.cgi?id=2254210","https://bugzilla.suse.com/show_bug.cgi?id=1217950","https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.10&id=10e09e273f69e149389b3e0e5d44b8c221c2e7f6","https://github.com/drakkan/sftpgo/releases/tag/v2.5.6","https://github.com/erlang/otp/releases/tag/OTP-26.2.1","https://go.dev/cl/550715","https://go.dev/issue/64784","https://security-tracker.debian.org/tracker/CVE-2023-48795","https://security-tracker.debian.org/tracker/source-package/libssh2","https://security-tracker.debian.org/tracker/source-package/proftpd-dfsg","https://ubuntu.com/security/CVE-2023-48795","https://github.com/libssh2/libssh2/pull/1291","https://github.com/jtesta/ssh-audit/commit/8e972c5e94b460379fe0c7d20209c16df81538a5","https://forum.netgate.com/topic/184941/terrapin-ssh-attack","https://github.com/rapier1/hpn-ssh/releases","https://github.com/proftpd/proftpd/issues/456","https://github.com/NixOS/nixpkgs/pull/275249","https://github.com/connectbot/sshlib/commit/5c8b534f6e97db7ac0e0e579331213aa25c173ab","https://github.com/mscdex/ssh2/commit/97b223f8891b96d6fc054df5ab1d5a1a545da2a3","https://crates.io/crates/thrussh/versions","https://github.com/TeraTermProject/teraterm/releases/tag/v5.1","https://github.com/connectbot/sshlib/compare/2.2.21...2.2.22","https://github.com/mwiede/jsch/compare/jsch-0.2.14...jsch-0.2.15","https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES","https://nest.pijul.com/pijul/thrussh/changes/D6H7OWTTMHHX6BTB3B6MNBOBX2L66CBL4LGSEUSAI2MCRCJDQFRQC","https://oryx-embedded.com/download/#changelog","https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update","https://www.paramiko.org/changelog.html","https://www.freebsd.org/security/advisories/FreeBSD-SA-23:19.openssh.asc","http://www.openwall.com/lists/oss-security/2023/12/19/5","http://www.openwall.com/lists/oss-security/2023/12/20/3","https://github.com/apache/mina-sshd/issues/445","https://github.com/hierynomus/sshj/issues/916","https://github.com/janmojzis/tinyssh/issues/81","https://github.com/net-ssh/net-ssh/blob/2e65064a52d73396bfc3806c9196fc8108f33cd8/CHANGES.txt#L14-L16","https://github.com/proftpd/proftpd/blob/0a7ea9b0ba9fcdf368374a226370d08f10397d99/RELEASE_NOTES","https://github.com/proftpd/proftpd/blob/d21e7a2e47e9b38f709bec58e3fa711f759ad0e1/RELEASE_NOTES","https://security-tracker.debian.org/tracker/source-package/trilead-ssh2","https://www.openwall.com/lists/oss-security/2023/12/20/3","http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html","https://github.com/PowerShell/Win32-OpenSSH/issues/2189","https://github.com/cyd01/KiTTY/issues/520","https://github.com/ssh-mitm/ssh-mitm/issues/165","https://filezilla-project.org/versions.php","https://github.com/PowerShell/Win32-OpenSSH/releases/tag/v9.5.0.0p1-Beta","https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html","https://news.ycombinator.com/item?id=38732005","https://nova.app/releases/#v11.8","https://roumenpetrov.info/secsh/#news20231220","https://security.gentoo.org/glsa/202312-16","https://security.gentoo.org/glsa/202312-17","https://winscp.net/eng/docs/history#6.2.2","https://www.bitvise.com/ssh-client-version-history#933","https://www.debian.org/security/2023/dsa-5586","https://www.debian.org/security/2023/dsa-5588","https://www.lancom-systems.de/service-support/allgemeine-sicherheitshinweise#c243508","https://www.theregister.com/2023/12/20/terrapin_attack_ssh","https://www.vandyke.com/products/securecrt/history.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0002","https://lists.debian.org/debian-lts-announce/2024/01/msg00013.html","https://lists.debian.org/debian-lts-announce/2024/01/msg00014.html","https://github.com/paramiko/paramiko/issues/2337#issuecomment-1887642773","https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-integrity-using-novel-data-corruption-attack","https://help.panic.com/releasenotes/transmit5","https://jadaptive.com/important-java-ssh-security-update-new-ssh-vulnerability-discovered-cve-2023-48795","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CAYYW35MUTNO65RVAELICTNZZFMT2XS","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BL5KTLOSLH2KHRN4HCXJPK3JUVLDGEL6","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7EYCFQCTSGJXWO3ZZ44MGKFC5HA7G3Y","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KMZCVGUGJZZVDPCVDA7TEB22VUCNEXDD","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QI3EHAHABFQK7OABNCSF5GMYP6TONTI7","https://security.netapp.com/advisory/ntap-20240105-0004","https://support.apple.com/kb/HT214084","https://thorntech.com/cve-2023-48795-and-sftp-gateway","https://www.netsarang.com/en/xshell-update-history","https://www.reddit.com/r/sysadmin/comments/18idv52/cve202348795_why_is_this_cve_still_undisclosed","https://www.suse.com/c/suse-addresses-the-ssh-v2-protocol-terrapin-attack-aka-cve-2023-48795","http://seclists.org/fulldisclosure/2024/Mar/21","https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html","http://www.openwall.com/lists/oss-security/2024/03/06/3","http://www.openwall.com/lists/oss-security/2024/04/17/8","https://www.vicarius.io/vsociety/posts/cve-2023-48795-mitigate-openssh-vulnerability","https://www.vicarius.io/vsociety/posts/cve-2023-48795-detect-openssh-vulnerabilit","https://lists.debian.org/debian-lts-announce/2025/04/msg00028.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00032.html","https://lists.debian.org/debian-lts-announce/2024/09/msg00042.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP","https://cert-portal.siemens.com/productcert/html/ssa-915275.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-364175.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-45x7-px36-x8w8","description":"Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin"},"relatedVulnerabilities":[{"id":"CVE-2023-48795","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-48795","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-48795","cwe":"CWE-354","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-48795","date":"2026-10-08","epss":0.93547,"percentile":0.9984}],"urls":["http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html","http://seclists.org/fulldisclosure/2024/Mar/21","http://www.openwall.com/lists/oss-security/2023/12/18/3","http://www.openwall.com/lists/oss-security/2023/12/19/5","http://www.openwall.com/lists/oss-security/2023/12/20/3","http://www.openwall.com/lists/oss-security/2024/03/06/3","http://www.openwall.com/lists/oss-security/2024/04/17/8","https://access.redhat.com/security/cve/cve-2023-48795","https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-integrity-using-novel-data-corruption-attack/","https://bugs.gentoo.org/920280","https://bugzilla.redhat.com/show_bug.cgi?id=2254210","https://bugzilla.suse.com/show_bug.cgi?id=1217950","https://crates.io/crates/thrussh/versions","https://filezilla-project.org/versions.php","https://forum.netgate.com/topic/184941/terrapin-ssh-attack","https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.10&id=10e09e273f69e149389b3e0e5d44b8c221c2e7f6","https://github.com/NixOS/nixpkgs/pull/275249","https://github.com/PowerShell/Win32-OpenSSH/issues/2189","https://github.com/PowerShell/Win32-OpenSSH/releases/tag/v9.5.0.0p1-Beta","https://github.com/TeraTermProject/teraterm/commit/7279fbd6ef4d0c8bdd6a90af4ada2899d786eec0","https://github.com/TeraTermProject/teraterm/releases/tag/v5.1","https://github.com/advisories/GHSA-45x7-px36-x8w8","https://github.com/apache/mina-sshd/issues/445","https://github.com/connectbot/sshlib/commit/5c8b534f6e97db7ac0e0e579331213aa25c173ab","https://github.com/connectbot/sshlib/compare/2.2.21...2.2.22","https://github.com/cyd01/KiTTY/issues/520","https://github.com/drakkan/sftpgo/releases/tag/v2.5.6","https://github.com/erlang/otp/blob/d1b43dc0f1361d2ad67601169e90a7fc50bb0369/lib/ssh/doc/src/notes.xml#L39-L42","https://github.com/erlang/otp/releases/tag/OTP-26.2.1","https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d","https://github.com/hierynomus/sshj/issues/916","https://github.com/janmojzis/tinyssh/issues/81","https://github.com/jtesta/ssh-audit/commit/8e972c5e94b460379fe0c7d20209c16df81538a5","https://github.com/libssh2/libssh2/pull/1291","https://github.com/mkj/dropbear/blob/17657c36cce6df7716d5ff151ec09a665382d5dd/CHANGES#L25","https://github.com/mscdex/ssh2/commit/97b223f8891b96d6fc054df5ab1d5a1a545da2a3","https://github.com/mwiede/jsch/compare/jsch-0.2.14...jsch-0.2.15","https://github.com/mwiede/jsch/issues/457","https://github.com/mwiede/jsch/pull/461","https://github.com/net-ssh/net-ssh/blob/2e65064a52d73396bfc3806c9196fc8108f33cd8/CHANGES.txt#L14-L16","https://github.com/openssh/openssh-portable/commits/master","https://github.com/paramiko/paramiko/issues/2337","https://github.com/proftpd/proftpd/blob/0a7ea9b0ba9fcdf368374a226370d08f10397d99/RELEASE_NOTES","https://github.com/proftpd/proftpd/blob/d21e7a2e47e9b38f709bec58e3fa711f759ad0e1/RELEASE_NOTES","https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES","https://github.com/proftpd/proftpd/issues/456","https://github.com/rapier1/hpn-ssh/releases","https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst","https://github.com/ronf/asyncssh/tags","https://github.com/ssh-mitm/ssh-mitm/issues/165","https://github.com/warp-tech/russh/releases/tag/v0.40.2","https://gitlab.com/libssh/libssh-mirror/-/tags","https://groups.google.com/g/golang-announce/c/-n5WqVC18LQ","https://groups.google.com/g/golang-announce/c/qA3XtxvMUyg","https://help.panic.com/releasenotes/transmit5/","https://jadaptive.com/important-java-ssh-security-update-new-ssh-vulnerability-discovered-cve-2023-48795/","https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html","https://lists.debian.org/debian-lts-announce/2024/01/msg00013.html","https://lists.debian.org/debian-lts-announce/2024/01/msg00014.html","https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CAYYW35MUTNO65RVAELICTNZZFMT2XS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BL5KTLOSLH2KHRN4HCXJPK3JUVLDGEL6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7EYCFQCTSGJXWO3ZZ44MGKFC5HA7G3Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KMZCVGUGJZZVDPCVDA7TEB22VUCNEXDD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QI3EHAHABFQK7OABNCSF5GMYP6TONTI7/","https://matt.ucc.asn.au/dropbear/CHANGES","https://nest.pijul.com/pijul/thrussh/changes/D6H7OWTTMHHX6BTB3B6MNBOBX2L66CBL4LGSEUSAI2MCRCJDQFRQC","https://news.ycombinator.com/item?id=38684904","https://news.ycombinator.com/item?id=38685286","https://news.ycombinator.com/item?id=38732005","https://nova.app/releases/#v11.8","https://oryx-embedded.com/download/#changelog","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0002","https://roumenpetrov.info/secsh/#news20231220","https://security-tracker.debian.org/tracker/CVE-2023-48795","https://security-tracker.debian.org/tracker/source-package/libssh2","https://security-tracker.debian.org/tracker/source-package/proftpd-dfsg","https://security-tracker.debian.org/tracker/source-package/trilead-ssh2","https://security.gentoo.org/glsa/202312-16","https://security.gentoo.org/glsa/202312-17","https://security.netapp.com/advisory/ntap-20240105-0004/","https://support.apple.com/kb/HT214084","https://thorntech.com/cve-2023-48795-and-sftp-gateway/","https://twitter.com/TrueSkrillor/status/1736774389725565005","https://ubuntu.com/security/CVE-2023-48795","https://winscp.net/eng/docs/history#6.2.2","https://www.bitvise.com/ssh-client-version-history#933","https://www.bitvise.com/ssh-server-version-history","https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html","https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update","https://www.debian.org/security/2023/dsa-5586","https://www.debian.org/security/2023/dsa-5588","https://www.freebsd.org/security/advisories/FreeBSD-SA-23:19.openssh.asc","https://www.lancom-systems.de/service-support/allgemeine-sicherheitshinweise#c243508","https://www.netsarang.com/en/xshell-update-history/","https://www.openssh.com/openbsd.html","https://www.openssh.com/txt/release-9.6","https://www.openwall.com/lists/oss-security/2023/12/18/2","https://www.openwall.com/lists/oss-security/2023/12/20/3","https://www.paramiko.org/changelog.html","https://www.reddit.com/r/sysadmin/comments/18idv52/cve202348795_why_is_this_cve_still_undisclosed/","https://www.suse.com/c/suse-addresses-the-ssh-v2-protocol-terrapin-attack-aka-cve-2023-48795/","https://www.terrapin-attack.com","https://www.theregister.com/2023/12/20/terrapin_attack_ssh","https://www.vandyke.com/products/securecrt/history.txt","https://lists.debian.org/debian-lts-announce/2024/09/msg00042.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/04/msg00028.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/","https://www.vicarius.io/vsociety/posts/cve-2023-48795-detect-openssh-vulnerabilit","https://www.vicarius.io/vsociety/posts/cve-2023-48795-mitigate-openssh-vulnerability","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-364175.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-48795","description":"The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust."}]},{"artifact":{"id":"763298202c68f152","cpes":["cpe:2.3:a:golang:crypto:v0.0.0-20190701094942-4def268fd1a4:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.0.0-20190701094942-4def268fd1a4:*:*:*:*:go:*:*"],"name":"golang.org/x/crypto","purl":"pkg:golang/golang.org/x/crypto@v0.0.0-20190701094942-4def268fd1a4","type":"go-module","version":"v0.0.0-20190701094942-4def268fd1a4","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.0.0-20231218163308-9d2ee975ef9f"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-45x7-px36-x8w8","versionConstraint":"<0.0.0-20231218163308-9d2ee975ef9f (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/crypto","version":"v0.0.0-20190701094942-4def268fd1a4"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-45x7-px36-x8w8","fix":{"state":"fixed","versions":["0.0.0-20231218163308-9d2ee975ef9f"],"available":[{"date":"2025-06-25","kind":"first-observed","version":"0.0.0-20231218163308-9d2ee975ef9f"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-48795","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-48795","cwe":"CWE-354","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-48795","date":"2026-10-08","epss":0.93547,"percentile":0.9984}],"risk":50.983115,"urls":["https://github.com/warp-tech/russh/security/advisories/GHSA-45x7-px36-x8w8","https://nvd.nist.gov/vuln/detail/CVE-2023-48795","https://github.com/paramiko/paramiko/issues/2337","https://github.com/TeraTermProject/teraterm/commit/7279fbd6ef4d0c8bdd6a90af4ada2899d786eec0","https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d","https://github.com/warp-tech/russh/commit/1aa340a7df1d5be1c0f4a9e247aade76dfdd2951","https://github.com/erlang/otp/blob/d1b43dc0f1361d2ad67601169e90a7fc50bb0369/lib/ssh/doc/src/notes.xml#L39-L42","https://github.com/mkj/dropbear/blob/17657c36cce6df7716d5ff151ec09a665382d5dd/CHANGES#L25","https://github.com/openssh/openssh-portable/commits/master","https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst","https://github.com/ronf/asyncssh/tags","https://github.com/warp-tech/russh/releases/tag/v0.40.2","https://gitlab.com/libssh/libssh-mirror/-/tags","https://groups.google.com/g/golang-announce/c/-n5WqVC18LQ","https://groups.google.com/g/golang-announce/c/qA3XtxvMUyg","https://matt.ucc.asn.au/dropbear/CHANGES","https://news.ycombinator.com/item?id=38684904","https://news.ycombinator.com/item?id=38685286","https://twitter.com/TrueSkrillor/status/1736774389725565005","https://www.bitvise.com/ssh-server-version-history","https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html","https://www.openssh.com/openbsd.html","https://www.openssh.com/txt/release-9.6","https://www.openwall.com/lists/oss-security/2023/12/18/2","https://www.terrapin-attack.com","http://www.openwall.com/lists/oss-security/2023/12/18/3","https://github.com/mwiede/jsch/issues/457","https://github.com/mwiede/jsch/pull/461","https://access.redhat.com/security/cve/cve-2023-48795","https://bugs.gentoo.org/920280","https://bugzilla.redhat.com/show_bug.cgi?id=2254210","https://bugzilla.suse.com/show_bug.cgi?id=1217950","https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.10&id=10e09e273f69e149389b3e0e5d44b8c221c2e7f6","https://github.com/drakkan/sftpgo/releases/tag/v2.5.6","https://github.com/erlang/otp/releases/tag/OTP-26.2.1","https://go.dev/cl/550715","https://go.dev/issue/64784","https://security-tracker.debian.org/tracker/CVE-2023-48795","https://security-tracker.debian.org/tracker/source-package/libssh2","https://security-tracker.debian.org/tracker/source-package/proftpd-dfsg","https://ubuntu.com/security/CVE-2023-48795","https://github.com/libssh2/libssh2/pull/1291","https://github.com/jtesta/ssh-audit/commit/8e972c5e94b460379fe0c7d20209c16df81538a5","https://forum.netgate.com/topic/184941/terrapin-ssh-attack","https://github.com/rapier1/hpn-ssh/releases","https://github.com/proftpd/proftpd/issues/456","https://github.com/NixOS/nixpkgs/pull/275249","https://github.com/connectbot/sshlib/commit/5c8b534f6e97db7ac0e0e579331213aa25c173ab","https://github.com/mscdex/ssh2/commit/97b223f8891b96d6fc054df5ab1d5a1a545da2a3","https://crates.io/crates/thrussh/versions","https://github.com/TeraTermProject/teraterm/releases/tag/v5.1","https://github.com/connectbot/sshlib/compare/2.2.21...2.2.22","https://github.com/mwiede/jsch/compare/jsch-0.2.14...jsch-0.2.15","https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES","https://nest.pijul.com/pijul/thrussh/changes/D6H7OWTTMHHX6BTB3B6MNBOBX2L66CBL4LGSEUSAI2MCRCJDQFRQC","https://oryx-embedded.com/download/#changelog","https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update","https://www.paramiko.org/changelog.html","https://www.freebsd.org/security/advisories/FreeBSD-SA-23:19.openssh.asc","http://www.openwall.com/lists/oss-security/2023/12/19/5","http://www.openwall.com/lists/oss-security/2023/12/20/3","https://github.com/apache/mina-sshd/issues/445","https://github.com/hierynomus/sshj/issues/916","https://github.com/janmojzis/tinyssh/issues/81","https://github.com/net-ssh/net-ssh/blob/2e65064a52d73396bfc3806c9196fc8108f33cd8/CHANGES.txt#L14-L16","https://github.com/proftpd/proftpd/blob/0a7ea9b0ba9fcdf368374a226370d08f10397d99/RELEASE_NOTES","https://github.com/proftpd/proftpd/blob/d21e7a2e47e9b38f709bec58e3fa711f759ad0e1/RELEASE_NOTES","https://security-tracker.debian.org/tracker/source-package/trilead-ssh2","https://www.openwall.com/lists/oss-security/2023/12/20/3","http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html","https://github.com/PowerShell/Win32-OpenSSH/issues/2189","https://github.com/cyd01/KiTTY/issues/520","https://github.com/ssh-mitm/ssh-mitm/issues/165","https://filezilla-project.org/versions.php","https://github.com/PowerShell/Win32-OpenSSH/releases/tag/v9.5.0.0p1-Beta","https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html","https://news.ycombinator.com/item?id=38732005","https://nova.app/releases/#v11.8","https://roumenpetrov.info/secsh/#news20231220","https://security.gentoo.org/glsa/202312-16","https://security.gentoo.org/glsa/202312-17","https://winscp.net/eng/docs/history#6.2.2","https://www.bitvise.com/ssh-client-version-history#933","https://www.debian.org/security/2023/dsa-5586","https://www.debian.org/security/2023/dsa-5588","https://www.lancom-systems.de/service-support/allgemeine-sicherheitshinweise#c243508","https://www.theregister.com/2023/12/20/terrapin_attack_ssh","https://www.vandyke.com/products/securecrt/history.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0002","https://lists.debian.org/debian-lts-announce/2024/01/msg00013.html","https://lists.debian.org/debian-lts-announce/2024/01/msg00014.html","https://github.com/paramiko/paramiko/issues/2337#issuecomment-1887642773","https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-integrity-using-novel-data-corruption-attack","https://help.panic.com/releasenotes/transmit5","https://jadaptive.com/important-java-ssh-security-update-new-ssh-vulnerability-discovered-cve-2023-48795","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CAYYW35MUTNO65RVAELICTNZZFMT2XS","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BL5KTLOSLH2KHRN4HCXJPK3JUVLDGEL6","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7EYCFQCTSGJXWO3ZZ44MGKFC5HA7G3Y","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KMZCVGUGJZZVDPCVDA7TEB22VUCNEXDD","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QI3EHAHABFQK7OABNCSF5GMYP6TONTI7","https://security.netapp.com/advisory/ntap-20240105-0004","https://support.apple.com/kb/HT214084","https://thorntech.com/cve-2023-48795-and-sftp-gateway","https://www.netsarang.com/en/xshell-update-history","https://www.reddit.com/r/sysadmin/comments/18idv52/cve202348795_why_is_this_cve_still_undisclosed","https://www.suse.com/c/suse-addresses-the-ssh-v2-protocol-terrapin-attack-aka-cve-2023-48795","http://seclists.org/fulldisclosure/2024/Mar/21","https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html","http://www.openwall.com/lists/oss-security/2024/03/06/3","http://www.openwall.com/lists/oss-security/2024/04/17/8","https://www.vicarius.io/vsociety/posts/cve-2023-48795-mitigate-openssh-vulnerability","https://www.vicarius.io/vsociety/posts/cve-2023-48795-detect-openssh-vulnerabilit","https://lists.debian.org/debian-lts-announce/2025/04/msg00028.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00032.html","https://lists.debian.org/debian-lts-announce/2024/09/msg00042.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP","https://cert-portal.siemens.com/productcert/html/ssa-915275.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-364175.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-45x7-px36-x8w8","description":"Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin"},"relatedVulnerabilities":[{"id":"CVE-2023-48795","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-48795","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-48795","cwe":"CWE-354","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-48795","date":"2026-10-08","epss":0.93547,"percentile":0.9984}],"urls":["http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html","http://seclists.org/fulldisclosure/2024/Mar/21","http://www.openwall.com/lists/oss-security/2023/12/18/3","http://www.openwall.com/lists/oss-security/2023/12/19/5","http://www.openwall.com/lists/oss-security/2023/12/20/3","http://www.openwall.com/lists/oss-security/2024/03/06/3","http://www.openwall.com/lists/oss-security/2024/04/17/8","https://access.redhat.com/security/cve/cve-2023-48795","https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-integrity-using-novel-data-corruption-attack/","https://bugs.gentoo.org/920280","https://bugzilla.redhat.com/show_bug.cgi?id=2254210","https://bugzilla.suse.com/show_bug.cgi?id=1217950","https://crates.io/crates/thrussh/versions","https://filezilla-project.org/versions.php","https://forum.netgate.com/topic/184941/terrapin-ssh-attack","https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.10&id=10e09e273f69e149389b3e0e5d44b8c221c2e7f6","https://github.com/NixOS/nixpkgs/pull/275249","https://github.com/PowerShell/Win32-OpenSSH/issues/2189","https://github.com/PowerShell/Win32-OpenSSH/releases/tag/v9.5.0.0p1-Beta","https://github.com/TeraTermProject/teraterm/commit/7279fbd6ef4d0c8bdd6a90af4ada2899d786eec0","https://github.com/TeraTermProject/teraterm/releases/tag/v5.1","https://github.com/advisories/GHSA-45x7-px36-x8w8","https://github.com/apache/mina-sshd/issues/445","https://github.com/connectbot/sshlib/commit/5c8b534f6e97db7ac0e0e579331213aa25c173ab","https://github.com/connectbot/sshlib/compare/2.2.21...2.2.22","https://github.com/cyd01/KiTTY/issues/520","https://github.com/drakkan/sftpgo/releases/tag/v2.5.6","https://github.com/erlang/otp/blob/d1b43dc0f1361d2ad67601169e90a7fc50bb0369/lib/ssh/doc/src/notes.xml#L39-L42","https://github.com/erlang/otp/releases/tag/OTP-26.2.1","https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d","https://github.com/hierynomus/sshj/issues/916","https://github.com/janmojzis/tinyssh/issues/81","https://github.com/jtesta/ssh-audit/commit/8e972c5e94b460379fe0c7d20209c16df81538a5","https://github.com/libssh2/libssh2/pull/1291","https://github.com/mkj/dropbear/blob/17657c36cce6df7716d5ff151ec09a665382d5dd/CHANGES#L25","https://github.com/mscdex/ssh2/commit/97b223f8891b96d6fc054df5ab1d5a1a545da2a3","https://github.com/mwiede/jsch/compare/jsch-0.2.14...jsch-0.2.15","https://github.com/mwiede/jsch/issues/457","https://github.com/mwiede/jsch/pull/461","https://github.com/net-ssh/net-ssh/blob/2e65064a52d73396bfc3806c9196fc8108f33cd8/CHANGES.txt#L14-L16","https://github.com/openssh/openssh-portable/commits/master","https://github.com/paramiko/paramiko/issues/2337","https://github.com/proftpd/proftpd/blob/0a7ea9b0ba9fcdf368374a226370d08f10397d99/RELEASE_NOTES","https://github.com/proftpd/proftpd/blob/d21e7a2e47e9b38f709bec58e3fa711f759ad0e1/RELEASE_NOTES","https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES","https://github.com/proftpd/proftpd/issues/456","https://github.com/rapier1/hpn-ssh/releases","https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst","https://github.com/ronf/asyncssh/tags","https://github.com/ssh-mitm/ssh-mitm/issues/165","https://github.com/warp-tech/russh/releases/tag/v0.40.2","https://gitlab.com/libssh/libssh-mirror/-/tags","https://groups.google.com/g/golang-announce/c/-n5WqVC18LQ","https://groups.google.com/g/golang-announce/c/qA3XtxvMUyg","https://help.panic.com/releasenotes/transmit5/","https://jadaptive.com/important-java-ssh-security-update-new-ssh-vulnerability-discovered-cve-2023-48795/","https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html","https://lists.debian.org/debian-lts-announce/2024/01/msg00013.html","https://lists.debian.org/debian-lts-announce/2024/01/msg00014.html","https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CAYYW35MUTNO65RVAELICTNZZFMT2XS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BL5KTLOSLH2KHRN4HCXJPK3JUVLDGEL6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7EYCFQCTSGJXWO3ZZ44MGKFC5HA7G3Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KMZCVGUGJZZVDPCVDA7TEB22VUCNEXDD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QI3EHAHABFQK7OABNCSF5GMYP6TONTI7/","https://matt.ucc.asn.au/dropbear/CHANGES","https://nest.pijul.com/pijul/thrussh/changes/D6H7OWTTMHHX6BTB3B6MNBOBX2L66CBL4LGSEUSAI2MCRCJDQFRQC","https://news.ycombinator.com/item?id=38684904","https://news.ycombinator.com/item?id=38685286","https://news.ycombinator.com/item?id=38732005","https://nova.app/releases/#v11.8","https://oryx-embedded.com/download/#changelog","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0002","https://roumenpetrov.info/secsh/#news20231220","https://security-tracker.debian.org/tracker/CVE-2023-48795","https://security-tracker.debian.org/tracker/source-package/libssh2","https://security-tracker.debian.org/tracker/source-package/proftpd-dfsg","https://security-tracker.debian.org/tracker/source-package/trilead-ssh2","https://security.gentoo.org/glsa/202312-16","https://security.gentoo.org/glsa/202312-17","https://security.netapp.com/advisory/ntap-20240105-0004/","https://support.apple.com/kb/HT214084","https://thorntech.com/cve-2023-48795-and-sftp-gateway/","https://twitter.com/TrueSkrillor/status/1736774389725565005","https://ubuntu.com/security/CVE-2023-48795","https://winscp.net/eng/docs/history#6.2.2","https://www.bitvise.com/ssh-client-version-history#933","https://www.bitvise.com/ssh-server-version-history","https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html","https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update","https://www.debian.org/security/2023/dsa-5586","https://www.debian.org/security/2023/dsa-5588","https://www.freebsd.org/security/advisories/FreeBSD-SA-23:19.openssh.asc","https://www.lancom-systems.de/service-support/allgemeine-sicherheitshinweise#c243508","https://www.netsarang.com/en/xshell-update-history/","https://www.openssh.com/openbsd.html","https://www.openssh.com/txt/release-9.6","https://www.openwall.com/lists/oss-security/2023/12/18/2","https://www.openwall.com/lists/oss-security/2023/12/20/3","https://www.paramiko.org/changelog.html","https://www.reddit.com/r/sysadmin/comments/18idv52/cve202348795_why_is_this_cve_still_undisclosed/","https://www.suse.com/c/suse-addresses-the-ssh-v2-protocol-terrapin-attack-aka-cve-2023-48795/","https://www.terrapin-attack.com","https://www.theregister.com/2023/12/20/terrapin_attack_ssh","https://www.vandyke.com/products/securecrt/history.txt","https://lists.debian.org/debian-lts-announce/2024/09/msg00042.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/04/msg00028.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/","https://www.vicarius.io/vsociety/posts/cve-2023-48795-detect-openssh-vulnerabilit","https://www.vicarius.io/vsociety/posts/cve-2023-48795-mitigate-openssh-vulnerability","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-364175.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-48795","description":"The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust."}]},{"artifact":{"id":"7f19231bca942dc4","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/debian/libldap-2.4-2@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-27212","versionConstraint":"< 2.4.47+dfsg-3+deb10u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-27212","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u6"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-27212","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27212","date":"2026-10-08","epss":0.63321,"percentile":0.9919}],"risk":47.490750000000006,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4860-1","link":"https://security-tracker.debian.org/tracker/DSA-4860-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-27212","description":"In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short timestamp. This is related to schema_init.c and checkTime."},"relatedVulnerabilities":[{"id":"CVE-2021-27212","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-27212","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27212","date":"2026-10-08","epss":0.63321,"percentile":0.9919}],"urls":["https://bugs.openldap.org/show_bug.cgi?id=9454","https://git.openldap.org/openldap/openldap/-/commit/3539fc33212b528c56b716584f2c2994af7c30b0","https://git.openldap.org/openldap/openldap/-/commit/9badb73425a67768c09bcaed1a9c26c684af6c30","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00035.html","https://security.netapp.com/advisory/ntap-20210319-0005/","https://www.debian.org/security/2021/dsa-4860"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-27212","description":"In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short timestamp. This is related to schema_init.c and checkTime."}]},{"artifact":{"id":"ed53a6639a2640b0","cpes":["cpe:2.3:a:libldap-common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-common","purl":"pkg:deb/debian/libldap-common@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=all&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-common/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.list"}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-27212","versionConstraint":"< 2.4.47+dfsg-3+deb10u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-27212","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u6"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-27212","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27212","date":"2026-10-08","epss":0.63321,"percentile":0.9919}],"risk":47.490750000000006,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4860-1","link":"https://security-tracker.debian.org/tracker/DSA-4860-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-27212","description":"In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short timestamp. This is related to schema_init.c and checkTime."},"relatedVulnerabilities":[{"id":"CVE-2021-27212","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-27212","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27212","date":"2026-10-08","epss":0.63321,"percentile":0.9919}],"urls":["https://bugs.openldap.org/show_bug.cgi?id=9454","https://git.openldap.org/openldap/openldap/-/commit/3539fc33212b528c56b716584f2c2994af7c30b0","https://git.openldap.org/openldap/openldap/-/commit/9badb73425a67768c09bcaed1a9c26c684af6c30","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00035.html","https://security.netapp.com/advisory/ntap-20210319-0005/","https://www.debian.org/security/2021/dsa-4860"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-27212","description":"In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short timestamp. This is related to schema_init.c and checkTime."}]},{"artifact":{"id":"727332619043e05d","cpes":["cpe:2.3:a:golang:networking:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.0.0-20190404232315-eb5bcb51f2a3","type":"go-module","version":"v0.0.0-20190404232315-eb5bcb51f2a3","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.23.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4v7x-pqxf-cx7m","versionConstraint":"<0.23.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.0.0-20190404232315-eb5bcb51f2a3"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-4v7x-pqxf-cx7m","fix":{"state":"fixed","versions":["0.23.0"],"available":[{"date":"2024-04-20","kind":"first-observed","version":"0.23.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45288","date":"2026-10-08","epss":0.91969,"percentile":0.99819}],"risk":47.364035,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-45288","https://go.dev/cl/576155","https://go.dev/issue/65051","https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M","https://pkg.go.dev/vuln/GO-2024-2687","https://nowotarski.info/http2-continuation-flood-technical-details","https://security.netapp.com/advisory/ntap-20240419-0009","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT","http://www.openwall.com/lists/oss-security/2024/04/03/16","http://www.openwall.com/lists/oss-security/2024/04/05/4","https://www.kb.cert.org/vuls/id/421644"],"severity":"Medium","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4v7x-pqxf-cx7m","description":"net/http, x/net/http2: close connections when receiving too many headers"},"relatedVulnerabilities":[{"id":"CVE-2023-45288","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45288","date":"2026-10-08","epss":0.91969,"percentile":0.99819}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/03/16","http://www.openwall.com/lists/oss-security/2024/04/05/4","https://go.dev/cl/576155","https://go.dev/issue/65051","https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT/","https://pkg.go.dev/vuln/GO-2024-2687","https://security.netapp.com/advisory/ntap-20240419-0009/","https://www.kb.cert.org/vuls/id/421644"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45288","description":"An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection."}]},{"artifact":{"id":"c6f08567c3b7bec6","cpes":["cpe:2.3:a:golang:networking:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.0.0-20190404232315-eb5bcb51f2a3","type":"go-module","version":"v0.0.0-20190404232315-eb5bcb51f2a3","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.23.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4v7x-pqxf-cx7m","versionConstraint":"<0.23.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.0.0-20190404232315-eb5bcb51f2a3"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-4v7x-pqxf-cx7m","fix":{"state":"fixed","versions":["0.23.0"],"available":[{"date":"2024-04-20","kind":"first-observed","version":"0.23.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45288","date":"2026-10-08","epss":0.91969,"percentile":0.99819}],"risk":47.364035,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-45288","https://go.dev/cl/576155","https://go.dev/issue/65051","https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M","https://pkg.go.dev/vuln/GO-2024-2687","https://nowotarski.info/http2-continuation-flood-technical-details","https://security.netapp.com/advisory/ntap-20240419-0009","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT","http://www.openwall.com/lists/oss-security/2024/04/03/16","http://www.openwall.com/lists/oss-security/2024/04/05/4","https://www.kb.cert.org/vuls/id/421644"],"severity":"Medium","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4v7x-pqxf-cx7m","description":"net/http, x/net/http2: close connections when receiving too many headers"},"relatedVulnerabilities":[{"id":"CVE-2023-45288","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-45288","date":"2026-10-08","epss":0.91969,"percentile":0.99819}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/03/16","http://www.openwall.com/lists/oss-security/2024/04/05/4","https://go.dev/cl/576155","https://go.dev/issue/65051","https://groups.google.com/g/golang-announce/c/YgW0sx8mN3M","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT/","https://pkg.go.dev/vuln/GO-2024-2687","https://security.netapp.com/advisory/ntap-20240419-0009/","https://www.kb.cert.org/vuls/id/421644"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45288","description":"An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection."}]},{"artifact":{"id":"bca20a7b0a858bf3","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/debian/libssl1.1@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1&upstream=openssl","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1n-0+deb10u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-0286","versionConstraint":"< 1.1.1n-0+deb10u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-0286","fix":{"state":"fixed","versions":["1.1.1n-0+deb10u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1n-0+deb10u4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0286","date":"2026-10-08","epss":0.59501,"percentile":0.99104}],"risk":44.328245,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-0286","description":"There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING.  When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network."},"relatedVulnerabilities":[{"id":"CVE-2023-0286","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0286","date":"2026-10-08","epss":0.59501,"percentile":0.99104}],"urls":["https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt","https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018_x509.patch.sig","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d","https://security.gentoo.org/glsa/202402-08","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0286","description":"There is a type confusion vulnerability relating to X.400 address processing\ninside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but\nthe public structure definition for GENERAL_NAME incorrectly specified the type\nof the x400Address field as ASN1_TYPE. This field is subsequently interpreted by\nthe OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an\nASN1_STRING.\n\nWhen CRL checking is enabled (i.e. the application sets the\nX509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass\narbitrary pointers to a memcmp call, enabling them to read memory contents or\nenact a denial of service. In most cases, the attack requires the attacker to\nprovide both the certificate chain and CRL, neither of which need to have a\nvalid signature. If the attacker only controls one of these inputs, the other\ninput must already contain an X.400 address as a CRL distribution point, which\nis uncommon. As such, this vulnerability is most likely to only affect\napplications which have implemented their own functionality for retrieving CRLs\nover a network."}]},{"artifact":{"id":"d308e84bddad0b0f","cpes":["cpe:2.3:a:openssl:openssl:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1n-0+deb10u4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-0286","versionConstraint":"< 1.1.1n-0+deb10u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-0286","fix":{"state":"fixed","versions":["1.1.1n-0+deb10u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1n-0+deb10u4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0286","date":"2026-10-08","epss":0.59501,"percentile":0.99104}],"risk":44.328245,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-0286","description":"There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING.  When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network."},"relatedVulnerabilities":[{"id":"CVE-2023-0286","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0286","date":"2026-10-08","epss":0.59501,"percentile":0.99104}],"urls":["https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt","https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018_x509.patch.sig","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d","https://security.gentoo.org/glsa/202402-08","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0286","description":"There is a type confusion vulnerability relating to X.400 address processing\ninside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but\nthe public structure definition for GENERAL_NAME incorrectly specified the type\nof the x400Address field as ASN1_TYPE. This field is subsequently interpreted by\nthe OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an\nASN1_STRING.\n\nWhen CRL checking is enabled (i.e. the application sets the\nX509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass\narbitrary pointers to a memcmp call, enabling them to read memory contents or\nenact a denial of service. In most cases, the attack requires the attacker to\nprovide both the certificate chain and CRL, neither of which need to have a\nvalid signature. If the attacker only controls one of these inputs, the other\ninput must already contain an X.400 address as a CRL distribution point, which\nis uncommon. As such, this vulnerability is most likely to only affect\napplications which have implemented their own functionality for retrieving CRLs\nover a network."}]},{"artifact":{"id":"0ee3c902a7004593","cpes":["cpe:2.3:a:libnghttp2-14:libnghttp2-14:1.36.0-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2-14:libnghttp2_14:1.36.0-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2_14:libnghttp2-14:1.36.0-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2_14:libnghttp2_14:1.36.0-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2:libnghttp2-14:1.36.0-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2:libnghttp2_14:1.36.0-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libnghttp2-14","purl":"pkg:deb/debian/libnghttp2-14@1.36.0-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=nghttp2","type":"deb","version":"1.36.0-2+deb10u1","language":"","licenses":["BSD-2-clause","Expat","GPL-3","GPL-3+","MIT","SIL-OFL-1.1","all-permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnghttp2-14/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libnghttp2-14/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnghttp2-14:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libnghttp2-14:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nghttp2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.36.0-2+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-28182","versionConstraint":"< 1.36.0-2+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"nghttp2","version":"1.36.0-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2024-28182","fix":{"state":"fixed","versions":["1.36.0-2+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.36.0-2+deb10u3"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28182","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-28182","date":"2026-10-08","epss":0.8496,"percentile":0.99708}],"risk":43.754400000000004,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-28182","description":"nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync.  This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability."},"relatedVulnerabilities":[{"id":"CVE-2024-28182","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28182","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-28182","date":"2026-10-08","epss":0.8496,"percentile":0.99708}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/03/16","https://github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0","https://github.com/nghttp2/nghttp2/commit/d71a4668c6bead55805d18810d633fbb98315af9","https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q","https://lists.debian.org/debian-lts-announce/2024/04/msg00026.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AGOME6ZXJG7664IPQNVE3DL67E3YP3HY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J6ZMXUGB66VAXDW5J6QSTHM5ET25FGSA/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXJO2EASHM2OQQLGVDY5ZSO7UVDVHTDK/","https://lists.debian.org/debian-lts-announce/2024/09/msg00041.html","https://www.kb.cert.org/vuls/id/421644"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28182","description":"nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync.  This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability."}]},{"artifact":{"id":"bca20a7b0a858bf3","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/debian/libssl1.1@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1&upstream=openssl","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1n-0+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-2650","versionConstraint":"< 1.1.1n-0+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-2650","fix":{"state":"fixed","versions":["1.1.1n-0+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1n-0+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-2650","date":"2026-10-08","epss":0.75116,"percentile":0.995}],"risk":43.1917,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-2650","description":"Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow.  Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service.  An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size limit.  OBJ_obj2txt() may be used to translate an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL type ASN1_OBJECT) to its canonical numeric text form, which are the sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by periods.  When one of the sub-identifiers in the OBJECT IDENTIFIER is very large (these are sizes that are seen as absurdly large, taking up tens or hundreds of KiBs), the translation to a decimal number in text may take a very long time.  The time complexity is O(n^2) with 'n' being the size of the sub-identifiers in bytes (*).  With OpenSSL 3.0, support to fetch cryptographic algorithms using names / identifiers in string form was introduced.  This includes using OBJECT IDENTIFIERs in canonical numeric text form as identifiers for fetching algorithms.  Such OBJECT IDENTIFIERs may be received through the ASN.1 structure AlgorithmIdentifier, which is commonly used in multiple protocols to specify what cryptographic algorithm should be used to sign or verify, encrypt or decrypt, or digest passed data.  Applications that call OBJ_obj2txt() directly with untrusted data are affected, with any version of OpenSSL.  If the use is for the mere purpose of display, the severity is considered low.  In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS.  It also impacts anything that processes X.509 certificates, including simple things like verifying its signature.  The impact on TLS is relatively low, because all versions of OpenSSL have a 100KiB limit on the peer's certificate chain.  Additionally, this only impacts clients, or servers that have explicitly enabled client authentication.  In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, such as X.509 certificates.  This is assumed to not happen in such a way that it would cause a Denial of Service, so these versions are considered not affected by this issue in such a way that it would be cause for concern, and the severity is therefore considered low."},"relatedVulnerabilities":[{"id":"CVE-2023-2650","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-2650","date":"2026-10-08","epss":0.75116,"percentile":0.995}],"urls":["http://www.openwall.com/lists/oss-security/2023/05/30/1","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=423a2bc737a908ad0c77bda470b2b59dc879936b","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=853c5e56ee0b8650c73140816bb8b91d6163422c","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9e209944b35cf82368071f160a744b6178f9b098","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db779b0e10b047f2585615e0b8f2acdf21f8544a","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0009","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230703-0001/","https://security.netapp.com/advisory/ntap-20231027-0009/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230530.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-2650","description":"Issue summary: Processing some specially crafted ASN.1 object identifiers or\ndata containing them may be very slow.\n\nImpact summary: Applications that use OBJ_obj2txt() directly, or use any of\nthe OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message\nsize limit may experience notable to very long delays when processing those\nmessages, which may lead to a Denial of Service.\n\nAn OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers -\nmost of which have no size limit.  OBJ_obj2txt() may be used to translate\nan ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL\ntype ASN1_OBJECT) to its canonical numeric text form, which are the\nsub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by\nperiods.\n\nWhen one of the sub-identifiers in the OBJECT IDENTIFIER is very large\n(these are sizes that are seen as absurdly large, taking up tens or hundreds\nof KiBs), the translation to a decimal number in text may take a very long\ntime.  The time complexity is O(n^2) with 'n' being the size of the\nsub-identifiers in bytes (*).\n\nWith OpenSSL 3.0, support to fetch cryptographic algorithms using names /\nidentifiers in string form was introduced.  This includes using OBJECT\nIDENTIFIERs in canonical numeric text form as identifiers for fetching\nalgorithms.\n\nSuch OBJECT IDENTIFIERs may be received through the ASN.1 structure\nAlgorithmIdentifier, which is commonly used in multiple protocols to specify\nwhat cryptographic algorithm should be used to sign or verify, encrypt or\ndecrypt, or digest passed data.\n\nApplications that call OBJ_obj2txt() directly with untrusted data are\naffected, with any version of OpenSSL.  If the use is for the mere purpose\nof display, the severity is considered low.\n\nIn OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME,\nCMS, CMP/CRMF or TS.  It also impacts anything that processes X.509\ncertificates, including simple things like verifying its signature.\n\nThe impact on TLS is relatively low, because all versions of OpenSSL have a\n100KiB limit on the peer's certificate chain.  Additionally, this only\nimpacts clients, or servers that have explicitly enabled client\nauthentication.\n\nIn OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects,\nsuch as X.509 certificates.  This is assumed to not happen in such a way\nthat it would cause a Denial of Service, so these versions are considered\nnot affected by this issue in such a way that it would be cause for concern,\nand the severity is therefore considered low."}]},{"artifact":{"id":"d308e84bddad0b0f","cpes":["cpe:2.3:a:openssl:openssl:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1n-0+deb10u5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-2650","versionConstraint":"< 1.1.1n-0+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-2650","fix":{"state":"fixed","versions":["1.1.1n-0+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1n-0+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-2650","date":"2026-10-08","epss":0.75116,"percentile":0.995}],"risk":43.1917,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-2650","description":"Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow.  Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service.  An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size limit.  OBJ_obj2txt() may be used to translate an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL type ASN1_OBJECT) to its canonical numeric text form, which are the sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by periods.  When one of the sub-identifiers in the OBJECT IDENTIFIER is very large (these are sizes that are seen as absurdly large, taking up tens or hundreds of KiBs), the translation to a decimal number in text may take a very long time.  The time complexity is O(n^2) with 'n' being the size of the sub-identifiers in bytes (*).  With OpenSSL 3.0, support to fetch cryptographic algorithms using names / identifiers in string form was introduced.  This includes using OBJECT IDENTIFIERs in canonical numeric text form as identifiers for fetching algorithms.  Such OBJECT IDENTIFIERs may be received through the ASN.1 structure AlgorithmIdentifier, which is commonly used in multiple protocols to specify what cryptographic algorithm should be used to sign or verify, encrypt or decrypt, or digest passed data.  Applications that call OBJ_obj2txt() directly with untrusted data are affected, with any version of OpenSSL.  If the use is for the mere purpose of display, the severity is considered low.  In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS.  It also impacts anything that processes X.509 certificates, including simple things like verifying its signature.  The impact on TLS is relatively low, because all versions of OpenSSL have a 100KiB limit on the peer's certificate chain.  Additionally, this only impacts clients, or servers that have explicitly enabled client authentication.  In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, such as X.509 certificates.  This is assumed to not happen in such a way that it would cause a Denial of Service, so these versions are considered not affected by this issue in such a way that it would be cause for concern, and the severity is therefore considered low."},"relatedVulnerabilities":[{"id":"CVE-2023-2650","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-2650","date":"2026-10-08","epss":0.75116,"percentile":0.995}],"urls":["http://www.openwall.com/lists/oss-security/2023/05/30/1","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=423a2bc737a908ad0c77bda470b2b59dc879936b","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=853c5e56ee0b8650c73140816bb8b91d6163422c","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9e209944b35cf82368071f160a744b6178f9b098","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db779b0e10b047f2585615e0b8f2acdf21f8544a","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0009","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230703-0001/","https://security.netapp.com/advisory/ntap-20231027-0009/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230530.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-2650","description":"Issue summary: Processing some specially crafted ASN.1 object identifiers or\ndata containing them may be very slow.\n\nImpact summary: Applications that use OBJ_obj2txt() directly, or use any of\nthe OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message\nsize limit may experience notable to very long delays when processing those\nmessages, which may lead to a Denial of Service.\n\nAn OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers -\nmost of which have no size limit.  OBJ_obj2txt() may be used to translate\nan ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL\ntype ASN1_OBJECT) to its canonical numeric text form, which are the\nsub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by\nperiods.\n\nWhen one of the sub-identifiers in the OBJECT IDENTIFIER is very large\n(these are sizes that are seen as absurdly large, taking up tens or hundreds\nof KiBs), the translation to a decimal number in text may take a very long\ntime.  The time complexity is O(n^2) with 'n' being the size of the\nsub-identifiers in bytes (*).\n\nWith OpenSSL 3.0, support to fetch cryptographic algorithms using names /\nidentifiers in string form was introduced.  This includes using OBJECT\nIDENTIFIERs in canonical numeric text form as identifiers for fetching\nalgorithms.\n\nSuch OBJECT IDENTIFIERs may be received through the ASN.1 structure\nAlgorithmIdentifier, which is commonly used in multiple protocols to specify\nwhat cryptographic algorithm should be used to sign or verify, encrypt or\ndecrypt, or digest passed data.\n\nApplications that call OBJ_obj2txt() directly with untrusted data are\naffected, with any version of OpenSSL.  If the use is for the mere purpose\nof display, the severity is considered low.\n\nIn OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME,\nCMS, CMP/CRMF or TS.  It also impacts anything that processes X.509\ncertificates, including simple things like verifying its signature.\n\nThe impact on TLS is relatively low, because all versions of OpenSSL have a\n100KiB limit on the peer's certificate chain.  Additionally, this only\nimpacts clients, or servers that have explicitly enabled client\nauthentication.\n\nIn OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects,\nsuch as X.509 certificates.  This is assumed to not happen in such a way\nthat it would cause a Denial of Service, so these versions are considered\nnot affected by this issue in such a way that it would be cause for concern,\nand the severity is therefore considered low."}]},{"artifact":{"id":"bca20a7b0a858bf3","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/debian/libssl1.1@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1&upstream=openssl","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1d-0+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-1967","versionConstraint":"< 1.1.1d-0+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-1967","fix":{"state":"fixed","versions":["1.1.1d-0+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1d-0+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-1967","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-1967","date":"2026-10-08","epss":0.53336,"percentile":0.98962}],"risk":40.001999999999995,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4661-1","link":"https://security-tracker.debian.org/tracker/DSA-4661-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-1967","description":"Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the \"signature_algorithms_cert\" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f)."},"relatedVulnerabilities":[{"id":"CVE-2020-1967","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-1967","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-1967","date":"2026-10-08","epss":0.53336,"percentile":0.98962}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html","http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html","http://seclists.org/fulldisclosure/2020/May/5","http://www.openwall.com/lists/oss-security/2020/04/22/2","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=eb563247aef3e83dda7679c43f9649270462e5b1","https://github.com/irsl/CVE-2020-1967","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440","https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee%40%3Cdev.tomcat.apache.org%3E","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/","https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc","https://security.gentoo.org/glsa/202004-10","https://security.netapp.com/advisory/ntap-20200424-0003/","https://security.netapp.com/advisory/ntap-20200717-0004/","https://www.debian.org/security/2020/dsa-4661","https://www.openssl.org/news/secadv/20200421.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.synology.com/security/advisory/Synology_SA_20_05","https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL","https://www.tenable.com/security/tns-2020-03","https://www.tenable.com/security/tns-2020-04","https://www.tenable.com/security/tns-2020-11","https://www.tenable.com/security/tns-2021-10"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-1967","description":"Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the \"signature_algorithms_cert\" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f)."}]},{"artifact":{"id":"d308e84bddad0b0f","cpes":["cpe:2.3:a:openssl:openssl:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1d-0+deb10u3"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-1967","versionConstraint":"< 1.1.1d-0+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-1967","fix":{"state":"fixed","versions":["1.1.1d-0+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1d-0+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-1967","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-1967","date":"2026-10-08","epss":0.53336,"percentile":0.98962}],"risk":40.001999999999995,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4661-1","link":"https://security-tracker.debian.org/tracker/DSA-4661-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-1967","description":"Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the \"signature_algorithms_cert\" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f)."},"relatedVulnerabilities":[{"id":"CVE-2020-1967","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-1967","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-1967","date":"2026-10-08","epss":0.53336,"percentile":0.98962}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html","http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html","http://seclists.org/fulldisclosure/2020/May/5","http://www.openwall.com/lists/oss-security/2020/04/22/2","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=eb563247aef3e83dda7679c43f9649270462e5b1","https://github.com/irsl/CVE-2020-1967","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440","https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee%40%3Cdev.tomcat.apache.org%3E","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/","https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc","https://security.gentoo.org/glsa/202004-10","https://security.netapp.com/advisory/ntap-20200424-0003/","https://security.netapp.com/advisory/ntap-20200717-0004/","https://www.debian.org/security/2020/dsa-4661","https://www.openssl.org/news/secadv/20200421.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.synology.com/security/advisory/Synology_SA_20_05","https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL","https://www.tenable.com/security/tns-2020-03","https://www.tenable.com/security/tns-2020-04","https://www.tenable.com/security/tns-2020-11","https://www.tenable.com/security/tns-2021-10"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-1967","description":"Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the \"signature_algorithms_cert\" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f)."}]},{"artifact":{"id":"bcc78aeb924eb6b8","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.2.11.dfsg-1:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/debian/zlib1g@1%3A1.2.11.dfsg-1?arch=amd64&distro=debian-10.1&upstream=zlib","type":"deb","version":"1:1.2.11.dfsg-1","language":"","licenses":["Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.2.11.dfsg-1+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-25032","versionConstraint":"< 1:1.2.11.dfsg-1+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"zlib","version":"1:1.2.11.dfsg-1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2018-25032","fix":{"state":"fixed","versions":["1:1.2.11.dfsg-1+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.2.11.dfsg-1+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-25032","date":"2026-10-08","epss":0.51733,"percentile":0.98922}],"risk":38.79975,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5111-1","link":"https://security-tracker.debian.org/tracker/DSA-5111-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-25032","description":"zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches."},"relatedVulnerabilities":[{"id":"CVE-2018-25032","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-25032","date":"2026-10-08","epss":0.51733,"percentile":0.98922}],"urls":["http://seclists.org/fulldisclosure/2022/May/33","http://seclists.org/fulldisclosure/2022/May/35","http://seclists.org/fulldisclosure/2022/May/38","http://www.openwall.com/lists/oss-security/2022/03/25/2","http://www.openwall.com/lists/oss-security/2022/03/26/1","https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf","https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531","https://github.com/madler/zlib/compare/v1.2.11...v1.2.12","https://github.com/madler/zlib/issues/605","https://lists.debian.org/debian-lts-announce/2022/04/msg00000.html","https://lists.debian.org/debian-lts-announce/2022/05/msg00008.html","https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/","https://security.gentoo.org/glsa/202210-42","https://security.netapp.com/advisory/ntap-20220526-0009/","https://security.netapp.com/advisory/ntap-20220729-0004/","https://support.apple.com/kb/HT213255","https://support.apple.com/kb/HT213256","https://support.apple.com/kb/HT213257","https://www.debian.org/security/2022/dsa-5111","https://www.openwall.com/lists/oss-security/2022/03/24/1","https://www.openwall.com/lists/oss-security/2022/03/28/1","https://www.openwall.com/lists/oss-security/2022/03/28/3","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/html/ssa-333517.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-419740.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html","https://cert-portal.siemens.com/productcert/html/ssa-565386.html","https://cert-portal.siemens.com/productcert/html/ssa-942865.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-25032","description":"zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches."}]},{"artifact":{"id":"bca20a7b0a858bf3","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/debian/libssl1.1@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1&upstream=openssl","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1d-0+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-23840","versionConstraint":"< 1.1.1d-0+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-23840","fix":{"state":"fixed","versions":["1.1.1d-0+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1d-0+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23840","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23840","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23840","date":"2026-10-08","epss":0.50732,"percentile":0.98897}],"risk":38.049,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4855-1","link":"https://security-tracker.debian.org/tracker/DSA-4855-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-23840","description":"Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x)."},"relatedVulnerabilities":[{"id":"CVE-2021-23840","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23840","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23840","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23840","date":"2026-10-08","epss":0.50732,"percentile":0.98897}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9b1129239f3ebb1d1c98ce9ed41d5c9476c47cb2","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846","https://kc.mcafee.com/corporate/index?page=content&id=SB10366","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/202103-03","https://security.netapp.com/advisory/ntap-20210219-0009/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2021/dsa-4855","https://www.openssl.org/news/secadv/20210216.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2021-03","https://www.tenable.com/security/tns-2021-09","https://www.tenable.com/security/tns-2021-10"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23840","description":"Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x)."}]},{"artifact":{"id":"d308e84bddad0b0f","cpes":["cpe:2.3:a:openssl:openssl:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1d-0+deb10u5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-23840","versionConstraint":"< 1.1.1d-0+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-23840","fix":{"state":"fixed","versions":["1.1.1d-0+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1d-0+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23840","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23840","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23840","date":"2026-10-08","epss":0.50732,"percentile":0.98897}],"risk":38.049,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4855-1","link":"https://security-tracker.debian.org/tracker/DSA-4855-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-23840","description":"Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x)."},"relatedVulnerabilities":[{"id":"CVE-2021-23840","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23840","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23840","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23840","date":"2026-10-08","epss":0.50732,"percentile":0.98897}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9b1129239f3ebb1d1c98ce9ed41d5c9476c47cb2","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846","https://kc.mcafee.com/corporate/index?page=content&id=SB10366","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/202103-03","https://security.netapp.com/advisory/ntap-20210219-0009/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2021/dsa-4855","https://www.openssl.org/news/secadv/20210216.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2021-03","https://www.tenable.com/security/tns-2021-09","https://www.tenable.com/security/tns-2021-10"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23840","description":"Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x)."}]},{"artifact":{"id":"bca20a7b0a858bf3","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/debian/libssl1.1@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1&upstream=openssl","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1d-0+deb10u7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3712","versionConstraint":"< 1.1.1d-0+deb10u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-3712","fix":{"state":"fixed","versions":["1.1.1d-0+deb10u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1d-0+deb10u7"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3712","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3712","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3712","date":"2026-10-08","epss":0.50445,"percentile":0.98887}],"risk":37.581525,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4963-1","link":"https://security-tracker.debian.org/tracker/DSA-4963-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-3712","description":"ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own \"d2i\" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the \"data\" and \"length\" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the \"data\" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y)."},"relatedVulnerabilities":[{"id":"CVE-2021-3712","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3712","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3712","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3712","date":"2026-10-08","epss":0.50445,"percentile":0.98887}],"urls":["http://www.openwall.com/lists/oss-security/2021/08/26/2","https://cert-portal.siemens.com/productcert/pdf/ssa-244969.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=94d23fcff9b2a7a8368dfe52214d5c2569882c11","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ccb0a11145ee72b042d10593a64eaf9e8a55ec12","https://kc.mcafee.com/corporate/index?page=content&id=SB10366","https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1%40%3Cdev.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/09/msg00014.html","https://lists.debian.org/debian-lts-announce/2021/09/msg00021.html","https://security.gentoo.org/glsa/202209-02","https://security.gentoo.org/glsa/202210-02","https://security.netapp.com/advisory/ntap-20210827-0010/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2021/dsa-4963","https://www.openssl.org/news/secadv/20210824.txt","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2021-16","https://www.tenable.com/security/tns-2022-02","https://cert-portal.siemens.com/productcert/html/ssa-019200.html","https://cert-portal.siemens.com/productcert/html/ssa-028723.html","https://cert-portal.siemens.com/productcert/html/ssa-244969.html","https://cert-portal.siemens.com/productcert/html/ssa-389290.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3712","description":"ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own \"d2i\" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the \"data\" and \"length\" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the \"data\" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y)."}]},{"artifact":{"id":"d308e84bddad0b0f","cpes":["cpe:2.3:a:openssl:openssl:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1d-0+deb10u7"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-3712","versionConstraint":"< 1.1.1d-0+deb10u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-3712","fix":{"state":"fixed","versions":["1.1.1d-0+deb10u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1d-0+deb10u7"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3712","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3712","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3712","date":"2026-10-08","epss":0.50445,"percentile":0.98887}],"risk":37.581525,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4963-1","link":"https://security-tracker.debian.org/tracker/DSA-4963-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-3712","description":"ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own \"d2i\" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the \"data\" and \"length\" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the \"data\" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y)."},"relatedVulnerabilities":[{"id":"CVE-2021-3712","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3712","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3712","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3712","date":"2026-10-08","epss":0.50445,"percentile":0.98887}],"urls":["http://www.openwall.com/lists/oss-security/2021/08/26/2","https://cert-portal.siemens.com/productcert/pdf/ssa-244969.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=94d23fcff9b2a7a8368dfe52214d5c2569882c11","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ccb0a11145ee72b042d10593a64eaf9e8a55ec12","https://kc.mcafee.com/corporate/index?page=content&id=SB10366","https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1%40%3Cdev.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/09/msg00014.html","https://lists.debian.org/debian-lts-announce/2021/09/msg00021.html","https://security.gentoo.org/glsa/202209-02","https://security.gentoo.org/glsa/202210-02","https://security.netapp.com/advisory/ntap-20210827-0010/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2021/dsa-4963","https://www.openssl.org/news/secadv/20210824.txt","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2021-16","https://www.tenable.com/security/tns-2022-02","https://cert-portal.siemens.com/productcert/html/ssa-019200.html","https://cert-portal.siemens.com/productcert/html/ssa-028723.html","https://cert-portal.siemens.com/productcert/html/ssa-244969.html","https://cert-portal.siemens.com/productcert/html/ssa-389290.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3712","description":"ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own \"d2i\" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the \"data\" and \"length\" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the \"data\" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y)."}]},{"artifact":{"id":"bca20a7b0a858bf3","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/debian/libssl1.1@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1&upstream=openssl","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1d-0+deb10u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3449","versionConstraint":"< 1.1.1d-0+deb10u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-3449","fix":{"state":"fixed","versions":["1.1.1d-0+deb10u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1d-0+deb10u6"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3449","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3449","date":"2026-10-08","epss":0.63542,"percentile":0.99195}],"risk":34.63039,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4875-1","link":"https://security-tracker.debian.org/tracker/DSA-4875-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-3449","description":"An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j)."},"relatedVulnerabilities":[{"id":"CVE-2021-3449","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3449","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3449","date":"2026-10-08","epss":0.63542,"percentile":0.99195}],"urls":["http://www.openwall.com/lists/oss-security/2021/03/27/1","http://www.openwall.com/lists/oss-security/2021/03/27/2","http://www.openwall.com/lists/oss-security/2021/03/28/3","http://www.openwall.com/lists/oss-security/2021/03/28/4","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-772220.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fb9fa6b51defd48157eeb207f52181f735d96148","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845","https://kc.mcafee.com/corporate/index?page=content&id=SB10356","https://lists.debian.org/debian-lts-announce/2021/08/msg00029.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013","https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc","https://security.gentoo.org/glsa/202103-03","https://security.netapp.com/advisory/ntap-20210326-0006/","https://security.netapp.com/advisory/ntap-20210513-0002/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd","https://www.debian.org/security/2021/dsa-4875","https://www.openssl.org/news/secadv/20210325.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2021-05","https://www.tenable.com/security/tns-2021-06","https://www.tenable.com/security/tns-2021-09","https://www.tenable.com/security/tns-2021-10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3449","description":"An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j)."}]},{"artifact":{"id":"d308e84bddad0b0f","cpes":["cpe:2.3:a:openssl:openssl:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1d-0+deb10u6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-3449","versionConstraint":"< 1.1.1d-0+deb10u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-3449","fix":{"state":"fixed","versions":["1.1.1d-0+deb10u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1d-0+deb10u6"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3449","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3449","date":"2026-10-08","epss":0.63542,"percentile":0.99195}],"risk":34.63039,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4875-1","link":"https://security-tracker.debian.org/tracker/DSA-4875-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-3449","description":"An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j)."},"relatedVulnerabilities":[{"id":"CVE-2021-3449","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3449","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3449","date":"2026-10-08","epss":0.63542,"percentile":0.99195}],"urls":["http://www.openwall.com/lists/oss-security/2021/03/27/1","http://www.openwall.com/lists/oss-security/2021/03/27/2","http://www.openwall.com/lists/oss-security/2021/03/28/3","http://www.openwall.com/lists/oss-security/2021/03/28/4","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-772220.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fb9fa6b51defd48157eeb207f52181f735d96148","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845","https://kc.mcafee.com/corporate/index?page=content&id=SB10356","https://lists.debian.org/debian-lts-announce/2021/08/msg00029.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013","https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc","https://security.gentoo.org/glsa/202103-03","https://security.netapp.com/advisory/ntap-20210326-0006/","https://security.netapp.com/advisory/ntap-20210513-0002/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd","https://www.debian.org/security/2021/dsa-4875","https://www.openssl.org/news/secadv/20210325.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2021-05","https://www.tenable.com/security/tns-2021-06","https://www.tenable.com/security/tns-2021-09","https://www.tenable.com/security/tns-2021-10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3449","description":"An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j)."}]},{"artifact":{"id":"d55bfe42f054b394","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.2.6-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.2.6-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=expat","type":"deb","version":"2.2.6-2+deb10u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.6-2+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-25236","versionConstraint":"< 2.2.6-2+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"expat","version":"2.2.6-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-25236","fix":{"state":"fixed","versions":["2.2.6-2+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.6-2+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-25236","cwe":"CWE-668","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-25236","cwe":"CWE-668","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-25236","date":"2026-10-08","epss":0.34174,"percentile":0.9837}],"risk":32.12356,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5085-1","link":"https://security-tracker.debian.org/tracker/DSA-5085-1"},{"id":"DSA-5085-2","link":"https://security-tracker.debian.org/tracker/DSA-5085-2"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-25236","description":"xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs."},"relatedVulnerabilities":[{"id":"CVE-2022-25236","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-25236","cwe":"CWE-668","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-25236","cwe":"CWE-668","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-25236","date":"2026-10-08","epss":0.34174,"percentile":0.9837}],"urls":["http://packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Code-Execution.html","http://www.openwall.com/lists/oss-security/2022/02/19/1","https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","https://github.com/libexpat/libexpat/pull/561","https://lists.debian.org/debian-lts-announce/2022/03/msg00007.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UFRBA3UQVIQKXTBUQXDWQOVWNBKLERU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y27XO3JMKAOMQZVPS3B4MJGEAHCZF5OM/","https://security.gentoo.org/glsa/202209-24","https://security.netapp.com/advisory/ntap-20220303-0008/","https://www.debian.org/security/2022/dsa-5085","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25236","description":"xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs."}]},{"artifact":{"id":"ecf5e89e65014edb","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.64.0-4:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/debian/libcurl4@7.64.0-4?arch=amd64&distro=debian-10.1&upstream=curl","type":"deb","version":"7.64.0-4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2398","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"curl","version":"7.64.0-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2024-2398","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2398","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-2398","date":"2026-10-08","epss":0.36081,"percentile":0.98442}],"risk":29.045205000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-2398","description":"When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory.  Further, this error condition fails silently and is therefore not easily detected by an application."},"relatedVulnerabilities":[{"id":"CVE-2024-2398","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2398","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-2398","date":"2026-10-08","epss":0.36081,"percentile":0.98442}],"urls":["http://seclists.org/fulldisclosure/2024/Jul/18","http://seclists.org/fulldisclosure/2024/Jul/19","http://seclists.org/fulldisclosure/2024/Jul/20","http://www.openwall.com/lists/oss-security/2024/03/27/3","https://curl.se/docs/CVE-2024-2398.html","https://curl.se/docs/CVE-2024-2398.json","https://hackerone.com/reports/2402845","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/","https://security.netapp.com/advisory/ntap-20240503-0009/","https://support.apple.com/kb/HT214118","https://support.apple.com/kb/HT214119","https://support.apple.com/kb/HT214120"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2398","description":"When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory.  Further, this error condition fails silently and is therefore not easily detected by an application."}]},{"artifact":{"id":"bca20a7b0a858bf3","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/debian/libssl1.1@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1&upstream=openssl","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2511","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2024-2511","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-10-08","epss":0.52421,"percentile":0.98938}],"risk":28.569444999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-2511","description":"Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions  Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service  This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation.  This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients.  The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue."},"relatedVulnerabilities":[{"id":"CVE-2024-2511","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-10-08","epss":0.52421,"percentile":0.98938}],"urls":["https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce","https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d","https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08","https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640","https://www.openssl.org/news/secadv/20240408.txt","http://www.openwall.com/lists/oss-security/2024/04/08/5","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240503-0013/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-354112.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2511","description":"Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unbounded manner. A\nmalicious client could deliberately create the scenario for this failure to\nforce a Denial of Service. It may also happen by accident in normal operation.\n\nThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\nclients.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\n1.0.2 is also not affected by this issue."}]},{"artifact":{"id":"d308e84bddad0b0f","cpes":["cpe:2.3:a:openssl:openssl:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-2511","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2024-2511","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-10-08","epss":0.52421,"percentile":0.98938}],"risk":28.569444999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-2511","description":"Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions  Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service  This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation.  This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients.  The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue."},"relatedVulnerabilities":[{"id":"CVE-2024-2511","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-10-08","epss":0.52421,"percentile":0.98938}],"urls":["https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce","https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d","https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08","https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640","https://www.openssl.org/news/secadv/20240408.txt","http://www.openwall.com/lists/oss-security/2024/04/08/5","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240503-0013/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-354112.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2511","description":"Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unbounded manner. A\nmalicious client could deliberately create the scenario for this failure to\nforce a Denial of Service. It may also happen by accident in normal operation.\n\nThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\nclients.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\n1.0.2 is also not affected by this issue."}]},{"artifact":{"id":"9c0f03079e497030","cpes":["cpe:2.3:a:libpython3.7-minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-minimal","purl":"pkg:deb/debian/libpython3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-23336","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-23336","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-10-08","epss":0.40736,"percentile":0.98622}],"risk":22.201120000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-23336","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."},"relatedVulnerabilities":[{"id":"CVE-2021-23336","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:P","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-10-08","epss":0.40736,"percentile":0.98622}],"urls":["http://www.openwall.com/lists/oss-security/2021/02/19/4","http://www.openwall.com/lists/oss-security/2021/05/01/2","https://github.com/python/cpython/pull/24297","https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/","https://security.gentoo.org/glsa/202104-04","https://security.netapp.com/advisory/ntap-20210326-0004/","https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/","https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23336","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."}]},{"artifact":{"id":"b6d8c37141cd8c0a","cpes":["cpe:2.3:a:libpython3.7-stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-stdlib","purl":"pkg:deb/debian/libpython3.7-stdlib@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-23336","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-23336","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-10-08","epss":0.40736,"percentile":0.98622}],"risk":22.201120000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-23336","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."},"relatedVulnerabilities":[{"id":"CVE-2021-23336","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:P","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-10-08","epss":0.40736,"percentile":0.98622}],"urls":["http://www.openwall.com/lists/oss-security/2021/02/19/4","http://www.openwall.com/lists/oss-security/2021/05/01/2","https://github.com/python/cpython/pull/24297","https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/","https://security.gentoo.org/glsa/202104-04","https://security.netapp.com/advisory/ntap-20210326-0004/","https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/","https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23336","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."}]},{"artifact":{"id":"94955c7d71be2bb1","cpes":["cpe:2.3:a:python3.7:python3.7:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7","purl":"pkg:deb/debian/python3.7@3.7.3-2?arch=amd64&distro=debian-10.1","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.list"},{"path":"/var/lib/dpkg/info/python3.7.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.postinst"},{"path":"/var/lib/dpkg/info/python3.7.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-23336","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-23336","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-10-08","epss":0.40736,"percentile":0.98622}],"risk":22.201120000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-23336","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."},"relatedVulnerabilities":[{"id":"CVE-2021-23336","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:P","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-10-08","epss":0.40736,"percentile":0.98622}],"urls":["http://www.openwall.com/lists/oss-security/2021/02/19/4","http://www.openwall.com/lists/oss-security/2021/05/01/2","https://github.com/python/cpython/pull/24297","https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/","https://security.gentoo.org/glsa/202104-04","https://security.netapp.com/advisory/ntap-20210326-0004/","https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/","https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23336","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."}]},{"artifact":{"id":"988c8a69c0d8509e","cpes":["cpe:2.3:a:python3.7-minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7-minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7-minimal","purl":"pkg:deb/debian/python3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.list"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.7-minimal.preinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.prerm"}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-23336","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-23336","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-10-08","epss":0.40736,"percentile":0.98622}],"risk":22.201120000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-23336","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."},"relatedVulnerabilities":[{"id":"CVE-2021-23336","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:P","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-10-08","epss":0.40736,"percentile":0.98622}],"urls":["http://www.openwall.com/lists/oss-security/2021/02/19/4","http://www.openwall.com/lists/oss-security/2021/05/01/2","https://github.com/python/cpython/pull/24297","https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/","https://security.gentoo.org/glsa/202104-04","https://security.netapp.com/advisory/ntap-20210326-0004/","https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/","https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23336","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."}]},{"artifact":{"id":"9c0f03079e497030","cpes":["cpe:2.3:a:libpython3.7-minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-minimal","purl":"pkg:deb/debian/libpython3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3177","versionConstraint":"< 3.7.3-2+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-3177","fix":{"state":"fixed","versions":["3.7.3-2+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-10-08","epss":0.23293,"percentile":0.97729}],"risk":21.89542,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-3177","description":"Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely."},"relatedVulnerabilities":[{"id":"CVE-2021-3177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-10-08","epss":0.23293,"percentile":0.97729}],"urls":["https://bugs.python.org/issue42938","https://github.com/python/cpython/pull/24239","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2022/02/msg00013.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRHOCQYX3QLDGDQGTWQAUUT2GGIZCZUO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCFZMVRQUKCBQIG5F2CBVADK63NFSE4A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPE7SMXYUIWPOIZV4DQYXODRXMFX3C5E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MGSV6BJQLRQ6RKVUXK7JGU7TP4QFGQXC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQPARTLNSFQVMMQHPNBFOCOZOO3TMQNA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXSMBHES3ANXXS2RSO5G6Q24BR4B2PWK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6XJAULOS5JVB2L67NCKKMJ5NTKZJBSD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4KSYYWMGAKOA2JVCQA422OINT6CKQ7O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDTZVGSXQ7HR7OCGSUHTRNTMBG43OMKU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7GZV74KM72O2PEJN2C4XP3V5Q5MZUOO/","https://news.ycombinator.com/item?id=26185005","https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html","https://security.gentoo.org/glsa/202101-18","https://security.netapp.com/advisory/ntap-20210226-0003/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3177","description":"Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely."}]},{"artifact":{"id":"b6d8c37141cd8c0a","cpes":["cpe:2.3:a:libpython3.7-stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-stdlib","purl":"pkg:deb/debian/libpython3.7-stdlib@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3177","versionConstraint":"< 3.7.3-2+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-3177","fix":{"state":"fixed","versions":["3.7.3-2+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-10-08","epss":0.23293,"percentile":0.97729}],"risk":21.89542,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-3177","description":"Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely."},"relatedVulnerabilities":[{"id":"CVE-2021-3177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-10-08","epss":0.23293,"percentile":0.97729}],"urls":["https://bugs.python.org/issue42938","https://github.com/python/cpython/pull/24239","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2022/02/msg00013.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRHOCQYX3QLDGDQGTWQAUUT2GGIZCZUO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCFZMVRQUKCBQIG5F2CBVADK63NFSE4A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPE7SMXYUIWPOIZV4DQYXODRXMFX3C5E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MGSV6BJQLRQ6RKVUXK7JGU7TP4QFGQXC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQPARTLNSFQVMMQHPNBFOCOZOO3TMQNA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXSMBHES3ANXXS2RSO5G6Q24BR4B2PWK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6XJAULOS5JVB2L67NCKKMJ5NTKZJBSD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4KSYYWMGAKOA2JVCQA422OINT6CKQ7O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDTZVGSXQ7HR7OCGSUHTRNTMBG43OMKU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7GZV74KM72O2PEJN2C4XP3V5Q5MZUOO/","https://news.ycombinator.com/item?id=26185005","https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html","https://security.gentoo.org/glsa/202101-18","https://security.netapp.com/advisory/ntap-20210226-0003/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3177","description":"Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely."}]},{"artifact":{"id":"94955c7d71be2bb1","cpes":["cpe:2.3:a:python3.7:python3.7:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7","purl":"pkg:deb/debian/python3.7@3.7.3-2?arch=amd64&distro=debian-10.1","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.list"},{"path":"/var/lib/dpkg/info/python3.7.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.postinst"},{"path":"/var/lib/dpkg/info/python3.7.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u3"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-3177","versionConstraint":"< 3.7.3-2+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-3177","fix":{"state":"fixed","versions":["3.7.3-2+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-10-08","epss":0.23293,"percentile":0.97729}],"risk":21.89542,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-3177","description":"Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely."},"relatedVulnerabilities":[{"id":"CVE-2021-3177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-10-08","epss":0.23293,"percentile":0.97729}],"urls":["https://bugs.python.org/issue42938","https://github.com/python/cpython/pull/24239","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2022/02/msg00013.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRHOCQYX3QLDGDQGTWQAUUT2GGIZCZUO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCFZMVRQUKCBQIG5F2CBVADK63NFSE4A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPE7SMXYUIWPOIZV4DQYXODRXMFX3C5E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MGSV6BJQLRQ6RKVUXK7JGU7TP4QFGQXC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQPARTLNSFQVMMQHPNBFOCOZOO3TMQNA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXSMBHES3ANXXS2RSO5G6Q24BR4B2PWK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6XJAULOS5JVB2L67NCKKMJ5NTKZJBSD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4KSYYWMGAKOA2JVCQA422OINT6CKQ7O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDTZVGSXQ7HR7OCGSUHTRNTMBG43OMKU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7GZV74KM72O2PEJN2C4XP3V5Q5MZUOO/","https://news.ycombinator.com/item?id=26185005","https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html","https://security.gentoo.org/glsa/202101-18","https://security.netapp.com/advisory/ntap-20210226-0003/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3177","description":"Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely."}]},{"artifact":{"id":"988c8a69c0d8509e","cpes":["cpe:2.3:a:python3.7-minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7-minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7-minimal","purl":"pkg:deb/debian/python3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.list"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.7-minimal.preinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.prerm"}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3177","versionConstraint":"< 3.7.3-2+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-3177","fix":{"state":"fixed","versions":["3.7.3-2+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-10-08","epss":0.23293,"percentile":0.97729}],"risk":21.89542,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-3177","description":"Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely."},"relatedVulnerabilities":[{"id":"CVE-2021-3177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-10-08","epss":0.23293,"percentile":0.97729}],"urls":["https://bugs.python.org/issue42938","https://github.com/python/cpython/pull/24239","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2022/02/msg00013.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRHOCQYX3QLDGDQGTWQAUUT2GGIZCZUO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCFZMVRQUKCBQIG5F2CBVADK63NFSE4A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPE7SMXYUIWPOIZV4DQYXODRXMFX3C5E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MGSV6BJQLRQ6RKVUXK7JGU7TP4QFGQXC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQPARTLNSFQVMMQHPNBFOCOZOO3TMQNA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXSMBHES3ANXXS2RSO5G6Q24BR4B2PWK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6XJAULOS5JVB2L67NCKKMJ5NTKZJBSD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4KSYYWMGAKOA2JVCQA422OINT6CKQ7O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDTZVGSXQ7HR7OCGSUHTRNTMBG43OMKU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7GZV74KM72O2PEJN2C4XP3V5Q5MZUOO/","https://news.ycombinator.com/item?id=26185005","https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html","https://security.gentoo.org/glsa/202101-18","https://security.netapp.com/advisory/ntap-20210226-0003/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3177","description":"Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely."}]},{"artifact":{"id":"ecf5e89e65014edb","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.64.0-4:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/debian/libcurl4@7.64.0-4?arch=amd64&distro=debian-10.1&upstream=curl","type":"deb","version":"7.64.0-4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.64.0-4+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-32206","versionConstraint":"< 7.64.0-4+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"curl","version":"7.64.0-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-32206","fix":{"state":"fixed","versions":["7.64.0-4+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.64.0-4+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-32206","cwe":"CWE-770","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-32206","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-32206","date":"2026-10-08","epss":0.33097,"percentile":0.98328}],"risk":19.030775,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-32206","description":"curl < 7.84.0 supports \"chained\" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable \"links\" in this \"decompression chain\" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a \"malloc bomb\", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors."},"relatedVulnerabilities":[{"id":"CVE-2022-32206","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-32206","cwe":"CWE-770","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-32206","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-32206","date":"2026-10-08","epss":0.33097,"percentile":0.98328}],"urls":["http://seclists.org/fulldisclosure/2022/Oct/28","http://seclists.org/fulldisclosure/2022/Oct/41","http://www.openwall.com/lists/oss-security/2023/02/15/3","https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf","https://hackerone.com/reports/1570651","https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20220915-0003/","https://support.apple.com/kb/HT213488","https://www.debian.org/security/2022/dsa-5197"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-32206","description":"curl < 7.84.0 supports \"chained\" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable \"links\" in this \"decompression chain\" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a \"malloc bomb\", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors."}]},{"artifact":{"id":"bcc78aeb924eb6b8","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.2.11.dfsg-1:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/debian/zlib1g@1%3A1.2.11.dfsg-1?arch=amd64&distro=debian-10.1&upstream=zlib","type":"deb","version":"1:1.2.11.dfsg-1","language":"","licenses":["Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.2.11.dfsg-1+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-37434","versionConstraint":"< 1:1.2.11.dfsg-1+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"zlib","version":"1:1.2.11.dfsg-1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-37434","fix":{"state":"fixed","versions":["1:1.2.11.dfsg-1+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.2.11.dfsg-1+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-37434","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-37434","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-37434","date":"2026-10-08","epss":0.18972,"percentile":0.97237}],"risk":17.83368,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-37434","description":"zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference)."},"relatedVulnerabilities":[{"id":"CVE-2022-37434","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-37434","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-37434","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-37434","date":"2026-10-08","epss":0.18972,"percentile":0.97237}],"urls":["http://seclists.org/fulldisclosure/2022/Oct/37","http://seclists.org/fulldisclosure/2022/Oct/38","http://seclists.org/fulldisclosure/2022/Oct/41","http://seclists.org/fulldisclosure/2022/Oct/42","http://www.openwall.com/lists/oss-security/2022/08/05/2","http://www.openwall.com/lists/oss-security/2022/08/09/1","https://github.com/curl/curl/issues/9271","https://github.com/ivd38/zlib_overflow","https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-L1063","https://github.com/madler/zlib/commit/1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d","https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1","https://github.com/nodejs/node/blob/75b68c6e4db515f76df73af476eccf382bbcb00a/deps/zlib/inflate.c#L762-L764","https://lists.debian.org/debian-lts-announce/2022/09/msg00012.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWN4VE3JQR4O2SOUS5TXNLANRPMHWV4I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMBOJ77A7T7PQCARMDUK75TE6LLESZ3O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAVPQNCG3XRLCLNSQRM3KAN5ZFMVXVTY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5U7OTKZSHY2I3ZFJSR2SHFHW72RKGDK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YRQAI7H4M4RQZ2IWZUEEXECBE5D56BH2/","https://security.netapp.com/advisory/ntap-20220901-0005/","https://security.netapp.com/advisory/ntap-20230427-0007/","https://support.apple.com/kb/HT213488","https://support.apple.com/kb/HT213489","https://support.apple.com/kb/HT213490","https://support.apple.com/kb/HT213491","https://support.apple.com/kb/HT213493","https://support.apple.com/kb/HT213494","https://www.debian.org/security/2022/dsa-5218","https://cert-portal.siemens.com/productcert/html/ssa-150063.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html","https://cert-portal.siemens.com/productcert/html/ssa-561322.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-37434","description":"zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference)."}]},{"artifact":{"id":"ecf5e89e65014edb","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.64.0-4:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/debian/libcurl4@7.64.0-4?arch=amd64&distro=debian-10.1&upstream=curl","type":"deb","version":"7.64.0-4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.64.0-4+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-5482","versionConstraint":"< 7.64.0-4+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"curl","version":"7.64.0-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-5482","fix":{"state":"fixed","versions":["7.64.0-4+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.64.0-4+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5482","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5482","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5482","date":"2026-10-08","epss":0.17939,"percentile":0.97115}],"risk":16.86266,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4633-1","link":"https://security-tracker.debian.org/tracker/DSA-4633-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-5482","description":"Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3."},"relatedVulnerabilities":[{"id":"CVE-2019-5482","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5482","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5482","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5482","date":"2026-10-08","epss":0.17939,"percentile":0.97115}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html","https://curl.haxx.se/docs/CVE-2019-5482.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CI4QQ2RSZX4VCFM76SIWGKY6BY7UWIC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/","https://seclists.org/bugtraq/2020/Feb/36","https://security.gentoo.org/glsa/202003-29","https://security.netapp.com/advisory/ntap-20191004-0003/","https://security.netapp.com/advisory/ntap-20200416-0003/","https://www.debian.org/security/2020/dsa-4633","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5482","description":"Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3."}]},{"artifact":{"id":"7c1ebd3787684a51","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.7-4:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/debian/libgnutls30@3.6.7-4?arch=amd64&distro=debian-10.1&upstream=gnutls28","type":"deb","version":"3.6.7-4","language":"","licenses":["sha256:d35f0abecc61a3676965c20cf13a44815b05d9b4a68985fa1809b13c2aff9090"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.7-4+deb10u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-13777","versionConstraint":"< 3.6.7-4+deb10u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"gnutls28","version":"3.6.7-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-13777","fix":{"state":"fixed","versions":["3.6.7-4+deb10u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.6.7-4+deb10u4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-13777","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-13777","date":"2026-10-08","epss":0.22284,"percentile":0.97632}],"risk":16.601580000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4697-1","link":"https://security-tracker.debian.org/tracker/DSA-4697-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-13777","description":"GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application."},"relatedVulnerabilities":[{"id":"CVE-2020-13777","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-13777","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-13777","date":"2026-10-08","epss":0.22284,"percentile":0.97632}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00015.html","https://gnutls.org/security-new.html#GNUTLS-SA-2020-06-03","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6C4DHUKV6M6SJ5CV6KVHZNHNF7HCUE5P/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RTXZOXC4MHTFE2HKY6IAZMF2WHD2WMV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RRQBFK3UZ7SV76IYDTS4PS6ABS2DSJHK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VMB3UGI5H5RCFRU6OGRPMNUCNLJGEN7Y/","https://security.gentoo.org/glsa/202006-01","https://security.netapp.com/advisory/ntap-20200619-0004/","https://usn.ubuntu.com/4384-1/","https://www.debian.org/security/2020/dsa-4697"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-13777","description":"GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3). The earliest affected version is 3.6.4 (2018-09-24) because of an error in a 2018-09-18 commit. Until the first key rotation, the TLS server always uses wrong data in place of an encryption key derived from an application."}]},{"artifact":{"id":"763298202c68f152","cpes":["cpe:2.3:a:golang:crypto:v0.0.0-20190701094942-4def268fd1a4:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.0.0-20190701094942-4def268fd1a4:*:*:*:*:go:*:*"],"name":"golang.org/x/crypto","purl":"pkg:golang/golang.org/x/crypto@v0.0.0-20190701094942-4def268fd1a4","type":"go-module","version":"v0.0.0-20190701094942-4def268fd1a4","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.0.0-20200220183623-bac4c82f6975"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-ffhg-7mh4-33c4","versionConstraint":"<0.0.0-20200220183623-bac4c82f6975 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/crypto","version":"v0.0.0-20190701094942-4def268fd1a4"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-ffhg-7mh4-33c4","fix":{"state":"fixed","versions":["0.0.0-20200220183623-bac4c82f6975"],"available":[{"date":"2021-09-29","kind":"first-observed","version":"0.0.0-20200220183623-bac4c82f6975"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-9283","cwe":"CWE-347","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-9283","date":"2026-10-08","epss":0.20891,"percentile":0.97505}],"risk":15.66825,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-9283","https://github.com/golang/crypto/commit/bac4c82f69751a6dd76e702d54b3ceb88adab236","https://groups.google.com/forum/#!topic/golang-announce/3L45YRc91SY","https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html","https://lists.debian.org/debian-lts-announce/2020/11/msg00027.html","https://lists.debian.org/debian-lts-announce/2020/11/msg00031.html","https://www.exploit-db.com/exploits/48121","http://packetstormsecurity.com/files/156480/Go-SSH-0.0.2-Denial-Of-Service.html","https://go.dev/cl/220357","https://go.googlesource.com/crypto/+/bac4c82f69751a6dd76e702d54b3ceb88adab236","https://groups.google.com/g/golang-announce/c/3L45YRc91SY","https://pkg.go.dev/vuln/GO-2020-0012"],"severity":"High","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-ffhg-7mh4-33c4","description":"Improper Verification of Cryptographic Signature in golang.org/x/crypto"},"relatedVulnerabilities":[{"id":"CVE-2020-9283","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-9283","cwe":"CWE-347","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-9283","date":"2026-10-08","epss":0.20891,"percentile":0.97505}],"urls":["http://packetstormsecurity.com/files/156480/Go-SSH-0.0.2-Denial-Of-Service.html","https://groups.google.com/forum/#%21topic/golang-announce/3L45YRc91SY","https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html","https://lists.debian.org/debian-lts-announce/2020/11/msg00027.html","https://lists.debian.org/debian-lts-announce/2020/11/msg00031.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00017.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-9283","description":"golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client."}]},{"artifact":{"id":"524ae46feda9a236","cpes":["cpe:2.3:a:golang:crypto:v0.0.0-20190701094942-4def268fd1a4:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.0.0-20190701094942-4def268fd1a4:*:*:*:*:go:*:*"],"name":"golang.org/x/crypto","purl":"pkg:golang/golang.org/x/crypto@v0.0.0-20190701094942-4def268fd1a4","type":"go-module","version":"v0.0.0-20190701094942-4def268fd1a4","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.0.0-20200220183623-bac4c82f6975"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-ffhg-7mh4-33c4","versionConstraint":"<0.0.0-20200220183623-bac4c82f6975 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/crypto","version":"v0.0.0-20190701094942-4def268fd1a4"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-ffhg-7mh4-33c4","fix":{"state":"fixed","versions":["0.0.0-20200220183623-bac4c82f6975"],"available":[{"date":"2021-09-29","kind":"first-observed","version":"0.0.0-20200220183623-bac4c82f6975"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-9283","cwe":"CWE-347","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-9283","date":"2026-10-08","epss":0.20891,"percentile":0.97505}],"risk":15.66825,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-9283","https://github.com/golang/crypto/commit/bac4c82f69751a6dd76e702d54b3ceb88adab236","https://groups.google.com/forum/#!topic/golang-announce/3L45YRc91SY","https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html","https://lists.debian.org/debian-lts-announce/2020/11/msg00027.html","https://lists.debian.org/debian-lts-announce/2020/11/msg00031.html","https://www.exploit-db.com/exploits/48121","http://packetstormsecurity.com/files/156480/Go-SSH-0.0.2-Denial-Of-Service.html","https://go.dev/cl/220357","https://go.googlesource.com/crypto/+/bac4c82f69751a6dd76e702d54b3ceb88adab236","https://groups.google.com/g/golang-announce/c/3L45YRc91SY","https://pkg.go.dev/vuln/GO-2020-0012"],"severity":"High","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-ffhg-7mh4-33c4","description":"Improper Verification of Cryptographic Signature in golang.org/x/crypto"},"relatedVulnerabilities":[{"id":"CVE-2020-9283","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-9283","cwe":"CWE-347","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-9283","date":"2026-10-08","epss":0.20891,"percentile":0.97505}],"urls":["http://packetstormsecurity.com/files/156480/Go-SSH-0.0.2-Denial-Of-Service.html","https://groups.google.com/forum/#%21topic/golang-announce/3L45YRc91SY","https://lists.debian.org/debian-lts-announce/2020/10/msg00014.html","https://lists.debian.org/debian-lts-announce/2020/11/msg00027.html","https://lists.debian.org/debian-lts-announce/2020/11/msg00031.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00017.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-9283","description":"golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client."}]},{"artifact":{"id":"9c0f03079e497030","cpes":["cpe:2.3:a:libpython3.7-minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-minimal","purl":"pkg:deb/debian/libpython3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-24329","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-24329","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-10-08","epss":0.20459,"percentile":0.9745}],"risk":15.344249999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-24329","description":"An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters."},"relatedVulnerabilities":[{"id":"CVE-2023-24329","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-10-08","epss":0.20459,"percentile":0.9745}],"urls":["https://github.com/python/cpython/issues/102153","https://github.com/python/cpython/pull/99421","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PEVICI7YNGGMSL3UCMWGE66QFLATH72/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSL6NSOAXWBJJ67XPLSSC74MNKZF3BBO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EM2XLZSTXG44TMFXF4E6VTGKR2MQCW3G/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2NY75GFDZ5T6YPN44D3VMFT5SUVTOTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GR5US3BYILYJ4SKBV6YBNPRUBAL5P2CN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H23OSKC6UG6IWOQAUPW74YUHWRWVXJP7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTLGV2HYFF4AMYJL25VDIGAIHCU7UPA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWC4WGXER5P6Q75RFGL7QUTPP3N5JR7T/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZEHSXSCMA4WWQKXT6QV7AAR6SWNZ2VP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5SP4RT3RRS434ZS2HQKQJ3VZW7YPKYR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHHJHJRLEF3TDT2K3676CAUVRDD4CCMR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUN6T22UJFXR7J5F6UUHCXXPKJ2DVHI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PURM5CFDABEWAIWZFD2MQ7ZJGCPYSQ44/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3J5N24ECS4B6MJDRO6UAYU6GPLYBDCL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRQHN7RWJQJHYP6E5EKESOYP5VDSHZG4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RA2MBEEES6L46OD64OBSVUUMGKNGMOWW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4IDB5OAR5Y4UK3HLMZBW4WEL2B7YFMJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZH26JGNZ5XYPZ5SAU3NKSBSPRE5OHTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2MZOJYGFCB5PPT6AKMAU72N7QOYWLBP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UONZWLB4QVLQIY5CPDLEUEKH6WX4VQMC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTOAUJNDWZDRWVSXJ354AYZYKRMT56HU/","https://pointernull.com/security/python-url-parse-problem.html","https://security.netapp.com/advisory/ntap-20230324-0004/","https://www.kb.cert.org/vuls/id/127587","https://lists.debian.org/debian-lts-announce/2024/11/msg00005.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24329","description":"An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters."}]},{"artifact":{"id":"b6d8c37141cd8c0a","cpes":["cpe:2.3:a:libpython3.7-stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-stdlib","purl":"pkg:deb/debian/libpython3.7-stdlib@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-24329","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-24329","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-10-08","epss":0.20459,"percentile":0.9745}],"risk":15.344249999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-24329","description":"An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters."},"relatedVulnerabilities":[{"id":"CVE-2023-24329","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-10-08","epss":0.20459,"percentile":0.9745}],"urls":["https://github.com/python/cpython/issues/102153","https://github.com/python/cpython/pull/99421","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PEVICI7YNGGMSL3UCMWGE66QFLATH72/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSL6NSOAXWBJJ67XPLSSC74MNKZF3BBO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EM2XLZSTXG44TMFXF4E6VTGKR2MQCW3G/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2NY75GFDZ5T6YPN44D3VMFT5SUVTOTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GR5US3BYILYJ4SKBV6YBNPRUBAL5P2CN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H23OSKC6UG6IWOQAUPW74YUHWRWVXJP7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTLGV2HYFF4AMYJL25VDIGAIHCU7UPA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWC4WGXER5P6Q75RFGL7QUTPP3N5JR7T/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZEHSXSCMA4WWQKXT6QV7AAR6SWNZ2VP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5SP4RT3RRS434ZS2HQKQJ3VZW7YPKYR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHHJHJRLEF3TDT2K3676CAUVRDD4CCMR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUN6T22UJFXR7J5F6UUHCXXPKJ2DVHI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PURM5CFDABEWAIWZFD2MQ7ZJGCPYSQ44/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3J5N24ECS4B6MJDRO6UAYU6GPLYBDCL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRQHN7RWJQJHYP6E5EKESOYP5VDSHZG4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RA2MBEEES6L46OD64OBSVUUMGKNGMOWW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4IDB5OAR5Y4UK3HLMZBW4WEL2B7YFMJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZH26JGNZ5XYPZ5SAU3NKSBSPRE5OHTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2MZOJYGFCB5PPT6AKMAU72N7QOYWLBP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UONZWLB4QVLQIY5CPDLEUEKH6WX4VQMC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTOAUJNDWZDRWVSXJ354AYZYKRMT56HU/","https://pointernull.com/security/python-url-parse-problem.html","https://security.netapp.com/advisory/ntap-20230324-0004/","https://www.kb.cert.org/vuls/id/127587","https://lists.debian.org/debian-lts-announce/2024/11/msg00005.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24329","description":"An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters."}]},{"artifact":{"id":"94955c7d71be2bb1","cpes":["cpe:2.3:a:python3.7:python3.7:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7","purl":"pkg:deb/debian/python3.7@3.7.3-2?arch=amd64&distro=debian-10.1","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.list"},{"path":"/var/lib/dpkg/info/python3.7.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.postinst"},{"path":"/var/lib/dpkg/info/python3.7.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-24329","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-24329","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-10-08","epss":0.20459,"percentile":0.9745}],"risk":15.344249999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-24329","description":"An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters."},"relatedVulnerabilities":[{"id":"CVE-2023-24329","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-10-08","epss":0.20459,"percentile":0.9745}],"urls":["https://github.com/python/cpython/issues/102153","https://github.com/python/cpython/pull/99421","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PEVICI7YNGGMSL3UCMWGE66QFLATH72/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSL6NSOAXWBJJ67XPLSSC74MNKZF3BBO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EM2XLZSTXG44TMFXF4E6VTGKR2MQCW3G/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2NY75GFDZ5T6YPN44D3VMFT5SUVTOTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GR5US3BYILYJ4SKBV6YBNPRUBAL5P2CN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H23OSKC6UG6IWOQAUPW74YUHWRWVXJP7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTLGV2HYFF4AMYJL25VDIGAIHCU7UPA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWC4WGXER5P6Q75RFGL7QUTPP3N5JR7T/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZEHSXSCMA4WWQKXT6QV7AAR6SWNZ2VP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5SP4RT3RRS434ZS2HQKQJ3VZW7YPKYR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHHJHJRLEF3TDT2K3676CAUVRDD4CCMR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUN6T22UJFXR7J5F6UUHCXXPKJ2DVHI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PURM5CFDABEWAIWZFD2MQ7ZJGCPYSQ44/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3J5N24ECS4B6MJDRO6UAYU6GPLYBDCL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRQHN7RWJQJHYP6E5EKESOYP5VDSHZG4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RA2MBEEES6L46OD64OBSVUUMGKNGMOWW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4IDB5OAR5Y4UK3HLMZBW4WEL2B7YFMJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZH26JGNZ5XYPZ5SAU3NKSBSPRE5OHTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2MZOJYGFCB5PPT6AKMAU72N7QOYWLBP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UONZWLB4QVLQIY5CPDLEUEKH6WX4VQMC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTOAUJNDWZDRWVSXJ354AYZYKRMT56HU/","https://pointernull.com/security/python-url-parse-problem.html","https://security.netapp.com/advisory/ntap-20230324-0004/","https://www.kb.cert.org/vuls/id/127587","https://lists.debian.org/debian-lts-announce/2024/11/msg00005.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24329","description":"An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters."}]},{"artifact":{"id":"988c8a69c0d8509e","cpes":["cpe:2.3:a:python3.7-minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7-minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7-minimal","purl":"pkg:deb/debian/python3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.list"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.7-minimal.preinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.prerm"}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-24329","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-24329","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-10-08","epss":0.20459,"percentile":0.9745}],"risk":15.344249999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-24329","description":"An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters."},"relatedVulnerabilities":[{"id":"CVE-2023-24329","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-10-08","epss":0.20459,"percentile":0.9745}],"urls":["https://github.com/python/cpython/issues/102153","https://github.com/python/cpython/pull/99421","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PEVICI7YNGGMSL3UCMWGE66QFLATH72/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSL6NSOAXWBJJ67XPLSSC74MNKZF3BBO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EM2XLZSTXG44TMFXF4E6VTGKR2MQCW3G/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2NY75GFDZ5T6YPN44D3VMFT5SUVTOTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GR5US3BYILYJ4SKBV6YBNPRUBAL5P2CN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H23OSKC6UG6IWOQAUPW74YUHWRWVXJP7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTLGV2HYFF4AMYJL25VDIGAIHCU7UPA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWC4WGXER5P6Q75RFGL7QUTPP3N5JR7T/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZEHSXSCMA4WWQKXT6QV7AAR6SWNZ2VP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5SP4RT3RRS434ZS2HQKQJ3VZW7YPKYR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHHJHJRLEF3TDT2K3676CAUVRDD4CCMR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUN6T22UJFXR7J5F6UUHCXXPKJ2DVHI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PURM5CFDABEWAIWZFD2MQ7ZJGCPYSQ44/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3J5N24ECS4B6MJDRO6UAYU6GPLYBDCL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRQHN7RWJQJHYP6E5EKESOYP5VDSHZG4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RA2MBEEES6L46OD64OBSVUUMGKNGMOWW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4IDB5OAR5Y4UK3HLMZBW4WEL2B7YFMJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZH26JGNZ5XYPZ5SAU3NKSBSPRE5OHTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2MZOJYGFCB5PPT6AKMAU72N7QOYWLBP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UONZWLB4QVLQIY5CPDLEUEKH6WX4VQMC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTOAUJNDWZDRWVSXJ354AYZYKRMT56HU/","https://pointernull.com/security/python-url-parse-problem.html","https://security.netapp.com/advisory/ntap-20230324-0004/","https://www.kb.cert.org/vuls/id/127587","https://lists.debian.org/debian-lts-announce/2024/11/msg00005.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24329","description":"An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters."}]},{"artifact":{"id":"bca20a7b0a858bf3","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/debian/libssl1.1@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1&upstream=openssl","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1n-0+deb10u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-4450","versionConstraint":"< 1.1.1n-0+deb10u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-4450","fix":{"state":"fixed","versions":["1.1.1n-0+deb10u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1n-0+deb10u4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4450","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4450","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4450","date":"2026-10-08","epss":0.20287,"percentile":0.97419}],"risk":15.21525,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-4450","description":"The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the \"name\" (e.g. \"CERTIFICATE\"), any header data and the payload data. If the function succeeds then the \"name_out\", \"header\" and \"data\" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack.  The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected.  These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0.  The OpenSSL asn1parse command line application is also impacted by this issue."},"relatedVulnerabilities":[{"id":"CVE-2022-4450","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4450","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4450","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4450","date":"2026-10-08","epss":0.20287,"percentile":0.97419}],"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=63bcf189be73a9cc1264059bed6f57974be74a83","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=bbcf509bd046b34cca19c766bbddc31683d0858b","https://security.gentoo.org/glsa/202402-08","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-4450","description":"The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and\ndecodes the \"name\" (e.g. \"CERTIFICATE\"), any header data and the payload data.\nIf the function succeeds then the \"name_out\", \"header\" and \"data\" arguments are\npopulated with pointers to buffers containing the relevant decoded data. The\ncaller is responsible for freeing those buffers. It is possible to construct a\nPEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex()\nwill return a failure code but will populate the header argument with a pointer\nto a buffer that has already been freed. If the caller also frees this buffer\nthen a double free will occur. This will most likely lead to a crash. This\ncould be exploited by an attacker who has the ability to supply malicious PEM\nfiles for parsing to achieve a denial of service attack.\n\nThe functions PEM_read_bio() and PEM_read() are simple wrappers around\nPEM_read_bio_ex() and therefore these functions are also directly affected.\n\nThese functions are also called indirectly by a number of other OpenSSL\nfunctions including PEM_X509_INFO_read_bio_ex() and\nSSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal\nuses of these functions are not vulnerable because the caller does not free the\nheader argument if PEM_read_bio_ex() returns a failure code. These locations\ninclude the PEM_read_bio_TYPE() functions as well as the decoders introduced in\nOpenSSL 3.0.\n\nThe OpenSSL asn1parse command line application is also impacted by this issue."}]},{"artifact":{"id":"d308e84bddad0b0f","cpes":["cpe:2.3:a:openssl:openssl:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1n-0+deb10u4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-4450","versionConstraint":"< 1.1.1n-0+deb10u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-4450","fix":{"state":"fixed","versions":["1.1.1n-0+deb10u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1n-0+deb10u4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4450","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4450","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4450","date":"2026-10-08","epss":0.20287,"percentile":0.97419}],"risk":15.21525,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-4450","description":"The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the \"name\" (e.g. \"CERTIFICATE\"), any header data and the payload data. If the function succeeds then the \"name_out\", \"header\" and \"data\" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack.  The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected.  These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0.  The OpenSSL asn1parse command line application is also impacted by this issue."},"relatedVulnerabilities":[{"id":"CVE-2022-4450","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4450","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4450","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4450","date":"2026-10-08","epss":0.20287,"percentile":0.97419}],"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=63bcf189be73a9cc1264059bed6f57974be74a83","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=bbcf509bd046b34cca19c766bbddc31683d0858b","https://security.gentoo.org/glsa/202402-08","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-4450","description":"The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and\ndecodes the \"name\" (e.g. \"CERTIFICATE\"), any header data and the payload data.\nIf the function succeeds then the \"name_out\", \"header\" and \"data\" arguments are\npopulated with pointers to buffers containing the relevant decoded data. The\ncaller is responsible for freeing those buffers. It is possible to construct a\nPEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex()\nwill return a failure code but will populate the header argument with a pointer\nto a buffer that has already been freed. If the caller also frees this buffer\nthen a double free will occur. This will most likely lead to a crash. This\ncould be exploited by an attacker who has the ability to supply malicious PEM\nfiles for parsing to achieve a denial of service attack.\n\nThe functions PEM_read_bio() and PEM_read() are simple wrappers around\nPEM_read_bio_ex() and therefore these functions are also directly affected.\n\nThese functions are also called indirectly by a number of other OpenSSL\nfunctions including PEM_X509_INFO_read_bio_ex() and\nSSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal\nuses of these functions are not vulnerable because the caller does not free the\nheader argument if PEM_read_bio_ex() returns a failure code. These locations\ninclude the PEM_read_bio_TYPE() functions as well as the decoders introduced in\nOpenSSL 3.0.\n\nThe OpenSSL asn1parse command line application is also impacted by this issue."}]},{"artifact":{"id":"9c0f03079e497030","cpes":["cpe:2.3:a:libpython3.7-minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-minimal","purl":"pkg:deb/debian/libpython3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9948","versionConstraint":"< 3.7.3-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-9948","fix":{"state":"fixed","versions":["3.7.3-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-10-08","epss":0.11844,"percentile":0.95998}],"risk":10.718820000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9948","description":"urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call."},"relatedVulnerabilities":[{"id":"CVE-2019-9948","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-10-08","epss":0.11844,"percentile":0.95998}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.securityfocus.com/bid/107549","https://access.redhat.com/errata/RHSA-2019:1700","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://bugs.python.org/issue35907","https://github.com/python/cpython/pull/11842","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190404-0004/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9948","description":"urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call."}]},{"artifact":{"id":"b6d8c37141cd8c0a","cpes":["cpe:2.3:a:libpython3.7-stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-stdlib","purl":"pkg:deb/debian/libpython3.7-stdlib@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9948","versionConstraint":"< 3.7.3-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-9948","fix":{"state":"fixed","versions":["3.7.3-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-10-08","epss":0.11844,"percentile":0.95998}],"risk":10.718820000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9948","description":"urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call."},"relatedVulnerabilities":[{"id":"CVE-2019-9948","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-10-08","epss":0.11844,"percentile":0.95998}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.securityfocus.com/bid/107549","https://access.redhat.com/errata/RHSA-2019:1700","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://bugs.python.org/issue35907","https://github.com/python/cpython/pull/11842","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190404-0004/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9948","description":"urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call."}]},{"artifact":{"id":"94955c7d71be2bb1","cpes":["cpe:2.3:a:python3.7:python3.7:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7","purl":"pkg:deb/debian/python3.7@3.7.3-2?arch=amd64&distro=debian-10.1","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.list"},{"path":"/var/lib/dpkg/info/python3.7.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.postinst"},{"path":"/var/lib/dpkg/info/python3.7.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-9948","versionConstraint":"< 3.7.3-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-9948","fix":{"state":"fixed","versions":["3.7.3-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-10-08","epss":0.11844,"percentile":0.95998}],"risk":10.718820000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9948","description":"urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call."},"relatedVulnerabilities":[{"id":"CVE-2019-9948","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-10-08","epss":0.11844,"percentile":0.95998}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.securityfocus.com/bid/107549","https://access.redhat.com/errata/RHSA-2019:1700","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://bugs.python.org/issue35907","https://github.com/python/cpython/pull/11842","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190404-0004/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9948","description":"urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call."}]},{"artifact":{"id":"988c8a69c0d8509e","cpes":["cpe:2.3:a:python3.7-minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7-minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7-minimal","purl":"pkg:deb/debian/python3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.list"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.7-minimal.preinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.prerm"}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9948","versionConstraint":"< 3.7.3-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-9948","fix":{"state":"fixed","versions":["3.7.3-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-10-08","epss":0.11844,"percentile":0.95998}],"risk":10.718820000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9948","description":"urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call."},"relatedVulnerabilities":[{"id":"CVE-2019-9948","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-10-08","epss":0.11844,"percentile":0.95998}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.securityfocus.com/bid/107549","https://access.redhat.com/errata/RHSA-2019:1700","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://bugs.python.org/issue35907","https://github.com/python/cpython/pull/11842","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190404-0004/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9948","description":"urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call."}]},{"artifact":{"id":"16faa100e8d6ebcf","cpes":["cpe:2.3:a:libssh2-1:libssh2-1:1.8.0-2.1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2-1:libssh2_1:1.8.0-2.1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2-1:1.8.0-2.1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2_1:1.8.0-2.1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2-1:1.8.0-2.1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2_1:1.8.0-2.1:*:*:*:*:*:*:*"],"name":"libssh2-1","purl":"pkg:deb/debian/libssh2-1@1.8.0-2.1?arch=amd64&distro=debian-10.1&upstream=libssh2","type":"deb","version":"1.8.0-2.1","language":"","licenses":["BSD3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh2-1/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libssh2-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.8.0-2.1+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-13115","versionConstraint":"< 1.8.0-2.1+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"libssh2","version":"1.8.0-2.1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-13115","fix":{"state":"fixed","versions":["1.8.0-2.1+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.8.0-2.1+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-13115","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-13115","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-13115","date":"2026-10-08","epss":0.11659,"percentile":0.95959}],"risk":9.09402,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-13115","description":"In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855."},"relatedVulnerabilities":[{"id":"CVE-2019-13115","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-13115","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-13115","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-13115","date":"2026-10-08","epss":0.11659,"percentile":0.95959}],"urls":["http://packetstormsecurity.com/files/172834/libssh2-1.8.2-Out-Of-Bounds-Read.html","https://blog.semmle.com/libssh2-integer-overflow/","https://github.com/libssh2/libssh2/compare/02ecf17...42d37aa","https://github.com/libssh2/libssh2/pull/350","https://libssh2.org/changes.html","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/07/msg00024.html","https://lists.debian.org/debian-lts-announce/2021/12/msg00013.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6LUNHPW64IGCASZ4JQ2J5KDXNZN53DWW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M7IF3LNHOA75O4WZWIHJLIRMA5LJUED3/","https://security.netapp.com/advisory/ntap-20190806-0002/","https://support.f5.com/csp/article/K13322484","https://support.f5.com/csp/article/K13322484?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-13115","description":"In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855."}]},{"artifact":{"id":"7f19231bca942dc4","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/debian/libldap-2.4-2@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36230","versionConstraint":"< 2.4.47+dfsg-3+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-36230","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36230","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36230","date":"2026-10-08","epss":0.11968,"percentile":0.96027}],"risk":8.975999999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4845-1","link":"https://security-tracker.debian.org/tracker/DSA-4845-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-36230","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in denial of service."},"relatedVulnerabilities":[{"id":"CVE-2020-36230","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36230","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36230","date":"2026-10-08","epss":0.11968,"percentile":0.96027}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9423","https://git.openldap.org/openldap/openldap/-/commit/8c1d96ee36ed98b32cd0e28b7069c7b8ea09d793","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36230","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in denial of service."}]},{"artifact":{"id":"ed53a6639a2640b0","cpes":["cpe:2.3:a:libldap-common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-common","purl":"pkg:deb/debian/libldap-common@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=all&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-common/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.list"}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36230","versionConstraint":"< 2.4.47+dfsg-3+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-36230","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36230","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36230","date":"2026-10-08","epss":0.11968,"percentile":0.96027}],"risk":8.975999999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4845-1","link":"https://security-tracker.debian.org/tracker/DSA-4845-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-36230","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in denial of service."},"relatedVulnerabilities":[{"id":"CVE-2020-36230","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36230","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36230","date":"2026-10-08","epss":0.11968,"percentile":0.96027}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9423","https://git.openldap.org/openldap/openldap/-/commit/8c1d96ee36ed98b32cd0e28b7069c7b8ea09d793","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36230","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in denial of service."}]},{"artifact":{"id":"5a00b6e84834b8f7","cpes":["cpe:2.3:a:libperl5.28:libperl5.28:5.28.1-6:*:*:*:*:*:*:*"],"name":"libperl5.28","purl":"pkg:deb/debian/libperl5.28@5.28.1-6?arch=amd64&distro=debian-10.1&upstream=perl","type":"deb","version":"5.28.1-6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.28/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libperl5.28/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.28:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libperl5.28:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.28.1-6+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10543","versionConstraint":"< 5.28.1-6+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"perl","version":"5.28.1-6"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-10543","fix":{"state":"fixed","versions":["5.28.1-6+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.28.1-6+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-08","epss":0.11334,"percentile":0.95884}],"risk":8.897189999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10543","description":"Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow."},"relatedVulnerabilities":[{"id":"CVE-2020-10543","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-08","epss":0.11334,"percentile":0.95884}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10543","description":"Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow."}]},{"artifact":{"id":"4a18855ea4ce4a40","cpes":["cpe:2.3:a:perl:perl:5.28.1-6:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.28.1-6?arch=amd64&distro=debian-10.1","type":"deb","version":"5.28.1-6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl.preinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.28.1-6+deb10u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-10543","versionConstraint":"< 5.28.1-6+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"perl","version":"5.28.1-6"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-10543","fix":{"state":"fixed","versions":["5.28.1-6+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.28.1-6+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-08","epss":0.11334,"percentile":0.95884}],"risk":8.897189999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10543","description":"Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow."},"relatedVulnerabilities":[{"id":"CVE-2020-10543","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-08","epss":0.11334,"percentile":0.95884}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10543","description":"Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow."}]},{"artifact":{"id":"62eec6c9883d4a8d","cpes":["cpe:2.3:a:perl-base:perl-base:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.28.1-6:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.28.1-6?arch=amd64&distro=debian-10.1&upstream=perl","type":"deb","version":"5.28.1-6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/perl-base.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.28.1-6+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10543","versionConstraint":"< 5.28.1-6+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"perl","version":"5.28.1-6"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-10543","fix":{"state":"fixed","versions":["5.28.1-6+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.28.1-6+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-08","epss":0.11334,"percentile":0.95884}],"risk":8.897189999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10543","description":"Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow."},"relatedVulnerabilities":[{"id":"CVE-2020-10543","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-08","epss":0.11334,"percentile":0.95884}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10543","description":"Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow."}]},{"artifact":{"id":"600f71408b95fb2a","cpes":["cpe:2.3:a:perl-modules-5.28:perl-modules-5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.28:perl_modules_5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.28:perl-modules-5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.28:perl_modules_5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.28:5.28.1-6:*:*:*:*:*:*:*"],"name":"perl-modules-5.28","purl":"pkg:deb/debian/perl-modules-5.28@5.28.1-6?arch=all&distro=debian-10.1&upstream=perl","type":"deb","version":"5.28.1-6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.28/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/perl-modules-5.28/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.28.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl-modules-5.28.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.28.list","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl-modules-5.28.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.28.1-6+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10543","versionConstraint":"< 5.28.1-6+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"perl","version":"5.28.1-6"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-10543","fix":{"state":"fixed","versions":["5.28.1-6+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.28.1-6+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-08","epss":0.11334,"percentile":0.95884}],"risk":8.897189999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10543","description":"Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow."},"relatedVulnerabilities":[{"id":"CVE-2020-10543","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-08","epss":0.11334,"percentile":0.95884}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10543","description":"Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow."}]},{"artifact":{"id":"bca20a7b0a858bf3","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/debian/libssl1.1@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1&upstream=openssl","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1n-0+deb10u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-4304","versionConstraint":"< 1.1.1n-0+deb10u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-4304","fix":{"state":"fixed","versions":["1.1.1n-0+deb10u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1n-0+deb10u4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4304","date":"2026-10-08","epss":0.16195,"percentile":0.96865}],"risk":8.826275,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-4304","description":"A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE.  For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection."},"relatedVulnerabilities":[{"id":"CVE-2022-4304","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4304","date":"2026-10-08","epss":0.16195,"percentile":0.96865}],"urls":["https://security.gentoo.org/glsa/202402-08","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-4304","description":"A timing based side channel exists in the OpenSSL RSA Decryption implementation\nwhich could be sufficient to recover a plaintext across a network in a\nBleichenbacher style attack. To achieve a successful decryption an attacker\nwould have to be able to send a very large number of trial messages for\ndecryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5,\nRSA-OEAP and RSASVE.\n\nFor example, in a TLS connection, RSA is commonly used by a client to send an\nencrypted pre-master secret to the server. An attacker that had observed a\ngenuine connection between a client and a server could use this flaw to send\ntrial messages to the server and record the time taken to process them. After a\nsufficiently large number of messages the attacker could recover the pre-master\nsecret used for the original connection and thus be able to decrypt the\napplication data sent over that connection."}]},{"artifact":{"id":"d308e84bddad0b0f","cpes":["cpe:2.3:a:openssl:openssl:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1n-0+deb10u4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-4304","versionConstraint":"< 1.1.1n-0+deb10u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-4304","fix":{"state":"fixed","versions":["1.1.1n-0+deb10u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1n-0+deb10u4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4304","date":"2026-10-08","epss":0.16195,"percentile":0.96865}],"risk":8.826275,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-4304","description":"A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE.  For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection."},"relatedVulnerabilities":[{"id":"CVE-2022-4304","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4304","date":"2026-10-08","epss":0.16195,"percentile":0.96865}],"urls":["https://security.gentoo.org/glsa/202402-08","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-4304","description":"A timing based side channel exists in the OpenSSL RSA Decryption implementation\nwhich could be sufficient to recover a plaintext across a network in a\nBleichenbacher style attack. To achieve a successful decryption an attacker\nwould have to be able to send a very large number of trial messages for\ndecryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5,\nRSA-OEAP and RSASVE.\n\nFor example, in a TLS connection, RSA is commonly used by a client to send an\nencrypted pre-master secret to the server. An attacker that had observed a\ngenuine connection between a client and a server could use this flaw to send\ntrial messages to the server and record the time taken to process them. After a\nsufficiently large number of messages the attacker could recover the pre-master\nsecret used for the original connection and thus be able to decrypt the\napplication data sent over that connection."}]},{"artifact":{"id":"9c0f03079e497030","cpes":["cpe:2.3:a:libpython3.7-minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-minimal","purl":"pkg:deb/debian/libpython3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3737","versionConstraint":"< 3.7.3-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-3737","fix":{"state":"fixed","versions":["3.7.3-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3737","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3737","date":"2026-10-08","epss":0.11586,"percentile":0.95942}],"risk":8.6895,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-3737","description":"A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability."},"relatedVulnerabilities":[{"id":"CVE-2021-3737","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3737","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3737","date":"2026-10-08","epss":0.11586,"percentile":0.95942}],"urls":["https://bugs.python.org/issue44022","https://bugzilla.redhat.com/show_bug.cgi?id=1995162","https://github.com/python/cpython/pull/25916","https://github.com/python/cpython/pull/26503","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html","https://security.netapp.com/advisory/ntap-20220407-0009/","https://ubuntu.com/security/CVE-2021-3737","https://www.oracle.com/security-alerts/cpujul2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3737","description":"A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability."}]},{"artifact":{"id":"b6d8c37141cd8c0a","cpes":["cpe:2.3:a:libpython3.7-stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-stdlib","purl":"pkg:deb/debian/libpython3.7-stdlib@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3737","versionConstraint":"< 3.7.3-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-3737","fix":{"state":"fixed","versions":["3.7.3-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3737","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3737","date":"2026-10-08","epss":0.11586,"percentile":0.95942}],"risk":8.6895,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-3737","description":"A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability."},"relatedVulnerabilities":[{"id":"CVE-2021-3737","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3737","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3737","date":"2026-10-08","epss":0.11586,"percentile":0.95942}],"urls":["https://bugs.python.org/issue44022","https://bugzilla.redhat.com/show_bug.cgi?id=1995162","https://github.com/python/cpython/pull/25916","https://github.com/python/cpython/pull/26503","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html","https://security.netapp.com/advisory/ntap-20220407-0009/","https://ubuntu.com/security/CVE-2021-3737","https://www.oracle.com/security-alerts/cpujul2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3737","description":"A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability."}]},{"artifact":{"id":"94955c7d71be2bb1","cpes":["cpe:2.3:a:python3.7:python3.7:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7","purl":"pkg:deb/debian/python3.7@3.7.3-2?arch=amd64&distro=debian-10.1","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.list"},{"path":"/var/lib/dpkg/info/python3.7.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.postinst"},{"path":"/var/lib/dpkg/info/python3.7.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-3737","versionConstraint":"< 3.7.3-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-3737","fix":{"state":"fixed","versions":["3.7.3-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3737","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3737","date":"2026-10-08","epss":0.11586,"percentile":0.95942}],"risk":8.6895,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-3737","description":"A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability."},"relatedVulnerabilities":[{"id":"CVE-2021-3737","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3737","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3737","date":"2026-10-08","epss":0.11586,"percentile":0.95942}],"urls":["https://bugs.python.org/issue44022","https://bugzilla.redhat.com/show_bug.cgi?id=1995162","https://github.com/python/cpython/pull/25916","https://github.com/python/cpython/pull/26503","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html","https://security.netapp.com/advisory/ntap-20220407-0009/","https://ubuntu.com/security/CVE-2021-3737","https://www.oracle.com/security-alerts/cpujul2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3737","description":"A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability."}]},{"artifact":{"id":"988c8a69c0d8509e","cpes":["cpe:2.3:a:python3.7-minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7-minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7-minimal","purl":"pkg:deb/debian/python3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.list"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.7-minimal.preinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.prerm"}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3737","versionConstraint":"< 3.7.3-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-3737","fix":{"state":"fixed","versions":["3.7.3-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3737","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3737","date":"2026-10-08","epss":0.11586,"percentile":0.95942}],"risk":8.6895,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-3737","description":"A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability."},"relatedVulnerabilities":[{"id":"CVE-2021-3737","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3737","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3737","date":"2026-10-08","epss":0.11586,"percentile":0.95942}],"urls":["https://bugs.python.org/issue44022","https://bugzilla.redhat.com/show_bug.cgi?id=1995162","https://github.com/python/cpython/pull/25916","https://github.com/python/cpython/pull/26503","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html","https://security.netapp.com/advisory/ntap-20220407-0009/","https://ubuntu.com/security/CVE-2021-3737","https://www.oracle.com/security-alerts/cpujul2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3737","description":"A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability."}]},{"artifact":{"id":"78e377730903892e","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.17-3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.17-3?arch=amd64&distro=debian-10.1&upstream=krb5","type":"deb","version":"1.17-3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.17-3+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-36222","versionConstraint":"< 1.17-3+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"krb5","version":"1.17-3"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-36222","fix":{"state":"fixed","versions":["1.17-3+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.17-3+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-36222","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-36222","date":"2026-10-08","epss":0.10276,"percentile":0.95584}],"risk":7.707,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4944-1","link":"https://security-tracker.debian.org/tracker/DSA-4944-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-36222","description":"ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation."},"relatedVulnerabilities":[{"id":"CVE-2021-36222","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-36222","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-36222","date":"2026-10-08","epss":0.10276,"percentile":0.95584}],"urls":["https://github.com/krb5/krb5/commit/fc98f520caefff2e5ee9a0026fdf5109944b3562","https://github.com/krb5/krb5/releases","https://security.netapp.com/advisory/ntap-20211022-0003/","https://security.netapp.com/advisory/ntap-20211104-0007/","https://web.mit.edu/kerberos/advisories/","https://www.debian.org/security/2021/dsa-4944","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-36222","description":"ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation."}]},{"artifact":{"id":"8934c1cbf61306d1","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.17-3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.17-3?arch=amd64&distro=debian-10.1&upstream=krb5","type":"deb","version":"1.17-3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.17-3+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-36222","versionConstraint":"< 1.17-3+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"krb5","version":"1.17-3"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-36222","fix":{"state":"fixed","versions":["1.17-3+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.17-3+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-36222","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-36222","date":"2026-10-08","epss":0.10276,"percentile":0.95584}],"risk":7.707,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4944-1","link":"https://security-tracker.debian.org/tracker/DSA-4944-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-36222","description":"ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation."},"relatedVulnerabilities":[{"id":"CVE-2021-36222","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-36222","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-36222","date":"2026-10-08","epss":0.10276,"percentile":0.95584}],"urls":["https://github.com/krb5/krb5/commit/fc98f520caefff2e5ee9a0026fdf5109944b3562","https://github.com/krb5/krb5/releases","https://security.netapp.com/advisory/ntap-20211022-0003/","https://security.netapp.com/advisory/ntap-20211104-0007/","https://web.mit.edu/kerberos/advisories/","https://www.debian.org/security/2021/dsa-4944","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-36222","description":"ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation."}]},{"artifact":{"id":"de70c2aa7611f8ea","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.17-3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.17-3?arch=amd64&distro=debian-10.1&upstream=krb5","type":"deb","version":"1.17-3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.17-3+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-36222","versionConstraint":"< 1.17-3+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"krb5","version":"1.17-3"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-36222","fix":{"state":"fixed","versions":["1.17-3+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.17-3+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-36222","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-36222","date":"2026-10-08","epss":0.10276,"percentile":0.95584}],"risk":7.707,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4944-1","link":"https://security-tracker.debian.org/tracker/DSA-4944-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-36222","description":"ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation."},"relatedVulnerabilities":[{"id":"CVE-2021-36222","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-36222","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-36222","date":"2026-10-08","epss":0.10276,"percentile":0.95584}],"urls":["https://github.com/krb5/krb5/commit/fc98f520caefff2e5ee9a0026fdf5109944b3562","https://github.com/krb5/krb5/releases","https://security.netapp.com/advisory/ntap-20211022-0003/","https://security.netapp.com/advisory/ntap-20211104-0007/","https://web.mit.edu/kerberos/advisories/","https://www.debian.org/security/2021/dsa-4944","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-36222","description":"ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation."}]},{"artifact":{"id":"481759f67535d39d","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.17-3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.17-3?arch=amd64&distro=debian-10.1&upstream=krb5","type":"deb","version":"1.17-3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.17-3+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-36222","versionConstraint":"< 1.17-3+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"krb5","version":"1.17-3"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-36222","fix":{"state":"fixed","versions":["1.17-3+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.17-3+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-36222","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-36222","date":"2026-10-08","epss":0.10276,"percentile":0.95584}],"risk":7.707,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4944-1","link":"https://security-tracker.debian.org/tracker/DSA-4944-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-36222","description":"ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation."},"relatedVulnerabilities":[{"id":"CVE-2021-36222","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-36222","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-36222","date":"2026-10-08","epss":0.10276,"percentile":0.95584}],"urls":["https://github.com/krb5/krb5/commit/fc98f520caefff2e5ee9a0026fdf5109944b3562","https://github.com/krb5/krb5/releases","https://security.netapp.com/advisory/ntap-20211022-0003/","https://security.netapp.com/advisory/ntap-20211104-0007/","https://web.mit.edu/kerberos/advisories/","https://www.debian.org/security/2021/dsa-4944","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-36222","description":"ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.17.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0433","versionConstraint":"<1.17.9||>=1.18.0-0,<1.18.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0433","fix":{"state":"fixed","versions":["1.17.9","1.18.1"],"available":[{"date":"2022-04-12","kind":"release","version":"1.17.9"},{"date":"2022-04-12","kind":"release","version":"1.18.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-24675","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-24675","date":"2026-10-08","epss":0.0995,"percentile":0.95486}],"risk":7.4624999999999995,"urls":["https://go.googlesource.com/go/+/45c3387d777caf28f4b992ad9a6216e3085bb8fe","https://go.dev/issue/51853","https://groups.google.com/g/golang-announce/c/oecdBNLOml8"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/399820","description":"encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data."},"relatedVulnerabilities":[{"id":"CVE-2022-24675","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-24675","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-24675","date":"2026-10-08","epss":0.0995,"percentile":0.95486}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf","https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/oecdBNLOml8","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42TYZC4OAY54TO75FBEFAPV5G7O4D5TM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F3BMW5QGX53CMIJIZWKXFKBJX2C5GWTY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RCRSABD6CUDIZULZPZL5BJ3ET3A2NEJP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/","https://security.gentoo.org/glsa/202208-02","https://security.netapp.com/advisory/ntap-20220915-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-24675","description":"encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.17.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0433","versionConstraint":"<1.17.9||>=1.18.0-0,<1.18.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0433","fix":{"state":"fixed","versions":["1.17.9","1.18.1"],"available":[{"date":"2022-04-12","kind":"release","version":"1.17.9"},{"date":"2022-04-12","kind":"release","version":"1.18.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-24675","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-24675","date":"2026-10-08","epss":0.0995,"percentile":0.95486}],"risk":7.4624999999999995,"urls":["https://go.googlesource.com/go/+/45c3387d777caf28f4b992ad9a6216e3085bb8fe","https://go.dev/issue/51853","https://groups.google.com/g/golang-announce/c/oecdBNLOml8"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/399820","description":"encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data."},"relatedVulnerabilities":[{"id":"CVE-2022-24675","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-24675","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-24675","date":"2026-10-08","epss":0.0995,"percentile":0.95486}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf","https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/oecdBNLOml8","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42TYZC4OAY54TO75FBEFAPV5G7O4D5TM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F3BMW5QGX53CMIJIZWKXFKBJX2C5GWTY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RCRSABD6CUDIZULZPZL5BJ3ET3A2NEJP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/","https://security.gentoo.org/glsa/202208-02","https://security.netapp.com/advisory/ntap-20220915-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-24675","description":"encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data."}]},{"artifact":{"id":"bca20a7b0a858bf3","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/debian/libssl1.1@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1&upstream=openssl","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1d-0+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1551","versionConstraint":"< 1.1.1d-0+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-1551","fix":{"state":"fixed","versions":["1.1.1d-0+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1d-0+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1551","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1551","date":"2026-10-08","epss":0.14298,"percentile":0.96523}],"risk":7.3634699999999995,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4855-1","link":"https://security-tracker.debian.org/tracker/DSA-4855-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1551","description":"There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t)."},"relatedVulnerabilities":[{"id":"CVE-2019-1551","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1551","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1551","date":"2026-10-08","epss":0.14298,"percentile":0.96523}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html","http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=419102400a2811582a7a3d4a4e317d72e5ce0a8f","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=f1c5eea8a817075d31e43f5876993c6710238c98","https://lists.debian.org/debian-lts-announce/2022/03/msg00023.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/","https://seclists.org/bugtraq/2019/Dec/39","https://seclists.org/bugtraq/2019/Dec/46","https://security.gentoo.org/glsa/202004-10","https://security.netapp.com/advisory/ntap-20191210-0001/","https://usn.ubuntu.com/4376-1/","https://usn.ubuntu.com/4504-1/","https://www.debian.org/security/2019/dsa-4594","https://www.debian.org/security/2021/dsa-4855","https://www.openssl.org/news/secadv/20191206.txt","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.tenable.com/security/tns-2019-09","https://www.tenable.com/security/tns-2020-03","https://www.tenable.com/security/tns-2020-11","https://www.tenable.com/security/tns-2021-10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1551","description":"There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t)."}]},{"artifact":{"id":"d308e84bddad0b0f","cpes":["cpe:2.3:a:openssl:openssl:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1d-0+deb10u5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-1551","versionConstraint":"< 1.1.1d-0+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-1551","fix":{"state":"fixed","versions":["1.1.1d-0+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1d-0+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1551","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1551","date":"2026-10-08","epss":0.14298,"percentile":0.96523}],"risk":7.3634699999999995,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4855-1","link":"https://security-tracker.debian.org/tracker/DSA-4855-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1551","description":"There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t)."},"relatedVulnerabilities":[{"id":"CVE-2019-1551","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1551","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1551","date":"2026-10-08","epss":0.14298,"percentile":0.96523}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html","http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=419102400a2811582a7a3d4a4e317d72e5ce0a8f","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=f1c5eea8a817075d31e43f5876993c6710238c98","https://lists.debian.org/debian-lts-announce/2022/03/msg00023.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/","https://seclists.org/bugtraq/2019/Dec/39","https://seclists.org/bugtraq/2019/Dec/46","https://security.gentoo.org/glsa/202004-10","https://security.netapp.com/advisory/ntap-20191210-0001/","https://usn.ubuntu.com/4376-1/","https://usn.ubuntu.com/4504-1/","https://www.debian.org/security/2019/dsa-4594","https://www.debian.org/security/2021/dsa-4855","https://www.openssl.org/news/secadv/20191206.txt","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.tenable.com/security/tns-2019-09","https://www.tenable.com/security/tns-2020-03","https://www.tenable.com/security/tns-2020-11","https://www.tenable.com/security/tns-2021-10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1551","description":"There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t)."}]},{"artifact":{"id":"ecf5e89e65014edb","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.64.0-4:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/debian/libcurl4@7.64.0-4?arch=amd64&distro=debian-10.1&upstream=curl","type":"deb","version":"7.64.0-4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.64.0-4+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-8285","versionConstraint":"< 7.64.0-4+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"curl","version":"7.64.0-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-8285","fix":{"state":"fixed","versions":["7.64.0-4+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.64.0-4+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-8285","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-8285","date":"2026-10-08","epss":0.0977,"percentile":0.95425}],"risk":7.3275,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4881-1","link":"https://security-tracker.debian.org/tracker/DSA-4881-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-8285","description":"curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing."},"relatedVulnerabilities":[{"id":"CVE-2020-8285","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-8285","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-8285","date":"2026-10-08","epss":0.0977,"percentile":0.95425}],"urls":["http://seclists.org/fulldisclosure/2021/Apr/51","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://curl.se/docs/CVE-2020-8285.html","https://github.com/curl/curl/issues/6255","https://hackerone.com/reports/1045844","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/","https://security.gentoo.org/glsa/202012-14","https://security.netapp.com/advisory/ntap-20210122-0007/","https://support.apple.com/kb/HT212325","https://support.apple.com/kb/HT212326","https://support.apple.com/kb/HT212327","https://www.debian.org/security/2021/dsa-4881","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8285","description":"curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing."}]},{"artifact":{"id":"ecf5e89e65014edb","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.64.0-4:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/debian/libcurl4@7.64.0-4?arch=amd64&distro=debian-10.1&upstream=curl","type":"deb","version":"7.64.0-4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.64.0-4+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-5481","versionConstraint":"< 7.64.0-4+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"curl","version":"7.64.0-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-5481","fix":{"state":"fixed","versions":["7.64.0-4+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.64.0-4+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5481","cwe":"CWE-415","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5481","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5481","date":"2026-10-08","epss":0.07465,"percentile":0.94317}],"risk":7.0171,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4633-1","link":"https://security-tracker.debian.org/tracker/DSA-4633-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-5481","description":"Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3."},"relatedVulnerabilities":[{"id":"CVE-2019-5481","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5481","cwe":"CWE-415","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5481","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5481","date":"2026-10-08","epss":0.07465,"percentile":0.94317}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html","https://curl.haxx.se/docs/CVE-2019-5481.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CI4QQ2RSZX4VCFM76SIWGKY6BY7UWIC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/","https://seclists.org/bugtraq/2020/Feb/36","https://security.gentoo.org/glsa/202003-29","https://security.netapp.com/advisory/ntap-20191004-0003/","https://www.debian.org/security/2020/dsa-4633","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5481","description":"Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3."}]},{"artifact":{"id":"9c0f03079e497030","cpes":["cpe:2.3:a:libpython3.7-minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-minimal","purl":"pkg:deb/debian/libpython3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0391","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-0391","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-10-08","epss":0.08325,"percentile":0.94816}],"risk":6.24375,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-0391","description":"A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\r' and '\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14."},"relatedVulnerabilities":[{"id":"CVE-2022-0391","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-10-08","epss":0.08325,"percentile":0.94816}],"urls":["https://bugs.python.org/issue43882","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20220225-0009/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0391","description":"A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\r' and '\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14."}]},{"artifact":{"id":"b6d8c37141cd8c0a","cpes":["cpe:2.3:a:libpython3.7-stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-stdlib","purl":"pkg:deb/debian/libpython3.7-stdlib@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0391","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-0391","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-10-08","epss":0.08325,"percentile":0.94816}],"risk":6.24375,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-0391","description":"A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\r' and '\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14."},"relatedVulnerabilities":[{"id":"CVE-2022-0391","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-10-08","epss":0.08325,"percentile":0.94816}],"urls":["https://bugs.python.org/issue43882","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20220225-0009/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0391","description":"A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\r' and '\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14."}]},{"artifact":{"id":"94955c7d71be2bb1","cpes":["cpe:2.3:a:python3.7:python3.7:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7","purl":"pkg:deb/debian/python3.7@3.7.3-2?arch=amd64&distro=debian-10.1","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.list"},{"path":"/var/lib/dpkg/info/python3.7.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.postinst"},{"path":"/var/lib/dpkg/info/python3.7.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-0391","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-0391","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-10-08","epss":0.08325,"percentile":0.94816}],"risk":6.24375,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-0391","description":"A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\r' and '\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14."},"relatedVulnerabilities":[{"id":"CVE-2022-0391","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-10-08","epss":0.08325,"percentile":0.94816}],"urls":["https://bugs.python.org/issue43882","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20220225-0009/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0391","description":"A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\r' and '\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14."}]},{"artifact":{"id":"988c8a69c0d8509e","cpes":["cpe:2.3:a:python3.7-minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7-minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7-minimal","purl":"pkg:deb/debian/python3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.list"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.7-minimal.preinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.prerm"}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0391","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-0391","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-10-08","epss":0.08325,"percentile":0.94816}],"risk":6.24375,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-0391","description":"A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\r' and '\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14."},"relatedVulnerabilities":[{"id":"CVE-2022-0391","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-10-08","epss":0.08325,"percentile":0.94816}],"urls":["https://bugs.python.org/issue43882","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20220225-0009/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0391","description":"A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\r' and '\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14."}]},{"artifact":{"id":"091f259a310587c1","cpes":["cpe:2.3:a:libsasl2-2:libsasl2-2:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-2:libsasl2_2:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2-2:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2_2:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-2:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_2:2.1.27\\+dfsg-1:*:*:*:*:*:*:*"],"name":"libsasl2-2","purl":"pkg:deb/debian/libsasl2-2@2.1.27%2Bdfsg-1?arch=amd64&distro=debian-10.1&upstream=cyrus-sasl2","type":"deb","version":"2.1.27+dfsg-1","language":"","licenses":["BSD-4-clause","GPL-3","GPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-2/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libsasl2-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.1.27+dfsg-1+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-19906","versionConstraint":"< 2.1.27+dfsg-1+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"cyrus-sasl2","version":"2.1.27+dfsg-1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-19906","fix":{"state":"fixed","versions":["2.1.27+dfsg-1+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.1.27+dfsg-1+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19906","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19906","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19906","date":"2026-10-08","epss":0.08036,"percentile":0.94649}],"risk":6.027,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4591-1","link":"https://security-tracker.debian.org/tracker/DSA-4591-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-19906","description":"cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl."},"relatedVulnerabilities":[{"id":"CVE-2019-19906","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19906","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19906","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19906","date":"2026-10-08","epss":0.08036,"percentile":0.94649}],"urls":["http://seclists.org/fulldisclosure/2020/Jul/23","http://seclists.org/fulldisclosure/2020/Jul/24","http://www.openwall.com/lists/oss-security/2022/02/23/4","https://github.com/cyrusimap/cyrus-sasl/issues/587","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/12/msg00027.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MW6GZCLECGL2PBNHVNPJIX4RPVRVFR7R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OB4GSVOJ6ESHQNT5GSV63OX5D4KPSTGT/","https://seclists.org/bugtraq/2019/Dec/42","https://support.apple.com/kb/HT211288","https://support.apple.com/kb/HT211289","https://usn.ubuntu.com/4256-1/","https://www.debian.org/security/2019/dsa-4591","https://www.openldap.org/its/index.cgi/Incoming?id=9123"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19906","description":"cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl."}]},{"artifact":{"id":"f08c59cc842f94ec","cpes":["cpe:2.3:a:libsasl2-modules-db:libsasl2-modules-db:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules-db:libsasl2_modules_db:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2-modules-db:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2_modules_db:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2-modules-db:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2_modules_db:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2-modules-db:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2_modules_db:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-modules-db:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_modules_db:2.1.27\\+dfsg-1:*:*:*:*:*:*:*"],"name":"libsasl2-modules-db","purl":"pkg:deb/debian/libsasl2-modules-db@2.1.27%2Bdfsg-1?arch=amd64&distro=debian-10.1&upstream=cyrus-sasl2","type":"deb","version":"2.1.27+dfsg-1","language":"","licenses":["BSD-4-clause","GPL-3","GPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-modules-db/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libsasl2-modules-db/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.1.27+dfsg-1+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-19906","versionConstraint":"< 2.1.27+dfsg-1+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"cyrus-sasl2","version":"2.1.27+dfsg-1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-19906","fix":{"state":"fixed","versions":["2.1.27+dfsg-1+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.1.27+dfsg-1+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19906","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19906","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19906","date":"2026-10-08","epss":0.08036,"percentile":0.94649}],"risk":6.027,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4591-1","link":"https://security-tracker.debian.org/tracker/DSA-4591-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-19906","description":"cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl."},"relatedVulnerabilities":[{"id":"CVE-2019-19906","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19906","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19906","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19906","date":"2026-10-08","epss":0.08036,"percentile":0.94649}],"urls":["http://seclists.org/fulldisclosure/2020/Jul/23","http://seclists.org/fulldisclosure/2020/Jul/24","http://www.openwall.com/lists/oss-security/2022/02/23/4","https://github.com/cyrusimap/cyrus-sasl/issues/587","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/12/msg00027.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MW6GZCLECGL2PBNHVNPJIX4RPVRVFR7R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OB4GSVOJ6ESHQNT5GSV63OX5D4KPSTGT/","https://seclists.org/bugtraq/2019/Dec/42","https://support.apple.com/kb/HT211288","https://support.apple.com/kb/HT211289","https://usn.ubuntu.com/4256-1/","https://www.debian.org/security/2019/dsa-4591","https://www.openldap.org/its/index.cgi/Incoming?id=9123"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19906","description":"cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl."}]},{"artifact":{"id":"c6f08567c3b7bec6","cpes":["cpe:2.3:a:golang:networking:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.0.0-20190404232315-eb5bcb51f2a3","type":"go-module","version":"v0.0.0-20190404232315-eb5bcb51f2a3","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.0.0-20210520170846-37e1c6afe023"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-83g2-8m93-v3w7","versionConstraint":"<0.0.0-20210520170846-37e1c6afe023 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.0.0-20190404232315-eb5bcb51f2a3"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-83g2-8m93-v3w7","fix":{"state":"fixed","versions":["0.0.0-20210520170846-37e1c6afe023"],"available":[{"date":"2023-02-26","kind":"first-observed","version":"0.0.0-20210520170846-37e1c6afe023"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33194","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33194","date":"2026-10-08","epss":0.07492,"percentile":0.94333}],"risk":5.619000000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-33194","https://github.com/golang/net/commit/37e1c6afe02340126705deced573a85ab75209d7","https://groups.google.com/g/golang-announce/c/wPunbCPkWUg","https://go.dev/cl/311090","https://go.dev/issue/46288","https://go.googlesource.com/net/+/37e1c6afe02340126705deced573a85ab75209d7","https://pkg.go.dev/vuln/GO-2021-0238","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4CHKSFMHZVOBCZSSVRE3UEYNKARTBMTM"],"severity":"High","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-83g2-8m93-v3w7","description":"golang.org/x/net/html Infinite Loop vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2021-33194","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33194","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33194","date":"2026-10-08","epss":0.07492,"percentile":0.94333}],"urls":["https://github.com/golang/net/commit/37e1c6afe02340126705deced573a85ab75209d7","https://groups.google.com/g/golang-announce/c/wPunbCPkWUg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4CHKSFMHZVOBCZSSVRE3UEYNKARTBMTM/","https://pkg.go.dev/vuln/GO-2021-0238"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33194","description":"golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input."}]},{"artifact":{"id":"727332619043e05d","cpes":["cpe:2.3:a:golang:networking:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.0.0-20190404232315-eb5bcb51f2a3","type":"go-module","version":"v0.0.0-20190404232315-eb5bcb51f2a3","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.0.0-20210520170846-37e1c6afe023"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-83g2-8m93-v3w7","versionConstraint":"<0.0.0-20210520170846-37e1c6afe023 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.0.0-20190404232315-eb5bcb51f2a3"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-83g2-8m93-v3w7","fix":{"state":"fixed","versions":["0.0.0-20210520170846-37e1c6afe023"],"available":[{"date":"2023-02-26","kind":"first-observed","version":"0.0.0-20210520170846-37e1c6afe023"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33194","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33194","date":"2026-10-08","epss":0.07492,"percentile":0.94333}],"risk":5.619000000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-33194","https://github.com/golang/net/commit/37e1c6afe02340126705deced573a85ab75209d7","https://groups.google.com/g/golang-announce/c/wPunbCPkWUg","https://go.dev/cl/311090","https://go.dev/issue/46288","https://go.googlesource.com/net/+/37e1c6afe02340126705deced573a85ab75209d7","https://pkg.go.dev/vuln/GO-2021-0238","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4CHKSFMHZVOBCZSSVRE3UEYNKARTBMTM"],"severity":"High","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-83g2-8m93-v3w7","description":"golang.org/x/net/html Infinite Loop vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2021-33194","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33194","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33194","date":"2026-10-08","epss":0.07492,"percentile":0.94333}],"urls":["https://github.com/golang/net/commit/37e1c6afe02340126705deced573a85ab75209d7","https://groups.google.com/g/golang-announce/c/wPunbCPkWUg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4CHKSFMHZVOBCZSSVRE3UEYNKARTBMTM/","https://pkg.go.dev/vuln/GO-2021-0238"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33194","description":"golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input."}]},{"artifact":{"id":"78e377730903892e","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.17-3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.17-3?arch=amd64&distro=debian-10.1&upstream=krb5","type":"deb","version":"1.17-3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.17-3+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-42898","versionConstraint":"< 1.17-3+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"krb5","version":"1.17-3"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-42898","fix":{"state":"fixed","versions":["1.17-3+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.17-3+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-08","epss":0.06473,"percentile":0.93575}],"risk":5.275495,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-42898","description":"PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has \"a similar bug.\""},"relatedVulnerabilities":[{"id":"CVE-2022-42898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-08","epss":0.06473,"percentile":0.93575}],"urls":["https://bugzilla.samba.org/show_bug.cgi?id=15203","https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c","https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583","https://security.gentoo.org/glsa/202309-06","https://security.gentoo.org/glsa/202310-06","https://security.netapp.com/advisory/ntap-20230216-0008/","https://security.netapp.com/advisory/ntap-20230223-0001/","https://web.mit.edu/kerberos/advisories/","https://web.mit.edu/kerberos/krb5-1.19/","https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt","https://www.samba.org/samba/security/CVE-2022-42898.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-42898","description":"PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has \"a similar bug.\""}]},{"artifact":{"id":"8934c1cbf61306d1","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.17-3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.17-3?arch=amd64&distro=debian-10.1&upstream=krb5","type":"deb","version":"1.17-3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.17-3+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-42898","versionConstraint":"< 1.17-3+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"krb5","version":"1.17-3"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-42898","fix":{"state":"fixed","versions":["1.17-3+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.17-3+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-08","epss":0.06473,"percentile":0.93575}],"risk":5.275495,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-42898","description":"PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has \"a similar bug.\""},"relatedVulnerabilities":[{"id":"CVE-2022-42898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-08","epss":0.06473,"percentile":0.93575}],"urls":["https://bugzilla.samba.org/show_bug.cgi?id=15203","https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c","https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583","https://security.gentoo.org/glsa/202309-06","https://security.gentoo.org/glsa/202310-06","https://security.netapp.com/advisory/ntap-20230216-0008/","https://security.netapp.com/advisory/ntap-20230223-0001/","https://web.mit.edu/kerberos/advisories/","https://web.mit.edu/kerberos/krb5-1.19/","https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt","https://www.samba.org/samba/security/CVE-2022-42898.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-42898","description":"PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has \"a similar bug.\""}]},{"artifact":{"id":"de70c2aa7611f8ea","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.17-3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.17-3?arch=amd64&distro=debian-10.1&upstream=krb5","type":"deb","version":"1.17-3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.17-3+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-42898","versionConstraint":"< 1.17-3+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"krb5","version":"1.17-3"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-42898","fix":{"state":"fixed","versions":["1.17-3+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.17-3+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-08","epss":0.06473,"percentile":0.93575}],"risk":5.275495,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-42898","description":"PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has \"a similar bug.\""},"relatedVulnerabilities":[{"id":"CVE-2022-42898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-08","epss":0.06473,"percentile":0.93575}],"urls":["https://bugzilla.samba.org/show_bug.cgi?id=15203","https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c","https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583","https://security.gentoo.org/glsa/202309-06","https://security.gentoo.org/glsa/202310-06","https://security.netapp.com/advisory/ntap-20230216-0008/","https://security.netapp.com/advisory/ntap-20230223-0001/","https://web.mit.edu/kerberos/advisories/","https://web.mit.edu/kerberos/krb5-1.19/","https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt","https://www.samba.org/samba/security/CVE-2022-42898.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-42898","description":"PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has \"a similar bug.\""}]},{"artifact":{"id":"481759f67535d39d","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.17-3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.17-3?arch=amd64&distro=debian-10.1&upstream=krb5","type":"deb","version":"1.17-3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.17-3+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-42898","versionConstraint":"< 1.17-3+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"krb5","version":"1.17-3"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-42898","fix":{"state":"fixed","versions":["1.17-3+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.17-3+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-08","epss":0.06473,"percentile":0.93575}],"risk":5.275495,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-42898","description":"PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has \"a similar bug.\""},"relatedVulnerabilities":[{"id":"CVE-2022-42898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-08","epss":0.06473,"percentile":0.93575}],"urls":["https://bugzilla.samba.org/show_bug.cgi?id=15203","https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c","https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583","https://security.gentoo.org/glsa/202309-06","https://security.gentoo.org/glsa/202310-06","https://security.netapp.com/advisory/ntap-20230216-0008/","https://security.netapp.com/advisory/ntap-20230223-0001/","https://web.mit.edu/kerberos/advisories/","https://web.mit.edu/kerberos/krb5-1.19/","https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt","https://www.samba.org/samba/security/CVE-2022-42898.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-42898","description":"PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has \"a similar bug.\""}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.16.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0273","versionConstraint":"<1.16.8||>=1.17.0-0,<1.17.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0273","fix":{"state":"fixed","versions":["1.16.8","1.17.1"],"available":[{"date":"2021-09-09","kind":"release","version":"1.16.8"},{"date":"2021-09-09","kind":"release","version":"1.17.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-39293","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-39293","date":"2026-10-08","epss":0.06934,"percentile":0.93947}],"risk":5.2005,"urls":["https://go.googlesource.com/go/+/bacbc33439b124ffd7392c91a5f5d96eca8c0c0b","https://go.dev/issue/47801","https://groups.google.com/g/golang-announce/c/dx9d7IOseHw"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/343434","description":"The NewReader and OpenReader functions in archive/zip can cause a panic or an unrecoverable fatal error when reading an archive that claims to contain a large number of files, regardless of its actual size. This is caused by an incomplete fix for CVE-2021-33196."},"relatedVulnerabilities":[{"id":"CVE-2021-39293","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-39293","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-39293","date":"2026-10-08","epss":0.06934,"percentile":0.93947}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf","https://groups.google.com/g/golang-announce/c/dx9d7IOseHw","https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html","https://security.netapp.com/advisory/ntap-20220217-0009/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-39293","description":"In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.16.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0273","versionConstraint":"<1.16.8||>=1.17.0-0,<1.17.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0273","fix":{"state":"fixed","versions":["1.16.8","1.17.1"],"available":[{"date":"2021-09-09","kind":"release","version":"1.16.8"},{"date":"2021-09-09","kind":"release","version":"1.17.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-39293","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-39293","date":"2026-10-08","epss":0.06934,"percentile":0.93947}],"risk":5.2005,"urls":["https://go.googlesource.com/go/+/bacbc33439b124ffd7392c91a5f5d96eca8c0c0b","https://go.dev/issue/47801","https://groups.google.com/g/golang-announce/c/dx9d7IOseHw"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/343434","description":"The NewReader and OpenReader functions in archive/zip can cause a panic or an unrecoverable fatal error when reading an archive that claims to contain a large number of files, regardless of its actual size. This is caused by an incomplete fix for CVE-2021-33196."},"relatedVulnerabilities":[{"id":"CVE-2021-39293","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-39293","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-39293","date":"2026-10-08","epss":0.06934,"percentile":0.93947}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf","https://groups.google.com/g/golang-announce/c/dx9d7IOseHw","https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html","https://security.netapp.com/advisory/ntap-20220217-0009/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-39293","description":"In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196."}]},{"artifact":{"id":"9c0f03079e497030","cpes":["cpe:2.3:a:libpython3.7-minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-minimal","purl":"pkg:deb/debian/libpython3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-10160","versionConstraint":"< 3.7.3-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-10160","fix":{"state":"fixed","versions":["3.7.3-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-10160","cwe":"CWE-172","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-10160","cwe":"CWE-522","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-10160","date":"2026-10-08","epss":0.05227,"percentile":0.92305}],"risk":4.91338,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-10160","description":"A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application."},"relatedVulnerabilities":[{"id":"CVE-2019-10160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-10160","cwe":"CWE-172","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-10160","cwe":"CWE-522","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-10160","date":"2026-10-08","epss":0.05227,"percentile":0.92305}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://access.redhat.com/errata/RHSA-2019:1587","https://access.redhat.com/errata/RHSA-2019:1700","https://access.redhat.com/errata/RHSA-2019:2437","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160","https://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09","https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e","https://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93de","https://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/","https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html","https://security.netapp.com/advisory/ntap-20190617-0003/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-10160","description":"A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application."}]},{"artifact":{"id":"b6d8c37141cd8c0a","cpes":["cpe:2.3:a:libpython3.7-stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-stdlib","purl":"pkg:deb/debian/libpython3.7-stdlib@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-10160","versionConstraint":"< 3.7.3-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-10160","fix":{"state":"fixed","versions":["3.7.3-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-10160","cwe":"CWE-172","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-10160","cwe":"CWE-522","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-10160","date":"2026-10-08","epss":0.05227,"percentile":0.92305}],"risk":4.91338,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-10160","description":"A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application."},"relatedVulnerabilities":[{"id":"CVE-2019-10160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-10160","cwe":"CWE-172","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-10160","cwe":"CWE-522","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-10160","date":"2026-10-08","epss":0.05227,"percentile":0.92305}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://access.redhat.com/errata/RHSA-2019:1587","https://access.redhat.com/errata/RHSA-2019:1700","https://access.redhat.com/errata/RHSA-2019:2437","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160","https://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09","https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e","https://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93de","https://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/","https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html","https://security.netapp.com/advisory/ntap-20190617-0003/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-10160","description":"A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application."}]},{"artifact":{"id":"94955c7d71be2bb1","cpes":["cpe:2.3:a:python3.7:python3.7:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7","purl":"pkg:deb/debian/python3.7@3.7.3-2?arch=amd64&distro=debian-10.1","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.list"},{"path":"/var/lib/dpkg/info/python3.7.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.postinst"},{"path":"/var/lib/dpkg/info/python3.7.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-10160","versionConstraint":"< 3.7.3-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-10160","fix":{"state":"fixed","versions":["3.7.3-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-10160","cwe":"CWE-172","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-10160","cwe":"CWE-522","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-10160","date":"2026-10-08","epss":0.05227,"percentile":0.92305}],"risk":4.91338,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-10160","description":"A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application."},"relatedVulnerabilities":[{"id":"CVE-2019-10160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-10160","cwe":"CWE-172","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-10160","cwe":"CWE-522","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-10160","date":"2026-10-08","epss":0.05227,"percentile":0.92305}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://access.redhat.com/errata/RHSA-2019:1587","https://access.redhat.com/errata/RHSA-2019:1700","https://access.redhat.com/errata/RHSA-2019:2437","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160","https://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09","https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e","https://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93de","https://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/","https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html","https://security.netapp.com/advisory/ntap-20190617-0003/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-10160","description":"A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application."}]},{"artifact":{"id":"988c8a69c0d8509e","cpes":["cpe:2.3:a:python3.7-minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7-minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7-minimal","purl":"pkg:deb/debian/python3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.list"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.7-minimal.preinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.prerm"}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-10160","versionConstraint":"< 3.7.3-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-10160","fix":{"state":"fixed","versions":["3.7.3-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-10160","cwe":"CWE-172","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-10160","cwe":"CWE-522","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-10160","date":"2026-10-08","epss":0.05227,"percentile":0.92305}],"risk":4.91338,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-10160","description":"A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application."},"relatedVulnerabilities":[{"id":"CVE-2019-10160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-10160","cwe":"CWE-172","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-10160","cwe":"CWE-522","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-10160","date":"2026-10-08","epss":0.05227,"percentile":0.92305}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://access.redhat.com/errata/RHSA-2019:1587","https://access.redhat.com/errata/RHSA-2019:1700","https://access.redhat.com/errata/RHSA-2019:2437","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160","https://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09","https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e","https://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93de","https://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/","https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html","https://security.netapp.com/advisory/ntap-20190617-0003/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-10160","description":"A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application."}]},{"artifact":{"id":"9c0f03079e497030","cpes":["cpe:2.3:a:libpython3.7-minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-minimal","purl":"pkg:deb/debian/libpython3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-48565","versionConstraint":"< 3.7.3-2+deb10u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-48565","fix":{"state":"fixed","versions":["3.7.3-2+deb10u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u6"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-48565","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-48565","date":"2026-10-08","epss":0.05065,"percentile":0.92102}],"risk":4.7611,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-48565","description":"An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities."},"relatedVulnerabilities":[{"id":"CVE-2022-48565","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-48565","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-48565","date":"2026-10-08","epss":0.05065,"percentile":0.92102}],"urls":["https://bugs.python.org/issue42051","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFHYAGWBFBNUGWU6XWKBHTCV5NH77MB7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BAYWJD576JUKLHCWKDLMJSUGTRDKPF3M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZRZRJHWLZ7MOJNPQBWGJVXMVYDC5BRA/","https://security.netapp.com/advisory/ntap-20231006-0007/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-48565","description":"An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities."}]},{"artifact":{"id":"b6d8c37141cd8c0a","cpes":["cpe:2.3:a:libpython3.7-stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-stdlib","purl":"pkg:deb/debian/libpython3.7-stdlib@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-48565","versionConstraint":"< 3.7.3-2+deb10u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-48565","fix":{"state":"fixed","versions":["3.7.3-2+deb10u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u6"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-48565","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-48565","date":"2026-10-08","epss":0.05065,"percentile":0.92102}],"risk":4.7611,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-48565","description":"An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities."},"relatedVulnerabilities":[{"id":"CVE-2022-48565","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-48565","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-48565","date":"2026-10-08","epss":0.05065,"percentile":0.92102}],"urls":["https://bugs.python.org/issue42051","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFHYAGWBFBNUGWU6XWKBHTCV5NH77MB7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BAYWJD576JUKLHCWKDLMJSUGTRDKPF3M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZRZRJHWLZ7MOJNPQBWGJVXMVYDC5BRA/","https://security.netapp.com/advisory/ntap-20231006-0007/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-48565","description":"An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities."}]},{"artifact":{"id":"94955c7d71be2bb1","cpes":["cpe:2.3:a:python3.7:python3.7:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7","purl":"pkg:deb/debian/python3.7@3.7.3-2?arch=amd64&distro=debian-10.1","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.list"},{"path":"/var/lib/dpkg/info/python3.7.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.postinst"},{"path":"/var/lib/dpkg/info/python3.7.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-48565","versionConstraint":"< 3.7.3-2+deb10u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-48565","fix":{"state":"fixed","versions":["3.7.3-2+deb10u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u6"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-48565","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-48565","date":"2026-10-08","epss":0.05065,"percentile":0.92102}],"risk":4.7611,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-48565","description":"An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities."},"relatedVulnerabilities":[{"id":"CVE-2022-48565","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-48565","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-48565","date":"2026-10-08","epss":0.05065,"percentile":0.92102}],"urls":["https://bugs.python.org/issue42051","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFHYAGWBFBNUGWU6XWKBHTCV5NH77MB7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BAYWJD576JUKLHCWKDLMJSUGTRDKPF3M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZRZRJHWLZ7MOJNPQBWGJVXMVYDC5BRA/","https://security.netapp.com/advisory/ntap-20231006-0007/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-48565","description":"An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities."}]},{"artifact":{"id":"988c8a69c0d8509e","cpes":["cpe:2.3:a:python3.7-minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7-minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7-minimal","purl":"pkg:deb/debian/python3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.list"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.7-minimal.preinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.prerm"}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-48565","versionConstraint":"< 3.7.3-2+deb10u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-48565","fix":{"state":"fixed","versions":["3.7.3-2+deb10u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u6"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-48565","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-48565","date":"2026-10-08","epss":0.05065,"percentile":0.92102}],"risk":4.7611,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-48565","description":"An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities."},"relatedVulnerabilities":[{"id":"CVE-2022-48565","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-48565","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-48565","date":"2026-10-08","epss":0.05065,"percentile":0.92102}],"urls":["https://bugs.python.org/issue42051","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AFHYAGWBFBNUGWU6XWKBHTCV5NH77MB7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BAYWJD576JUKLHCWKDLMJSUGTRDKPF3M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KZRZRJHWLZ7MOJNPQBWGJVXMVYDC5BRA/","https://security.netapp.com/advisory/ntap-20231006-0007/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-48565","description":"An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities."}]},{"artifact":{"id":"9c0f03079e497030","cpes":["cpe:2.3:a:libpython3.7-minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-minimal","purl":"pkg:deb/debian/libpython3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-26116","versionConstraint":"< 3.7.3-2+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-26116","fix":{"state":"fixed","versions":["3.7.3-2+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-26116","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-26116","date":"2026-10-08","epss":0.06358,"percentile":0.93473}],"risk":4.67313,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-26116","description":"http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request."},"relatedVulnerabilities":[{"id":"CVE-2020-26116","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-26116","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-26116","date":"2026-10-08","epss":0.06358,"percentile":0.93473}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00027.html","https://bugs.python.org/issue39603","https://lists.debian.org/debian-lts-announce/2020/11/msg00032.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BW4GCLQISJCOEGQNIMVUZDQMIY6RR6CC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HDQ2THWU4GPV4Y5H5WW5PFMSWXL2CRFD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWMAVY4T4257AZHTF2RZJKNJNSJFY24O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QOX7DGMMWWL6POCRYGAUCISOLR2IG3XV/","https://python-security.readthedocs.io/vuln/http-header-injection-method.html","https://security.gentoo.org/glsa/202101-18","https://security.netapp.com/advisory/ntap-20201023-0001/","https://usn.ubuntu.com/4581-1/","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-26116","description":"http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request."}]},{"artifact":{"id":"b6d8c37141cd8c0a","cpes":["cpe:2.3:a:libpython3.7-stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-stdlib","purl":"pkg:deb/debian/libpython3.7-stdlib@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-26116","versionConstraint":"< 3.7.3-2+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-26116","fix":{"state":"fixed","versions":["3.7.3-2+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-26116","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-26116","date":"2026-10-08","epss":0.06358,"percentile":0.93473}],"risk":4.67313,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-26116","description":"http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request."},"relatedVulnerabilities":[{"id":"CVE-2020-26116","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-26116","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-26116","date":"2026-10-08","epss":0.06358,"percentile":0.93473}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00027.html","https://bugs.python.org/issue39603","https://lists.debian.org/debian-lts-announce/2020/11/msg00032.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BW4GCLQISJCOEGQNIMVUZDQMIY6RR6CC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HDQ2THWU4GPV4Y5H5WW5PFMSWXL2CRFD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWMAVY4T4257AZHTF2RZJKNJNSJFY24O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QOX7DGMMWWL6POCRYGAUCISOLR2IG3XV/","https://python-security.readthedocs.io/vuln/http-header-injection-method.html","https://security.gentoo.org/glsa/202101-18","https://security.netapp.com/advisory/ntap-20201023-0001/","https://usn.ubuntu.com/4581-1/","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-26116","description":"http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request."}]},{"artifact":{"id":"94955c7d71be2bb1","cpes":["cpe:2.3:a:python3.7:python3.7:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7","purl":"pkg:deb/debian/python3.7@3.7.3-2?arch=amd64&distro=debian-10.1","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.list"},{"path":"/var/lib/dpkg/info/python3.7.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.postinst"},{"path":"/var/lib/dpkg/info/python3.7.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u3"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-26116","versionConstraint":"< 3.7.3-2+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-26116","fix":{"state":"fixed","versions":["3.7.3-2+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-26116","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-26116","date":"2026-10-08","epss":0.06358,"percentile":0.93473}],"risk":4.67313,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-26116","description":"http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request."},"relatedVulnerabilities":[{"id":"CVE-2020-26116","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-26116","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-26116","date":"2026-10-08","epss":0.06358,"percentile":0.93473}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00027.html","https://bugs.python.org/issue39603","https://lists.debian.org/debian-lts-announce/2020/11/msg00032.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BW4GCLQISJCOEGQNIMVUZDQMIY6RR6CC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HDQ2THWU4GPV4Y5H5WW5PFMSWXL2CRFD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWMAVY4T4257AZHTF2RZJKNJNSJFY24O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QOX7DGMMWWL6POCRYGAUCISOLR2IG3XV/","https://python-security.readthedocs.io/vuln/http-header-injection-method.html","https://security.gentoo.org/glsa/202101-18","https://security.netapp.com/advisory/ntap-20201023-0001/","https://usn.ubuntu.com/4581-1/","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-26116","description":"http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request."}]},{"artifact":{"id":"988c8a69c0d8509e","cpes":["cpe:2.3:a:python3.7-minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7-minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7-minimal","purl":"pkg:deb/debian/python3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.list"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.7-minimal.preinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.prerm"}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-26116","versionConstraint":"< 3.7.3-2+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-26116","fix":{"state":"fixed","versions":["3.7.3-2+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-26116","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-26116","date":"2026-10-08","epss":0.06358,"percentile":0.93473}],"risk":4.67313,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-26116","description":"http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request."},"relatedVulnerabilities":[{"id":"CVE-2020-26116","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-26116","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-26116","date":"2026-10-08","epss":0.06358,"percentile":0.93473}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00027.html","https://bugs.python.org/issue39603","https://lists.debian.org/debian-lts-announce/2020/11/msg00032.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BW4GCLQISJCOEGQNIMVUZDQMIY6RR6CC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HDQ2THWU4GPV4Y5H5WW5PFMSWXL2CRFD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWMAVY4T4257AZHTF2RZJKNJNSJFY24O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QOX7DGMMWWL6POCRYGAUCISOLR2IG3XV/","https://python-security.readthedocs.io/vuln/http-header-injection-method.html","https://security.gentoo.org/glsa/202101-18","https://security.netapp.com/advisory/ntap-20201023-0001/","https://usn.ubuntu.com/4581-1/","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-26116","description":"http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request."}]},{"artifact":{"id":"d55bfe42f054b394","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.2.6-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.2.6-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=expat","type":"deb","version":"2.2.6-2+deb10u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.6-2+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-25235","versionConstraint":"< 2.2.6-2+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"expat","version":"2.2.6-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-25235","fix":{"state":"fixed","versions":["2.2.6-2+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.6-2+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-25235","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-25235","cwe":"CWE-116","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-25235","date":"2026-10-08","epss":0.04955,"percentile":0.91956}],"risk":4.6577,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5085-1","link":"https://security-tracker.debian.org/tracker/DSA-5085-1"},{"id":"DSA-5085-2","link":"https://security-tracker.debian.org/tracker/DSA-5085-2"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-25235","description":"xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context."},"relatedVulnerabilities":[{"id":"CVE-2022-25235","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-25235","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-25235","cwe":"CWE-116","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-25235","date":"2026-10-08","epss":0.04955,"percentile":0.91956}],"urls":["http://www.openwall.com/lists/oss-security/2022/02/19/1","https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","https://github.com/libexpat/libexpat/pull/562","https://lists.debian.org/debian-lts-announce/2022/03/msg00007.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UFRBA3UQVIQKXTBUQXDWQOVWNBKLERU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y27XO3JMKAOMQZVPS3B4MJGEAHCZF5OM/","https://security.gentoo.org/glsa/202209-24","https://security.netapp.com/advisory/ntap-20220303-0008/","https://www.debian.org/security/2022/dsa-5085","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25235","description":"xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context."}]},{"artifact":{"id":"02757d5e36fd6ee1","cpes":["cpe:2.3:a:libsystemd0:libsystemd0:241-7\\~deb10u1:*:*:*:*:*:*:*"],"name":"libsystemd0","purl":"pkg:deb/debian/libsystemd0@241-7~deb10u1?arch=amd64&distro=debian-10.1&upstream=systemd","type":"deb","version":"241-7~deb10u1","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsystemd0/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libsystemd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"241-7~deb10u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-33910","versionConstraint":"< 241-7~deb10u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"systemd","version":"241-7~deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-33910","fix":{"state":"fixed","versions":["241-7~deb10u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"241-7~deb10u8"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33910","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-33910","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-33910","date":"2026-10-08","epss":0.08792,"percentile":0.95058}],"risk":4.6158,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4942-1","link":"https://security-tracker.debian.org/tracker/DSA-4942-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-33910","description":"basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash."},"relatedVulnerabilities":[{"id":"CVE-2021-33910","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":4.9,"impactScore":6.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33910","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-33910","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-33910","date":"2026-10-08","epss":0.08792,"percentile":0.95058}],"urls":["http://packetstormsecurity.com/files/163621/Sequoia-A-Deep-Root-In-Linuxs-Filesystem-Layer.html","http://www.openwall.com/lists/oss-security/2021/08/04/2","http://www.openwall.com/lists/oss-security/2021/08/17/3","http://www.openwall.com/lists/oss-security/2021/09/07/3","https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf","https://github.com/systemd/systemd-stable/commit/4a1c5f34bd3e1daed4490e9d97918e504d19733b","https://github.com/systemd/systemd-stable/commit/764b74113e36ac5219a4b82a05f311b5a92136ce","https://github.com/systemd/systemd-stable/commit/b00674347337b7531c92fdb65590ab253bb57538","https://github.com/systemd/systemd-stable/commit/cfd14c65374027b34dbbc4f0551456c5dc2d1f61","https://github.com/systemd/systemd/commit/b34a4f0e6729de292cb3b0c03c1d48f246ad896b","https://github.com/systemd/systemd/pull/20256/commits/441e0115646d54f080e5c3bb0ba477c892861ab9","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2LSDMHAKI4LGFOCSPXNVVSEWQFAVFWR7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42TMJVNYRY65B4QCJICBYOEIVZV3KUYI/","https://security.gentoo.org/glsa/202107-48","https://security.netapp.com/advisory/ntap-20211104-0008/","https://www.debian.org/security/2021/dsa-4942","https://www.openwall.com/lists/oss-security/2021/07/20/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33910","description":"basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash."}]},{"artifact":{"id":"8899fd13acd75827","cpes":["cpe:2.3:a:libudev1:libudev1:241-7\\~deb10u1:*:*:*:*:*:*:*"],"name":"libudev1","purl":"pkg:deb/debian/libudev1@241-7~deb10u1?arch=amd64&distro=debian-10.1&upstream=systemd","type":"deb","version":"241-7~deb10u1","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"241-7~deb10u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-33910","versionConstraint":"< 241-7~deb10u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"systemd","version":"241-7~deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-33910","fix":{"state":"fixed","versions":["241-7~deb10u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"241-7~deb10u8"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33910","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-33910","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-33910","date":"2026-10-08","epss":0.08792,"percentile":0.95058}],"risk":4.6158,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4942-1","link":"https://security-tracker.debian.org/tracker/DSA-4942-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-33910","description":"basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash."},"relatedVulnerabilities":[{"id":"CVE-2021-33910","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":4.9,"impactScore":6.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33910","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-33910","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-33910","date":"2026-10-08","epss":0.08792,"percentile":0.95058}],"urls":["http://packetstormsecurity.com/files/163621/Sequoia-A-Deep-Root-In-Linuxs-Filesystem-Layer.html","http://www.openwall.com/lists/oss-security/2021/08/04/2","http://www.openwall.com/lists/oss-security/2021/08/17/3","http://www.openwall.com/lists/oss-security/2021/09/07/3","https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf","https://github.com/systemd/systemd-stable/commit/4a1c5f34bd3e1daed4490e9d97918e504d19733b","https://github.com/systemd/systemd-stable/commit/764b74113e36ac5219a4b82a05f311b5a92136ce","https://github.com/systemd/systemd-stable/commit/b00674347337b7531c92fdb65590ab253bb57538","https://github.com/systemd/systemd-stable/commit/cfd14c65374027b34dbbc4f0551456c5dc2d1f61","https://github.com/systemd/systemd/commit/b34a4f0e6729de292cb3b0c03c1d48f246ad896b","https://github.com/systemd/systemd/pull/20256/commits/441e0115646d54f080e5c3bb0ba477c892861ab9","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2LSDMHAKI4LGFOCSPXNVVSEWQFAVFWR7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42TMJVNYRY65B4QCJICBYOEIVZV3KUYI/","https://security.gentoo.org/glsa/202107-48","https://security.netapp.com/advisory/ntap-20211104-0008/","https://www.debian.org/security/2021/dsa-4942","https://www.openwall.com/lists/oss-security/2021/07/20/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33910","description":"basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash."}]},{"artifact":{"id":"d55bfe42f054b394","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.2.6-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.2.6-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=expat","type":"deb","version":"2.2.6-2+deb10u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.6-2+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-22822","versionConstraint":"< 2.2.6-2+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"expat","version":"2.2.6-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-22822","fix":{"state":"fixed","versions":["2.2.6-2+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.6-2+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22822","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-22822","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-22822","date":"2026-10-08","epss":0.04829,"percentile":0.9176}],"risk":4.5392600000000005,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5073-1","link":"https://security-tracker.debian.org/tracker/DSA-5073-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-22822","description":"addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow."},"relatedVulnerabilities":[{"id":"CVE-2022-22822","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22822","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-22822","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-22822","date":"2026-10-08","epss":0.04829,"percentile":0.9176}],"urls":["http://www.openwall.com/lists/oss-security/2022/01/17/3","https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","https://github.com/libexpat/libexpat/pull/539","https://security.gentoo.org/glsa/202209-24","https://www.debian.org/security/2022/dsa-5073","https://www.tenable.com/security/tns-2022-05"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-22822","description":"addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow."}]},{"artifact":{"id":"d55bfe42f054b394","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.2.6-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.2.6-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=expat","type":"deb","version":"2.2.6-2+deb10u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.6-2+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-25315","versionConstraint":"< 2.2.6-2+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"expat","version":"2.2.6-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-25315","fix":{"state":"fixed","versions":["2.2.6-2+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.6-2+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-25315","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-25315","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-25315","date":"2026-10-08","epss":0.04821,"percentile":0.91746}],"risk":4.531740000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5085-1","link":"https://security-tracker.debian.org/tracker/DSA-5085-1"},{"id":"DSA-5085-2","link":"https://security-tracker.debian.org/tracker/DSA-5085-2"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-25315","description":"In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames."},"relatedVulnerabilities":[{"id":"CVE-2022-25315","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-25315","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-25315","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-25315","date":"2026-10-08","epss":0.04821,"percentile":0.91746}],"urls":["http://www.openwall.com/lists/oss-security/2022/02/19/1","https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","https://github.com/libexpat/libexpat/pull/559","https://lists.debian.org/debian-lts-announce/2022/03/msg00007.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UFRBA3UQVIQKXTBUQXDWQOVWNBKLERU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y27XO3JMKAOMQZVPS3B4MJGEAHCZF5OM/","https://security.gentoo.org/glsa/202209-24","https://security.netapp.com/advisory/ntap-20220303-0008/","https://www.debian.org/security/2022/dsa-5085","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25315","description":"In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames."}]},{"artifact":{"id":"2d52d7c9fca553cc","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.28-10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.28-10?arch=amd64&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-23218","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-23218","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23218","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-23218","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-23218","date":"2026-10-08","epss":0.0482,"percentile":0.91745}],"risk":4.5308,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-23218","description":"The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2022-23218","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23218","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-23218","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-23218","date":"2026-10-08","epss":0.0482,"percentile":0.91745}],"urls":["https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://security.gentoo.org/glsa/202208-24","https://sourceware.org/bugzilla/show_bug.cgi?id=28768","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23218","description":"The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution."}]},{"artifact":{"id":"fe0324c22198dabb","cpes":["cpe:2.3:a:libc-l10n:libc-l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc-l10n:libc_l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc-l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc_l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_l10n:2.28-10:*:*:*:*:*:*:*"],"name":"libc-l10n","purl":"pkg:deb/debian/libc-l10n@2.28-10?arch=all&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-l10n/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libc-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libc-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libc-l10n.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-23218","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-23218","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23218","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-23218","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-23218","date":"2026-10-08","epss":0.0482,"percentile":0.91745}],"risk":4.5308,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-23218","description":"The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2022-23218","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23218","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-23218","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-23218","date":"2026-10-08","epss":0.0482,"percentile":0.91745}],"urls":["https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://security.gentoo.org/glsa/202208-24","https://sourceware.org/bugzilla/show_bug.cgi?id=28768","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23218","description":"The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution."}]},{"artifact":{"id":"4d00fd0f941e584e","cpes":["cpe:2.3:a:libc6:libc6:2.28-10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.28-10?arch=amd64&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-23218","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-23218","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23218","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-23218","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-23218","date":"2026-10-08","epss":0.0482,"percentile":0.91745}],"risk":4.5308,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-23218","description":"The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2022-23218","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23218","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-23218","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-23218","date":"2026-10-08","epss":0.0482,"percentile":0.91745}],"urls":["https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://security.gentoo.org/glsa/202208-24","https://sourceware.org/bugzilla/show_bug.cgi?id=28768","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23218","description":"The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution."}]},{"artifact":{"id":"c1d71c418353daa4","cpes":["cpe:2.3:a:locales:locales:2.28-10:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/debian/locales@2.28-10?arch=all&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-23218","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-23218","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23218","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-23218","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-23218","date":"2026-10-08","epss":0.0482,"percentile":0.91745}],"risk":4.5308,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-23218","description":"The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2022-23218","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23218","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-23218","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-23218","date":"2026-10-08","epss":0.0482,"percentile":0.91745}],"urls":["https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://security.gentoo.org/glsa/202208-24","https://sourceware.org/bugzilla/show_bug.cgi?id=28768","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23218","description":"The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution."}]},{"artifact":{"id":"5a00b6e84834b8f7","cpes":["cpe:2.3:a:libperl5.28:libperl5.28:5.28.1-6:*:*:*:*:*:*:*"],"name":"libperl5.28","purl":"pkg:deb/debian/libperl5.28@5.28.1-6?arch=amd64&distro=debian-10.1&upstream=perl","type":"deb","version":"5.28.1-6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.28/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libperl5.28/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.28:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libperl5.28:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.28.1-6+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-12723","versionConstraint":"< 5.28.1-6+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"perl","version":"5.28.1-6"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-12723","fix":{"state":"fixed","versions":["5.28.1-6+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.28.1-6+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12723","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12723","date":"2026-10-08","epss":0.05971,"percentile":0.93112}],"risk":4.47825,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-12723","description":"regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls."},"relatedVulnerabilities":[{"id":"CVE-2020-12723","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12723","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12723","date":"2026-10-08","epss":0.05971,"percentile":0.93112}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/Perl/perl5/issues/16947","https://github.com/Perl/perl5/issues/17743","https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-12723","description":"regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls."}]},{"artifact":{"id":"4a18855ea4ce4a40","cpes":["cpe:2.3:a:perl:perl:5.28.1-6:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.28.1-6?arch=amd64&distro=debian-10.1","type":"deb","version":"5.28.1-6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl.preinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.28.1-6+deb10u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-12723","versionConstraint":"< 5.28.1-6+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"perl","version":"5.28.1-6"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-12723","fix":{"state":"fixed","versions":["5.28.1-6+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.28.1-6+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12723","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12723","date":"2026-10-08","epss":0.05971,"percentile":0.93112}],"risk":4.47825,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-12723","description":"regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls."},"relatedVulnerabilities":[{"id":"CVE-2020-12723","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12723","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12723","date":"2026-10-08","epss":0.05971,"percentile":0.93112}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/Perl/perl5/issues/16947","https://github.com/Perl/perl5/issues/17743","https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-12723","description":"regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls."}]},{"artifact":{"id":"62eec6c9883d4a8d","cpes":["cpe:2.3:a:perl-base:perl-base:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.28.1-6:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.28.1-6?arch=amd64&distro=debian-10.1&upstream=perl","type":"deb","version":"5.28.1-6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/perl-base.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.28.1-6+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-12723","versionConstraint":"< 5.28.1-6+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"perl","version":"5.28.1-6"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-12723","fix":{"state":"fixed","versions":["5.28.1-6+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.28.1-6+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12723","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12723","date":"2026-10-08","epss":0.05971,"percentile":0.93112}],"risk":4.47825,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-12723","description":"regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls."},"relatedVulnerabilities":[{"id":"CVE-2020-12723","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12723","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12723","date":"2026-10-08","epss":0.05971,"percentile":0.93112}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/Perl/perl5/issues/16947","https://github.com/Perl/perl5/issues/17743","https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-12723","description":"regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls."}]},{"artifact":{"id":"600f71408b95fb2a","cpes":["cpe:2.3:a:perl-modules-5.28:perl-modules-5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.28:perl_modules_5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.28:perl-modules-5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.28:perl_modules_5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.28:5.28.1-6:*:*:*:*:*:*:*"],"name":"perl-modules-5.28","purl":"pkg:deb/debian/perl-modules-5.28@5.28.1-6?arch=all&distro=debian-10.1&upstream=perl","type":"deb","version":"5.28.1-6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.28/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/perl-modules-5.28/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.28.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl-modules-5.28.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.28.list","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl-modules-5.28.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.28.1-6+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-12723","versionConstraint":"< 5.28.1-6+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"perl","version":"5.28.1-6"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-12723","fix":{"state":"fixed","versions":["5.28.1-6+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.28.1-6+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12723","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12723","date":"2026-10-08","epss":0.05971,"percentile":0.93112}],"risk":4.47825,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-12723","description":"regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls."},"relatedVulnerabilities":[{"id":"CVE-2020-12723","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12723","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12723","date":"2026-10-08","epss":0.05971,"percentile":0.93112}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/Perl/perl5/issues/16947","https://github.com/Perl/perl5/issues/17743","https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-12723","description":"regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls."}]},{"artifact":{"id":"ecf5e89e65014edb","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.64.0-4:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/debian/libcurl4@7.64.0-4?arch=amd64&distro=debian-10.1&upstream=curl","type":"deb","version":"7.64.0-4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.64.0-4+deb10u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-32221","versionConstraint":"< 7.64.0-4+deb10u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"curl","version":"7.64.0-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-32221","fix":{"state":"fixed","versions":["7.64.0-4+deb10u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.64.0-4+deb10u4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-32221","cwe":"CWE-200","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-32221","cwe":"CWE-668","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-32221","date":"2026-10-08","epss":0.04676,"percentile":0.91537}],"risk":4.395440000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-32221","description":"When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST."},"relatedVulnerabilities":[{"id":"CVE-2022-32221","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-32221","cwe":"CWE-200","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-32221","cwe":"CWE-668","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-32221","date":"2026-10-08","epss":0.04676,"percentile":0.91537}],"urls":["http://seclists.org/fulldisclosure/2023/Jan/19","http://seclists.org/fulldisclosure/2023/Jan/20","http://www.openwall.com/lists/oss-security/2023/05/17/4","https://hackerone.com/reports/1704017","https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20230110-0006/","https://security.netapp.com/advisory/ntap-20230208-0002/","https://support.apple.com/kb/HT213604","https://support.apple.com/kb/HT213605","https://www.debian.org/security/2023/dsa-5330"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-32221","description":"When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST."}]},{"artifact":{"id":"d55bfe42f054b394","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.2.6-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.2.6-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=expat","type":"deb","version":"2.2.6-2+deb10u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.6-2+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-23852","versionConstraint":"< 2.2.6-2+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"expat","version":"2.2.6-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-23852","fix":{"state":"fixed","versions":["2.2.6-2+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.6-2+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23852","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-23852","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-23852","date":"2026-10-08","epss":0.04563,"percentile":0.9136}],"risk":4.28922,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5073-1","link":"https://security-tracker.debian.org/tracker/DSA-5073-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-23852","description":"Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES."},"relatedVulnerabilities":[{"id":"CVE-2022-23852","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23852","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-23852","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-23852","date":"2026-10-08","epss":0.04563,"percentile":0.9136}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","https://github.com/libexpat/libexpat/pull/550","https://lists.debian.org/debian-lts-announce/2022/03/msg00007.html","https://security.gentoo.org/glsa/202209-24","https://security.netapp.com/advisory/ntap-20220217-0001/","https://www.debian.org/security/2022/dsa-5073","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.tenable.com/security/tns-2022-05"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23852","description":"Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES."}]},{"artifact":{"id":"2d52d7c9fca553cc","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.28-10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.28-10?arch=amd64&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-6096","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-6096","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-6096","cwe":"CWE-195","type":"Secondary","source":"talos-cna@cisco.com"},{"cve":"CVE-2020-6096","cwe":"CWE-191","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2020-6096","cwe":"CWE-681","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-6096","date":"2026-10-08","epss":0.05354,"percentile":0.92432}],"risk":4.17612,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-6096","description":"An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data."},"relatedVulnerabilities":[{"id":"CVE-2020-6096","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"talos-cna@cisco.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-6096","cwe":"CWE-195","type":"Secondary","source":"talos-cna@cisco.com"},{"cve":"CVE-2020-6096","cwe":"CWE-191","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2020-6096","cwe":"CWE-681","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-6096","date":"2026-10-08","epss":0.05354,"percentile":0.92432}],"urls":["https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPYXTDOOB4PQGTYAMZAZNJIB3FF6YQXI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/URXOIA2LDUKHQXK4BE55BQBRI6ZZG3Y6/","https://security.gentoo.org/glsa/202101-20","https://sourceware.org/bugzilla/show_bug.cgi?id=25620","https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1019"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-6096","description":"An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data."}]},{"artifact":{"id":"fe0324c22198dabb","cpes":["cpe:2.3:a:libc-l10n:libc-l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc-l10n:libc_l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc-l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc_l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_l10n:2.28-10:*:*:*:*:*:*:*"],"name":"libc-l10n","purl":"pkg:deb/debian/libc-l10n@2.28-10?arch=all&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-l10n/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libc-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libc-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libc-l10n.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-6096","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-6096","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-6096","cwe":"CWE-195","type":"Secondary","source":"talos-cna@cisco.com"},{"cve":"CVE-2020-6096","cwe":"CWE-191","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2020-6096","cwe":"CWE-681","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-6096","date":"2026-10-08","epss":0.05354,"percentile":0.92432}],"risk":4.17612,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-6096","description":"An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data."},"relatedVulnerabilities":[{"id":"CVE-2020-6096","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"talos-cna@cisco.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-6096","cwe":"CWE-195","type":"Secondary","source":"talos-cna@cisco.com"},{"cve":"CVE-2020-6096","cwe":"CWE-191","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2020-6096","cwe":"CWE-681","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-6096","date":"2026-10-08","epss":0.05354,"percentile":0.92432}],"urls":["https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPYXTDOOB4PQGTYAMZAZNJIB3FF6YQXI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/URXOIA2LDUKHQXK4BE55BQBRI6ZZG3Y6/","https://security.gentoo.org/glsa/202101-20","https://sourceware.org/bugzilla/show_bug.cgi?id=25620","https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1019"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-6096","description":"An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data."}]},{"artifact":{"id":"4d00fd0f941e584e","cpes":["cpe:2.3:a:libc6:libc6:2.28-10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.28-10?arch=amd64&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-6096","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-6096","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-6096","cwe":"CWE-195","type":"Secondary","source":"talos-cna@cisco.com"},{"cve":"CVE-2020-6096","cwe":"CWE-191","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2020-6096","cwe":"CWE-681","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-6096","date":"2026-10-08","epss":0.05354,"percentile":0.92432}],"risk":4.17612,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-6096","description":"An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data."},"relatedVulnerabilities":[{"id":"CVE-2020-6096","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"talos-cna@cisco.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-6096","cwe":"CWE-195","type":"Secondary","source":"talos-cna@cisco.com"},{"cve":"CVE-2020-6096","cwe":"CWE-191","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2020-6096","cwe":"CWE-681","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-6096","date":"2026-10-08","epss":0.05354,"percentile":0.92432}],"urls":["https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPYXTDOOB4PQGTYAMZAZNJIB3FF6YQXI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/URXOIA2LDUKHQXK4BE55BQBRI6ZZG3Y6/","https://security.gentoo.org/glsa/202101-20","https://sourceware.org/bugzilla/show_bug.cgi?id=25620","https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1019"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-6096","description":"An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data."}]},{"artifact":{"id":"c1d71c418353daa4","cpes":["cpe:2.3:a:locales:locales:2.28-10:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/debian/locales@2.28-10?arch=all&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-6096","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-6096","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-6096","cwe":"CWE-195","type":"Secondary","source":"talos-cna@cisco.com"},{"cve":"CVE-2020-6096","cwe":"CWE-191","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2020-6096","cwe":"CWE-681","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-6096","date":"2026-10-08","epss":0.05354,"percentile":0.92432}],"risk":4.17612,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-6096","description":"An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data."},"relatedVulnerabilities":[{"id":"CVE-2020-6096","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"talos-cna@cisco.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-6096","cwe":"CWE-195","type":"Secondary","source":"talos-cna@cisco.com"},{"cve":"CVE-2020-6096","cwe":"CWE-191","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2020-6096","cwe":"CWE-681","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-6096","date":"2026-10-08","epss":0.05354,"percentile":0.92432}],"urls":["https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPYXTDOOB4PQGTYAMZAZNJIB3FF6YQXI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/URXOIA2LDUKHQXK4BE55BQBRI6ZZG3Y6/","https://security.gentoo.org/glsa/202101-20","https://sourceware.org/bugzilla/show_bug.cgi?id=25620","https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1019"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-6096","description":"An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data."}]},{"artifact":{"id":"3b266bbb8fa28b2f","cpes":["cpe:2.3:a:gzip:gzip:1.9-3:*:*:*:*:*:*:*"],"name":"gzip","purl":"pkg:deb/debian/gzip@1.9-3?arch=amd64&distro=debian-10.1","type":"deb","version":"1.9-3","language":"","licenses":["sha256:f9ac4a5d7a670e3891881a2cdba5fa2cd625c4d58eae4a7aa372ac00a06803bd"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gzip/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/gzip/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gzip.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/gzip.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gzip.list","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/gzip.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.9-3+deb10u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-1271","versionConstraint":"< 1.9-3+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"gzip","version":"1.9-3"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-1271","fix":{"state":"fixed","versions":["1.9-3+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.9-3+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-1271","cwe":"CWE-179","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-1271","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-1271","date":"2026-10-08","epss":0.0507,"percentile":0.92107}],"risk":4.1320500000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5122-1","link":"https://security-tracker.debian.org/tracker/DSA-5122-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-1271","description":"An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system."},"relatedVulnerabilities":[{"id":"CVE-2022-1271","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-1271","cwe":"CWE-179","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-1271","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-1271","date":"2026-10-08","epss":0.0507,"percentile":0.92107}],"urls":["https://access.redhat.com/security/cve/CVE-2022-1271","https://bugzilla.redhat.com/show_bug.cgi?id=2073310","https://git.tukaani.org/?p=xz.git%3Ba=commit%3Bh=69d1b3fc29677af8ade8dc15dba83f0589cb63d6","https://lists.gnu.org/r/bug-gzip/2022-04/msg00011.html","https://security-tracker.debian.org/tracker/CVE-2022-1271","https://security.gentoo.org/glsa/202209-01","https://security.netapp.com/advisory/ntap-20220930-0006/","https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch","https://www.openwall.com/lists/oss-security/2022/04/07/8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-1271","description":"An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system."}]},{"artifact":{"id":"c32191f717ec58de","cpes":["cpe:2.3:a:liblzma5:liblzma5:5.2.4-1:*:*:*:*:*:*:*"],"name":"liblzma5","purl":"pkg:deb/debian/liblzma5@5.2.4-1?arch=amd64&distro=debian-10.1&upstream=xz-utils","type":"deb","version":"5.2.4-1","language":"","licenses":["Autoconf","GPL-2","GPL-2+","GPL-3","LGPL-2","LGPL-2.1","LGPL-2.1+","PD","PD-debian","config-h","noderivs","permissive-fsf","permissive-nowarranty","probably-PD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/liblzma5/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/liblzma5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/liblzma5:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/liblzma5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"xz-utils"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.2.4-1+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-1271","versionConstraint":"< 5.2.4-1+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"xz-utils","version":"5.2.4-1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-1271","fix":{"state":"fixed","versions":["5.2.4-1+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.2.4-1+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-1271","cwe":"CWE-179","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-1271","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-1271","date":"2026-10-08","epss":0.0507,"percentile":0.92107}],"risk":4.1320500000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5123-1","link":"https://security-tracker.debian.org/tracker/DSA-5123-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-1271","description":"An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system."},"relatedVulnerabilities":[{"id":"CVE-2022-1271","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-1271","cwe":"CWE-179","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-1271","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-1271","date":"2026-10-08","epss":0.0507,"percentile":0.92107}],"urls":["https://access.redhat.com/security/cve/CVE-2022-1271","https://bugzilla.redhat.com/show_bug.cgi?id=2073310","https://git.tukaani.org/?p=xz.git%3Ba=commit%3Bh=69d1b3fc29677af8ade8dc15dba83f0589cb63d6","https://lists.gnu.org/r/bug-gzip/2022-04/msg00011.html","https://security-tracker.debian.org/tracker/CVE-2022-1271","https://security.gentoo.org/glsa/202209-01","https://security.netapp.com/advisory/ntap-20220930-0006/","https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch","https://www.openwall.com/lists/oss-security/2022/04/07/8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-1271","description":"An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system."}]},{"artifact":{"id":"ecf5e89e65014edb","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.64.0-4:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/debian/libcurl4@7.64.0-4?arch=amd64&distro=debian-10.1&upstream=curl","type":"deb","version":"7.64.0-4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.64.0-4+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-32208","versionConstraint":"< 7.64.0-4+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"curl","version":"7.64.0-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-32208","fix":{"state":"fixed","versions":["7.64.0-4+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.64.0-4+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-32208","cwe":"CWE-840","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-32208","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-32208","date":"2026-10-08","epss":0.07499,"percentile":0.94338}],"risk":4.086955000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-32208","description":"When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client."},"relatedVulnerabilities":[{"id":"CVE-2022-32208","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-32208","cwe":"CWE-840","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-32208","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-32208","date":"2026-10-08","epss":0.07499,"percentile":0.94338}],"urls":["http://seclists.org/fulldisclosure/2022/Oct/28","http://seclists.org/fulldisclosure/2022/Oct/41","https://hackerone.com/reports/1590071","https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20220915-0003/","https://support.apple.com/kb/HT213488","https://www.debian.org/security/2022/dsa-5197"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-32208","description":"When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client."}]},{"artifact":{"id":"bca20a7b0a858bf3","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/debian/libssl1.1@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1&upstream=openssl","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1d-0+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-23841","versionConstraint":"< 1.1.1d-0+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-23841","fix":{"state":"fixed","versions":["1.1.1d-0+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1d-0+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23841","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-23841","date":"2026-10-08","epss":0.0741,"percentile":0.94291}],"risk":4.03845,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4855-1","link":"https://security-tracker.debian.org/tracker/DSA-4855-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-23841","description":"The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x)."},"relatedVulnerabilities":[{"id":"CVE-2021-23841","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23841","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-23841","date":"2026-10-08","epss":0.0741,"percentile":0.94291}],"urls":["http://seclists.org/fulldisclosure/2021/May/67","http://seclists.org/fulldisclosure/2021/May/68","http://seclists.org/fulldisclosure/2021/May/70","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=122a19ab48091c657f7cb1fb3af9fc07bd557bbf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8252ee4d90f3f2004d3d0aeeed003ad49c9a7807","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846","https://security.gentoo.org/glsa/202103-03","https://security.netapp.com/advisory/ntap-20210219-0009/","https://security.netapp.com/advisory/ntap-20210513-0002/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://support.apple.com/kb/HT212528","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212534","https://www.debian.org/security/2021/dsa-4855","https://www.openssl.org/news/secadv/20210216.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2021-03","https://www.tenable.com/security/tns-2021-09"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23841","description":"The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x)."}]},{"artifact":{"id":"d308e84bddad0b0f","cpes":["cpe:2.3:a:openssl:openssl:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1d-0+deb10u5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-23841","versionConstraint":"< 1.1.1d-0+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-23841","fix":{"state":"fixed","versions":["1.1.1d-0+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1d-0+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23841","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-23841","date":"2026-10-08","epss":0.0741,"percentile":0.94291}],"risk":4.03845,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4855-1","link":"https://security-tracker.debian.org/tracker/DSA-4855-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-23841","description":"The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x)."},"relatedVulnerabilities":[{"id":"CVE-2021-23841","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23841","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-23841","date":"2026-10-08","epss":0.0741,"percentile":0.94291}],"urls":["http://seclists.org/fulldisclosure/2021/May/67","http://seclists.org/fulldisclosure/2021/May/68","http://seclists.org/fulldisclosure/2021/May/70","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=122a19ab48091c657f7cb1fb3af9fc07bd557bbf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8252ee4d90f3f2004d3d0aeeed003ad49c9a7807","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846","https://security.gentoo.org/glsa/202103-03","https://security.netapp.com/advisory/ntap-20210219-0009/","https://security.netapp.com/advisory/ntap-20210513-0002/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://support.apple.com/kb/HT212528","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212534","https://www.debian.org/security/2021/dsa-4855","https://www.openssl.org/news/secadv/20210216.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2021-03","https://www.tenable.com/security/tns-2021-09"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23841","description":"The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x)."}]},{"artifact":{"id":"2d52d7c9fca553cc","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.28-10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.28-10?arch=amd64&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-23219","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-23219","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23219","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-23219","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-23219","date":"2026-10-08","epss":0.04293,"percentile":0.90869}],"risk":4.03542,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-23219","description":"The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2022-23219","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23219","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-23219","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-23219","date":"2026-10-08","epss":0.04293,"percentile":0.90869}],"urls":["https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://security.gentoo.org/glsa/202208-24","https://sourceware.org/bugzilla/show_bug.cgi?id=22542","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23219","description":"The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution."}]},{"artifact":{"id":"fe0324c22198dabb","cpes":["cpe:2.3:a:libc-l10n:libc-l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc-l10n:libc_l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc-l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc_l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_l10n:2.28-10:*:*:*:*:*:*:*"],"name":"libc-l10n","purl":"pkg:deb/debian/libc-l10n@2.28-10?arch=all&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-l10n/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libc-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libc-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libc-l10n.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-23219","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-23219","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23219","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-23219","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-23219","date":"2026-10-08","epss":0.04293,"percentile":0.90869}],"risk":4.03542,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-23219","description":"The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2022-23219","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23219","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-23219","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-23219","date":"2026-10-08","epss":0.04293,"percentile":0.90869}],"urls":["https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://security.gentoo.org/glsa/202208-24","https://sourceware.org/bugzilla/show_bug.cgi?id=22542","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23219","description":"The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution."}]},{"artifact":{"id":"4d00fd0f941e584e","cpes":["cpe:2.3:a:libc6:libc6:2.28-10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.28-10?arch=amd64&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-23219","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-23219","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23219","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-23219","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-23219","date":"2026-10-08","epss":0.04293,"percentile":0.90869}],"risk":4.03542,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-23219","description":"The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2022-23219","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23219","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-23219","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-23219","date":"2026-10-08","epss":0.04293,"percentile":0.90869}],"urls":["https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://security.gentoo.org/glsa/202208-24","https://sourceware.org/bugzilla/show_bug.cgi?id=22542","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23219","description":"The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution."}]},{"artifact":{"id":"c1d71c418353daa4","cpes":["cpe:2.3:a:locales:locales:2.28-10:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/debian/locales@2.28-10?arch=all&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-23219","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-23219","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23219","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-23219","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-23219","date":"2026-10-08","epss":0.04293,"percentile":0.90869}],"risk":4.03542,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-23219","description":"The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution."},"relatedVulnerabilities":[{"id":"CVE-2022-23219","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23219","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-23219","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-23219","date":"2026-10-08","epss":0.04293,"percentile":0.90869}],"urls":["https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://security.gentoo.org/glsa/202208-24","https://sourceware.org/bugzilla/show_bug.cgi?id=22542","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23219","description":"The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.15.14"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0243","versionConstraint":"<1.15.14||>=1.16.0-0,<1.16.6 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0243","fix":{"state":"fixed","versions":["1.15.14","1.16.6"],"available":[{"date":"2021-07-12","kind":"release","version":"1.15.14"},{"date":"2021-07-12","kind":"release","version":"1.16.6"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-34558","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-34558","date":"2026-10-08","epss":0.06975,"percentile":0.93978}],"risk":4.010625,"urls":["https://go.googlesource.com/go/+/a98589711da5e9d935e8d690cfca92892e86d557","https://groups.google.com/g/golang-announce/c/n9FxMelZGAQ","https://go.dev/issue/47143"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/334031","description":"crypto/tls clients can panic when provided a certificate of the wrong type for the negotiated parameters. net/http clients performing HTTPS requests are also affected."},"relatedVulnerabilities":[{"id":"CVE-2021-34558","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:N/A:P","metrics":{"baseScore":2.6,"impactScore":2.9,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-34558","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-34558","date":"2026-10-08","epss":0.06975,"percentile":0.93978}],"urls":["https://golang.org/doc/devel/release#go1.16.minor","https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/n9FxMelZGAQ","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BA7MFVXRBEKRTLSLYDICTYCGEMK2HZ7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3XBQUFVI5TMV4KMKI7GKA223LHGPQISE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BTC3JQUASFN5U2XA4UZIGAPZQBD5JSS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D7FRFM7WWR2JCT6NORQ7AO6B453OMI3I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITRXPCHUCJGXCX2CUEPKZRRTB27GG4ZB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYIUSR4YP52PWG7YE7AA3DZ5OSURNFJB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBMLUQMN6XRKPVOI5XFFBP4XSR7RNTYR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLOGBB7XBBRB3J5FDPW5KWHSH7IRF64W/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXJ2MVMAHOIGRH37ZSFYC4EVWLJFL2EQ/","https://security.gentoo.org/glsa/202208-02","https://security.netapp.com/advisory/ntap-20210813-0005/","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-34558","description":"The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.15.14"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0243","versionConstraint":"<1.15.14||>=1.16.0-0,<1.16.6 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0243","fix":{"state":"fixed","versions":["1.15.14","1.16.6"],"available":[{"date":"2021-07-12","kind":"release","version":"1.15.14"},{"date":"2021-07-12","kind":"release","version":"1.16.6"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-34558","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-34558","date":"2026-10-08","epss":0.06975,"percentile":0.93978}],"risk":4.010625,"urls":["https://go.googlesource.com/go/+/a98589711da5e9d935e8d690cfca92892e86d557","https://groups.google.com/g/golang-announce/c/n9FxMelZGAQ","https://go.dev/issue/47143"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/334031","description":"crypto/tls clients can panic when provided a certificate of the wrong type for the negotiated parameters. net/http clients performing HTTPS requests are also affected."},"relatedVulnerabilities":[{"id":"CVE-2021-34558","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:N/A:P","metrics":{"baseScore":2.6,"impactScore":2.9,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-34558","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-34558","date":"2026-10-08","epss":0.06975,"percentile":0.93978}],"urls":["https://golang.org/doc/devel/release#go1.16.minor","https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/n9FxMelZGAQ","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BA7MFVXRBEKRTLSLYDICTYCGEMK2HZ7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3XBQUFVI5TMV4KMKI7GKA223LHGPQISE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6BTC3JQUASFN5U2XA4UZIGAPZQBD5JSS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D7FRFM7WWR2JCT6NORQ7AO6B453OMI3I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITRXPCHUCJGXCX2CUEPKZRRTB27GG4ZB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYIUSR4YP52PWG7YE7AA3DZ5OSURNFJB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LBMLUQMN6XRKPVOI5XFFBP4XSR7RNTYR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLOGBB7XBBRB3J5FDPW5KWHSH7IRF64W/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXJ2MVMAHOIGRH37ZSFYC4EVWLJFL2EQ/","https://security.gentoo.org/glsa/202208-02","https://security.netapp.com/advisory/ntap-20210813-0005/","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-34558","description":"The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic."}]},{"artifact":{"id":"0ee3c902a7004593","cpes":["cpe:2.3:a:libnghttp2-14:libnghttp2-14:1.36.0-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2-14:libnghttp2_14:1.36.0-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2_14:libnghttp2-14:1.36.0-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2_14:libnghttp2_14:1.36.0-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2:libnghttp2-14:1.36.0-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libnghttp2:libnghttp2_14:1.36.0-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libnghttp2-14","purl":"pkg:deb/debian/libnghttp2-14@1.36.0-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=nghttp2","type":"deb","version":"1.36.0-2+deb10u1","language":"","licenses":["BSD-2-clause","Expat","GPL-3","GPL-3+","MIT","SIL-OFL-1.1","all-permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnghttp2-14/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libnghttp2-14/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnghttp2-14:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libnghttp2-14:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nghttp2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.36.0-2+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-11080","versionConstraint":"< 1.36.0-2+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"nghttp2","version":"1.36.0-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-11080","fix":{"state":"fixed","versions":["1.36.0-2+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.36.0-2+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-11080","cwe":"CWE-707","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-11080","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11080","date":"2026-10-08","epss":0.05316,"percentile":0.92393}],"risk":3.987,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-11080","description":"In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection."},"relatedVulnerabilities":[{"id":"CVE-2020-11080","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-11080","cwe":"CWE-707","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-11080","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11080","date":"2026-10-08","epss":0.05316,"percentile":0.92393}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html","https://github.com/nghttp2/nghttp2/commit/336a98feb0d56b9ac54e12736b18785c27f75090","https://github.com/nghttp2/nghttp2/commit/f8da73bd042f810f34d19f9eae02b46d870af394","https://github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr","https://lists.debian.org/debian-lts-announce/2021/10/msg00011.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAC2AA36OTRHKSVM5OV7TTVB3CZIGEFL/","https://www.debian.org/security/2020/dsa-4696","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-11080","description":"In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection."}]},{"artifact":{"id":"5a00b6e84834b8f7","cpes":["cpe:2.3:a:libperl5.28:libperl5.28:5.28.1-6:*:*:*:*:*:*:*"],"name":"libperl5.28","purl":"pkg:deb/debian/libperl5.28@5.28.1-6?arch=amd64&distro=debian-10.1&upstream=perl","type":"deb","version":"5.28.1-6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.28/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libperl5.28/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.28:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libperl5.28:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.28.1-6+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10878","versionConstraint":"< 5.28.1-6+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"perl","version":"5.28.1-6"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-10878","fix":{"state":"fixed","versions":["5.28.1-6+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.28.1-6+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10878","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10878","date":"2026-10-08","epss":0.04879,"percentile":0.91837}],"risk":3.9275949999999997,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10878","description":"Perl before 5.30.3 has an integer overflow related to mishandling of a \"PL_regkind[OP(n)] == NOTHING\" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection."},"relatedVulnerabilities":[{"id":"CVE-2020-10878","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10878","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10878","date":"2026-10-08","epss":0.04879,"percentile":0.91837}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8","https://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10878","description":"Perl before 5.30.3 has an integer overflow related to mishandling of a \"PL_regkind[OP(n)] == NOTHING\" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection."}]},{"artifact":{"id":"4a18855ea4ce4a40","cpes":["cpe:2.3:a:perl:perl:5.28.1-6:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.28.1-6?arch=amd64&distro=debian-10.1","type":"deb","version":"5.28.1-6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl.preinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.28.1-6+deb10u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-10878","versionConstraint":"< 5.28.1-6+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"perl","version":"5.28.1-6"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-10878","fix":{"state":"fixed","versions":["5.28.1-6+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.28.1-6+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10878","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10878","date":"2026-10-08","epss":0.04879,"percentile":0.91837}],"risk":3.9275949999999997,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10878","description":"Perl before 5.30.3 has an integer overflow related to mishandling of a \"PL_regkind[OP(n)] == NOTHING\" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection."},"relatedVulnerabilities":[{"id":"CVE-2020-10878","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10878","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10878","date":"2026-10-08","epss":0.04879,"percentile":0.91837}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8","https://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10878","description":"Perl before 5.30.3 has an integer overflow related to mishandling of a \"PL_regkind[OP(n)] == NOTHING\" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection."}]},{"artifact":{"id":"62eec6c9883d4a8d","cpes":["cpe:2.3:a:perl-base:perl-base:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.28.1-6:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.28.1-6?arch=amd64&distro=debian-10.1&upstream=perl","type":"deb","version":"5.28.1-6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/perl-base.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.28.1-6+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10878","versionConstraint":"< 5.28.1-6+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"perl","version":"5.28.1-6"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-10878","fix":{"state":"fixed","versions":["5.28.1-6+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.28.1-6+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10878","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10878","date":"2026-10-08","epss":0.04879,"percentile":0.91837}],"risk":3.9275949999999997,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10878","description":"Perl before 5.30.3 has an integer overflow related to mishandling of a \"PL_regkind[OP(n)] == NOTHING\" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection."},"relatedVulnerabilities":[{"id":"CVE-2020-10878","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10878","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10878","date":"2026-10-08","epss":0.04879,"percentile":0.91837}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8","https://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10878","description":"Perl before 5.30.3 has an integer overflow related to mishandling of a \"PL_regkind[OP(n)] == NOTHING\" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection."}]},{"artifact":{"id":"600f71408b95fb2a","cpes":["cpe:2.3:a:perl-modules-5.28:perl-modules-5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.28:perl_modules_5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.28:perl-modules-5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.28:perl_modules_5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.28:5.28.1-6:*:*:*:*:*:*:*"],"name":"perl-modules-5.28","purl":"pkg:deb/debian/perl-modules-5.28@5.28.1-6?arch=all&distro=debian-10.1&upstream=perl","type":"deb","version":"5.28.1-6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.28/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/perl-modules-5.28/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.28.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl-modules-5.28.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.28.list","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl-modules-5.28.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.28.1-6+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10878","versionConstraint":"< 5.28.1-6+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"perl","version":"5.28.1-6"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-10878","fix":{"state":"fixed","versions":["5.28.1-6+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.28.1-6+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10878","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10878","date":"2026-10-08","epss":0.04879,"percentile":0.91837}],"risk":3.9275949999999997,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10878","description":"Perl before 5.30.3 has an integer overflow related to mishandling of a \"PL_regkind[OP(n)] == NOTHING\" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection."},"relatedVulnerabilities":[{"id":"CVE-2020-10878","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10878","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10878","date":"2026-10-08","epss":0.04879,"percentile":0.91837}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8","https://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10878","description":"Perl before 5.30.3 has an integer overflow related to mishandling of a \"PL_regkind[OP(n)] == NOTHING\" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection."}]},{"artifact":{"id":"bca20a7b0a858bf3","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/debian/libssl1.1@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1&upstream=openssl","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1d-0+deb10u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-1971","versionConstraint":"< 1.1.1d-0+deb10u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-1971","fix":{"state":"fixed","versions":["1.1.1d-0+deb10u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1d-0+deb10u4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-1971","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-1971","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-1971","date":"2026-10-08","epss":0.07051,"percentile":0.94041}],"risk":3.842795,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4807-1","link":"https://security-tracker.debian.org/tracker/DSA-4807-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-1971","description":"The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the \"-crl_download\" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w)."},"relatedVulnerabilities":[{"id":"CVE-2020-1971","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-1971","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-1971","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-1971","date":"2026-10-08","epss":0.07051,"percentile":0.94041}],"urls":["http://www.openwall.com/lists/oss-security/2021/09/14/2","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2154ab83e14ede338d2ede9bbe5cdfce5d5a6c9e","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=f960d81215ebf3f65e03d4d5d857fb9b666d6920","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44676","https://lists.apache.org/thread.html/r63c6f2dd363d9b514d0a4bcf624580616a679898cc14c109a49b750c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rbb769f771711fb274e0a4acb1b5911c8aab544a6ac5e8c12d40c5143%40%3Ccommits.pulsar.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00020.html","https://lists.debian.org/debian-lts-announce/2020/12/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGSI34Y5LQ5RYXN4M2I5ZQT65LFVDOUU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PWPSSZNZOBJU2YR6Z4TGHXKYW3YP5QG7/","https://security.FreeBSD.org/advisories/FreeBSD-SA-20:33.openssl.asc","https://security.gentoo.org/glsa/202012-13","https://security.netapp.com/advisory/ntap-20201218-0005/","https://security.netapp.com/advisory/ntap-20210513-0002/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2020/dsa-4807","https://www.openssl.org/news/secadv/20201208.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2020-11","https://www.tenable.com/security/tns-2021-09","https://www.tenable.com/security/tns-2021-10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-1971","description":"The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the \"-crl_download\" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w)."}]},{"artifact":{"id":"d308e84bddad0b0f","cpes":["cpe:2.3:a:openssl:openssl:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1d-0+deb10u4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-1971","versionConstraint":"< 1.1.1d-0+deb10u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-1971","fix":{"state":"fixed","versions":["1.1.1d-0+deb10u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1d-0+deb10u4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-1971","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-1971","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-1971","date":"2026-10-08","epss":0.07051,"percentile":0.94041}],"risk":3.842795,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4807-1","link":"https://security-tracker.debian.org/tracker/DSA-4807-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-1971","description":"The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the \"-crl_download\" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w)."},"relatedVulnerabilities":[{"id":"CVE-2020-1971","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-1971","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-1971","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-1971","date":"2026-10-08","epss":0.07051,"percentile":0.94041}],"urls":["http://www.openwall.com/lists/oss-security/2021/09/14/2","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2154ab83e14ede338d2ede9bbe5cdfce5d5a6c9e","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=f960d81215ebf3f65e03d4d5d857fb9b666d6920","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44676","https://lists.apache.org/thread.html/r63c6f2dd363d9b514d0a4bcf624580616a679898cc14c109a49b750c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rbb769f771711fb274e0a4acb1b5911c8aab544a6ac5e8c12d40c5143%40%3Ccommits.pulsar.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00020.html","https://lists.debian.org/debian-lts-announce/2020/12/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGSI34Y5LQ5RYXN4M2I5ZQT65LFVDOUU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PWPSSZNZOBJU2YR6Z4TGHXKYW3YP5QG7/","https://security.FreeBSD.org/advisories/FreeBSD-SA-20:33.openssl.asc","https://security.gentoo.org/glsa/202012-13","https://security.netapp.com/advisory/ntap-20201218-0005/","https://security.netapp.com/advisory/ntap-20210513-0002/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2020/dsa-4807","https://www.openssl.org/news/secadv/20201208.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2020-11","https://www.tenable.com/security/tns-2021-09","https://www.tenable.com/security/tns-2021-10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-1971","description":"The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the \"-crl_download\" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w)."}]},{"artifact":{"id":"9c0f03079e497030","cpes":["cpe:2.3:a:libpython3.7-minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-minimal","purl":"pkg:deb/debian/libpython3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-16056","versionConstraint":"< 3.7.3-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-16056","fix":{"state":"fixed","versions":["3.7.3-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16056","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16056","date":"2026-10-08","epss":0.0512,"percentile":0.9217}],"risk":3.8400000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-16056","description":"An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally."},"relatedVulnerabilities":[{"id":"CVE-2019-16056","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16056","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16056","date":"2026-10-08","epss":0.0512,"percentile":0.9217}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://access.redhat.com/errata/RHSA-2019:3725","https://access.redhat.com/errata/RHSA-2019:3948","https://bugs.python.org/issue34155","https://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/09/msg00018.html","https://lists.debian.org/debian-lts-announce/2019/09/msg00019.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4KZEFP6E4YPYB52AF4WXCUDSGQOTF37/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QASRD4E2G65GGEHYKVHYCXB2XWAGTNL4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QP46PQSUKYPGWTADQ67NOV3BUN6JM34Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SDQQ56P7ZZR64XV5DUVWNSNXKKEXUG2J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/","https://security.netapp.com/advisory/ntap-20190926-0005/","https://usn.ubuntu.com/4151-1/","https://usn.ubuntu.com/4151-2/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16056","description":"An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally."}]},{"artifact":{"id":"b6d8c37141cd8c0a","cpes":["cpe:2.3:a:libpython3.7-stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-stdlib","purl":"pkg:deb/debian/libpython3.7-stdlib@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-16056","versionConstraint":"< 3.7.3-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-16056","fix":{"state":"fixed","versions":["3.7.3-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16056","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16056","date":"2026-10-08","epss":0.0512,"percentile":0.9217}],"risk":3.8400000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-16056","description":"An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally."},"relatedVulnerabilities":[{"id":"CVE-2019-16056","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16056","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16056","date":"2026-10-08","epss":0.0512,"percentile":0.9217}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://access.redhat.com/errata/RHSA-2019:3725","https://access.redhat.com/errata/RHSA-2019:3948","https://bugs.python.org/issue34155","https://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/09/msg00018.html","https://lists.debian.org/debian-lts-announce/2019/09/msg00019.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4KZEFP6E4YPYB52AF4WXCUDSGQOTF37/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QASRD4E2G65GGEHYKVHYCXB2XWAGTNL4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QP46PQSUKYPGWTADQ67NOV3BUN6JM34Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SDQQ56P7ZZR64XV5DUVWNSNXKKEXUG2J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/","https://security.netapp.com/advisory/ntap-20190926-0005/","https://usn.ubuntu.com/4151-1/","https://usn.ubuntu.com/4151-2/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16056","description":"An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally."}]},{"artifact":{"id":"94955c7d71be2bb1","cpes":["cpe:2.3:a:python3.7:python3.7:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7","purl":"pkg:deb/debian/python3.7@3.7.3-2?arch=amd64&distro=debian-10.1","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.list"},{"path":"/var/lib/dpkg/info/python3.7.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.postinst"},{"path":"/var/lib/dpkg/info/python3.7.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-16056","versionConstraint":"< 3.7.3-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-16056","fix":{"state":"fixed","versions":["3.7.3-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16056","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16056","date":"2026-10-08","epss":0.0512,"percentile":0.9217}],"risk":3.8400000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-16056","description":"An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally."},"relatedVulnerabilities":[{"id":"CVE-2019-16056","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16056","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16056","date":"2026-10-08","epss":0.0512,"percentile":0.9217}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://access.redhat.com/errata/RHSA-2019:3725","https://access.redhat.com/errata/RHSA-2019:3948","https://bugs.python.org/issue34155","https://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/09/msg00018.html","https://lists.debian.org/debian-lts-announce/2019/09/msg00019.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4KZEFP6E4YPYB52AF4WXCUDSGQOTF37/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QASRD4E2G65GGEHYKVHYCXB2XWAGTNL4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QP46PQSUKYPGWTADQ67NOV3BUN6JM34Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SDQQ56P7ZZR64XV5DUVWNSNXKKEXUG2J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/","https://security.netapp.com/advisory/ntap-20190926-0005/","https://usn.ubuntu.com/4151-1/","https://usn.ubuntu.com/4151-2/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16056","description":"An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally."}]},{"artifact":{"id":"988c8a69c0d8509e","cpes":["cpe:2.3:a:python3.7-minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7-minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7-minimal","purl":"pkg:deb/debian/python3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.list"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.7-minimal.preinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.prerm"}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-16056","versionConstraint":"< 3.7.3-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-16056","fix":{"state":"fixed","versions":["3.7.3-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16056","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16056","date":"2026-10-08","epss":0.0512,"percentile":0.9217}],"risk":3.8400000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-16056","description":"An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally."},"relatedVulnerabilities":[{"id":"CVE-2019-16056","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16056","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16056","date":"2026-10-08","epss":0.0512,"percentile":0.9217}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://access.redhat.com/errata/RHSA-2019:3725","https://access.redhat.com/errata/RHSA-2019:3948","https://bugs.python.org/issue34155","https://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/09/msg00018.html","https://lists.debian.org/debian-lts-announce/2019/09/msg00019.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4KZEFP6E4YPYB52AF4WXCUDSGQOTF37/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QASRD4E2G65GGEHYKVHYCXB2XWAGTNL4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QP46PQSUKYPGWTADQ67NOV3BUN6JM34Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SDQQ56P7ZZR64XV5DUVWNSNXKKEXUG2J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/","https://security.netapp.com/advisory/ntap-20190926-0005/","https://usn.ubuntu.com/4151-1/","https://usn.ubuntu.com/4151-2/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16056","description":"An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally."}]},{"artifact":{"id":"9c0f03079e497030","cpes":["cpe:2.3:a:libpython3.7-minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-minimal","purl":"pkg:deb/debian/libpython3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-8492","versionConstraint":"< 3.7.3-2+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-8492","fix":{"state":"fixed","versions":["3.7.3-2+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8492","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-8492","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-8492","date":"2026-10-08","epss":0.06617,"percentile":0.9369}],"risk":3.804775,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-8492","description":"Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking."},"relatedVulnerabilities":[{"id":"CVE-2020-8492","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8492","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-8492","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-8492","date":"2026-10-08","epss":0.06617,"percentile":0.9369}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html","https://bugs.python.org/issue39503","https://github.com/python/cpython/pull/18284","https://lists.apache.org/thread.html/rdb31a608dd6758c6093fd645aea3fbf022dd25b37109b6aaea5bc0b5%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rfec113c733162b39633fd86a2d0f34bf42ac35f711b3ec1835c774da%40%3Ccommits.cassandra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WOKDEXLYW5UQ4S7PA7E37IITOC7C56J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APGWEMYZIY5VHLCSZ3HD67PA5Z2UQFGH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/","https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html","https://security.gentoo.org/glsa/202005-09","https://security.netapp.com/advisory/ntap-20200221-0001/","https://usn.ubuntu.com/4333-1/","https://usn.ubuntu.com/4333-2/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8492","description":"Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking."}]},{"artifact":{"id":"b6d8c37141cd8c0a","cpes":["cpe:2.3:a:libpython3.7-stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-stdlib","purl":"pkg:deb/debian/libpython3.7-stdlib@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-8492","versionConstraint":"< 3.7.3-2+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-8492","fix":{"state":"fixed","versions":["3.7.3-2+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8492","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-8492","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-8492","date":"2026-10-08","epss":0.06617,"percentile":0.9369}],"risk":3.804775,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-8492","description":"Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking."},"relatedVulnerabilities":[{"id":"CVE-2020-8492","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8492","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-8492","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-8492","date":"2026-10-08","epss":0.06617,"percentile":0.9369}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html","https://bugs.python.org/issue39503","https://github.com/python/cpython/pull/18284","https://lists.apache.org/thread.html/rdb31a608dd6758c6093fd645aea3fbf022dd25b37109b6aaea5bc0b5%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rfec113c733162b39633fd86a2d0f34bf42ac35f711b3ec1835c774da%40%3Ccommits.cassandra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WOKDEXLYW5UQ4S7PA7E37IITOC7C56J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APGWEMYZIY5VHLCSZ3HD67PA5Z2UQFGH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/","https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html","https://security.gentoo.org/glsa/202005-09","https://security.netapp.com/advisory/ntap-20200221-0001/","https://usn.ubuntu.com/4333-1/","https://usn.ubuntu.com/4333-2/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8492","description":"Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking."}]},{"artifact":{"id":"94955c7d71be2bb1","cpes":["cpe:2.3:a:python3.7:python3.7:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7","purl":"pkg:deb/debian/python3.7@3.7.3-2?arch=amd64&distro=debian-10.1","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.list"},{"path":"/var/lib/dpkg/info/python3.7.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.postinst"},{"path":"/var/lib/dpkg/info/python3.7.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u2"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-8492","versionConstraint":"< 3.7.3-2+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-8492","fix":{"state":"fixed","versions":["3.7.3-2+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8492","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-8492","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-8492","date":"2026-10-08","epss":0.06617,"percentile":0.9369}],"risk":3.804775,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-8492","description":"Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking."},"relatedVulnerabilities":[{"id":"CVE-2020-8492","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8492","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-8492","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-8492","date":"2026-10-08","epss":0.06617,"percentile":0.9369}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html","https://bugs.python.org/issue39503","https://github.com/python/cpython/pull/18284","https://lists.apache.org/thread.html/rdb31a608dd6758c6093fd645aea3fbf022dd25b37109b6aaea5bc0b5%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rfec113c733162b39633fd86a2d0f34bf42ac35f711b3ec1835c774da%40%3Ccommits.cassandra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WOKDEXLYW5UQ4S7PA7E37IITOC7C56J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APGWEMYZIY5VHLCSZ3HD67PA5Z2UQFGH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/","https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html","https://security.gentoo.org/glsa/202005-09","https://security.netapp.com/advisory/ntap-20200221-0001/","https://usn.ubuntu.com/4333-1/","https://usn.ubuntu.com/4333-2/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8492","description":"Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking."}]},{"artifact":{"id":"988c8a69c0d8509e","cpes":["cpe:2.3:a:python3.7-minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7-minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7-minimal","purl":"pkg:deb/debian/python3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.list"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.7-minimal.preinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.prerm"}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-8492","versionConstraint":"< 3.7.3-2+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-8492","fix":{"state":"fixed","versions":["3.7.3-2+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8492","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-8492","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-8492","date":"2026-10-08","epss":0.06617,"percentile":0.9369}],"risk":3.804775,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-8492","description":"Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking."},"relatedVulnerabilities":[{"id":"CVE-2020-8492","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8492","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-8492","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-8492","date":"2026-10-08","epss":0.06617,"percentile":0.9369}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html","https://bugs.python.org/issue39503","https://github.com/python/cpython/pull/18284","https://lists.apache.org/thread.html/rdb31a608dd6758c6093fd645aea3fbf022dd25b37109b6aaea5bc0b5%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rfec113c733162b39633fd86a2d0f34bf42ac35f711b3ec1835c774da%40%3Ccommits.cassandra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WOKDEXLYW5UQ4S7PA7E37IITOC7C56J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APGWEMYZIY5VHLCSZ3HD67PA5Z2UQFGH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/","https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html","https://security.gentoo.org/glsa/202005-09","https://security.netapp.com/advisory/ntap-20200221-0001/","https://usn.ubuntu.com/4333-1/","https://usn.ubuntu.com/4333-2/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8492","description":"Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking."}]},{"artifact":{"id":"7c1ebd3787684a51","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.7-4:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/debian/libgnutls30@3.6.7-4?arch=amd64&distro=debian-10.1&upstream=gnutls28","type":"deb","version":"3.6.7-4","language":"","licenses":["sha256:d35f0abecc61a3676965c20cf13a44815b05d9b4a68985fa1809b13c2aff9090"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2011-3389","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"gnutls28","version":"3.6.7-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2011-3389","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2011-3389","cwe":"CWE-326","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-3389","date":"2026-10-08","epss":0.73327,"percentile":0.99453}],"risk":3.66635,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2011-3389","description":"The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack."},"relatedVulnerabilities":[{"id":"CVE-2011-3389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2011-3389","cwe":"CWE-326","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-3389","date":"2026-10-08","epss":0.73327,"percentile":0.99453}],"urls":["http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/","http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx","http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx","http://curl.haxx.se/docs/adv_20120124B.html","http://downloads.asterisk.org/pub/security/AST-2016-001.html","http://ekoparty.org/2011/juliano-rizzo.php","http://eprint.iacr.org/2004/111","http://eprint.iacr.org/2006/136","http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html","http://isc.sans.edu/diary/SSL+TLS+part+3+/11635","http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html","http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html","http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html","http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html","http://lists.apple.com/archives/security-announce/2012/May/msg00001.html","http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html","http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html","http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html","http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html","http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://marc.info/?l=bugtraq&m=132750579901589&w=2","http://marc.info/?l=bugtraq&m=132872385320240&w=2","http://marc.info/?l=bugtraq&m=133365109612558&w=2","http://marc.info/?l=bugtraq&m=133728004526190&w=2","http://marc.info/?l=bugtraq&m=134254866602253&w=2","http://marc.info/?l=bugtraq&m=134254957702612&w=2","http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue","http://osvdb.org/74829","http://rhn.redhat.com/errata/RHSA-2012-0508.html","http://rhn.redhat.com/errata/RHSA-2013-1455.html","http://secunia.com/advisories/45791","http://secunia.com/advisories/47998","http://secunia.com/advisories/48256","http://secunia.com/advisories/48692","http://secunia.com/advisories/48915","http://secunia.com/advisories/48948","http://secunia.com/advisories/49198","http://secunia.com/advisories/55322","http://secunia.com/advisories/55350","http://secunia.com/advisories/55351","http://security.gentoo.org/glsa/glsa-201203-02.xml","http://security.gentoo.org/glsa/glsa-201406-32.xml","http://support.apple.com/kb/HT4999","http://support.apple.com/kb/HT5001","http://support.apple.com/kb/HT5130","http://support.apple.com/kb/HT5281","http://support.apple.com/kb/HT5501","http://support.apple.com/kb/HT6150","http://technet.microsoft.com/security/advisory/2588513","http://vnhacker.blogspot.com/2011/09/beast.html","http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf","http://www.debian.org/security/2012/dsa-2398","http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html","http://www.ibm.com/developerworks/java/jdk/alerts/","http://www.imperialviolet.org/2011/09/23/chromeandbeast.html","http://www.insecure.cl/Beast-SSL.rar","http://www.kb.cert.org/vuls/id/864643","http://www.mandriva.com/security/advisories?name=MDVSA-2012:058","http://www.opera.com/docs/changelogs/mac/1151/","http://www.opera.com/docs/changelogs/mac/1160/","http://www.opera.com/docs/changelogs/unix/1151/","http://www.opera.com/docs/changelogs/unix/1160/","http://www.opera.com/docs/changelogs/windows/1151/","http://www.opera.com/docs/changelogs/windows/1160/","http://www.opera.com/support/kb/view/1004/","http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html","http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html","http://www.redhat.com/support/errata/RHSA-2011-1384.html","http://www.redhat.com/support/errata/RHSA-2012-0006.html","http://www.securityfocus.com/bid/49388","http://www.securityfocus.com/bid/49778","http://www.securitytracker.com/id/1029190","http://www.securitytracker.com/id?1025997","http://www.securitytracker.com/id?1026103","http://www.securitytracker.com/id?1026704","http://www.ubuntu.com/usn/USN-1263-1","http://www.us-cert.gov/cas/techalerts/TA12-010A.html","https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail","https://bugzilla.novell.com/show_bug.cgi?id=719047","https://bugzilla.redhat.com/show_bug.cgi?id=737506","https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf","https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006","https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862","https://hermes.opensuse.org/messages/13154861","https://hermes.opensuse.org/messages/13155432","https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02","https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-3389","description":"The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.13.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0142","versionConstraint":"<1.13.15||>=1.14.0-0,<1.14.7 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0142","fix":{"state":"fixed","versions":["1.13.15","1.14.7"],"available":[{"date":"2020-08-06","kind":"release","version":"1.13.15"},{"date":"2020-08-06","kind":"release","version":"1.14.7"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-16845","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-16845","date":"2026-10-08","epss":0.04861,"percentile":0.91812}],"risk":3.6457500000000005,"urls":["https://go.googlesource.com/go/+/027d7241ce050d197e7fabea3d541ffbe3487258","https://go.dev/issue/40618","https://groups.google.com/g/golang-announce/c/NyPIaucMgXo"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/247120","description":"ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs.\n\nCertain invalid inputs to ReadUvarint or ReadVarint can cause these functions to read an unlimited number of bytes from the ByteReader parameter before returning an error. This can lead to processing more input than expected when the caller is reading directly from a network and depends on ReadUvarint or ReadVarint only consuming a small, bounded number of bytes, even from invalid inputs."},"relatedVulnerabilities":[{"id":"CVE-2020-16845","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-16845","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-16845","date":"2026-10-08","epss":0.04861,"percentile":0.91812}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00028.html","http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html","https://groups.google.com/forum/#%21topic/golang-announce/NyPIaucMgXo","https://groups.google.com/forum/#%21topic/golang-announce/_ulYYcIWg3Q","https://lists.debian.org/debian-lts-announce/2020/11/msg00037.html","https://lists.debian.org/debian-lts-announce/2020/11/msg00038.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RCFJTMKHY5ICGEM5BUFUEDDGSPJ25XU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWRBAH4UZJO3RROQ72SYCUPFCJFA22FO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WV2VWKFTH4EJGZBZALVUJQJOAQB5MDQ4/","https://security.netapp.com/advisory/ntap-20200924-0002/","https://www.debian.org/security/2021/dsa-4848","https://www.oracle.com/security-alerts/cpuApr2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-16845","description":"Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs."},{"id":"GHSA-q6gq-997w-f55g","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-16845","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-16845","date":"2026-10-08","epss":0.04861,"percentile":0.91812}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-16845","https://github.com/ulikunitz/xz/issues/35","https://github.com/ulikunitz/xz/commit/69c6093c7b2397b923acf82cb378f55ab2652b9b","https://groups.google.com/forum/#!topic/golang-announce/NyPIaucMgXo","https://groups.google.com/forum/#!topic/golang-announce/_ulYYcIWg3Q","https://lists.debian.org/debian-lts-announce/2020/11/msg00037.html","https://lists.debian.org/debian-lts-announce/2020/11/msg00038.html","https://www.debian.org/security/2021/dsa-4848","https://www.oracle.com/security-alerts/cpuApr2021.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00028.html","http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6RCFJTMKHY5ICGEM5BUFUEDDGSPJ25XU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWRBAH4UZJO3RROQ72SYCUPFCJFA22FO","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WV2VWKFTH4EJGZBZALVUJQJOAQB5MDQ4","https://security.netapp.com/advisory/ntap-20200924-0002"],"severity":"High","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-q6gq-997w-f55g","description":"Withdrawn Advisory: Infinite loop in xz"}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.13.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0142","versionConstraint":"<1.13.15||>=1.14.0-0,<1.14.7 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0142","fix":{"state":"fixed","versions":["1.13.15","1.14.7"],"available":[{"date":"2020-08-06","kind":"release","version":"1.13.15"},{"date":"2020-08-06","kind":"release","version":"1.14.7"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-16845","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-16845","date":"2026-10-08","epss":0.04861,"percentile":0.91812}],"risk":3.6457500000000005,"urls":["https://go.googlesource.com/go/+/027d7241ce050d197e7fabea3d541ffbe3487258","https://go.dev/issue/40618","https://groups.google.com/g/golang-announce/c/NyPIaucMgXo"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/247120","description":"ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs.\n\nCertain invalid inputs to ReadUvarint or ReadVarint can cause these functions to read an unlimited number of bytes from the ByteReader parameter before returning an error. This can lead to processing more input than expected when the caller is reading directly from a network and depends on ReadUvarint or ReadVarint only consuming a small, bounded number of bytes, even from invalid inputs."},"relatedVulnerabilities":[{"id":"CVE-2020-16845","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-16845","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-16845","date":"2026-10-08","epss":0.04861,"percentile":0.91812}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00028.html","http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html","https://groups.google.com/forum/#%21topic/golang-announce/NyPIaucMgXo","https://groups.google.com/forum/#%21topic/golang-announce/_ulYYcIWg3Q","https://lists.debian.org/debian-lts-announce/2020/11/msg00037.html","https://lists.debian.org/debian-lts-announce/2020/11/msg00038.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RCFJTMKHY5ICGEM5BUFUEDDGSPJ25XU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWRBAH4UZJO3RROQ72SYCUPFCJFA22FO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WV2VWKFTH4EJGZBZALVUJQJOAQB5MDQ4/","https://security.netapp.com/advisory/ntap-20200924-0002/","https://www.debian.org/security/2021/dsa-4848","https://www.oracle.com/security-alerts/cpuApr2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-16845","description":"Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs."},{"id":"GHSA-q6gq-997w-f55g","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-16845","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-16845","date":"2026-10-08","epss":0.04861,"percentile":0.91812}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-16845","https://github.com/ulikunitz/xz/issues/35","https://github.com/ulikunitz/xz/commit/69c6093c7b2397b923acf82cb378f55ab2652b9b","https://groups.google.com/forum/#!topic/golang-announce/NyPIaucMgXo","https://groups.google.com/forum/#!topic/golang-announce/_ulYYcIWg3Q","https://lists.debian.org/debian-lts-announce/2020/11/msg00037.html","https://lists.debian.org/debian-lts-announce/2020/11/msg00038.html","https://www.debian.org/security/2021/dsa-4848","https://www.oracle.com/security-alerts/cpuApr2021.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00028.html","http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6RCFJTMKHY5ICGEM5BUFUEDDGSPJ25XU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWRBAH4UZJO3RROQ72SYCUPFCJFA22FO","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WV2VWKFTH4EJGZBZALVUJQJOAQB5MDQ4","https://security.netapp.com/advisory/ntap-20200924-0002"],"severity":"High","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-q6gq-997w-f55g","description":"Withdrawn Advisory: Infinite loop in xz"}]},{"artifact":{"id":"7c1ebd3787684a51","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.7-4:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/debian/libgnutls30@3.6.7-4?arch=amd64&distro=debian-10.1&upstream=gnutls28","type":"deb","version":"3.6.7-4","language":"","licenses":["sha256:d35f0abecc61a3676965c20cf13a44815b05d9b4a68985fa1809b13c2aff9090"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.7-4+deb10u7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-20231","versionConstraint":"< 3.6.7-4+deb10u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"gnutls28","version":"3.6.7-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-20231","fix":{"state":"fixed","versions":["3.6.7-4+deb10u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.6.7-4+deb10u7"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-20231","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2021-20231","date":"2026-10-08","epss":0.03751,"percentile":0.89592}],"risk":3.5259400000000003,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-20231","description":"A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequences."},"relatedVulnerabilities":[{"id":"CVE-2021-20231","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-20231","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2021-20231","date":"2026-10-08","epss":0.03751,"percentile":0.89592}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1922276","https://lists.apache.org/thread.html/r50661d6f0082709aad9a584431b59ec364f9974b63b07e0800230168%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/r5d4001031e7790d8c6396c499522b4ed2aab782da87b1a14184793bb%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/r5f88bed447742fcc5c47bf1c7be965ef450131914a6e1f85feba2779%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/r6ac143ba6dd98bd4bf6bf010d46e56e254056459721ba18822d611f7%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/r9cbc69e57276413788e90a6ee16c7c034ea4258d31935b70db2bd158%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/rcd70a4c88a47a75fd2d5f3ffb7cee8c2a18c713320bd90fdcb57495f%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/rf5e1256d870193def4a82ad89ab95e63943a313b5ff0d81aa87e4532%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/rfd5273d72d244178441e6904a2f2b41a3268f569e8092ea0b3b2bb20%40%3Cissues.spark.apache.org%3E","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OSLAE6PP33A7VYRYMYMUVB3U6B26GZER/","https://security.netapp.com/advisory/ntap-20210416-0005/","https://www.gnutls.org/security-new.html#GNUTLS-SA-2021-03-10"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-20231","description":"A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequences."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.16.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0263","versionConstraint":"<1.16.10||>=1.17.0-0,<1.17.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0263","fix":{"state":"fixed","versions":["1.16.10","1.17.3"],"available":[{"date":"2021-11-04","kind":"release","version":"1.16.10"},{"date":"2021-11-04","kind":"release","version":"1.17.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-41771","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-41771","date":"2026-10-08","epss":0.04698,"percentile":0.91566}],"risk":3.5235000000000003,"urls":["https://go.googlesource.com/go/+/61536ec03063b4951163bd09609c86d82631fa27","https://groups.google.com/g/golang-announce/c/0fM21h43arc","https://go.dev/issue/48990"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/367075","description":"Calling File.ImportedSymbols on a loaded file which contains an invalid dynamic symbol table command can cause a panic, in particular if the encoded number of undefined symbols is larger than the number of symbols in the symbol table."},"relatedVulnerabilities":[{"id":"CVE-2021-41771","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-41771","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-41771","date":"2026-10-08","epss":0.04698,"percentile":0.91566}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf","https://groups.google.com/g/golang-announce/c/0fM21h43arc","https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html","https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html","https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OFS3M3OFB24SWPTIAPARKGPUMQVUY6Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON7BQRRJZBOR5TJHURBAB3WLF4YXFC6Z/","https://security.gentoo.org/glsa/202208-02","https://security.netapp.com/advisory/ntap-20211210-0003/","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-41771","description":"ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.16.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0263","versionConstraint":"<1.16.10||>=1.17.0-0,<1.17.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0263","fix":{"state":"fixed","versions":["1.16.10","1.17.3"],"available":[{"date":"2021-11-04","kind":"release","version":"1.16.10"},{"date":"2021-11-04","kind":"release","version":"1.17.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-41771","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-41771","date":"2026-10-08","epss":0.04698,"percentile":0.91566}],"risk":3.5235000000000003,"urls":["https://go.googlesource.com/go/+/61536ec03063b4951163bd09609c86d82631fa27","https://groups.google.com/g/golang-announce/c/0fM21h43arc","https://go.dev/issue/48990"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/367075","description":"Calling File.ImportedSymbols on a loaded file which contains an invalid dynamic symbol table command can cause a panic, in particular if the encoded number of undefined symbols is larger than the number of symbols in the symbol table."},"relatedVulnerabilities":[{"id":"CVE-2021-41771","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-41771","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-41771","date":"2026-10-08","epss":0.04698,"percentile":0.91566}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf","https://groups.google.com/g/golang-announce/c/0fM21h43arc","https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html","https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html","https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OFS3M3OFB24SWPTIAPARKGPUMQVUY6Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON7BQRRJZBOR5TJHURBAB3WLF4YXFC6Z/","https://security.gentoo.org/glsa/202208-02","https://security.netapp.com/advisory/ntap-20211210-0003/","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-41771","description":"ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation."}]},{"artifact":{"id":"d55bfe42f054b394","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.2.6-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.2.6-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=expat","type":"deb","version":"2.2.6-2+deb10u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.6-2+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-25314","versionConstraint":"< 2.2.6-2+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"expat","version":"2.2.6-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-25314","fix":{"state":"fixed","versions":["2.2.6-2+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.6-2+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-25314","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-25314","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-25314","date":"2026-10-08","epss":0.04693,"percentile":0.91557}],"risk":3.51975,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5085-1","link":"https://security-tracker.debian.org/tracker/DSA-5085-1"},{"id":"DSA-5085-2","link":"https://security-tracker.debian.org/tracker/DSA-5085-2"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-25314","description":"In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString."},"relatedVulnerabilities":[{"id":"CVE-2022-25314","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-25314","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-25314","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-25314","date":"2026-10-08","epss":0.04693,"percentile":0.91557}],"urls":["http://www.openwall.com/lists/oss-security/2022/02/19/1","https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","https://github.com/libexpat/libexpat/pull/560","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UFRBA3UQVIQKXTBUQXDWQOVWNBKLERU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y27XO3JMKAOMQZVPS3B4MJGEAHCZF5OM/","https://security.gentoo.org/glsa/202209-24","https://security.netapp.com/advisory/ntap-20220303-0008/","https://www.debian.org/security/2022/dsa-5085","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25314","description":"In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString."}]},{"artifact":{"id":"09f128b26388fc18","cpes":["cpe:2.3:a:libidn2-0:libidn2-0:2.0.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libidn2-0:libidn2_0:2.0.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libidn2_0:libidn2-0:2.0.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libidn2_0:libidn2_0:2.0.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libidn2:libidn2-0:2.0.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libidn2:libidn2_0:2.0.5-1:*:*:*:*:*:*:*"],"name":"libidn2-0","purl":"pkg:deb/debian/libidn2-0@2.0.5-1?arch=amd64&distro=debian-10.1&upstream=libidn2","type":"deb","version":"2.0.5-1","language":"","licenses":["GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-3","LGPL-3+","Unicode"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libidn2-0/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libidn2-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libidn2-0:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libidn2-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libidn2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.0.5-1+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-18224","versionConstraint":"< 2.0.5-1+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"libidn2","version":"2.0.5-1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-18224","fix":{"state":"fixed","versions":["2.0.5-1+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.0.5-1+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-18224","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-18224","date":"2026-10-08","epss":0.03708,"percentile":0.89459}],"risk":3.48552,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4613-1","link":"https://security-tracker.debian.org/tracker/DSA-4613-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-18224","description":"idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string."},"relatedVulnerabilities":[{"id":"CVE-2019-18224","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-18224","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-18224","date":"2026-10-08","epss":0.03708,"percentile":0.89459}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00008.html","http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00009.html","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12420","https://github.com/libidn/libidn2/commit/e4d1558aa2c1c04a05066ee8600f37603890ba8c","https://github.com/libidn/libidn2/compare/libidn2-2.1.0...libidn2-2.1.1","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDQVQ2XPV5BTZUFINT7AFJSKNNBVURNJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MINU5RKDFE6TKAFY5DRFN3WSFDS4DYVS/","https://seclists.org/bugtraq/2020/Feb/4","https://security.gentoo.org/glsa/202003-63","https://usn.ubuntu.com/4168-1/","https://www.debian.org/security/2020/dsa-4613"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-18224","description":"idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string."}]},{"artifact":{"id":"ecf5e89e65014edb","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.64.0-4:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/debian/libcurl4@7.64.0-4?arch=amd64&distro=debian-10.1&upstream=curl","type":"deb","version":"7.64.0-4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.64.0-4+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-8286","versionConstraint":"< 7.64.0-4+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"curl","version":"7.64.0-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-8286","fix":{"state":"fixed","versions":["7.64.0-4+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.64.0-4+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8286","cwe":"CWE-295","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2020-8286","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-8286","date":"2026-10-08","epss":0.04631,"percentile":0.9147}],"risk":3.47325,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4881-1","link":"https://security-tracker.debian.org/tracker/DSA-4881-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-8286","description":"curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response."},"relatedVulnerabilities":[{"id":"CVE-2020-8286","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8286","cwe":"CWE-295","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2020-8286","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-8286","date":"2026-10-08","epss":0.04631,"percentile":0.9147}],"urls":["http://seclists.org/fulldisclosure/2021/Apr/50","http://seclists.org/fulldisclosure/2021/Apr/51","http://seclists.org/fulldisclosure/2021/Apr/54","https://cert-portal.siemens.com/productcert/pdf/ssa-200951.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://curl.se/docs/CVE-2020-8286.html","https://hackerone.com/reports/1048457","https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/","https://security.gentoo.org/glsa/202012-14","https://security.netapp.com/advisory/ntap-20210122-0007/","https://support.apple.com/kb/HT212325","https://support.apple.com/kb/HT212326","https://support.apple.com/kb/HT212327","https://www.debian.org/security/2021/dsa-4881","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8286","description":"curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response."}]},{"artifact":{"id":"d55bfe42f054b394","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.2.6-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.2.6-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=expat","type":"deb","version":"2.2.6-2+deb10u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.6-2+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-45960","versionConstraint":"< 2.2.6-2+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"expat","version":"2.2.6-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-45960","fix":{"state":"fixed","versions":["2.2.6-2+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.6-2+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-45960","cwe":"CWE-682","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-45960","cwe":"CWE-682","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-45960","date":"2026-10-08","epss":0.04234,"percentile":0.90764}],"risk":3.4507100000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5073-1","link":"https://security-tracker.debian.org/tracker/DSA-5073-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-45960","description":"In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory)."},"relatedVulnerabilities":[{"id":"CVE-2021-45960","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-45960","cwe":"CWE-682","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-45960","cwe":"CWE-682","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-45960","date":"2026-10-08","epss":0.04234,"percentile":0.90764}],"urls":["http://www.openwall.com/lists/oss-security/2022/01/17/3","https://bugzilla.mozilla.org/show_bug.cgi?id=1217609","https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","https://github.com/libexpat/libexpat/issues/531","https://github.com/libexpat/libexpat/pull/534","https://security.gentoo.org/glsa/202209-24","https://security.netapp.com/advisory/ntap-20220121-0004/","https://www.debian.org/security/2022/dsa-5073","https://www.tenable.com/security/tns-2022-05"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-45960","description":"In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory)."}]},{"artifact":{"id":"c6f08567c3b7bec6","cpes":["cpe:2.3:a:golang:networking:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.0.0-20190404232315-eb5bcb51f2a3","type":"go-module","version":"v0.0.0-20190404232315-eb5bcb51f2a3","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.7.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vvpx-j8f3-3w6h","versionConstraint":"<0.7.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.0.0-20190404232315-eb5bcb51f2a3"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-vvpx-j8f3-3w6h","fix":{"state":"fixed","versions":["0.7.0"],"available":[{"date":"2023-02-18","kind":"first-observed","version":"0.7.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41723","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41723","date":"2026-10-08","epss":0.04561,"percentile":0.91357}],"risk":3.42075,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-41723","https://go.dev/cl/468135","https://go.dev/issue/57855","https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E","https://vuln.go.dev/ID/GO-2023-1571.json","https://go.dev/cl/468295","https://pkg.go.dev/vuln/GO-2023-1571","https://security.gentoo.org/glsa/202311-09","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MA5XS5DAOJ5PKKNG5TUXKPQOFHT5VBC","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGW7GE2Z32ZT47UFAQFDRQE33B7Q7LMT","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RLBQ3A7ROLEQXQLXFDLNJ7MYPKG5GULE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XX3IMUTZKRQ73PBZM4E2JP4BKYH4C6XE","https://www.couchbase.com/alerts"],"severity":"High","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vvpx-j8f3-3w6h","description":"golang.org/x/net vulnerable to Uncontrolled Resource Consumption"},"relatedVulnerabilities":[{"id":"CVE-2022-41723","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41723","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41723","date":"2026-10-08","epss":0.04561,"percentile":0.91357}],"urls":["https://go.dev/cl/468135","https://go.dev/cl/468295","https://go.dev/issue/57855","https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MA5XS5DAOJ5PKKNG5TUXKPQOFHT5VBC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGW7GE2Z32ZT47UFAQFDRQE33B7Q7LMT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RLBQ3A7ROLEQXQLXFDLNJ7MYPKG5GULE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XX3IMUTZKRQ73PBZM4E2JP4BKYH4C6XE/","https://pkg.go.dev/vuln/GO-2023-1571","https://security.gentoo.org/glsa/202311-09","https://www.couchbase.com/alerts/","https://security.netapp.com/advisory/ntap-20230331-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41723","description":"A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests."}]},{"artifact":{"id":"727332619043e05d","cpes":["cpe:2.3:a:golang:networking:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.0.0-20190404232315-eb5bcb51f2a3","type":"go-module","version":"v0.0.0-20190404232315-eb5bcb51f2a3","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.7.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vvpx-j8f3-3w6h","versionConstraint":"<0.7.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.0.0-20190404232315-eb5bcb51f2a3"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-vvpx-j8f3-3w6h","fix":{"state":"fixed","versions":["0.7.0"],"available":[{"date":"2023-02-18","kind":"first-observed","version":"0.7.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41723","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41723","date":"2026-10-08","epss":0.04561,"percentile":0.91357}],"risk":3.42075,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-41723","https://go.dev/cl/468135","https://go.dev/issue/57855","https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E","https://vuln.go.dev/ID/GO-2023-1571.json","https://go.dev/cl/468295","https://pkg.go.dev/vuln/GO-2023-1571","https://security.gentoo.org/glsa/202311-09","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MA5XS5DAOJ5PKKNG5TUXKPQOFHT5VBC","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGW7GE2Z32ZT47UFAQFDRQE33B7Q7LMT","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RLBQ3A7ROLEQXQLXFDLNJ7MYPKG5GULE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XX3IMUTZKRQ73PBZM4E2JP4BKYH4C6XE","https://www.couchbase.com/alerts"],"severity":"High","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vvpx-j8f3-3w6h","description":"golang.org/x/net vulnerable to Uncontrolled Resource Consumption"},"relatedVulnerabilities":[{"id":"CVE-2022-41723","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41723","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41723","date":"2026-10-08","epss":0.04561,"percentile":0.91357}],"urls":["https://go.dev/cl/468135","https://go.dev/cl/468295","https://go.dev/issue/57855","https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MA5XS5DAOJ5PKKNG5TUXKPQOFHT5VBC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGW7GE2Z32ZT47UFAQFDRQE33B7Q7LMT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RLBQ3A7ROLEQXQLXFDLNJ7MYPKG5GULE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XX3IMUTZKRQ73PBZM4E2JP4BKYH4C6XE/","https://pkg.go.dev/vuln/GO-2023-1571","https://security.gentoo.org/glsa/202311-09","https://www.couchbase.com/alerts/","https://security.netapp.com/advisory/ntap-20230331-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41723","description":"A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.19.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2023-1571","versionConstraint":"<1.19.6||>=1.20.0-0,<1.20.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2023-1571","fix":{"state":"fixed","versions":["1.19.6","1.20.1"],"available":[{"date":"2023-02-14","kind":"release","version":"1.19.6"},{"date":"2023-02-14","kind":"release","version":"1.20.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41723","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41723","date":"2026-10-08","epss":0.04561,"percentile":0.91357}],"risk":3.42075,"urls":["https://go.dev/cl/468135","https://go.dev/cl/468295","https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/57855","description":"A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests."},"relatedVulnerabilities":[{"id":"CVE-2022-41723","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41723","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41723","date":"2026-10-08","epss":0.04561,"percentile":0.91357}],"urls":["https://go.dev/cl/468135","https://go.dev/cl/468295","https://go.dev/issue/57855","https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MA5XS5DAOJ5PKKNG5TUXKPQOFHT5VBC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGW7GE2Z32ZT47UFAQFDRQE33B7Q7LMT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RLBQ3A7ROLEQXQLXFDLNJ7MYPKG5GULE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XX3IMUTZKRQ73PBZM4E2JP4BKYH4C6XE/","https://pkg.go.dev/vuln/GO-2023-1571","https://security.gentoo.org/glsa/202311-09","https://www.couchbase.com/alerts/","https://security.netapp.com/advisory/ntap-20230331-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41723","description":"A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests."},{"id":"GHSA-vvpx-j8f3-3w6h","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41723","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41723","date":"2026-10-08","epss":0.04561,"percentile":0.91357}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-41723","https://go.dev/cl/468135","https://go.dev/issue/57855","https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E","https://vuln.go.dev/ID/GO-2023-1571.json","https://go.dev/cl/468295","https://pkg.go.dev/vuln/GO-2023-1571","https://security.gentoo.org/glsa/202311-09","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MA5XS5DAOJ5PKKNG5TUXKPQOFHT5VBC","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGW7GE2Z32ZT47UFAQFDRQE33B7Q7LMT","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RLBQ3A7ROLEQXQLXFDLNJ7MYPKG5GULE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XX3IMUTZKRQ73PBZM4E2JP4BKYH4C6XE","https://www.couchbase.com/alerts"],"severity":"High","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-vvpx-j8f3-3w6h","description":"golang.org/x/net vulnerable to Uncontrolled Resource Consumption"}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.19.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2023-1571","versionConstraint":"<1.19.6||>=1.20.0-0,<1.20.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2023-1571","fix":{"state":"fixed","versions":["1.19.6","1.20.1"],"available":[{"date":"2023-02-14","kind":"release","version":"1.19.6"},{"date":"2023-02-14","kind":"release","version":"1.20.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41723","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41723","date":"2026-10-08","epss":0.04561,"percentile":0.91357}],"risk":3.42075,"urls":["https://go.dev/cl/468135","https://go.dev/cl/468295","https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/57855","description":"A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests."},"relatedVulnerabilities":[{"id":"CVE-2022-41723","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41723","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41723","date":"2026-10-08","epss":0.04561,"percentile":0.91357}],"urls":["https://go.dev/cl/468135","https://go.dev/cl/468295","https://go.dev/issue/57855","https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MA5XS5DAOJ5PKKNG5TUXKPQOFHT5VBC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGW7GE2Z32ZT47UFAQFDRQE33B7Q7LMT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RLBQ3A7ROLEQXQLXFDLNJ7MYPKG5GULE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XX3IMUTZKRQ73PBZM4E2JP4BKYH4C6XE/","https://pkg.go.dev/vuln/GO-2023-1571","https://security.gentoo.org/glsa/202311-09","https://www.couchbase.com/alerts/","https://security.netapp.com/advisory/ntap-20230331-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41723","description":"A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests."},{"id":"GHSA-vvpx-j8f3-3w6h","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41723","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41723","date":"2026-10-08","epss":0.04561,"percentile":0.91357}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-41723","https://go.dev/cl/468135","https://go.dev/issue/57855","https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E","https://vuln.go.dev/ID/GO-2023-1571.json","https://go.dev/cl/468295","https://pkg.go.dev/vuln/GO-2023-1571","https://security.gentoo.org/glsa/202311-09","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MA5XS5DAOJ5PKKNG5TUXKPQOFHT5VBC","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGW7GE2Z32ZT47UFAQFDRQE33B7Q7LMT","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RLBQ3A7ROLEQXQLXFDLNJ7MYPKG5GULE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XX3IMUTZKRQ73PBZM4E2JP4BKYH4C6XE","https://www.couchbase.com/alerts"],"severity":"High","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-vvpx-j8f3-3w6h","description":"golang.org/x/net vulnerable to Uncontrolled Resource Consumption"}]},{"artifact":{"id":"ecf5e89e65014edb","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.64.0-4:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/debian/libcurl4@7.64.0-4?arch=amd64&distro=debian-10.1&upstream=curl","type":"deb","version":"7.64.0-4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.64.0-4+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-22946","versionConstraint":"< 7.64.0-4+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"curl","version":"7.64.0-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-22946","fix":{"state":"fixed","versions":["7.64.0-4+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.64.0-4+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-22946","cwe":"CWE-325","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2021-22946","cwe":"CWE-319","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-22946","cwe":"CWE-319","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-22946","date":"2026-10-08","epss":0.04539,"percentile":0.91321}],"risk":3.40425,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-22946","description":"A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network."},"relatedVulnerabilities":[{"id":"CVE-2021-22946","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-22946","cwe":"CWE-325","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2021-22946","cwe":"CWE-319","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-22946","cwe":"CWE-319","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-22946","date":"2026-10-08","epss":0.04539,"percentile":0.91321}],"urls":["http://seclists.org/fulldisclosure/2022/Mar/29","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://hackerone.com/reports/1334111","https://lists.debian.org/debian-lts-announce/2021/09/msg00022.html","https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20211029-0003/","https://security.netapp.com/advisory/ntap-20220121-0008/","https://support.apple.com/kb/HT213183","https://www.debian.org/security/2022/dsa-5197","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-22946","description":"A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network."}]},{"artifact":{"id":"bca20a7b0a858bf3","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/debian/libssl1.1@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1&upstream=openssl","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1n-0+deb10u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-0215","versionConstraint":"< 1.1.1n-0+deb10u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-0215","fix":{"state":"fixed","versions":["1.1.1n-0+deb10u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1n-0+deb10u4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0215","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0215","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0215","date":"2026-10-08","epss":0.04494,"percentile":0.91248}],"risk":3.3705,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-0215","description":"The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.  The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash.    This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7.  Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream.  The OpenSSL cms and smime command line applications are similarly affected."},"relatedVulnerabilities":[{"id":"CVE-2023-0215","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0215","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0215","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0215","date":"2026-10-08","epss":0.04494,"percentile":0.91248}],"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8818064ce3c3c0f1b740a5aaba2a987e75bfbafd","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9816136fe31d92ace4037d5da5257f763aeeb4eb","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c3829dd8825c654652201e16f8a0a0c46ee3f344","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230427-0007/","https://security.netapp.com/advisory/ntap-20230427-0009/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0215","description":"The public API function BIO_new_NDEF is a helper function used for streaming\nASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the\nSMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by\nend user applications.\n\nThe function receives a BIO from the caller, prepends a new BIO_f_asn1 filter\nBIO onto the front of it to form a BIO chain, and then returns the new head of\nthe BIO chain to the caller. Under certain conditions, for example if a CMS\nrecipient public key is invalid, the new filter BIO is freed and the function\nreturns a NULL result indicating a failure. However, in this case, the BIO chain\nis not properly cleaned up and the BIO passed by the caller still retains\ninternal pointers to the previously freed filter BIO. If the caller then goes on\nto call BIO_pop() on the BIO then a use-after-free will occur. This will most\nlikely result in a crash.\n\n\n\nThis scenario occurs directly in the internal function B64_write_ASN1() which\nmay cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on\nthe BIO. This internal function is in turn called by the public API functions\nPEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream,\nSMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7.\n\nOther public API functions that may be impacted by this include\ni2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and\ni2d_PKCS7_bio_stream.\n\nThe OpenSSL cms and smime command line applications are similarly affected."}]},{"artifact":{"id":"d308e84bddad0b0f","cpes":["cpe:2.3:a:openssl:openssl:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1n-0+deb10u4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-0215","versionConstraint":"< 1.1.1n-0+deb10u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-0215","fix":{"state":"fixed","versions":["1.1.1n-0+deb10u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1n-0+deb10u4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0215","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0215","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0215","date":"2026-10-08","epss":0.04494,"percentile":0.91248}],"risk":3.3705,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-0215","description":"The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.  The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash.    This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7.  Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream.  The OpenSSL cms and smime command line applications are similarly affected."},"relatedVulnerabilities":[{"id":"CVE-2023-0215","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0215","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0215","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0215","date":"2026-10-08","epss":0.04494,"percentile":0.91248}],"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8818064ce3c3c0f1b740a5aaba2a987e75bfbafd","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9816136fe31d92ace4037d5da5257f763aeeb4eb","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c3829dd8825c654652201e16f8a0a0c46ee3f344","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230427-0007/","https://security.netapp.com/advisory/ntap-20230427-0009/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0215","description":"The public API function BIO_new_NDEF is a helper function used for streaming\nASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the\nSMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by\nend user applications.\n\nThe function receives a BIO from the caller, prepends a new BIO_f_asn1 filter\nBIO onto the front of it to form a BIO chain, and then returns the new head of\nthe BIO chain to the caller. Under certain conditions, for example if a CMS\nrecipient public key is invalid, the new filter BIO is freed and the function\nreturns a NULL result indicating a failure. However, in this case, the BIO chain\nis not properly cleaned up and the BIO passed by the caller still retains\ninternal pointers to the previously freed filter BIO. If the caller then goes on\nto call BIO_pop() on the BIO then a use-after-free will occur. This will most\nlikely result in a crash.\n\n\n\nThis scenario occurs directly in the internal function B64_write_ASN1() which\nmay cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on\nthe BIO. This internal function is in turn called by the public API functions\nPEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream,\nSMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7.\n\nOther public API functions that may be impacted by this include\ni2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and\ni2d_PKCS7_bio_stream.\n\nThe OpenSSL cms and smime command line applications are similarly affected."}]},{"artifact":{"id":"9c0f03079e497030","cpes":["cpe:2.3:a:libpython3.7-minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-minimal","purl":"pkg:deb/debian/libpython3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10735","versionConstraint":"< 3.7.3-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-10735","fix":{"state":"fixed","versions":["3.7.3-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-10735","date":"2026-10-08","epss":0.04486,"percentile":0.91233}],"risk":3.3644999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10735","description":"A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int(\"text\"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability."},"relatedVulnerabilities":[{"id":"CVE-2020-10735","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-10735","date":"2026-10-08","epss":0.04486,"percentile":0.91233}],"urls":["http://www.openwall.com/lists/oss-security/2022/09/21/1","http://www.openwall.com/lists/oss-security/2022/09/21/4","https://access.redhat.com/security/cve/CVE-2020-10735","https://bugzilla.redhat.com/show_bug.cgi?id=1834423","https://docs.google.com/document/d/1KjuF_aXlzPUxTK4BMgezGJ2Pn7uevfX7g0_mvgHlL7Y","https://github.com/python/cpython/issues/95778","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VCU6EVQDIXNCEDJUCTFIER2WVNNDTYZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/32AAQKABEKFCB5DDV5OONRZK6BS23HPW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4EWKR2SPX3JORLWCXFY3KN2U5B5CIUQQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XL6E5A3I36TRR73VNBOXNIQP4AMZDFZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/76YE7AM37MRU76XJV4M27CWDAMUGNRYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSRPVJZL6DJFWKYRHMNJB7VCEUCBKRF5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFGV7P2PYFBMK32OKHCAC2ZPJQV5AUDF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NHC6IUU7CLRQ3QLPWUXLONSG3SXFTR47/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKYE2DOI2X7WZXAWTQJZAXYIWM37HDCY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5U223OE5ZOUHZAZYSYSWVJQIKDE73E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5WQB7Z3CXOWVBD2AFAHYPA5ONYFFZ4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PD7FTLJOIGMUSCDR3JAN6WRFHJEE4PH5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZYJSGLSCQOKXXFVJVJQAXLEOJBIWGEL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TD7JDDKJXK6D26XAN3YRFNM2LAJHT5UO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMWPRAAJS7I6U3U45V7GZVXWNSECI22M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4ZZV4CDFRMTPDBI7C5L43RFL3XLIGUY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBPDVCDIUCEBE7C4NAGNA2KQJYOTPBAZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V7ZUJDHK7KNG6SLIFXW7MNZ6O2PUJYK6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZEOAJWGGY55QU35UM2OVZATBW5MX2OZD/","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10735","description":"A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int(\"text\"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability."}]},{"artifact":{"id":"b6d8c37141cd8c0a","cpes":["cpe:2.3:a:libpython3.7-stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-stdlib","purl":"pkg:deb/debian/libpython3.7-stdlib@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10735","versionConstraint":"< 3.7.3-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-10735","fix":{"state":"fixed","versions":["3.7.3-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-10735","date":"2026-10-08","epss":0.04486,"percentile":0.91233}],"risk":3.3644999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10735","description":"A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int(\"text\"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability."},"relatedVulnerabilities":[{"id":"CVE-2020-10735","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-10735","date":"2026-10-08","epss":0.04486,"percentile":0.91233}],"urls":["http://www.openwall.com/lists/oss-security/2022/09/21/1","http://www.openwall.com/lists/oss-security/2022/09/21/4","https://access.redhat.com/security/cve/CVE-2020-10735","https://bugzilla.redhat.com/show_bug.cgi?id=1834423","https://docs.google.com/document/d/1KjuF_aXlzPUxTK4BMgezGJ2Pn7uevfX7g0_mvgHlL7Y","https://github.com/python/cpython/issues/95778","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VCU6EVQDIXNCEDJUCTFIER2WVNNDTYZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/32AAQKABEKFCB5DDV5OONRZK6BS23HPW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4EWKR2SPX3JORLWCXFY3KN2U5B5CIUQQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XL6E5A3I36TRR73VNBOXNIQP4AMZDFZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/76YE7AM37MRU76XJV4M27CWDAMUGNRYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSRPVJZL6DJFWKYRHMNJB7VCEUCBKRF5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFGV7P2PYFBMK32OKHCAC2ZPJQV5AUDF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NHC6IUU7CLRQ3QLPWUXLONSG3SXFTR47/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKYE2DOI2X7WZXAWTQJZAXYIWM37HDCY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5U223OE5ZOUHZAZYSYSWVJQIKDE73E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5WQB7Z3CXOWVBD2AFAHYPA5ONYFFZ4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PD7FTLJOIGMUSCDR3JAN6WRFHJEE4PH5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZYJSGLSCQOKXXFVJVJQAXLEOJBIWGEL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TD7JDDKJXK6D26XAN3YRFNM2LAJHT5UO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMWPRAAJS7I6U3U45V7GZVXWNSECI22M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4ZZV4CDFRMTPDBI7C5L43RFL3XLIGUY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBPDVCDIUCEBE7C4NAGNA2KQJYOTPBAZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V7ZUJDHK7KNG6SLIFXW7MNZ6O2PUJYK6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZEOAJWGGY55QU35UM2OVZATBW5MX2OZD/","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10735","description":"A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int(\"text\"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability."}]},{"artifact":{"id":"94955c7d71be2bb1","cpes":["cpe:2.3:a:python3.7:python3.7:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7","purl":"pkg:deb/debian/python3.7@3.7.3-2?arch=amd64&distro=debian-10.1","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.list"},{"path":"/var/lib/dpkg/info/python3.7.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.postinst"},{"path":"/var/lib/dpkg/info/python3.7.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-10735","versionConstraint":"< 3.7.3-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-10735","fix":{"state":"fixed","versions":["3.7.3-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-10735","date":"2026-10-08","epss":0.04486,"percentile":0.91233}],"risk":3.3644999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10735","description":"A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int(\"text\"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability."},"relatedVulnerabilities":[{"id":"CVE-2020-10735","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-10735","date":"2026-10-08","epss":0.04486,"percentile":0.91233}],"urls":["http://www.openwall.com/lists/oss-security/2022/09/21/1","http://www.openwall.com/lists/oss-security/2022/09/21/4","https://access.redhat.com/security/cve/CVE-2020-10735","https://bugzilla.redhat.com/show_bug.cgi?id=1834423","https://docs.google.com/document/d/1KjuF_aXlzPUxTK4BMgezGJ2Pn7uevfX7g0_mvgHlL7Y","https://github.com/python/cpython/issues/95778","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VCU6EVQDIXNCEDJUCTFIER2WVNNDTYZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/32AAQKABEKFCB5DDV5OONRZK6BS23HPW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4EWKR2SPX3JORLWCXFY3KN2U5B5CIUQQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XL6E5A3I36TRR73VNBOXNIQP4AMZDFZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/76YE7AM37MRU76XJV4M27CWDAMUGNRYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSRPVJZL6DJFWKYRHMNJB7VCEUCBKRF5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFGV7P2PYFBMK32OKHCAC2ZPJQV5AUDF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NHC6IUU7CLRQ3QLPWUXLONSG3SXFTR47/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKYE2DOI2X7WZXAWTQJZAXYIWM37HDCY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5U223OE5ZOUHZAZYSYSWVJQIKDE73E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5WQB7Z3CXOWVBD2AFAHYPA5ONYFFZ4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PD7FTLJOIGMUSCDR3JAN6WRFHJEE4PH5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZYJSGLSCQOKXXFVJVJQAXLEOJBIWGEL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TD7JDDKJXK6D26XAN3YRFNM2LAJHT5UO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMWPRAAJS7I6U3U45V7GZVXWNSECI22M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4ZZV4CDFRMTPDBI7C5L43RFL3XLIGUY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBPDVCDIUCEBE7C4NAGNA2KQJYOTPBAZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V7ZUJDHK7KNG6SLIFXW7MNZ6O2PUJYK6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZEOAJWGGY55QU35UM2OVZATBW5MX2OZD/","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10735","description":"A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int(\"text\"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability."}]},{"artifact":{"id":"988c8a69c0d8509e","cpes":["cpe:2.3:a:python3.7-minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7-minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7-minimal","purl":"pkg:deb/debian/python3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.list"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.7-minimal.preinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.prerm"}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10735","versionConstraint":"< 3.7.3-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-10735","fix":{"state":"fixed","versions":["3.7.3-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-10735","date":"2026-10-08","epss":0.04486,"percentile":0.91233}],"risk":3.3644999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10735","description":"A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int(\"text\"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability."},"relatedVulnerabilities":[{"id":"CVE-2020-10735","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10735","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-10735","date":"2026-10-08","epss":0.04486,"percentile":0.91233}],"urls":["http://www.openwall.com/lists/oss-security/2022/09/21/1","http://www.openwall.com/lists/oss-security/2022/09/21/4","https://access.redhat.com/security/cve/CVE-2020-10735","https://bugzilla.redhat.com/show_bug.cgi?id=1834423","https://docs.google.com/document/d/1KjuF_aXlzPUxTK4BMgezGJ2Pn7uevfX7g0_mvgHlL7Y","https://github.com/python/cpython/issues/95778","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VCU6EVQDIXNCEDJUCTFIER2WVNNDTYZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/32AAQKABEKFCB5DDV5OONRZK6BS23HPW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4EWKR2SPX3JORLWCXFY3KN2U5B5CIUQQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XL6E5A3I36TRR73VNBOXNIQP4AMZDFZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/76YE7AM37MRU76XJV4M27CWDAMUGNRYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSRPVJZL6DJFWKYRHMNJB7VCEUCBKRF5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFGV7P2PYFBMK32OKHCAC2ZPJQV5AUDF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NHC6IUU7CLRQ3QLPWUXLONSG3SXFTR47/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKYE2DOI2X7WZXAWTQJZAXYIWM37HDCY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5U223OE5ZOUHZAZYSYSWVJQIKDE73E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5WQB7Z3CXOWVBD2AFAHYPA5ONYFFZ4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PD7FTLJOIGMUSCDR3JAN6WRFHJEE4PH5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZYJSGLSCQOKXXFVJVJQAXLEOJBIWGEL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TD7JDDKJXK6D26XAN3YRFNM2LAJHT5UO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMWPRAAJS7I6U3U45V7GZVXWNSECI22M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4ZZV4CDFRMTPDBI7C5L43RFL3XLIGUY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBPDVCDIUCEBE7C4NAGNA2KQJYOTPBAZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V7ZUJDHK7KNG6SLIFXW7MNZ6O2PUJYK6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZEOAJWGGY55QU35UM2OVZATBW5MX2OZD/","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10735","description":"A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int(\"text\"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability."}]},{"artifact":{"id":"bca20a7b0a858bf3","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/debian/libssl1.1@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1&upstream=openssl","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1n-0+deb10u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-3446","versionConstraint":"< 1.1.1n-0+deb10u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-3446","fix":{"state":"fixed","versions":["1.1.1n-0+deb10u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1n-0+deb10u6"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-3446","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-3446","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-3446","date":"2026-10-08","epss":0.06531,"percentile":0.93621}],"risk":3.363465,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-3446","description":"Issue summary: Checking excessively long DH keys or parameters may be very slow.  Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service.  The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length.  However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large.  An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulernable to a Denial of Service attack.  The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check().  Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the '-check' option.  The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."},"relatedVulnerabilities":[{"id":"CVE-2023-3446","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-3446","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-3446","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-3446","date":"2026-10-08","epss":0.06531,"percentile":0.93621}],"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23","https://www.openssl.org/news/secadv/20230719.txt","http://www.openwall.com/lists/oss-security/2023/07/19/4","http://www.openwall.com/lists/oss-security/2023/07/19/5","http://www.openwall.com/lists/oss-security/2023/07/19/6","http://www.openwall.com/lists/oss-security/2023/07/31/1","http://www.openwall.com/lists/oss-security/2024/05/16/1","https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230803-0011/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-3446","description":"Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normally use a modulus which\nis over 10,000 bits in length.\n\nHowever the DH_check() function checks numerous aspects of the key or parameters\nthat have been supplied. Some of those checks use the supplied modulus value\neven if it has already been found to be too large.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulernable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the '-check' option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."}]},{"artifact":{"id":"d308e84bddad0b0f","cpes":["cpe:2.3:a:openssl:openssl:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1n-0+deb10u6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-3446","versionConstraint":"< 1.1.1n-0+deb10u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-3446","fix":{"state":"fixed","versions":["1.1.1n-0+deb10u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1n-0+deb10u6"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-3446","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-3446","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-3446","date":"2026-10-08","epss":0.06531,"percentile":0.93621}],"risk":3.363465,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-3446","description":"Issue summary: Checking excessively long DH keys or parameters may be very slow.  Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service.  The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length.  However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large.  An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulernable to a Denial of Service attack.  The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check().  Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the '-check' option.  The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."},"relatedVulnerabilities":[{"id":"CVE-2023-3446","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-3446","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-3446","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-3446","date":"2026-10-08","epss":0.06531,"percentile":0.93621}],"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23","https://www.openssl.org/news/secadv/20230719.txt","http://www.openwall.com/lists/oss-security/2023/07/19/4","http://www.openwall.com/lists/oss-security/2023/07/19/5","http://www.openwall.com/lists/oss-security/2023/07/19/6","http://www.openwall.com/lists/oss-security/2023/07/31/1","http://www.openwall.com/lists/oss-security/2024/05/16/1","https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230803-0011/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-3446","description":"Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normally use a modulus which\nis over 10,000 bits in length.\n\nHowever the DH_check() function checks numerous aspects of the key or parameters\nthat have been supplied. Some of those checks use the supplied modulus value\neven if it has already been found to be too large.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulernable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the '-check' option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."}]},{"artifact":{"id":"091f259a310587c1","cpes":["cpe:2.3:a:libsasl2-2:libsasl2-2:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-2:libsasl2_2:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2-2:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2_2:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-2:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_2:2.1.27\\+dfsg-1:*:*:*:*:*:*:*"],"name":"libsasl2-2","purl":"pkg:deb/debian/libsasl2-2@2.1.27%2Bdfsg-1?arch=amd64&distro=debian-10.1&upstream=cyrus-sasl2","type":"deb","version":"2.1.27+dfsg-1","language":"","licenses":["BSD-4-clause","GPL-3","GPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-2/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libsasl2-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.1.27+dfsg-1+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-24407","versionConstraint":"< 2.1.27+dfsg-1+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"cyrus-sasl2","version":"2.1.27+dfsg-1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-24407","fix":{"state":"fixed","versions":["2.1.27+dfsg-1+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.1.27+dfsg-1+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-24407","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-24407","date":"2026-10-08","epss":0.04123,"percentile":0.90534}],"risk":3.360245000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5087-1","link":"https://security-tracker.debian.org/tracker/DSA-5087-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-24407","description":"In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement."},"relatedVulnerabilities":[{"id":"CVE-2022-24407","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-24407","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-24407","date":"2026-10-08","epss":0.04123,"percentile":0.90534}],"urls":["http://www.openwall.com/lists/oss-security/2022/02/23/4","https://github.com/cyrusimap/cyrus-sasl/blob/fdcd13ceaef8de684dc69008011fa865c5b4a3ac/docsrc/sasl/release-notes/2.1/index.rst","https://lists.debian.org/debian-lts-announce/2022/03/msg00002.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4FIXU75Q6RBNK6UYM7MQ3TCFGXR7AX4U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H26R4SMGM3WHXX4XYNNJB4YGFIL5UNF4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZZC6BMPI3V3MC2IGNLN377ETUWO7QBIH/","https://security.netapp.com/advisory/ntap-20221007-0003/","https://www.cyrusimap.org/sasl/sasl/release-notes/2.1/index.html#new-in-2-1-28","https://www.debian.org/security/2022/dsa-5087","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-24407","description":"In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement."}]},{"artifact":{"id":"f08c59cc842f94ec","cpes":["cpe:2.3:a:libsasl2-modules-db:libsasl2-modules-db:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules-db:libsasl2_modules_db:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2-modules-db:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2_modules_db:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2-modules-db:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2_modules_db:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2-modules-db:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2_modules_db:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-modules-db:2.1.27\\+dfsg-1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_modules_db:2.1.27\\+dfsg-1:*:*:*:*:*:*:*"],"name":"libsasl2-modules-db","purl":"pkg:deb/debian/libsasl2-modules-db@2.1.27%2Bdfsg-1?arch=amd64&distro=debian-10.1&upstream=cyrus-sasl2","type":"deb","version":"2.1.27+dfsg-1","language":"","licenses":["BSD-4-clause","GPL-3","GPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-modules-db/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libsasl2-modules-db/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.1.27+dfsg-1+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-24407","versionConstraint":"< 2.1.27+dfsg-1+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"cyrus-sasl2","version":"2.1.27+dfsg-1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-24407","fix":{"state":"fixed","versions":["2.1.27+dfsg-1+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.1.27+dfsg-1+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-24407","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-24407","date":"2026-10-08","epss":0.04123,"percentile":0.90534}],"risk":3.360245000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5087-1","link":"https://security-tracker.debian.org/tracker/DSA-5087-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-24407","description":"In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement."},"relatedVulnerabilities":[{"id":"CVE-2022-24407","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-24407","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-24407","date":"2026-10-08","epss":0.04123,"percentile":0.90534}],"urls":["http://www.openwall.com/lists/oss-security/2022/02/23/4","https://github.com/cyrusimap/cyrus-sasl/blob/fdcd13ceaef8de684dc69008011fa865c5b4a3ac/docsrc/sasl/release-notes/2.1/index.rst","https://lists.debian.org/debian-lts-announce/2022/03/msg00002.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4FIXU75Q6RBNK6UYM7MQ3TCFGXR7AX4U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H26R4SMGM3WHXX4XYNNJB4YGFIL5UNF4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZZC6BMPI3V3MC2IGNLN377ETUWO7QBIH/","https://security.netapp.com/advisory/ntap-20221007-0003/","https://www.cyrusimap.org/sasl/sasl/release-notes/2.1/index.html#new-in-2-1-28","https://www.debian.org/security/2022/dsa-5087","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-24407","description":"In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement."}]},{"artifact":{"id":"7f19231bca942dc4","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/debian/libldap-2.4-2@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-12243","versionConstraint":"< 2.4.47+dfsg-3+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-12243","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12243","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12243","date":"2026-10-08","epss":0.04423,"percentile":0.91112}],"risk":3.31725,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4666-1","link":"https://security-tracker.debian.org/tracker/DSA-4666-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-12243","description":"In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash)."},"relatedVulnerabilities":[{"id":"CVE-2020-12243","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12243","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12243","date":"2026-10-08","epss":0.04423,"percentile":0.91112}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00016.html","https://bugs.openldap.org/show_bug.cgi?id=9202","https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_4/CHANGES","https://git.openldap.org/openldap/openldap/-/commit/98464c11df8247d6a11b52e294ba5dd4f0380440","https://lists.debian.org/debian-lts-announce/2020/05/msg00001.html","https://security.netapp.com/advisory/ntap-20200511-0003/","https://support.apple.com/kb/HT211289","https://usn.ubuntu.com/4352-1/","https://usn.ubuntu.com/4352-2/","https://www.debian.org/security/2020/dsa-4666","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-12243","description":"In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash)."}]},{"artifact":{"id":"ed53a6639a2640b0","cpes":["cpe:2.3:a:libldap-common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-common","purl":"pkg:deb/debian/libldap-common@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=all&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-common/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.list"}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-12243","versionConstraint":"< 2.4.47+dfsg-3+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-12243","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12243","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12243","date":"2026-10-08","epss":0.04423,"percentile":0.91112}],"risk":3.31725,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4666-1","link":"https://security-tracker.debian.org/tracker/DSA-4666-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-12243","description":"In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash)."},"relatedVulnerabilities":[{"id":"CVE-2020-12243","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12243","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12243","date":"2026-10-08","epss":0.04423,"percentile":0.91112}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00016.html","https://bugs.openldap.org/show_bug.cgi?id=9202","https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_4/CHANGES","https://git.openldap.org/openldap/openldap/-/commit/98464c11df8247d6a11b52e294ba5dd4f0380440","https://lists.debian.org/debian-lts-announce/2020/05/msg00001.html","https://security.netapp.com/advisory/ntap-20200511-0003/","https://support.apple.com/kb/HT211289","https://usn.ubuntu.com/4352-1/","https://usn.ubuntu.com/4352-2/","https://www.debian.org/security/2020/dsa-4666","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-12243","description":"In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash)."}]},{"artifact":{"id":"78e377730903892e","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.17-3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.17-3?arch=amd64&distro=debian-10.1&upstream=krb5","type":"deb","version":"1.17-3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.17-3+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-28196","versionConstraint":"< 1.17-3+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"krb5","version":"1.17-3"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-28196","fix":{"state":"fixed","versions":["1.17-3+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.17-3+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-28196","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-28196","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-28196","date":"2026-10-08","epss":0.04417,"percentile":0.91102}],"risk":3.3127500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4795-1","link":"https://security-tracker.debian.org/tracker/DSA-4795-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-28196","description":"MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit."},"relatedVulnerabilities":[{"id":"CVE-2020-28196","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-28196","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-28196","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-28196","date":"2026-10-08","epss":0.04417,"percentile":0.91102}],"urls":["https://github.com/krb5/krb5/commit/57415dda6cf04e73ffc3723be518eddfae599bfd","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/11/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/45KKOZQWIIIW5C45PJVGQ32AXBSYNBE7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/73IGOG6CZAVMVNS4GGRMOLOZ7B6QVA7F/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPH2V3WSQTELROZK3GFCPQDOFLKIZ6H5/","https://security.gentoo.org/glsa/202011-17","https://security.netapp.com/advisory/ntap-20201202-0001/","https://security.netapp.com/advisory/ntap-20210513-0002/","https://www.debian.org/security/2020/dsa-4795","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-28196","description":"MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit."}]},{"artifact":{"id":"8934c1cbf61306d1","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.17-3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.17-3?arch=amd64&distro=debian-10.1&upstream=krb5","type":"deb","version":"1.17-3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.17-3+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-28196","versionConstraint":"< 1.17-3+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"krb5","version":"1.17-3"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-28196","fix":{"state":"fixed","versions":["1.17-3+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.17-3+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-28196","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-28196","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-28196","date":"2026-10-08","epss":0.04417,"percentile":0.91102}],"risk":3.3127500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4795-1","link":"https://security-tracker.debian.org/tracker/DSA-4795-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-28196","description":"MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit."},"relatedVulnerabilities":[{"id":"CVE-2020-28196","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-28196","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-28196","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-28196","date":"2026-10-08","epss":0.04417,"percentile":0.91102}],"urls":["https://github.com/krb5/krb5/commit/57415dda6cf04e73ffc3723be518eddfae599bfd","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/11/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/45KKOZQWIIIW5C45PJVGQ32AXBSYNBE7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/73IGOG6CZAVMVNS4GGRMOLOZ7B6QVA7F/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPH2V3WSQTELROZK3GFCPQDOFLKIZ6H5/","https://security.gentoo.org/glsa/202011-17","https://security.netapp.com/advisory/ntap-20201202-0001/","https://security.netapp.com/advisory/ntap-20210513-0002/","https://www.debian.org/security/2020/dsa-4795","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-28196","description":"MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit."}]},{"artifact":{"id":"de70c2aa7611f8ea","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.17-3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.17-3?arch=amd64&distro=debian-10.1&upstream=krb5","type":"deb","version":"1.17-3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.17-3+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-28196","versionConstraint":"< 1.17-3+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"krb5","version":"1.17-3"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-28196","fix":{"state":"fixed","versions":["1.17-3+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.17-3+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-28196","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-28196","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-28196","date":"2026-10-08","epss":0.04417,"percentile":0.91102}],"risk":3.3127500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4795-1","link":"https://security-tracker.debian.org/tracker/DSA-4795-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-28196","description":"MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit."},"relatedVulnerabilities":[{"id":"CVE-2020-28196","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-28196","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-28196","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-28196","date":"2026-10-08","epss":0.04417,"percentile":0.91102}],"urls":["https://github.com/krb5/krb5/commit/57415dda6cf04e73ffc3723be518eddfae599bfd","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/11/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/45KKOZQWIIIW5C45PJVGQ32AXBSYNBE7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/73IGOG6CZAVMVNS4GGRMOLOZ7B6QVA7F/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPH2V3WSQTELROZK3GFCPQDOFLKIZ6H5/","https://security.gentoo.org/glsa/202011-17","https://security.netapp.com/advisory/ntap-20201202-0001/","https://security.netapp.com/advisory/ntap-20210513-0002/","https://www.debian.org/security/2020/dsa-4795","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-28196","description":"MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit."}]},{"artifact":{"id":"481759f67535d39d","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.17-3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.17-3?arch=amd64&distro=debian-10.1&upstream=krb5","type":"deb","version":"1.17-3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.17-3+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-28196","versionConstraint":"< 1.17-3+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"krb5","version":"1.17-3"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-28196","fix":{"state":"fixed","versions":["1.17-3+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.17-3+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-28196","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-28196","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-28196","date":"2026-10-08","epss":0.04417,"percentile":0.91102}],"risk":3.3127500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4795-1","link":"https://security-tracker.debian.org/tracker/DSA-4795-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-28196","description":"MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit."},"relatedVulnerabilities":[{"id":"CVE-2020-28196","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-28196","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-28196","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-28196","date":"2026-10-08","epss":0.04417,"percentile":0.91102}],"urls":["https://github.com/krb5/krb5/commit/57415dda6cf04e73ffc3723be518eddfae599bfd","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/11/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/45KKOZQWIIIW5C45PJVGQ32AXBSYNBE7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/73IGOG6CZAVMVNS4GGRMOLOZ7B6QVA7F/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPH2V3WSQTELROZK3GFCPQDOFLKIZ6H5/","https://security.gentoo.org/glsa/202011-17","https://security.netapp.com/advisory/ntap-20201202-0001/","https://security.netapp.com/advisory/ntap-20210513-0002/","https://www.debian.org/security/2020/dsa-4795","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-28196","description":"MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit."}]},{"artifact":{"id":"7c1ebd3787684a51","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.7-4:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/debian/libgnutls30@3.6.7-4?arch=amd64&distro=debian-10.1&upstream=gnutls28","type":"deb","version":"3.6.7-4","language":"","licenses":["sha256:d35f0abecc61a3676965c20cf13a44815b05d9b4a68985fa1809b13c2aff9090"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.7-4+deb10u7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-20232","versionConstraint":"< 3.6.7-4+deb10u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"gnutls28","version":"3.6.7-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-20232","fix":{"state":"fixed","versions":["3.6.7-4+deb10u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.6.7-4+deb10u7"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-20232","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2021-20232","date":"2026-10-08","epss":0.03444,"percentile":0.88669}],"risk":3.2373600000000002,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-20232","description":"A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and other potential consequences."},"relatedVulnerabilities":[{"id":"CVE-2021-20232","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-20232","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2021-20232","date":"2026-10-08","epss":0.03444,"percentile":0.88669}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1922275","https://lists.apache.org/thread.html/r50661d6f0082709aad9a584431b59ec364f9974b63b07e0800230168%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/r5d4001031e7790d8c6396c499522b4ed2aab782da87b1a14184793bb%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/r5f88bed447742fcc5c47bf1c7be965ef450131914a6e1f85feba2779%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/r6ac143ba6dd98bd4bf6bf010d46e56e254056459721ba18822d611f7%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/r9cbc69e57276413788e90a6ee16c7c034ea4258d31935b70db2bd158%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/rcd70a4c88a47a75fd2d5f3ffb7cee8c2a18c713320bd90fdcb57495f%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/rf5e1256d870193def4a82ad89ab95e63943a313b5ff0d81aa87e4532%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/rfd5273d72d244178441e6904a2f2b41a3268f569e8092ea0b3b2bb20%40%3Cissues.spark.apache.org%3E","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OSLAE6PP33A7VYRYMYMUVB3U6B26GZER/","https://security.netapp.com/advisory/ntap-20210416-0005/","https://www.gnutls.org/security-new.html#GNUTLS-SA-2021-03-10"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-20232","description":"A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and other potential consequences."}]},{"artifact":{"id":"7f19231bca942dc4","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/debian/libldap-2.4-2@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36225","versionConstraint":"< 2.4.47+dfsg-3+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-36225","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36225","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36225","date":"2026-10-08","epss":0.043,"percentile":0.90884}],"risk":3.225,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4845-1","link":"https://security-tracker.debian.org/tracker/DSA-4845-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-36225","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resulting in denial of service."},"relatedVulnerabilities":[{"id":"CVE-2020-36225","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36225","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36225","date":"2026-10-08","epss":0.043,"percentile":0.90884}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9412","https://git.openldap.org/openldap/openldap/-/commit/554dff1927176579d652f2fe60c90e9abbad4c65","https://git.openldap.org/openldap/openldap/-/commit/5a2017d4e61a6ddc4dcb4415028e0d08eb6bca26","https://git.openldap.org/openldap/openldap/-/commit/c0b61a9486508e5202aa2e0cfb68c9813731b439","https://git.openldap.org/openldap/openldap/-/commit/d169e7958a3e0dc70f59c8374bf8a59833b7bdd8","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36225","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resulting in denial of service."}]},{"artifact":{"id":"ed53a6639a2640b0","cpes":["cpe:2.3:a:libldap-common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-common","purl":"pkg:deb/debian/libldap-common@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=all&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-common/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.list"}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36225","versionConstraint":"< 2.4.47+dfsg-3+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-36225","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36225","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36225","date":"2026-10-08","epss":0.043,"percentile":0.90884}],"risk":3.225,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4845-1","link":"https://security-tracker.debian.org/tracker/DSA-4845-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-36225","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resulting in denial of service."},"relatedVulnerabilities":[{"id":"CVE-2020-36225","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36225","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36225","date":"2026-10-08","epss":0.043,"percentile":0.90884}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9412","https://git.openldap.org/openldap/openldap/-/commit/554dff1927176579d652f2fe60c90e9abbad4c65","https://git.openldap.org/openldap/openldap/-/commit/5a2017d4e61a6ddc4dcb4415028e0d08eb6bca26","https://git.openldap.org/openldap/openldap/-/commit/c0b61a9486508e5202aa2e0cfb68c9813731b439","https://git.openldap.org/openldap/openldap/-/commit/d169e7958a3e0dc70f59c8374bf8a59833b7bdd8","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36225","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resulting in denial of service."}]},{"artifact":{"id":"7f19231bca942dc4","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/debian/libldap-2.4-2@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36223","versionConstraint":"< 2.4.47+dfsg-3+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-36223","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36223","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36223","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36223","date":"2026-10-08","epss":0.043,"percentile":0.90883}],"risk":3.225,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4845-1","link":"https://security-tracker.debian.org/tracker/DSA-4845-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-36223","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control handling, resulting in denial of service (double free and out-of-bounds read)."},"relatedVulnerabilities":[{"id":"CVE-2020-36223","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36223","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36223","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36223","date":"2026-10-08","epss":0.043,"percentile":0.90883}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9408","https://git.openldap.org/openldap/openldap/-/commit/21981053a1195ae1555e23df4d9ac68d34ede9dd","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36223","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control handling, resulting in denial of service (double free and out-of-bounds read)."}]},{"artifact":{"id":"7f19231bca942dc4","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/debian/libldap-2.4-2@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36224","versionConstraint":"< 2.4.47+dfsg-3+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-36224","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36224","cwe":"CWE-763","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36224","date":"2026-10-08","epss":0.043,"percentile":0.90883}],"risk":3.225,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4845-1","link":"https://security-tracker.debian.org/tracker/DSA-4845-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-36224","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service."},"relatedVulnerabilities":[{"id":"CVE-2020-36224","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36224","cwe":"CWE-763","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36224","date":"2026-10-08","epss":0.043,"percentile":0.90883}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9409","https://git.openldap.org/openldap/openldap/-/commit/554dff1927176579d652f2fe60c90e9abbad4c65","https://git.openldap.org/openldap/openldap/-/commit/5a2017d4e61a6ddc4dcb4415028e0d08eb6bca26","https://git.openldap.org/openldap/openldap/-/commit/c0b61a9486508e5202aa2e0cfb68c9813731b439","https://git.openldap.org/openldap/openldap/-/commit/d169e7958a3e0dc70f59c8374bf8a59833b7bdd8","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36224","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service."}]},{"artifact":{"id":"7f19231bca942dc4","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/debian/libldap-2.4-2@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36229","versionConstraint":"< 2.4.47+dfsg-3+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-36229","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36229","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36229","date":"2026-10-08","epss":0.043,"percentile":0.90883}],"risk":3.225,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4845-1","link":"https://security-tracker.debian.org/tracker/DSA-4845-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-36229","description":"A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring, resulting in denial of service."},"relatedVulnerabilities":[{"id":"CVE-2020-36229","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36229","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36229","date":"2026-10-08","epss":0.043,"percentile":0.90883}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9425","https://git.openldap.org/openldap/openldap/-/commit/4bdfffd2889c0c5cdf58bebafbdc8fce4bb2bff0","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36229","description":"A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring, resulting in denial of service."}]},{"artifact":{"id":"ed53a6639a2640b0","cpes":["cpe:2.3:a:libldap-common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-common","purl":"pkg:deb/debian/libldap-common@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=all&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-common/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.list"}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36223","versionConstraint":"< 2.4.47+dfsg-3+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-36223","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36223","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36223","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36223","date":"2026-10-08","epss":0.043,"percentile":0.90883}],"risk":3.225,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4845-1","link":"https://security-tracker.debian.org/tracker/DSA-4845-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-36223","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control handling, resulting in denial of service (double free and out-of-bounds read)."},"relatedVulnerabilities":[{"id":"CVE-2020-36223","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36223","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36223","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36223","date":"2026-10-08","epss":0.043,"percentile":0.90883}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9408","https://git.openldap.org/openldap/openldap/-/commit/21981053a1195ae1555e23df4d9ac68d34ede9dd","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36223","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control handling, resulting in denial of service (double free and out-of-bounds read)."}]},{"artifact":{"id":"ed53a6639a2640b0","cpes":["cpe:2.3:a:libldap-common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-common","purl":"pkg:deb/debian/libldap-common@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=all&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-common/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.list"}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36224","versionConstraint":"< 2.4.47+dfsg-3+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-36224","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36224","cwe":"CWE-763","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36224","date":"2026-10-08","epss":0.043,"percentile":0.90883}],"risk":3.225,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4845-1","link":"https://security-tracker.debian.org/tracker/DSA-4845-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-36224","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service."},"relatedVulnerabilities":[{"id":"CVE-2020-36224","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36224","cwe":"CWE-763","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36224","date":"2026-10-08","epss":0.043,"percentile":0.90883}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9409","https://git.openldap.org/openldap/openldap/-/commit/554dff1927176579d652f2fe60c90e9abbad4c65","https://git.openldap.org/openldap/openldap/-/commit/5a2017d4e61a6ddc4dcb4415028e0d08eb6bca26","https://git.openldap.org/openldap/openldap/-/commit/c0b61a9486508e5202aa2e0cfb68c9813731b439","https://git.openldap.org/openldap/openldap/-/commit/d169e7958a3e0dc70f59c8374bf8a59833b7bdd8","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36224","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service."}]},{"artifact":{"id":"ed53a6639a2640b0","cpes":["cpe:2.3:a:libldap-common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-common","purl":"pkg:deb/debian/libldap-common@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=all&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-common/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.list"}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36229","versionConstraint":"< 2.4.47+dfsg-3+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-36229","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36229","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36229","date":"2026-10-08","epss":0.043,"percentile":0.90883}],"risk":3.225,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4845-1","link":"https://security-tracker.debian.org/tracker/DSA-4845-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-36229","description":"A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring, resulting in denial of service."},"relatedVulnerabilities":[{"id":"CVE-2020-36229","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36229","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36229","date":"2026-10-08","epss":0.043,"percentile":0.90883}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9425","https://git.openldap.org/openldap/openldap/-/commit/4bdfffd2889c0c5cdf58bebafbdc8fce4bb2bff0","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36229","description":"A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring, resulting in denial of service."}]},{"artifact":{"id":"d55bfe42f054b394","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.2.6-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.2.6-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=expat","type":"deb","version":"2.2.6-2+deb10u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.6-2+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-22823","versionConstraint":"< 2.2.6-2+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"expat","version":"2.2.6-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-22823","fix":{"state":"fixed","versions":["2.2.6-2+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.6-2+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22823","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-22823","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-22823","date":"2026-10-08","epss":0.03404,"percentile":0.88532}],"risk":3.19976,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5073-1","link":"https://security-tracker.debian.org/tracker/DSA-5073-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-22823","description":"build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow."},"relatedVulnerabilities":[{"id":"CVE-2022-22823","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22823","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-22823","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-22823","date":"2026-10-08","epss":0.03404,"percentile":0.88532}],"urls":["http://www.openwall.com/lists/oss-security/2022/01/17/3","https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","https://github.com/libexpat/libexpat/pull/539","https://security.gentoo.org/glsa/202209-24","https://www.debian.org/security/2022/dsa-5073","https://www.tenable.com/security/tns-2022-05"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-22823","description":"build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow."}]},{"artifact":{"id":"d55bfe42f054b394","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.2.6-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.2.6-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=expat","type":"deb","version":"2.2.6-2+deb10u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.6-2+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-22824","versionConstraint":"< 2.2.6-2+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"expat","version":"2.2.6-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-22824","fix":{"state":"fixed","versions":["2.2.6-2+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.6-2+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22824","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-22824","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-22824","date":"2026-10-08","epss":0.03404,"percentile":0.88532}],"risk":3.19976,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5073-1","link":"https://security-tracker.debian.org/tracker/DSA-5073-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-22824","description":"defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow."},"relatedVulnerabilities":[{"id":"CVE-2022-22824","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22824","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-22824","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-22824","date":"2026-10-08","epss":0.03404,"percentile":0.88532}],"urls":["http://www.openwall.com/lists/oss-security/2022/01/17/3","https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","https://github.com/libexpat/libexpat/pull/539","https://security.gentoo.org/glsa/202209-24","https://www.debian.org/security/2022/dsa-5073","https://www.tenable.com/security/tns-2022-05"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-22824","description":"defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow."}]},{"artifact":{"id":"55c72a3cae1cb771","cpes":["cpe:2.3:a:libonig5:libonig5:6.9.1-1:*:*:*:*:*:*:*"],"name":"libonig5","purl":"pkg:deb/debian/libonig5@6.9.1-1?arch=amd64&distro=debian-10.1&upstream=libonig","type":"deb","version":"6.9.1-1","language":"","licenses":["BSD-2-clause","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libonig5/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libonig5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libonig5:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libonig5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libonig"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-19012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"libonig","version":"6.9.1-1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-19012","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-19012","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19012","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19012","date":"2026-10-08","epss":0.10539,"percentile":0.95665}],"risk":3.1616999999999997,"urls":[],"severity":"Low","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-19012","description":"An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression."},"relatedVulnerabilities":[{"id":"CVE-2019-19012","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19012","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19012","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19012","date":"2026-10-08","epss":0.10539,"percentile":0.95665}],"urls":["https://github.com/kkos/oniguruma/issues/164","https://github.com/kkos/oniguruma/releases/tag/v6.9.4_rc2","https://github.com/tarantula-team/CVE-2019-19012","https://lists.debian.org/debian-lts-announce/2019/12/msg00002.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NO267PLHGYZSWX3XTRPKYBKD4J3YOU5V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3MBNW6Z4DOXSCNWGBLQ7OA3OGUJ44WL/","https://usn.ubuntu.com/4460-1/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19012","description":"An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.17.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0435","versionConstraint":"<1.17.9||>=1.18.0-0,<1.18.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0435","fix":{"state":"fixed","versions":["1.17.9","1.18.1"],"available":[{"date":"2022-04-12","kind":"release","version":"1.17.9"},{"date":"2022-04-12","kind":"release","version":"1.18.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-28327","date":"2026-10-08","epss":0.04195,"percentile":0.90687}],"risk":3.14625,"urls":["https://go.googlesource.com/go/+/37065847d87df92b5eb246c88ba2085efcf0b331","https://go.dev/issue/52075","https://groups.google.com/g/golang-announce/c/oecdBNLOml8"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/397135","description":"A crafted scalar input longer than 32 bytes can cause P256().ScalarMult or P256().ScalarBaseMult to panic. Indirect uses through crypto/ecdsa and crypto/tls are unaffected. amd64, arm64, ppc64le, and s390x are unaffected."},"relatedVulnerabilities":[{"id":"CVE-2022-28327","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-28327","date":"2026-10-08","epss":0.04195,"percentile":0.90687}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf","https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/oecdBNLOml8","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42TYZC4OAY54TO75FBEFAPV5G7O4D5TM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F3BMW5QGX53CMIJIZWKXFKBJX2C5GWTY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NY6GEAJMNKKMU5H46QO4D7D6A24KSPXE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RCRSABD6CUDIZULZPZL5BJ3ET3A2NEJP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/","https://security.gentoo.org/glsa/202208-02","https://security.netapp.com/advisory/ntap-20220915-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-28327","description":"The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.17.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0435","versionConstraint":"<1.17.9||>=1.18.0-0,<1.18.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0435","fix":{"state":"fixed","versions":["1.17.9","1.18.1"],"available":[{"date":"2022-04-12","kind":"release","version":"1.17.9"},{"date":"2022-04-12","kind":"release","version":"1.18.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-28327","date":"2026-10-08","epss":0.04195,"percentile":0.90687}],"risk":3.14625,"urls":["https://go.googlesource.com/go/+/37065847d87df92b5eb246c88ba2085efcf0b331","https://go.dev/issue/52075","https://groups.google.com/g/golang-announce/c/oecdBNLOml8"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/397135","description":"A crafted scalar input longer than 32 bytes can cause P256().ScalarMult or P256().ScalarBaseMult to panic. Indirect uses through crypto/ecdsa and crypto/tls are unaffected. amd64, arm64, ppc64le, and s390x are unaffected."},"relatedVulnerabilities":[{"id":"CVE-2022-28327","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-28327","date":"2026-10-08","epss":0.04195,"percentile":0.90687}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf","https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/oecdBNLOml8","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42TYZC4OAY54TO75FBEFAPV5G7O4D5TM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F3BMW5QGX53CMIJIZWKXFKBJX2C5GWTY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NY6GEAJMNKKMU5H46QO4D7D6A24KSPXE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RCRSABD6CUDIZULZPZL5BJ3ET3A2NEJP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/","https://security.gentoo.org/glsa/202208-02","https://security.netapp.com/advisory/ntap-20220915-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-28327","description":"The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input."}]},{"artifact":{"id":"7f19231bca942dc4","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/debian/libldap-2.4-2@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36226","versionConstraint":"< 2.4.47+dfsg-3+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-36226","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-36226","date":"2026-10-08","epss":0.04184,"percentile":0.90665}],"risk":3.1380000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4845-1","link":"https://security-tracker.debian.org/tracker/DSA-4845-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-36226","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service."},"relatedVulnerabilities":[{"id":"CVE-2020-36226","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-36226","date":"2026-10-08","epss":0.04184,"percentile":0.90665}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9413","https://git.openldap.org/openldap/openldap/-/commit/554dff1927176579d652f2fe60c90e9abbad4c65","https://git.openldap.org/openldap/openldap/-/commit/5a2017d4e61a6ddc4dcb4415028e0d08eb6bca26","https://git.openldap.org/openldap/openldap/-/commit/c0b61a9486508e5202aa2e0cfb68c9813731b439","https://git.openldap.org/openldap/openldap/-/commit/d169e7958a3e0dc70f59c8374bf8a59833b7bdd8","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36226","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service."}]},{"artifact":{"id":"ed53a6639a2640b0","cpes":["cpe:2.3:a:libldap-common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-common","purl":"pkg:deb/debian/libldap-common@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=all&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-common/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.list"}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36226","versionConstraint":"< 2.4.47+dfsg-3+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-36226","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-36226","date":"2026-10-08","epss":0.04184,"percentile":0.90665}],"risk":3.1380000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4845-1","link":"https://security-tracker.debian.org/tracker/DSA-4845-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-36226","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service."},"relatedVulnerabilities":[{"id":"CVE-2020-36226","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-36226","date":"2026-10-08","epss":0.04184,"percentile":0.90665}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9413","https://git.openldap.org/openldap/openldap/-/commit/554dff1927176579d652f2fe60c90e9abbad4c65","https://git.openldap.org/openldap/openldap/-/commit/5a2017d4e61a6ddc4dcb4415028e0d08eb6bca26","https://git.openldap.org/openldap/openldap/-/commit/c0b61a9486508e5202aa2e0cfb68c9813731b439","https://git.openldap.org/openldap/openldap/-/commit/d169e7958a3e0dc70f59c8374bf8a59833b7bdd8","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36226","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service."}]},{"artifact":{"id":"c6f08567c3b7bec6","cpes":["cpe:2.3:a:golang:networking:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.0.0-20190404232315-eb5bcb51f2a3","type":"go-module","version":"v0.0.0-20190404232315-eb5bcb51f2a3","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.4.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xrjj-mj9h-534m","versionConstraint":"<0.4.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.0.0-20190404232315-eb5bcb51f2a3"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-xrjj-mj9h-534m","fix":{"state":"fixed","versions":["0.4.0"],"available":[{"date":"2024-05-21","kind":"first-observed","version":"0.4.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41717","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41717","date":"2026-10-08","epss":0.06077,"percentile":0.93221}],"risk":3.129655,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-41717","https://go.dev/cl/455635","https://go.dev/cl/455717","https://go.dev/issue/56350","https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ","https://pkg.go.dev/vuln/GO-2022-1144","https://security.gentoo.org/glsa/202311-09","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WPEIZ7AMEJCZXU3FEJZMVRNHQZXX5P3I","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QBKBAZBIOXZV5QCFHZNSVXULR32XJCYD","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q52IQI754YAE4XPR4QBRWPIVZWYGZ4FS","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PW3XC47AUW5J5M2ULJX7WCCL3B2ETLMT","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PUM4DIVOLJCBK5ZDP4LJOL24GXT3YSIR","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NQGNAXK3YBPMUP3J4TECIRDHFGW37522","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CSVIS6MTMFVBA7JPMRAUNKUOYEVSJYSB","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ANIOPUXWIHVRA6CEWXCGOMX3YYS6KFHG","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/56B2FFESRYYP6IY2AZ3UWXLWKZ5IYZN4","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4SBIUECMLNC572P23DDOKJNKPJVX26SP","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2"],"severity":"Medium","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xrjj-mj9h-534m","description":"golang.org/x/net/http2 vulnerable to possible excessive memory growth"},"relatedVulnerabilities":[{"id":"CVE-2022-41717","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41717","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41717","date":"2026-10-08","epss":0.06077,"percentile":0.93221}],"urls":["https://go.dev/cl/455635","https://go.dev/cl/455717","https://go.dev/issue/56350","https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4SBIUECMLNC572P23DDOKJNKPJVX26SP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/56B2FFESRYYP6IY2AZ3UWXLWKZ5IYZN4/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ANIOPUXWIHVRA6CEWXCGOMX3YYS6KFHG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CSVIS6MTMFVBA7JPMRAUNKUOYEVSJYSB/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NQGNAXK3YBPMUP3J4TECIRDHFGW37522/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PUM4DIVOLJCBK5ZDP4LJOL24GXT3YSIR/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PW3XC47AUW5J5M2ULJX7WCCL3B2ETLMT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q52IQI754YAE4XPR4QBRWPIVZWYGZ4FS/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QBKBAZBIOXZV5QCFHZNSVXULR32XJCYD/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WPEIZ7AMEJCZXU3FEJZMVRNHQZXX5P3I/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/","https://pkg.go.dev/vuln/GO-2022-1144","https://security.gentoo.org/glsa/202311-09","https://security.netapp.com/advisory/ntap-20230120-0008/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41717","description":"An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection."}]},{"artifact":{"id":"727332619043e05d","cpes":["cpe:2.3:a:golang:networking:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.0.0-20190404232315-eb5bcb51f2a3","type":"go-module","version":"v0.0.0-20190404232315-eb5bcb51f2a3","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.4.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xrjj-mj9h-534m","versionConstraint":"<0.4.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.0.0-20190404232315-eb5bcb51f2a3"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-xrjj-mj9h-534m","fix":{"state":"fixed","versions":["0.4.0"],"available":[{"date":"2024-05-21","kind":"first-observed","version":"0.4.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41717","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41717","date":"2026-10-08","epss":0.06077,"percentile":0.93221}],"risk":3.129655,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-41717","https://go.dev/cl/455635","https://go.dev/cl/455717","https://go.dev/issue/56350","https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ","https://pkg.go.dev/vuln/GO-2022-1144","https://security.gentoo.org/glsa/202311-09","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WPEIZ7AMEJCZXU3FEJZMVRNHQZXX5P3I","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QBKBAZBIOXZV5QCFHZNSVXULR32XJCYD","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q52IQI754YAE4XPR4QBRWPIVZWYGZ4FS","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PW3XC47AUW5J5M2ULJX7WCCL3B2ETLMT","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PUM4DIVOLJCBK5ZDP4LJOL24GXT3YSIR","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NQGNAXK3YBPMUP3J4TECIRDHFGW37522","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CSVIS6MTMFVBA7JPMRAUNKUOYEVSJYSB","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ANIOPUXWIHVRA6CEWXCGOMX3YYS6KFHG","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/56B2FFESRYYP6IY2AZ3UWXLWKZ5IYZN4","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4SBIUECMLNC572P23DDOKJNKPJVX26SP","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2"],"severity":"Medium","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xrjj-mj9h-534m","description":"golang.org/x/net/http2 vulnerable to possible excessive memory growth"},"relatedVulnerabilities":[{"id":"CVE-2022-41717","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41717","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41717","date":"2026-10-08","epss":0.06077,"percentile":0.93221}],"urls":["https://go.dev/cl/455635","https://go.dev/cl/455717","https://go.dev/issue/56350","https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4SBIUECMLNC572P23DDOKJNKPJVX26SP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/56B2FFESRYYP6IY2AZ3UWXLWKZ5IYZN4/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ANIOPUXWIHVRA6CEWXCGOMX3YYS6KFHG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CSVIS6MTMFVBA7JPMRAUNKUOYEVSJYSB/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NQGNAXK3YBPMUP3J4TECIRDHFGW37522/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PUM4DIVOLJCBK5ZDP4LJOL24GXT3YSIR/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PW3XC47AUW5J5M2ULJX7WCCL3B2ETLMT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q52IQI754YAE4XPR4QBRWPIVZWYGZ4FS/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QBKBAZBIOXZV5QCFHZNSVXULR32XJCYD/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WPEIZ7AMEJCZXU3FEJZMVRNHQZXX5P3I/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/","https://pkg.go.dev/vuln/GO-2022-1144","https://security.gentoo.org/glsa/202311-09","https://security.netapp.com/advisory/ntap-20230120-0008/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41717","description":"An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-1144","versionConstraint":"<1.18.9||>=1.19.0-0,<1.19.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-1144","fix":{"state":"fixed","versions":["1.18.9","1.19.4"],"available":[{"date":"2022-12-06","kind":"release","version":"1.18.9"},{"date":"2022-12-06","kind":"release","version":"1.19.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41717","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41717","date":"2026-10-08","epss":0.06077,"percentile":0.93221}],"risk":3.129655,"urls":["https://go.dev/cl/455717","https://go.dev/cl/455635","https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/56350","description":"An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests.\n\nHTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection."},"relatedVulnerabilities":[{"id":"CVE-2022-41717","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41717","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41717","date":"2026-10-08","epss":0.06077,"percentile":0.93221}],"urls":["https://go.dev/cl/455635","https://go.dev/cl/455717","https://go.dev/issue/56350","https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4SBIUECMLNC572P23DDOKJNKPJVX26SP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/56B2FFESRYYP6IY2AZ3UWXLWKZ5IYZN4/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ANIOPUXWIHVRA6CEWXCGOMX3YYS6KFHG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CSVIS6MTMFVBA7JPMRAUNKUOYEVSJYSB/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NQGNAXK3YBPMUP3J4TECIRDHFGW37522/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PUM4DIVOLJCBK5ZDP4LJOL24GXT3YSIR/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PW3XC47AUW5J5M2ULJX7WCCL3B2ETLMT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q52IQI754YAE4XPR4QBRWPIVZWYGZ4FS/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QBKBAZBIOXZV5QCFHZNSVXULR32XJCYD/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WPEIZ7AMEJCZXU3FEJZMVRNHQZXX5P3I/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/","https://pkg.go.dev/vuln/GO-2022-1144","https://security.gentoo.org/glsa/202311-09","https://security.netapp.com/advisory/ntap-20230120-0008/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41717","description":"An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection."},{"id":"GHSA-xrjj-mj9h-534m","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41717","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41717","date":"2026-10-08","epss":0.06077,"percentile":0.93221}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-41717","https://go.dev/cl/455635","https://go.dev/cl/455717","https://go.dev/issue/56350","https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ","https://pkg.go.dev/vuln/GO-2022-1144","https://security.gentoo.org/glsa/202311-09","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WPEIZ7AMEJCZXU3FEJZMVRNHQZXX5P3I","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QBKBAZBIOXZV5QCFHZNSVXULR32XJCYD","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q52IQI754YAE4XPR4QBRWPIVZWYGZ4FS","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PW3XC47AUW5J5M2ULJX7WCCL3B2ETLMT","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PUM4DIVOLJCBK5ZDP4LJOL24GXT3YSIR","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NQGNAXK3YBPMUP3J4TECIRDHFGW37522","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CSVIS6MTMFVBA7JPMRAUNKUOYEVSJYSB","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ANIOPUXWIHVRA6CEWXCGOMX3YYS6KFHG","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/56B2FFESRYYP6IY2AZ3UWXLWKZ5IYZN4","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4SBIUECMLNC572P23DDOKJNKPJVX26SP","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2"],"severity":"Medium","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-xrjj-mj9h-534m","description":"golang.org/x/net/http2 vulnerable to possible excessive memory growth"}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.18.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-1144","versionConstraint":"<1.18.9||>=1.19.0-0,<1.19.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-1144","fix":{"state":"fixed","versions":["1.18.9","1.19.4"],"available":[{"date":"2022-12-06","kind":"release","version":"1.18.9"},{"date":"2022-12-06","kind":"release","version":"1.19.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41717","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41717","date":"2026-10-08","epss":0.06077,"percentile":0.93221}],"risk":3.129655,"urls":["https://go.dev/cl/455717","https://go.dev/cl/455635","https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/56350","description":"An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests.\n\nHTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection."},"relatedVulnerabilities":[{"id":"CVE-2022-41717","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41717","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41717","date":"2026-10-08","epss":0.06077,"percentile":0.93221}],"urls":["https://go.dev/cl/455635","https://go.dev/cl/455717","https://go.dev/issue/56350","https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4SBIUECMLNC572P23DDOKJNKPJVX26SP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/56B2FFESRYYP6IY2AZ3UWXLWKZ5IYZN4/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ANIOPUXWIHVRA6CEWXCGOMX3YYS6KFHG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CSVIS6MTMFVBA7JPMRAUNKUOYEVSJYSB/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NQGNAXK3YBPMUP3J4TECIRDHFGW37522/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PUM4DIVOLJCBK5ZDP4LJOL24GXT3YSIR/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PW3XC47AUW5J5M2ULJX7WCCL3B2ETLMT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q52IQI754YAE4XPR4QBRWPIVZWYGZ4FS/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QBKBAZBIOXZV5QCFHZNSVXULR32XJCYD/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WPEIZ7AMEJCZXU3FEJZMVRNHQZXX5P3I/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/","https://pkg.go.dev/vuln/GO-2022-1144","https://security.gentoo.org/glsa/202311-09","https://security.netapp.com/advisory/ntap-20230120-0008/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41717","description":"An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection."},{"id":"GHSA-xrjj-mj9h-534m","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41717","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41717","date":"2026-10-08","epss":0.06077,"percentile":0.93221}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-41717","https://go.dev/cl/455635","https://go.dev/cl/455717","https://go.dev/issue/56350","https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ","https://pkg.go.dev/vuln/GO-2022-1144","https://security.gentoo.org/glsa/202311-09","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WPEIZ7AMEJCZXU3FEJZMVRNHQZXX5P3I","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QBKBAZBIOXZV5QCFHZNSVXULR32XJCYD","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q52IQI754YAE4XPR4QBRWPIVZWYGZ4FS","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PW3XC47AUW5J5M2ULJX7WCCL3B2ETLMT","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PUM4DIVOLJCBK5ZDP4LJOL24GXT3YSIR","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NQGNAXK3YBPMUP3J4TECIRDHFGW37522","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CSVIS6MTMFVBA7JPMRAUNKUOYEVSJYSB","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ANIOPUXWIHVRA6CEWXCGOMX3YYS6KFHG","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/56B2FFESRYYP6IY2AZ3UWXLWKZ5IYZN4","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4SBIUECMLNC572P23DDOKJNKPJVX26SP","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2"],"severity":"Medium","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-xrjj-mj9h-534m","description":"golang.org/x/net/http2 vulnerable to possible excessive memory growth"}]},{"artifact":{"id":"d3f929327cc1f09c","cpes":["cpe:2.3:a:libglib2.0-0:libglib2.0-0:2.58.3-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0-0:libglib2.0_0:2.58.3-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0_0:libglib2.0-0:2.58.3-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0_0:libglib2.0_0:2.58.3-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0:libglib2.0-0:2.58.3-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0:libglib2.0_0:2.58.3-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libglib2.0-0","purl":"pkg:deb/debian/libglib2.0-0@2.58.3-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=glib2.0","type":"deb","version":"2.58.3-2+deb10u1","language":"","licenses":["sha256:ac63a394252c3de7e3afca547269c18fde17b8143b63ab2ddf6ea205339c1271"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libglib2.0-0/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libglib2.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libglib2.0-0:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libglib2.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glib2.0"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.58.3-2+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-27218","versionConstraint":"< 2.58.3-2+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glib2.0","version":"2.58.3-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-27218","fix":{"state":"fixed","versions":["2.58.3-2+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.58.3-2+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-27218","cwe":"CWE-681","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27218","date":"2026-10-08","epss":0.0408,"percentile":0.90443}],"risk":3.06,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-27218","description":"An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32, causing unintended length truncation."},"relatedVulnerabilities":[{"id":"CVE-2021-27218","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-27218","cwe":"CWE-681","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27218","date":"2026-10-08","epss":0.0408,"percentile":0.90443}],"urls":["https://gitlab.gnome.org/GNOME/glib/-/merge_requests/1942","https://gitlab.gnome.org/GNOME/glib/-/merge_requests/1944","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2022/06/msg00006.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2REA7RVKN7ZHRLJOEGBRQKJIPZQPAELZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JJMPNDO4GDVURYQFYKFOWY5HAF4FTEPN/","https://security.gentoo.org/glsa/202107-13","https://security.netapp.com/advisory/ntap-20210319-0004/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-27218","description":"An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32, causing unintended length truncation."}]},{"artifact":{"id":"da9ff9a377f09d63","cpes":["cpe:2.3:a:dpkg:dpkg:1.19.7:*:*:*:*:*:*:*"],"name":"dpkg","purl":"pkg:deb/debian/dpkg@1.19.7?arch=amd64&distro=debian-10.1","type":"deb","version":"1.19.7","language":"","licenses":["BSD-2-clause","GPL-2","GPL-2+","public-domain-md5","public-domain-s-s-d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/dpkg/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/dpkg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dpkg.conffiles","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/dpkg.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dpkg.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/dpkg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dpkg.list","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/dpkg.list"},{"path":"/var/lib/dpkg/info/dpkg.postinst","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/dpkg.postinst"},{"path":"/var/lib/dpkg/info/dpkg.postrm","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/dpkg.postrm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.19.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-1664","versionConstraint":"< 1.19.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"dpkg","version":"1.19.7"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-1664","fix":{"state":"fixed","versions":["1.19.8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.19.8"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-1664","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-1664","date":"2026-10-08","epss":0.0324,"percentile":0.87919}],"risk":3.0456,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5147-1","link":"https://security-tracker.debian.org/tracker/DSA-5147-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-1664","description":"Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a debian.tar, the in-place extraction can lead to directory traversal situations on specially crafted orig.tar and debian.tar tarballs."},"relatedVulnerabilities":[{"id":"CVE-2022-1664","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-1664","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-1664","date":"2026-10-08","epss":0.0324,"percentile":0.87919}],"urls":["https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=1f23dddc17f69c9598477098c7fb9936e15fa495","https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=58814cacee39c4ce9e2cd0e3a3b9b57ad437eff5","https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=7a6c03cb34d4a09f35df2f10779cbf1b70a5200b","https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=faa4c92debe45412bfcf8a44f26e827800bb24be","https://lists.debian.org/debian-lts-announce/2022/05/msg00033.html","https://lists.debian.org/debian-security-announce/2022/msg00115.html","https://security.netapp.com/advisory/ntap-20221007-0002/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-1664","description":"Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a debian.tar, the in-place extraction can lead to directory traversal situations on specially crafted orig.tar and debian.tar tarballs."}]},{"artifact":{"id":"02d6c38191dc424f","cpes":["cpe:2.3:a:liblz4-1:liblz4-1:1.8.3-1:*:*:*:*:*:*:*","cpe:2.3:a:liblz4-1:liblz4_1:1.8.3-1:*:*:*:*:*:*:*","cpe:2.3:a:liblz4_1:liblz4-1:1.8.3-1:*:*:*:*:*:*:*","cpe:2.3:a:liblz4_1:liblz4_1:1.8.3-1:*:*:*:*:*:*:*","cpe:2.3:a:liblz4:liblz4-1:1.8.3-1:*:*:*:*:*:*:*","cpe:2.3:a:liblz4:liblz4_1:1.8.3-1:*:*:*:*:*:*:*"],"name":"liblz4-1","purl":"pkg:deb/debian/liblz4-1@1.8.3-1?arch=amd64&distro=debian-10.1&upstream=lz4","type":"deb","version":"1.8.3-1","language":"","licenses":["BSD-2-clause","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/liblz4-1/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/liblz4-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/liblz4-1:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/liblz4-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"lz4"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.8.3-1+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3520","versionConstraint":"< 1.8.3-1+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"lz4","version":"1.8.3-1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-3520","fix":{"state":"fixed","versions":["1.8.3-1+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.8.3-1+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3520","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3520","cwe":"CWE-190","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3520","cwe":"CWE-787","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3520","date":"2026-10-08","epss":0.03216,"percentile":0.87832}],"risk":3.0230400000000004,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4919-1","link":"https://security-tracker.debian.org/tracker/DSA-4919-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-3520","description":"There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well."},"relatedVulnerabilities":[{"id":"CVE-2021-3520","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3520","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3520","cwe":"CWE-190","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3520","cwe":"CWE-787","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3520","date":"2026-10-08","epss":0.03216,"percentile":0.87832}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1954559","https://security.netapp.com/advisory/ntap-20211104-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3520","description":"There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well."}]},{"artifact":{"id":"9c0f03079e497030","cpes":["cpe:2.3:a:libpython3.7-minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-minimal","purl":"pkg:deb/debian/libpython3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9740","versionConstraint":"< 3.7.3-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-9740","fix":{"state":"fixed","versions":["3.7.3-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9740","date":"2026-10-08","epss":0.05408,"percentile":0.92485}],"risk":3.0014399999999997,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9740","description":"An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."},"relatedVulnerabilities":[{"id":"CVE-2019-9740","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9740","date":"2026-10-08","epss":0.05408,"percentile":0.92485}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.openwall.com/lists/oss-security/2021/02/04/2","http://www.securityfocus.com/bid/107466","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue36276","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00026.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190619-0005/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9740","description":"An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."}]},{"artifact":{"id":"b6d8c37141cd8c0a","cpes":["cpe:2.3:a:libpython3.7-stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-stdlib","purl":"pkg:deb/debian/libpython3.7-stdlib@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9740","versionConstraint":"< 3.7.3-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-9740","fix":{"state":"fixed","versions":["3.7.3-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9740","date":"2026-10-08","epss":0.05408,"percentile":0.92485}],"risk":3.0014399999999997,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9740","description":"An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."},"relatedVulnerabilities":[{"id":"CVE-2019-9740","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9740","date":"2026-10-08","epss":0.05408,"percentile":0.92485}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.openwall.com/lists/oss-security/2021/02/04/2","http://www.securityfocus.com/bid/107466","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue36276","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00026.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190619-0005/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9740","description":"An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."}]},{"artifact":{"id":"94955c7d71be2bb1","cpes":["cpe:2.3:a:python3.7:python3.7:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7","purl":"pkg:deb/debian/python3.7@3.7.3-2?arch=amd64&distro=debian-10.1","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.list"},{"path":"/var/lib/dpkg/info/python3.7.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.postinst"},{"path":"/var/lib/dpkg/info/python3.7.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-9740","versionConstraint":"< 3.7.3-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-9740","fix":{"state":"fixed","versions":["3.7.3-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9740","date":"2026-10-08","epss":0.05408,"percentile":0.92485}],"risk":3.0014399999999997,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9740","description":"An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."},"relatedVulnerabilities":[{"id":"CVE-2019-9740","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9740","date":"2026-10-08","epss":0.05408,"percentile":0.92485}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.openwall.com/lists/oss-security/2021/02/04/2","http://www.securityfocus.com/bid/107466","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue36276","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00026.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190619-0005/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9740","description":"An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."}]},{"artifact":{"id":"988c8a69c0d8509e","cpes":["cpe:2.3:a:python3.7-minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7-minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7-minimal","purl":"pkg:deb/debian/python3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.list"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.7-minimal.preinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.prerm"}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9740","versionConstraint":"< 3.7.3-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-9740","fix":{"state":"fixed","versions":["3.7.3-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9740","date":"2026-10-08","epss":0.05408,"percentile":0.92485}],"risk":3.0014399999999997,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9740","description":"An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."},"relatedVulnerabilities":[{"id":"CVE-2019-9740","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9740","date":"2026-10-08","epss":0.05408,"percentile":0.92485}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.openwall.com/lists/oss-security/2021/02/04/2","http://www.securityfocus.com/bid/107466","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue36276","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00026.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190619-0005/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9740","description":"An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."}]},{"artifact":{"id":"d55bfe42f054b394","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.2.6-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.2.6-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=expat","type":"deb","version":"2.2.6-2+deb10u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.6-2+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-23990","versionConstraint":"< 2.2.6-2+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"expat","version":"2.2.6-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-23990","fix":{"state":"fixed","versions":["2.2.6-2+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.6-2+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23990","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-23990","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-23990","date":"2026-10-08","epss":0.03992,"percentile":0.90252}],"risk":2.9939999999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5073-1","link":"https://security-tracker.debian.org/tracker/DSA-5073-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-23990","description":"Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function."},"relatedVulnerabilities":[{"id":"CVE-2022-23990","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23990","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-23990","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-23990","date":"2026-10-08","epss":0.03992,"percentile":0.90252}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","https://github.com/libexpat/libexpat/pull/551","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/34NXVL2RZC2YZRV74ZQ3RNFB7WCEUP7D/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7FF2UH7MPXKTADYSJUAHI2Y5UHBSHUH/","https://security.gentoo.org/glsa/202209-24","https://www.debian.org/security/2022/dsa-5073","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.tenable.com/security/tns-2022-05"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23990","description":"Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function."}]},{"artifact":{"id":"c6f08567c3b7bec6","cpes":["cpe:2.3:a:golang:networking:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.0.0-20190404232315-eb5bcb51f2a3","type":"go-module","version":"v0.0.0-20190404232315-eb5bcb51f2a3","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.0.0-20211209124913-491a49abca63"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0288","versionConstraint":"<0.0.0-20211209124913-491a49abca63 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.0.0-20190404232315-eb5bcb51f2a3"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0288","fix":{"state":"fixed","versions":["0.0.0-20211209124913-491a49abca63"],"available":[{"date":"2021-12-09","kind":"release","version":"0.0.0-20211209124913-491a49abca63"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-44716","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-44716","date":"2026-10-08","epss":0.03958,"percentile":0.90166}],"risk":2.9684999999999997,"urls":["https://go.dev/issue/50058","https://groups.google.com/g/golang-announce/c/hcmEScgc00k"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/369794","description":"An attacker can cause unbounded memory growth in servers accepting HTTP/2 requests."},"relatedVulnerabilities":[{"id":"CVE-2021-44716","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-44716","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-44716","date":"2026-10-08","epss":0.03958,"percentile":0.90166}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf","https://groups.google.com/g/golang-announce/c/hcmEScgc00k","https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html","https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html","https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html","https://security.gentoo.org/glsa/202208-02","https://security.netapp.com/advisory/ntap-20220121-0002/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-44716","description":"net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests."},{"id":"GHSA-vc3p-29h2-gpcp","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-44716","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-44716","date":"2026-10-08","epss":0.03958,"percentile":0.90166}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-44716","https://groups.google.com/g/golang-announce/c/hcmEScgc00k","https://security.netapp.com/advisory/ntap-20220121-0002/","https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html","https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html","https://security.gentoo.org/glsa/202208-02","https://go.dev/cl/369794","https://go.dev/issue/50058","https://pkg.go.dev/vuln/GO-2022-0288"],"severity":"High","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-vc3p-29h2-gpcp","description":"golang.org/x/net/http2 allows uncontrolled memory consumption"}]},{"artifact":{"id":"727332619043e05d","cpes":["cpe:2.3:a:golang:networking:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.0.0-20190404232315-eb5bcb51f2a3","type":"go-module","version":"v0.0.0-20190404232315-eb5bcb51f2a3","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.0.0-20211209124913-491a49abca63"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0288","versionConstraint":"<0.0.0-20211209124913-491a49abca63 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.0.0-20190404232315-eb5bcb51f2a3"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0288","fix":{"state":"fixed","versions":["0.0.0-20211209124913-491a49abca63"],"available":[{"date":"2021-12-09","kind":"release","version":"0.0.0-20211209124913-491a49abca63"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-44716","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-44716","date":"2026-10-08","epss":0.03958,"percentile":0.90166}],"risk":2.9684999999999997,"urls":["https://go.dev/issue/50058","https://groups.google.com/g/golang-announce/c/hcmEScgc00k"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/369794","description":"An attacker can cause unbounded memory growth in servers accepting HTTP/2 requests."},"relatedVulnerabilities":[{"id":"CVE-2021-44716","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-44716","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-44716","date":"2026-10-08","epss":0.03958,"percentile":0.90166}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf","https://groups.google.com/g/golang-announce/c/hcmEScgc00k","https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html","https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html","https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html","https://security.gentoo.org/glsa/202208-02","https://security.netapp.com/advisory/ntap-20220121-0002/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-44716","description":"net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests."},{"id":"GHSA-vc3p-29h2-gpcp","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-44716","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-44716","date":"2026-10-08","epss":0.03958,"percentile":0.90166}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-44716","https://groups.google.com/g/golang-announce/c/hcmEScgc00k","https://security.netapp.com/advisory/ntap-20220121-0002/","https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html","https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html","https://security.gentoo.org/glsa/202208-02","https://go.dev/cl/369794","https://go.dev/issue/50058","https://pkg.go.dev/vuln/GO-2022-0288"],"severity":"High","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-vc3p-29h2-gpcp","description":"golang.org/x/net/http2 allows uncontrolled memory consumption"}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.16.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0288","versionConstraint":"<1.16.12||>=1.17.0-0,<1.17.5 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0288","fix":{"state":"fixed","versions":["1.16.12","1.17.5"],"available":[{"date":"2021-12-09","kind":"release","version":"1.16.12"},{"date":"2021-12-09","kind":"release","version":"1.17.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-44716","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-44716","date":"2026-10-08","epss":0.03958,"percentile":0.90166}],"risk":2.9684999999999997,"urls":["https://go.dev/issue/50058","https://groups.google.com/g/golang-announce/c/hcmEScgc00k"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/369794","description":"An attacker can cause unbounded memory growth in servers accepting HTTP/2 requests."},"relatedVulnerabilities":[{"id":"CVE-2021-44716","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-44716","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-44716","date":"2026-10-08","epss":0.03958,"percentile":0.90166}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf","https://groups.google.com/g/golang-announce/c/hcmEScgc00k","https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html","https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html","https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html","https://security.gentoo.org/glsa/202208-02","https://security.netapp.com/advisory/ntap-20220121-0002/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-44716","description":"net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests."},{"id":"GHSA-vc3p-29h2-gpcp","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-44716","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-44716","date":"2026-10-08","epss":0.03958,"percentile":0.90166}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-44716","https://groups.google.com/g/golang-announce/c/hcmEScgc00k","https://security.netapp.com/advisory/ntap-20220121-0002/","https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html","https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html","https://security.gentoo.org/glsa/202208-02","https://go.dev/cl/369794","https://go.dev/issue/50058","https://pkg.go.dev/vuln/GO-2022-0288"],"severity":"High","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-vc3p-29h2-gpcp","description":"golang.org/x/net/http2 allows uncontrolled memory consumption"}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.16.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0288","versionConstraint":"<1.16.12||>=1.17.0-0,<1.17.5 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0288","fix":{"state":"fixed","versions":["1.16.12","1.17.5"],"available":[{"date":"2021-12-09","kind":"release","version":"1.16.12"},{"date":"2021-12-09","kind":"release","version":"1.17.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-44716","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-44716","date":"2026-10-08","epss":0.03958,"percentile":0.90166}],"risk":2.9684999999999997,"urls":["https://go.dev/issue/50058","https://groups.google.com/g/golang-announce/c/hcmEScgc00k"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/369794","description":"An attacker can cause unbounded memory growth in servers accepting HTTP/2 requests."},"relatedVulnerabilities":[{"id":"CVE-2021-44716","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-44716","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-44716","date":"2026-10-08","epss":0.03958,"percentile":0.90166}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf","https://groups.google.com/g/golang-announce/c/hcmEScgc00k","https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html","https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html","https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html","https://security.gentoo.org/glsa/202208-02","https://security.netapp.com/advisory/ntap-20220121-0002/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-44716","description":"net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests."},{"id":"GHSA-vc3p-29h2-gpcp","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-44716","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-44716","date":"2026-10-08","epss":0.03958,"percentile":0.90166}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-44716","https://groups.google.com/g/golang-announce/c/hcmEScgc00k","https://security.netapp.com/advisory/ntap-20220121-0002/","https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html","https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html","https://security.gentoo.org/glsa/202208-02","https://go.dev/cl/369794","https://go.dev/issue/50058","https://pkg.go.dev/vuln/GO-2022-0288"],"severity":"High","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-vc3p-29h2-gpcp","description":"golang.org/x/net/http2 allows uncontrolled memory consumption"}]},{"artifact":{"id":"524ae46feda9a236","cpes":["cpe:2.3:a:golang:crypto:v0.0.0-20190701094942-4def268fd1a4:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.0.0-20190701094942-4def268fd1a4:*:*:*:*:go:*:*"],"name":"golang.org/x/crypto","purl":"pkg:golang/golang.org/x/crypto@v0.0.0-20190701094942-4def268fd1a4","type":"go-module","version":"v0.0.0-20190701094942-4def268fd1a4","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.0.0-20220314234659-1baeb1ce4c0b"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8c26-wmh5-6g9v","versionConstraint":"<0.0.0-20220314234659-1baeb1ce4c0b (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/crypto","version":"v0.0.0-20190701094942-4def268fd1a4"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-8c26-wmh5-6g9v","fix":{"state":"fixed","versions":["0.0.0-20220314234659-1baeb1ce4c0b"],"available":[{"date":"2023-02-18","kind":"first-observed","version":"0.0.0-20220314234659-1baeb1ce4c0b"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27191","date":"2026-10-08","epss":0.03931,"percentile":0.90097}],"risk":2.94825,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-27191","https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/-cp44ypCT5s","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HHGBEGJ54DZZGTXFUQNS7ZIG3E624YAF/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QTFOIDHQRGNI4P6LYN6ILH5G443RYYKB/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YHYRQB7TRMHDB3NEHW5XBRG7PPMUTPGV/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQNPPQWSTP2IX7SHE6TS4SP4EVMI5EZK/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J5WPM42UR6XIBQNQPNQHM32X7S4LJTRX/","https://security.netapp.com/advisory/ntap-20220429-0002/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZ3S7LB65N54HXXBCB67P4TTOHTNPP5O/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZFUNHFHQVJSADNH7EZ3B53CYDZVEEPBP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/","https://raw.githubusercontent.com/golang/vulndb/df2d3d326300e2ae768f00351ffa96cc2c56cf54/reports/GO-2021-0356.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/","https://go.dev/cl/392355","https://go.googlesource.com/crypto/+/1baeb1ce4c0b006eff0f294c47cb7617598dfb3d","https://pkg.go.dev/vuln/GO-2021-0356"],"severity":"High","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8c26-wmh5-6g9v","description":"golang.org/x/crypto/ssh Denial of service via crafted Signer"},"relatedVulnerabilities":[{"id":"CVE-2022-27191","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27191","date":"2026-10-08","epss":0.03931,"percentile":0.90097}],"urls":["https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/-cp44ypCT5s","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZ3S7LB65N54HXXBCB67P4TTOHTNPP5O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HHGBEGJ54DZZGTXFUQNS7ZIG3E624YAF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J5WPM42UR6XIBQNQPNQHM32X7S4LJTRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QTFOIDHQRGNI4P6LYN6ILH5G443RYYKB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YHYRQB7TRMHDB3NEHW5XBRG7PPMUTPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZFUNHFHQVJSADNH7EZ3B53CYDZVEEPBP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQNPPQWSTP2IX7SHE6TS4SP4EVMI5EZK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/","https://security.netapp.com/advisory/ntap-20220429-0002/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27191","description":"The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey."}]},{"artifact":{"id":"763298202c68f152","cpes":["cpe:2.3:a:golang:crypto:v0.0.0-20190701094942-4def268fd1a4:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.0.0-20190701094942-4def268fd1a4:*:*:*:*:go:*:*"],"name":"golang.org/x/crypto","purl":"pkg:golang/golang.org/x/crypto@v0.0.0-20190701094942-4def268fd1a4","type":"go-module","version":"v0.0.0-20190701094942-4def268fd1a4","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.0.0-20220314234659-1baeb1ce4c0b"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8c26-wmh5-6g9v","versionConstraint":"<0.0.0-20220314234659-1baeb1ce4c0b (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/crypto","version":"v0.0.0-20190701094942-4def268fd1a4"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-8c26-wmh5-6g9v","fix":{"state":"fixed","versions":["0.0.0-20220314234659-1baeb1ce4c0b"],"available":[{"date":"2023-02-18","kind":"first-observed","version":"0.0.0-20220314234659-1baeb1ce4c0b"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27191","date":"2026-10-08","epss":0.03931,"percentile":0.90097}],"risk":2.94825,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-27191","https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/-cp44ypCT5s","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HHGBEGJ54DZZGTXFUQNS7ZIG3E624YAF/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QTFOIDHQRGNI4P6LYN6ILH5G443RYYKB/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YHYRQB7TRMHDB3NEHW5XBRG7PPMUTPGV/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQNPPQWSTP2IX7SHE6TS4SP4EVMI5EZK/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J5WPM42UR6XIBQNQPNQHM32X7S4LJTRX/","https://security.netapp.com/advisory/ntap-20220429-0002/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZ3S7LB65N54HXXBCB67P4TTOHTNPP5O/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZFUNHFHQVJSADNH7EZ3B53CYDZVEEPBP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/","https://raw.githubusercontent.com/golang/vulndb/df2d3d326300e2ae768f00351ffa96cc2c56cf54/reports/GO-2021-0356.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/","https://go.dev/cl/392355","https://go.googlesource.com/crypto/+/1baeb1ce4c0b006eff0f294c47cb7617598dfb3d","https://pkg.go.dev/vuln/GO-2021-0356"],"severity":"High","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8c26-wmh5-6g9v","description":"golang.org/x/crypto/ssh Denial of service via crafted Signer"},"relatedVulnerabilities":[{"id":"CVE-2022-27191","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27191","date":"2026-10-08","epss":0.03931,"percentile":0.90097}],"urls":["https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/-cp44ypCT5s","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZ3S7LB65N54HXXBCB67P4TTOHTNPP5O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HHGBEGJ54DZZGTXFUQNS7ZIG3E624YAF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J5WPM42UR6XIBQNQPNQHM32X7S4LJTRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QTFOIDHQRGNI4P6LYN6ILH5G443RYYKB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YHYRQB7TRMHDB3NEHW5XBRG7PPMUTPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZFUNHFHQVJSADNH7EZ3B53CYDZVEEPBP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQNPPQWSTP2IX7SHE6TS4SP4EVMI5EZK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/","https://security.netapp.com/advisory/ntap-20220429-0002/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27191","description":"The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey."}]},{"artifact":{"id":"16faa100e8d6ebcf","cpes":["cpe:2.3:a:libssh2-1:libssh2-1:1.8.0-2.1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2-1:libssh2_1:1.8.0-2.1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2-1:1.8.0-2.1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2_1:1.8.0-2.1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2-1:1.8.0-2.1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2_1:1.8.0-2.1:*:*:*:*:*:*:*"],"name":"libssh2-1","purl":"pkg:deb/debian/libssh2-1@1.8.0-2.1?arch=amd64&distro=debian-10.1&upstream=libssh2","type":"deb","version":"1.8.0-2.1","language":"","licenses":["BSD3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh2-1/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libssh2-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.8.0-2.1+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-17498","versionConstraint":"< 1.8.0-2.1+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"libssh2","version":"1.8.0-2.1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-17498","fix":{"state":"fixed","versions":["1.8.0-2.1+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.8.0-2.1+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17498","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17498","date":"2026-10-08","epss":0.03762,"percentile":0.89624}],"risk":2.9343600000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-17498","description":"In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server."},"relatedVulnerabilities":[{"id":"CVE-2019-17498","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17498","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17498","date":"2026-10-08","epss":0.03762,"percentile":0.89624}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00026.html","http://packetstormsecurity.com/files/172835/libssh2-1.9.0-Out-Of-Bounds-Read.html","https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/","https://github.com/kevinbackhouse/SecurityExploits/tree/8cbdbbe6363510f7d9ceec685373da12e6fc752d/libssh2/out_of_bounds_read_disconnect_CVE-2019-17498","https://github.com/libssh2/libssh2/blob/42d37aa63129a1b2644bf6495198923534322d64/src/packet.c#L480","https://github.com/libssh2/libssh2/commit/dedcbd106f8e52d5586b0205bc7677e4c9868f9c","https://lists.debian.org/debian-lts-announce/2019/11/msg00010.html","https://lists.debian.org/debian-lts-announce/2021/12/msg00013.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22H4Q5XMGS3QNSA7OCL3U7UQZ4NXMR5O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TY7EEE34RFKCTXTMBQQWWSLXZWSCXNDB/","https://security.netapp.com/advisory/ntap-20220909-0004/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-17498","description":"In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server."}]},{"artifact":{"id":"9c0f03079e497030","cpes":["cpe:2.3:a:libpython3.7-minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-minimal","purl":"pkg:deb/debian/libpython3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9947","versionConstraint":"< 3.7.3-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-9947","fix":{"state":"fixed","versions":["3.7.3-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9947","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9947","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9947","date":"2026-10-08","epss":0.05253,"percentile":0.92331}],"risk":2.915415,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9947","description":"An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."},"relatedVulnerabilities":[{"id":"CVE-2019-9947","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9947","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9947","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9947","date":"2026-10-08","epss":0.05253,"percentile":0.92331}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.openwall.com/lists/oss-security/2021/02/04/2","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue35906","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00026.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190404-0004/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9947","description":"An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."}]},{"artifact":{"id":"b6d8c37141cd8c0a","cpes":["cpe:2.3:a:libpython3.7-stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-stdlib","purl":"pkg:deb/debian/libpython3.7-stdlib@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9947","versionConstraint":"< 3.7.3-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-9947","fix":{"state":"fixed","versions":["3.7.3-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9947","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9947","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9947","date":"2026-10-08","epss":0.05253,"percentile":0.92331}],"risk":2.915415,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9947","description":"An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."},"relatedVulnerabilities":[{"id":"CVE-2019-9947","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9947","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9947","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9947","date":"2026-10-08","epss":0.05253,"percentile":0.92331}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.openwall.com/lists/oss-security/2021/02/04/2","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue35906","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00026.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190404-0004/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9947","description":"An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."}]},{"artifact":{"id":"94955c7d71be2bb1","cpes":["cpe:2.3:a:python3.7:python3.7:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7","purl":"pkg:deb/debian/python3.7@3.7.3-2?arch=amd64&distro=debian-10.1","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.list"},{"path":"/var/lib/dpkg/info/python3.7.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.postinst"},{"path":"/var/lib/dpkg/info/python3.7.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-9947","versionConstraint":"< 3.7.3-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-9947","fix":{"state":"fixed","versions":["3.7.3-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9947","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9947","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9947","date":"2026-10-08","epss":0.05253,"percentile":0.92331}],"risk":2.915415,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9947","description":"An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."},"relatedVulnerabilities":[{"id":"CVE-2019-9947","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9947","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9947","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9947","date":"2026-10-08","epss":0.05253,"percentile":0.92331}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.openwall.com/lists/oss-security/2021/02/04/2","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue35906","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00026.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190404-0004/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9947","description":"An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."}]},{"artifact":{"id":"988c8a69c0d8509e","cpes":["cpe:2.3:a:python3.7-minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7-minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7-minimal","purl":"pkg:deb/debian/python3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.list"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.7-minimal.preinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.prerm"}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9947","versionConstraint":"< 3.7.3-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-9947","fix":{"state":"fixed","versions":["3.7.3-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9947","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9947","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9947","date":"2026-10-08","epss":0.05253,"percentile":0.92331}],"risk":2.915415,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9947","description":"An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."},"relatedVulnerabilities":[{"id":"CVE-2019-9947","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9947","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9947","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9947","date":"2026-10-08","epss":0.05253,"percentile":0.92331}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.openwall.com/lists/oss-security/2021/02/04/2","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue35906","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00026.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190404-0004/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9947","description":"An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."}]},{"artifact":{"id":"d55bfe42f054b394","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.2.6-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.2.6-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=expat","type":"deb","version":"2.2.6-2+deb10u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.6-2+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-46143","versionConstraint":"< 2.2.6-2+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"expat","version":"2.2.6-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-46143","fix":{"state":"fixed","versions":["2.2.6-2+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.6-2+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-46143","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-46143","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-46143","date":"2026-10-08","epss":0.0379,"percentile":0.897}],"risk":2.89935,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5073-1","link":"https://security-tracker.debian.org/tracker/DSA-5073-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-46143","description":"In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize."},"relatedVulnerabilities":[{"id":"CVE-2021-46143","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-46143","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-46143","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-46143","date":"2026-10-08","epss":0.0379,"percentile":0.897}],"urls":["http://www.openwall.com/lists/oss-security/2022/01/17/3","https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","https://github.com/libexpat/libexpat/issues/532","https://github.com/libexpat/libexpat/pull/538","https://security.gentoo.org/glsa/202209-24","https://security.netapp.com/advisory/ntap-20220121-0006/","https://www.debian.org/security/2022/dsa-5073","https://www.tenable.com/security/tns-2022-05"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-46143","description":"In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize."}]},{"artifact":{"id":"763298202c68f152","cpes":["cpe:2.3:a:golang:crypto:v0.0.0-20190701094942-4def268fd1a4:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.0.0-20190701094942-4def268fd1a4:*:*:*:*:go:*:*"],"name":"golang.org/x/crypto","purl":"pkg:golang/golang.org/x/crypto@v0.0.0-20190701094942-4def268fd1a4","type":"go-module","version":"v0.0.0-20190701094942-4def268fd1a4","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.31.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v778-237x-gjrc","versionConstraint":"<0.31.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/crypto","version":"v0.0.0-20190701094942-4def268fd1a4"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-v778-237x-gjrc","fix":{"state":"fixed","versions":["0.31.0"],"available":[{"date":"2024-12-12","kind":"first-observed","version":"0.31.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-45337","date":"2026-10-08","epss":0.03181,"percentile":0.87682}],"risk":2.878805,"urls":["https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909","https://go.dev/cl/635315","https://go.dev/issue/70779","https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ","https://pkg.go.dev/vuln/GO-2024-3321","https://nvd.nist.gov/vuln/detail/CVE-2024-45337","http://www.openwall.com/lists/oss-security/2024/12/11/2","https://security.netapp.com/advisory/ntap-20250131-0007"],"severity":"Critical","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v778-237x-gjrc","description":"Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto"},"relatedVulnerabilities":[{"id":"CVE-2024-45337","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-45337","date":"2026-10-08","epss":0.03181,"percentile":0.87682}],"urls":["https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909","https://go.dev/cl/635315","https://go.dev/issue/70779","https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ","https://pkg.go.dev/vuln/GO-2024-3321","http://www.openwall.com/lists/oss-security/2024/12/11/2","https://security.netapp.com/advisory/ntap-20250131-0007/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-45337","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance."}]},{"artifact":{"id":"524ae46feda9a236","cpes":["cpe:2.3:a:golang:crypto:v0.0.0-20190701094942-4def268fd1a4:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.0.0-20190701094942-4def268fd1a4:*:*:*:*:go:*:*"],"name":"golang.org/x/crypto","purl":"pkg:golang/golang.org/x/crypto@v0.0.0-20190701094942-4def268fd1a4","type":"go-module","version":"v0.0.0-20190701094942-4def268fd1a4","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.31.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v778-237x-gjrc","versionConstraint":"<0.31.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/crypto","version":"v0.0.0-20190701094942-4def268fd1a4"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-v778-237x-gjrc","fix":{"state":"fixed","versions":["0.31.0"],"available":[{"date":"2024-12-12","kind":"first-observed","version":"0.31.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-45337","date":"2026-10-08","epss":0.03181,"percentile":0.87682}],"risk":2.878805,"urls":["https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909","https://go.dev/cl/635315","https://go.dev/issue/70779","https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ","https://pkg.go.dev/vuln/GO-2024-3321","https://nvd.nist.gov/vuln/detail/CVE-2024-45337","http://www.openwall.com/lists/oss-security/2024/12/11/2","https://security.netapp.com/advisory/ntap-20250131-0007"],"severity":"Critical","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v778-237x-gjrc","description":"Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto"},"relatedVulnerabilities":[{"id":"CVE-2024-45337","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-45337","date":"2026-10-08","epss":0.03181,"percentile":0.87682}],"urls":["https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909","https://go.dev/cl/635315","https://go.dev/issue/70779","https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ","https://pkg.go.dev/vuln/GO-2024-3321","http://www.openwall.com/lists/oss-security/2024/12/11/2","https://security.netapp.com/advisory/ntap-20250131-0007/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-45337","description":"Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance."}]},{"artifact":{"id":"c6f08567c3b7bec6","cpes":["cpe:2.3:a:golang:networking:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.0.0-20190404232315-eb5bcb51f2a3","type":"go-module","version":"v0.0.0-20190404232315-eb5bcb51f2a3","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.17.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4374-p667-p6c8","versionConstraint":"<0.17.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.0.0-20190404232315-eb5bcb51f2a3"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-4374-p667-p6c8","fix":{"state":"fixed","versions":["0.17.0"],"available":[{"date":"2023-10-12","kind":"first-observed","version":"0.17.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39325","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-39325","date":"2026-10-08","epss":0.03796,"percentile":0.89716}],"risk":2.8470000000000004,"urls":["https://github.com/golang/go/issues/63417","https://go.dev/cl/534215","https://go.dev/cl/534235","https://go.dev/issue/63417","https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ","https://nvd.nist.gov/vuln/detail/CVE-2023-39325","https://pkg.go.dev/vuln/GO-2023-2102","https://security.gentoo.org/glsa/202311-09","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OVW5V2DM5K5IC3H7O42YDUGNJ74J35O","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FTMJ3NJIDAZFWJQQSP3L22MUFJ3UP2PT","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPWCNYB5PQ5PCVZ4NJT6G56ZYFZ5QBU6","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MZQYOOKHQDQ57LV2IAG6NRFOVXKHJJ3Z","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PJCUNGIQDUMZ4Z6HWVYIMR66A35F5S74","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LZSWTV4NV4SNQARNXG5T6LRHP26EW2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV","https://security.netapp.com/advisory/ntap-20231110-0008","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5E5JSJBZLYXOTZWXHJKRVCIXIHVWKJ6","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJWHBLVZDM5KQSDFRBFRKU5KSSOLIRQ4","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ODBY7RVMGZCBSTWF2OZGIZS57FNFUL67","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXOU2JZUBEBP7GBKAYIJRPRBZSJCD7ST","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WJ4QVX2AMUJ2F2S27POOAHRC4K3CHU4"],"severity":"High","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4374-p667-p6c8","description":"HTTP/2 rapid reset can cause excessive work in net/http"},"relatedVulnerabilities":[{"id":"CVE-2023-39325","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39325","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-39325","date":"2026-10-08","epss":0.03796,"percentile":0.89716}],"urls":["https://go.dev/cl/534215","https://go.dev/cl/534235","https://go.dev/issue/63417","https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OVW5V2DM5K5IC3H7O42YDUGNJ74J35O/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WJ4QVX2AMUJ2F2S27POOAHRC4K3CHU4/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FTMJ3NJIDAZFWJQQSP3L22MUFJ3UP2PT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPWCNYB5PQ5PCVZ4NJT6G56ZYFZ5QBU6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5E5JSJBZLYXOTZWXHJKRVCIXIHVWKJ6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MZQYOOKHQDQ57LV2IAG6NRFOVXKHJJ3Z/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ODBY7RVMGZCBSTWF2OZGIZS57FNFUL67/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PJCUNGIQDUMZ4Z6HWVYIMR66A35F5S74/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXOU2JZUBEBP7GBKAYIJRPRBZSJCD7ST/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LZSWTV4NV4SNQARNXG5T6LRHP26EW2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJWHBLVZDM5KQSDFRBFRKU5KSSOLIRQ4/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/","https://pkg.go.dev/vuln/GO-2023-2102","https://security.gentoo.org/glsa/202311-09","https://security.netapp.com/advisory/ntap-20231110-0008/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-39325","description":"A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function."}]},{"artifact":{"id":"727332619043e05d","cpes":["cpe:2.3:a:golang:networking:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.0.0-20190404232315-eb5bcb51f2a3","type":"go-module","version":"v0.0.0-20190404232315-eb5bcb51f2a3","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.17.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4374-p667-p6c8","versionConstraint":"<0.17.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.0.0-20190404232315-eb5bcb51f2a3"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-4374-p667-p6c8","fix":{"state":"fixed","versions":["0.17.0"],"available":[{"date":"2023-10-12","kind":"first-observed","version":"0.17.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39325","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-39325","date":"2026-10-08","epss":0.03796,"percentile":0.89716}],"risk":2.8470000000000004,"urls":["https://github.com/golang/go/issues/63417","https://go.dev/cl/534215","https://go.dev/cl/534235","https://go.dev/issue/63417","https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ","https://nvd.nist.gov/vuln/detail/CVE-2023-39325","https://pkg.go.dev/vuln/GO-2023-2102","https://security.gentoo.org/glsa/202311-09","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OVW5V2DM5K5IC3H7O42YDUGNJ74J35O","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FTMJ3NJIDAZFWJQQSP3L22MUFJ3UP2PT","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPWCNYB5PQ5PCVZ4NJT6G56ZYFZ5QBU6","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MZQYOOKHQDQ57LV2IAG6NRFOVXKHJJ3Z","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PJCUNGIQDUMZ4Z6HWVYIMR66A35F5S74","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LZSWTV4NV4SNQARNXG5T6LRHP26EW2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV","https://security.netapp.com/advisory/ntap-20231110-0008","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5E5JSJBZLYXOTZWXHJKRVCIXIHVWKJ6","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJWHBLVZDM5KQSDFRBFRKU5KSSOLIRQ4","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ODBY7RVMGZCBSTWF2OZGIZS57FNFUL67","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXOU2JZUBEBP7GBKAYIJRPRBZSJCD7ST","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WJ4QVX2AMUJ2F2S27POOAHRC4K3CHU4"],"severity":"High","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4374-p667-p6c8","description":"HTTP/2 rapid reset can cause excessive work in net/http"},"relatedVulnerabilities":[{"id":"CVE-2023-39325","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39325","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-39325","date":"2026-10-08","epss":0.03796,"percentile":0.89716}],"urls":["https://go.dev/cl/534215","https://go.dev/cl/534235","https://go.dev/issue/63417","https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OVW5V2DM5K5IC3H7O42YDUGNJ74J35O/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WJ4QVX2AMUJ2F2S27POOAHRC4K3CHU4/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FTMJ3NJIDAZFWJQQSP3L22MUFJ3UP2PT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPWCNYB5PQ5PCVZ4NJT6G56ZYFZ5QBU6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5E5JSJBZLYXOTZWXHJKRVCIXIHVWKJ6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MZQYOOKHQDQ57LV2IAG6NRFOVXKHJJ3Z/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ODBY7RVMGZCBSTWF2OZGIZS57FNFUL67/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PJCUNGIQDUMZ4Z6HWVYIMR66A35F5S74/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXOU2JZUBEBP7GBKAYIJRPRBZSJCD7ST/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LZSWTV4NV4SNQARNXG5T6LRHP26EW2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJWHBLVZDM5KQSDFRBFRKU5KSSOLIRQ4/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/","https://pkg.go.dev/vuln/GO-2023-2102","https://security.gentoo.org/glsa/202311-09","https://security.netapp.com/advisory/ntap-20231110-0008/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-39325","description":"A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.20.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2023-2102","versionConstraint":"<1.20.10||>=1.21.0-0,<1.21.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2023-2102","fix":{"state":"fixed","versions":["1.20.10","1.21.3"],"available":[{"date":"2023-10-10","kind":"release","version":"1.20.10"},{"date":"2023-10-10","kind":"release","version":"1.21.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39325","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-39325","date":"2026-10-08","epss":0.03796,"percentile":0.89716}],"risk":2.8470000000000004,"urls":["https://go.dev/cl/534215","https://go.dev/cl/534235","https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/63417","description":"A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing.\n\nWith the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection.\n\nThis issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2.\n\nThe default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function."},"relatedVulnerabilities":[{"id":"CVE-2023-39325","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39325","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-39325","date":"2026-10-08","epss":0.03796,"percentile":0.89716}],"urls":["https://go.dev/cl/534215","https://go.dev/cl/534235","https://go.dev/issue/63417","https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OVW5V2DM5K5IC3H7O42YDUGNJ74J35O/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WJ4QVX2AMUJ2F2S27POOAHRC4K3CHU4/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FTMJ3NJIDAZFWJQQSP3L22MUFJ3UP2PT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPWCNYB5PQ5PCVZ4NJT6G56ZYFZ5QBU6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5E5JSJBZLYXOTZWXHJKRVCIXIHVWKJ6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MZQYOOKHQDQ57LV2IAG6NRFOVXKHJJ3Z/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ODBY7RVMGZCBSTWF2OZGIZS57FNFUL67/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PJCUNGIQDUMZ4Z6HWVYIMR66A35F5S74/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXOU2JZUBEBP7GBKAYIJRPRBZSJCD7ST/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LZSWTV4NV4SNQARNXG5T6LRHP26EW2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJWHBLVZDM5KQSDFRBFRKU5KSSOLIRQ4/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/","https://pkg.go.dev/vuln/GO-2023-2102","https://security.gentoo.org/glsa/202311-09","https://security.netapp.com/advisory/ntap-20231110-0008/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-39325","description":"A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function."},{"id":"GHSA-4374-p667-p6c8","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39325","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-39325","date":"2026-10-08","epss":0.03796,"percentile":0.89716}],"urls":["https://github.com/golang/go/issues/63417","https://go.dev/cl/534215","https://go.dev/cl/534235","https://go.dev/issue/63417","https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ","https://nvd.nist.gov/vuln/detail/CVE-2023-39325","https://pkg.go.dev/vuln/GO-2023-2102","https://security.gentoo.org/glsa/202311-09","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OVW5V2DM5K5IC3H7O42YDUGNJ74J35O","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FTMJ3NJIDAZFWJQQSP3L22MUFJ3UP2PT","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPWCNYB5PQ5PCVZ4NJT6G56ZYFZ5QBU6","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MZQYOOKHQDQ57LV2IAG6NRFOVXKHJJ3Z","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PJCUNGIQDUMZ4Z6HWVYIMR66A35F5S74","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LZSWTV4NV4SNQARNXG5T6LRHP26EW2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV","https://security.netapp.com/advisory/ntap-20231110-0008","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5E5JSJBZLYXOTZWXHJKRVCIXIHVWKJ6","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJWHBLVZDM5KQSDFRBFRKU5KSSOLIRQ4","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ODBY7RVMGZCBSTWF2OZGIZS57FNFUL67","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXOU2JZUBEBP7GBKAYIJRPRBZSJCD7ST","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WJ4QVX2AMUJ2F2S27POOAHRC4K3CHU4"],"severity":"High","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-4374-p667-p6c8","description":"HTTP/2 rapid reset can cause excessive work in net/http"}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.20.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2023-2102","versionConstraint":"<1.20.10||>=1.21.0-0,<1.21.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2023-2102","fix":{"state":"fixed","versions":["1.20.10","1.21.3"],"available":[{"date":"2023-10-10","kind":"release","version":"1.20.10"},{"date":"2023-10-10","kind":"release","version":"1.21.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39325","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-39325","date":"2026-10-08","epss":0.03796,"percentile":0.89716}],"risk":2.8470000000000004,"urls":["https://go.dev/cl/534215","https://go.dev/cl/534235","https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/63417","description":"A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing.\n\nWith the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection.\n\nThis issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2.\n\nThe default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function."},"relatedVulnerabilities":[{"id":"CVE-2023-39325","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39325","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-39325","date":"2026-10-08","epss":0.03796,"percentile":0.89716}],"urls":["https://go.dev/cl/534215","https://go.dev/cl/534235","https://go.dev/issue/63417","https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OVW5V2DM5K5IC3H7O42YDUGNJ74J35O/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WJ4QVX2AMUJ2F2S27POOAHRC4K3CHU4/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FTMJ3NJIDAZFWJQQSP3L22MUFJ3UP2PT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPWCNYB5PQ5PCVZ4NJT6G56ZYFZ5QBU6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5E5JSJBZLYXOTZWXHJKRVCIXIHVWKJ6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MZQYOOKHQDQ57LV2IAG6NRFOVXKHJJ3Z/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ODBY7RVMGZCBSTWF2OZGIZS57FNFUL67/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PJCUNGIQDUMZ4Z6HWVYIMR66A35F5S74/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXOU2JZUBEBP7GBKAYIJRPRBZSJCD7ST/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LZSWTV4NV4SNQARNXG5T6LRHP26EW2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJWHBLVZDM5KQSDFRBFRKU5KSSOLIRQ4/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV/","https://pkg.go.dev/vuln/GO-2023-2102","https://security.gentoo.org/glsa/202311-09","https://security.netapp.com/advisory/ntap-20231110-0008/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-39325","description":"A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function."},{"id":"GHSA-4374-p667-p6c8","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39325","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-39325","date":"2026-10-08","epss":0.03796,"percentile":0.89716}],"urls":["https://github.com/golang/go/issues/63417","https://go.dev/cl/534215","https://go.dev/cl/534235","https://go.dev/issue/63417","https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ","https://nvd.nist.gov/vuln/detail/CVE-2023-39325","https://pkg.go.dev/vuln/GO-2023-2102","https://security.gentoo.org/glsa/202311-09","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OVW5V2DM5K5IC3H7O42YDUGNJ74J35O","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SZN67IL7HMGMNAVLOTIXLIHUDXZK4LH","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5RSKA2II6QTD4YUKUNDVJQSRYSFC4VFR","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AVZDNSMVDAQJ64LJC5I5U5LDM5753647","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2BBIDR2ZMB3X5BC7SR4SLQMHRMVPY6L","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECRC75BQJP6FJN2L7KCKYZW4DSBD7QSD","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FTMJ3NJIDAZFWJQQSP3L22MUFJ3UP2PT","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSY7SXFFTPZFWDM6XELSDSHZLVW3AHK7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZQIELEIRSZUYTFFH5KTH2YJ4IIQG2KE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPWCNYB5PQ5PCVZ4NJT6G56ZYFZ5QBU6","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MZQYOOKHQDQ57LV2IAG6NRFOVXKHJJ3Z","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NG7IMPL55MVWU3LCI4JQJT3K2U5CHDV7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OXGWPQOJ3JNDW2XIYKIVJ7N7QUIFNM2Q","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PJCUNGIQDUMZ4Z6HWVYIMR66A35F5S74","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QF5QSYAOPDOWLY6DUHID56Q4HQFYB45I","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UTT7DG3QOF5ZNJLUGHDNLRUIN6OWZARP","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W2LZSWTV4NV4SNQARNXG5T6LRHP26EW2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WCNCBYKZXLDFGAJUB7ZP5VLC3YTHJNVH","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XTNLSL44Y5FB6JWADSZH6DCV4JJAAEQY","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRKEXKANQ7BKJW2YTAMP625LJUJZLJ4P","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZSVEMQV5ROY5YW5QE3I57HT3ITWG5GCV","https://security.netapp.com/advisory/ntap-20231110-0008","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5E5JSJBZLYXOTZWXHJKRVCIXIHVWKJ6","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJWHBLVZDM5KQSDFRBFRKU5KSSOLIRQ4","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ODBY7RVMGZCBSTWF2OZGIZS57FNFUL67","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXOU2JZUBEBP7GBKAYIJRPRBZSJCD7ST","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3WJ4QVX2AMUJ2F2S27POOAHRC4K3CHU4"],"severity":"High","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-4374-p667-p6c8","description":"HTTP/2 rapid reset can cause excessive work in net/http"}]},{"artifact":{"id":"ecf5e89e65014edb","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.64.0-4:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/debian/libcurl4@7.64.0-4?arch=amd64&distro=debian-10.1&upstream=curl","type":"deb","version":"7.64.0-4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.64.0-4+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-8231","versionConstraint":"< 7.64.0-4+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"curl","version":"7.64.0-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-8231","fix":{"state":"fixed","versions":["7.64.0-4+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.64.0-4+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8231","cwe":"CWE-416","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2020-8231","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-8231","date":"2026-10-08","epss":0.03766,"percentile":0.89634}],"risk":2.8245,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4881-1","link":"https://security-tracker.debian.org/tracker/DSA-4881-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-8231","description":"Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data."},"relatedVulnerabilities":[{"id":"CVE-2020-8231","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8231","cwe":"CWE-416","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2020-8231","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-8231","date":"2026-10-08","epss":0.03766,"percentile":0.89634}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://curl.haxx.se/docs/CVE-2020-8231.html","https://hackerone.com/reports/948876","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/202012-14","https://www.debian.org/security/2021/dsa-4881","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8231","description":"Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data."}]},{"artifact":{"id":"7c1ebd3787684a51","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.7-4:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/debian/libgnutls30@3.6.7-4?arch=amd64&distro=debian-10.1&upstream=gnutls28","type":"deb","version":"3.6.7-4","language":"","licenses":["sha256:d35f0abecc61a3676965c20cf13a44815b05d9b4a68985fa1809b13c2aff9090"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.7-4+deb10u7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-24659","versionConstraint":"< 3.6.7-4+deb10u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"gnutls28","version":"3.6.7-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-24659","fix":{"state":"fixed","versions":["3.6.7-4+deb10u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.6.7-4+deb10u7"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-24659","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-24659","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-24659","date":"2026-10-08","epss":0.0373,"percentile":0.89535}],"risk":2.7975,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-24659","description":"An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure."},"relatedVulnerabilities":[{"id":"CVE-2020-24659","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-24659","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-24659","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-24659","date":"2026-10-08","epss":0.0373,"percentile":0.89535}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00054.html","http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00060.html","https://gitlab.com/gnutls/gnutls/-/issues/1071","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62BUAI4FQQLG6VTKRT7SUZPGJJ4NASQ3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AWN56FDLQQXT2D2YHNI4TYH432TDMQ7N/","https://security.gentoo.org/glsa/202009-01","https://security.netapp.com/advisory/ntap-20200911-0006/","https://usn.ubuntu.com/4491-1/","https://www.gnutls.org/security-new.html#GNUTLS-SA-2020-09-04"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-24659","description":"An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure."}]},{"artifact":{"id":"31533a2d94521b3a","cpes":["cpe:2.3:a:libgmp10:libgmp10:2\\:6.1.2\\+dfsg-4:*:*:*:*:*:*:*"],"name":"libgmp10","purl":"pkg:deb/debian/libgmp10@2%3A6.1.2%2Bdfsg-4?arch=amd64&distro=debian-10.1&upstream=gmp","type":"deb","version":"2:6.1.2+dfsg-4","language":"","licenses":["sha256:f73f781beb9f85b3f921f9bf540fc89d6eff9e20689ef9323ce510d077a30878"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgmp10/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libgmp10/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgmp10:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libgmp10:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gmp"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:6.1.2+dfsg-4+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-43618","versionConstraint":"< 2:6.1.2+dfsg-4+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"gmp","version":"2:6.1.2+dfsg-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-43618","fix":{"state":"fixed","versions":["2:6.1.2+dfsg-4+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:6.1.2+dfsg-4+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-43618","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-43618","date":"2026-10-08","epss":0.03712,"percentile":0.89469}],"risk":2.784,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-43618","description":"GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms."},"relatedVulnerabilities":[{"id":"CVE-2021-43618","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-43618","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-43618","date":"2026-10-08","epss":0.03712,"percentile":0.89469}],"urls":["http://seclists.org/fulldisclosure/2022/Oct/8","http://www.openwall.com/lists/oss-security/2022/10/13/3","https://bugs.debian.org/994405","https://gmplib.org/list-archives/gmp-bugs/2021-September/005077.html","https://gmplib.org/repo/gmp-6.2/rev/561a9c25298e","https://lists.debian.org/debian-lts-announce/2021/12/msg00001.html","https://security.gentoo.org/glsa/202309-13","https://security.netapp.com/advisory/ntap-20221111-0001/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-43618","description":"GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.16.14"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0319","versionConstraint":"<1.16.14||>=1.17.0-0,<1.17.7 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0319","fix":{"state":"fixed","versions":["1.16.14","1.17.7"],"available":[{"date":"2022-02-09","kind":"release","version":"1.16.14"},{"date":"2022-02-09","kind":"release","version":"1.17.7"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23806","cwe":"CWE-252","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-23806","date":"2026-10-08","epss":0.03073,"percentile":0.87271}],"risk":2.7810650000000003,"urls":["https://go.googlesource.com/go/+/7f9494c277a471f6f47f4af3036285c0b1419816","https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ","https://go.dev/issue/50974"],"severity":"Critical","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/382455","description":"Some big.Int values that are not valid field elements (negative or overflowing) might cause Curve.IsOnCurve to incorrectly return true. Operating on those values may cause a panic or an invalid curve operation. Note that Unmarshal will never return such values."},"relatedVulnerabilities":[{"id":"CVE-2022-23806","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23806","cwe":"CWE-252","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-23806","date":"2026-10-08","epss":0.03073,"percentile":0.87271}],"urls":["https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ","https://lists.debian.org/debian-lts-announce/2022/04/msg00017.html","https://lists.debian.org/debian-lts-announce/2022/04/msg00018.html","https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html","https://security.gentoo.org/glsa/202208-02","https://security.netapp.com/advisory/ntap-20220225-0006/","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23806","description":"Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.16.14"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0319","versionConstraint":"<1.16.14||>=1.17.0-0,<1.17.7 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0319","fix":{"state":"fixed","versions":["1.16.14","1.17.7"],"available":[{"date":"2022-02-09","kind":"release","version":"1.16.14"},{"date":"2022-02-09","kind":"release","version":"1.17.7"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23806","cwe":"CWE-252","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-23806","date":"2026-10-08","epss":0.03073,"percentile":0.87271}],"risk":2.7810650000000003,"urls":["https://go.googlesource.com/go/+/7f9494c277a471f6f47f4af3036285c0b1419816","https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ","https://go.dev/issue/50974"],"severity":"Critical","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/382455","description":"Some big.Int values that are not valid field elements (negative or overflowing) might cause Curve.IsOnCurve to incorrectly return true. Operating on those values may cause a panic or an invalid curve operation. Note that Unmarshal will never return such values."},"relatedVulnerabilities":[{"id":"CVE-2022-23806","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23806","cwe":"CWE-252","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-23806","date":"2026-10-08","epss":0.03073,"percentile":0.87271}],"urls":["https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ","https://lists.debian.org/debian-lts-announce/2022/04/msg00017.html","https://lists.debian.org/debian-lts-announce/2022/04/msg00018.html","https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html","https://security.gentoo.org/glsa/202208-02","https://security.netapp.com/advisory/ntap-20220225-0006/","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23806","description":"Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element."}]},{"artifact":{"id":"bca20a7b0a858bf3","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/debian/libssl1.1@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1&upstream=openssl","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1n-0+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-0464","versionConstraint":"< 1.1.1n-0+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-0464","fix":{"state":"fixed","versions":["1.1.1n-0+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1n-0+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0464","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0464","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0464","date":"2026-10-08","epss":0.03658,"percentile":0.89322}],"risk":2.7435,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-0464","description":"A security vulnerability has been identified in all supported versions  of OpenSSL related to the verification of X.509 certificate chains that include policy constraints.  Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems.  Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function."},"relatedVulnerabilities":[{"id":"CVE-2023-0464","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0464","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0464","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0464","date":"2026-10-08","epss":0.03658,"percentile":0.89322}],"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2017771e2db3e2b96f89bbe8766c3209f6a99545","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2dcd4f1e3115f38cefa43e3efbe9b801c27e642e","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=879f7080d7e141f415c79eaa3a8ac4a3dad0348b","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=959c59c7a0164117e7f8366466a32bb1f8d77ff1","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.couchbase.com/alerts/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230322.txt","https://security.netapp.com/advisory/ntap-20230406-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0464","description":"A security vulnerability has been identified in all supported versions\n\nof OpenSSL related to the verification of X.509 certificate chains\nthat include policy constraints.  Attackers may be able to exploit this\nvulnerability by creating a malicious certificate chain that triggers\nexponential use of computational resources, leading to a denial-of-service\n(DoS) attack on affected systems.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function."}]},{"artifact":{"id":"d308e84bddad0b0f","cpes":["cpe:2.3:a:openssl:openssl:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1n-0+deb10u5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-0464","versionConstraint":"< 1.1.1n-0+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-0464","fix":{"state":"fixed","versions":["1.1.1n-0+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1n-0+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0464","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0464","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0464","date":"2026-10-08","epss":0.03658,"percentile":0.89322}],"risk":2.7435,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-0464","description":"A security vulnerability has been identified in all supported versions  of OpenSSL related to the verification of X.509 certificate chains that include policy constraints.  Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems.  Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function."},"relatedVulnerabilities":[{"id":"CVE-2023-0464","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0464","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0464","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0464","date":"2026-10-08","epss":0.03658,"percentile":0.89322}],"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2017771e2db3e2b96f89bbe8766c3209f6a99545","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2dcd4f1e3115f38cefa43e3efbe9b801c27e642e","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=879f7080d7e141f415c79eaa3a8ac4a3dad0348b","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=959c59c7a0164117e7f8366466a32bb1f8d77ff1","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.couchbase.com/alerts/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230322.txt","https://security.netapp.com/advisory/ntap-20230406-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0464","description":"A security vulnerability has been identified in all supported versions\n\nof OpenSSL related to the verification of X.509 certificate chains\nthat include policy constraints.  Attackers may be able to exploit this\nvulnerability by creating a malicious certificate chain that triggers\nexponential use of computational resources, leading to a denial-of-service\n(DoS) attack on affected systems.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function."}]},{"artifact":{"id":"02d6c38191dc424f","cpes":["cpe:2.3:a:liblz4-1:liblz4-1:1.8.3-1:*:*:*:*:*:*:*","cpe:2.3:a:liblz4-1:liblz4_1:1.8.3-1:*:*:*:*:*:*:*","cpe:2.3:a:liblz4_1:liblz4-1:1.8.3-1:*:*:*:*:*:*:*","cpe:2.3:a:liblz4_1:liblz4_1:1.8.3-1:*:*:*:*:*:*:*","cpe:2.3:a:liblz4:liblz4-1:1.8.3-1:*:*:*:*:*:*:*","cpe:2.3:a:liblz4:liblz4_1:1.8.3-1:*:*:*:*:*:*:*"],"name":"liblz4-1","purl":"pkg:deb/debian/liblz4-1@1.8.3-1?arch=amd64&distro=debian-10.1&upstream=lz4","type":"deb","version":"1.8.3-1","language":"","licenses":["BSD-2-clause","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/liblz4-1/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/liblz4-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/liblz4-1:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/liblz4-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"lz4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-17543","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"lz4","version":"1.8.3-1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-17543","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-17543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17543","date":"2026-10-08","epss":0.09116,"percentile":0.95192}],"risk":2.7348,"urls":[],"severity":"Low","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-17543","description":"LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states \"only a few specific / uncommon usages of the API are at risk.\""},"relatedVulnerabilities":[{"id":"CVE-2019-17543","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17543","date":"2026-10-08","epss":0.09116,"percentile":0.95192}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00069.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00070.html","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15941","https://github.com/lz4/lz4/compare/v1.9.1...v1.9.2","https://github.com/lz4/lz4/issues/801","https://github.com/lz4/lz4/pull/756","https://github.com/lz4/lz4/pull/760","https://lists.apache.org/thread.html/25015588b770d67470b7ba7ea49a305d6735dd7f00eabe7d50ec1e17%40%3Cissues.arrow.apache.org%3E","https://lists.apache.org/thread.html/543302d55e2d2da4311994e9b0debdc676bf3fd05e1a2be3407aa2d6%40%3Cissues.arrow.apache.org%3E","https://lists.apache.org/thread.html/793012683dc0fa6819b7c2560e6cf990811014c40c7d75412099c357%40%3Cissues.arrow.apache.org%3E","https://lists.apache.org/thread.html/9ff0606d16be2ab6a81619e1c9e23c3e251756638e36272c8c8b7fa3%40%3Cissues.arrow.apache.org%3E","https://lists.apache.org/thread.html/f0038c4fab2ee25aee849ebeff6b33b3aa89e07ccfb06b5c87b36316%40%3Cissues.arrow.apache.org%3E","https://lists.apache.org/thread.html/f506bc371d4a068d5d84d7361293568f61167d3a1c3e91f0def2d7d3%40%3Cdev.arrow.apache.org%3E","https://lists.apache.org/thread.html/r0fb226357e7988a241b06b93bab065bcea2eb38658b382e485960e26%40%3Cissues.kudu.apache.org%3E","https://lists.apache.org/thread.html/r4068ba81066792f2b4d208b39c4c4713c5d4c79bd8cb6c1904af5720%40%3Cissues.kudu.apache.org%3E","https://lists.apache.org/thread.html/r7bc72200f94298bc9a0e35637f388deb53467ca4b2e2ad1ff66d8960%40%3Cissues.kudu.apache.org%3E","https://security.netapp.com/advisory/ntap-20210723-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-17543","description":"LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states \"only a few specific / uncommon usages of the API are at risk.\""}]},{"artifact":{"id":"ecf5e89e65014edb","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.64.0-4:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/debian/libcurl4@7.64.0-4?arch=amd64&distro=debian-10.1&upstream=curl","type":"deb","version":"7.64.0-4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.64.0-4+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-22876","versionConstraint":"< 7.64.0-4+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"curl","version":"7.64.0-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-22876","fix":{"state":"fixed","versions":["7.64.0-4+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.64.0-4+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-22876","cwe":"CWE-359","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2021-22876","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-22876","date":"2026-10-08","epss":0.05301,"percentile":0.92378}],"risk":2.7300150000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4881-1","link":"https://security-tracker.debian.org/tracker/DSA-4881-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-22876","description":"curl 7.1.1 to and including 7.75.0 is vulnerable to an \"Exposure of Private Personal Information to an Unauthorized Actor\" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request."},"relatedVulnerabilities":[{"id":"CVE-2021-22876","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-22876","cwe":"CWE-359","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2021-22876","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-22876","date":"2026-10-08","epss":0.05301,"percentile":0.92378}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://curl.se/docs/CVE-2021-22876.html","https://hackerone.com/reports/1101882","https://lists.debian.org/debian-lts-announce/2021/05/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ZC5BMIOKLBQJSFCHEDN2G2C2SH274BP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITVWPVGLFISU5BJC2BXBRYSDXTXE2YGC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQUIOYX2KUU6FIUZVB5WWZ6JHSSYSQWJ/","https://security.gentoo.org/glsa/202105-36","https://security.netapp.com/advisory/ntap-20210521-0007/","https://www.oracle.com//security-alerts/cpujul2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-22876","description":"curl 7.1.1 to and including 7.75.0 is vulnerable to an \"Exposure of Private Personal Information to an Unauthorized Actor\" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request."}]},{"artifact":{"id":"2d52d7c9fca553cc","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.28-10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.28-10?arch=amd64&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-33574","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-33574","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33574","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33574","date":"2026-10-08","epss":0.02874,"percentile":0.86413}],"risk":2.7015600000000006,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-33574","description":"The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact."},"relatedVulnerabilities":[{"id":"CVE-2021-33574","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33574","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33574","date":"2026-10-08","epss":0.02874,"percentile":0.86413}],"urls":["https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJYYIMDDYOHTP2PORLABTOHYQYYREZDD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBUUWUGXVILQXVWEOU7N42ICHPJNAEUP/","https://security.gentoo.org/glsa/202107-07","https://security.netapp.com/advisory/ntap-20210629-0005/","https://sourceware.org/bugzilla/show_bug.cgi?id=27896","https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c1"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33574","description":"The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact."}]},{"artifact":{"id":"fe0324c22198dabb","cpes":["cpe:2.3:a:libc-l10n:libc-l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc-l10n:libc_l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc-l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc_l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_l10n:2.28-10:*:*:*:*:*:*:*"],"name":"libc-l10n","purl":"pkg:deb/debian/libc-l10n@2.28-10?arch=all&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-l10n/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libc-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libc-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libc-l10n.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-33574","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-33574","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33574","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33574","date":"2026-10-08","epss":0.02874,"percentile":0.86413}],"risk":2.7015600000000006,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-33574","description":"The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact."},"relatedVulnerabilities":[{"id":"CVE-2021-33574","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33574","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33574","date":"2026-10-08","epss":0.02874,"percentile":0.86413}],"urls":["https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJYYIMDDYOHTP2PORLABTOHYQYYREZDD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBUUWUGXVILQXVWEOU7N42ICHPJNAEUP/","https://security.gentoo.org/glsa/202107-07","https://security.netapp.com/advisory/ntap-20210629-0005/","https://sourceware.org/bugzilla/show_bug.cgi?id=27896","https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c1"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33574","description":"The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact."}]},{"artifact":{"id":"4d00fd0f941e584e","cpes":["cpe:2.3:a:libc6:libc6:2.28-10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.28-10?arch=amd64&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-33574","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-33574","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33574","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33574","date":"2026-10-08","epss":0.02874,"percentile":0.86413}],"risk":2.7015600000000006,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-33574","description":"The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact."},"relatedVulnerabilities":[{"id":"CVE-2021-33574","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33574","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33574","date":"2026-10-08","epss":0.02874,"percentile":0.86413}],"urls":["https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJYYIMDDYOHTP2PORLABTOHYQYYREZDD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBUUWUGXVILQXVWEOU7N42ICHPJNAEUP/","https://security.gentoo.org/glsa/202107-07","https://security.netapp.com/advisory/ntap-20210629-0005/","https://sourceware.org/bugzilla/show_bug.cgi?id=27896","https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c1"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33574","description":"The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact."}]},{"artifact":{"id":"c1d71c418353daa4","cpes":["cpe:2.3:a:locales:locales:2.28-10:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/debian/locales@2.28-10?arch=all&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-33574","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-33574","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33574","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33574","date":"2026-10-08","epss":0.02874,"percentile":0.86413}],"risk":2.7015600000000006,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-33574","description":"The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact."},"relatedVulnerabilities":[{"id":"CVE-2021-33574","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33574","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33574","date":"2026-10-08","epss":0.02874,"percentile":0.86413}],"urls":["https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJYYIMDDYOHTP2PORLABTOHYQYYREZDD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBUUWUGXVILQXVWEOU7N42ICHPJNAEUP/","https://security.gentoo.org/glsa/202107-07","https://security.netapp.com/advisory/ntap-20210629-0005/","https://sourceware.org/bugzilla/show_bug.cgi?id=27896","https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c1"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33574","description":"The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact."}]},{"artifact":{"id":"9c0f03079e497030","cpes":["cpe:2.3:a:libpython3.7-minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-minimal","purl":"pkg:deb/debian/libpython3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3733","versionConstraint":"< 3.7.3-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-3733","fix":{"state":"fixed","versions":["3.7.3-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3733","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3733","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3733","date":"2026-10-08","epss":0.04675,"percentile":0.91534}],"risk":2.688125,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-3733","description":"There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability."},"relatedVulnerabilities":[{"id":"CVE-2021-3733","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3733","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3733","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3733","date":"2026-10-08","epss":0.04675,"percentile":0.91534}],"urls":["https://bugs.python.org/issue43075","https://bugzilla.redhat.com/show_bug.cgi?id=1995234","https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb","https://github.com/python/cpython/pull/24391","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://security.netapp.com/advisory/ntap-20220407-0001/","https://ubuntu.com/security/CVE-2021-3733","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3733","description":"There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability."}]},{"artifact":{"id":"b6d8c37141cd8c0a","cpes":["cpe:2.3:a:libpython3.7-stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-stdlib","purl":"pkg:deb/debian/libpython3.7-stdlib@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3733","versionConstraint":"< 3.7.3-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-3733","fix":{"state":"fixed","versions":["3.7.3-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3733","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3733","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3733","date":"2026-10-08","epss":0.04675,"percentile":0.91534}],"risk":2.688125,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-3733","description":"There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability."},"relatedVulnerabilities":[{"id":"CVE-2021-3733","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3733","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3733","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3733","date":"2026-10-08","epss":0.04675,"percentile":0.91534}],"urls":["https://bugs.python.org/issue43075","https://bugzilla.redhat.com/show_bug.cgi?id=1995234","https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb","https://github.com/python/cpython/pull/24391","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://security.netapp.com/advisory/ntap-20220407-0001/","https://ubuntu.com/security/CVE-2021-3733","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3733","description":"There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability."}]},{"artifact":{"id":"94955c7d71be2bb1","cpes":["cpe:2.3:a:python3.7:python3.7:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7","purl":"pkg:deb/debian/python3.7@3.7.3-2?arch=amd64&distro=debian-10.1","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.list"},{"path":"/var/lib/dpkg/info/python3.7.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.postinst"},{"path":"/var/lib/dpkg/info/python3.7.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-3733","versionConstraint":"< 3.7.3-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-3733","fix":{"state":"fixed","versions":["3.7.3-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3733","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3733","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3733","date":"2026-10-08","epss":0.04675,"percentile":0.91534}],"risk":2.688125,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-3733","description":"There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability."},"relatedVulnerabilities":[{"id":"CVE-2021-3733","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3733","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3733","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3733","date":"2026-10-08","epss":0.04675,"percentile":0.91534}],"urls":["https://bugs.python.org/issue43075","https://bugzilla.redhat.com/show_bug.cgi?id=1995234","https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb","https://github.com/python/cpython/pull/24391","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://security.netapp.com/advisory/ntap-20220407-0001/","https://ubuntu.com/security/CVE-2021-3733","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3733","description":"There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability."}]},{"artifact":{"id":"988c8a69c0d8509e","cpes":["cpe:2.3:a:python3.7-minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7-minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7-minimal","purl":"pkg:deb/debian/python3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.list"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.7-minimal.preinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.prerm"}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3733","versionConstraint":"< 3.7.3-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-3733","fix":{"state":"fixed","versions":["3.7.3-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3733","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3733","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3733","date":"2026-10-08","epss":0.04675,"percentile":0.91534}],"risk":2.688125,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-3733","description":"There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability."},"relatedVulnerabilities":[{"id":"CVE-2021-3733","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3733","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3733","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3733","date":"2026-10-08","epss":0.04675,"percentile":0.91534}],"urls":["https://bugs.python.org/issue43075","https://bugzilla.redhat.com/show_bug.cgi?id=1995234","https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb","https://github.com/python/cpython/pull/24391","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://security.netapp.com/advisory/ntap-20220407-0001/","https://ubuntu.com/security/CVE-2021-3733","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3733","description":"There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability."}]},{"artifact":{"id":"de13d9d3b0096104","cpes":["cpe:2.3:a:libp11-kit0:libp11-kit0:0.23.15-2:*:*:*:*:*:*:*","cpe:2.3:a:libp11-kit0:libp11_kit0:0.23.15-2:*:*:*:*:*:*:*","cpe:2.3:a:libp11_kit0:libp11-kit0:0.23.15-2:*:*:*:*:*:*:*","cpe:2.3:a:libp11_kit0:libp11_kit0:0.23.15-2:*:*:*:*:*:*:*","cpe:2.3:a:libp11:libp11-kit0:0.23.15-2:*:*:*:*:*:*:*","cpe:2.3:a:libp11:libp11_kit0:0.23.15-2:*:*:*:*:*:*:*"],"name":"libp11-kit0","purl":"pkg:deb/debian/libp11-kit0@0.23.15-2?arch=amd64&distro=debian-10.1&upstream=p11-kit","type":"deb","version":"0.23.15-2","language":"","licenses":["sha256:7e0942c830cd46f69d01e0806c63b6757bb229b635f0bdd48bcc0e7c32ea4787"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libp11-kit0/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libp11-kit0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libp11-kit0:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libp11-kit0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"p11-kit"}]},"matchDetails":[{"fix":{"suggestedVersion":"0.23.15-2+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-29363","versionConstraint":"< 0.23.15-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"p11-kit","version":"0.23.15-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-29363","fix":{"state":"fixed","versions":["0.23.15-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"0.23.15-2+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-29363","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-29363","date":"2026-10-08","epss":0.03528,"percentile":0.88926}],"risk":2.646,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4822-1","link":"https://security-tracker.debian.org/tracker/DSA-4822-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-29363","description":"An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the remote entity supplies a serialized byte array in a CK_ATTRIBUTE, the receiving entity may not allocate sufficient length for the buffer to store the deserialized value."},"relatedVulnerabilities":[{"id":"CVE-2020-29363","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-29363","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-29363","date":"2026-10-08","epss":0.03528,"percentile":0.88926}],"urls":["https://github.com/p11-glue/p11-kit/releases","https://github.com/p11-glue/p11-kit/security/advisories/GHSA-5j67-fw89-fp6x","https://www.debian.org/security/2021/dsa-4822","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-29363","description":"An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the remote entity supplies a serialized byte array in a CK_ATTRIBUTE, the receiving entity may not allocate sufficient length for the buffer to store the deserialized value."}]},{"artifact":{"id":"23379702208ad4ae","cpes":["cpe:2.3:a:libncurses6:libncurses6:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libncurses6","purl":"pkg:deb/debian/libncurses6@6.1%2B20181013-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=ncurses","type":"deb","version":"6.1+20181013-2+deb10u1","language":"","licenses":["sha256:5e8ee902c8906ddb7779fd36dc9979cb08b51fbebf7c0b1a9aeb78af382af590"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo6/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libncurses6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncurses6:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libncurses6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"fix":{"suggestedVersion":"6.1+20181013-2+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-39537","versionConstraint":"< 6.1+20181013-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"ncurses","version":"6.1+20181013-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-39537","fix":{"state":"fixed","versions":["6.1+20181013-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"6.1+20181013-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-39537","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-39537","date":"2026-10-08","epss":0.03231,"percentile":0.87888}],"risk":2.6332649999999997,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-39537","description":"An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow."},"relatedVulnerabilities":[{"id":"CVE-2021-39537","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-39537","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-39537","date":"2026-10-08","epss":0.03231,"percentile":0.87888}],"urls":["http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c?rev=1.1&content-type=text/x-cvsweb-markup","http://seclists.org/fulldisclosure/2022/Oct/28","http://seclists.org/fulldisclosure/2022/Oct/41","http://seclists.org/fulldisclosure/2022/Oct/43","http://seclists.org/fulldisclosure/2022/Oct/45","https://lists.debian.org/debian-lts-announce/2023/12/msg00004.html","https://lists.gnu.org/archive/html/bug-ncurses/2020-08/msg00006.html","https://lists.gnu.org/archive/html/bug-ncurses/2021-10/msg00023.html","https://security.netapp.com/advisory/ntap-20230427-0012/","https://support.apple.com/kb/HT213443","https://support.apple.com/kb/HT213444","https://support.apple.com/kb/HT213488"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-39537","description":"An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow."}]},{"artifact":{"id":"845a07db623ef9dc","cpes":["cpe:2.3:a:libncursesw6:libncursesw6:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libncursesw6","purl":"pkg:deb/debian/libncursesw6@6.1%2B20181013-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=ncurses","type":"deb","version":"6.1+20181013-2+deb10u1","language":"","licenses":["sha256:5e8ee902c8906ddb7779fd36dc9979cb08b51fbebf7c0b1a9aeb78af382af590"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo6/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libncursesw6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncursesw6:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libncursesw6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"fix":{"suggestedVersion":"6.1+20181013-2+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-39537","versionConstraint":"< 6.1+20181013-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"ncurses","version":"6.1+20181013-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-39537","fix":{"state":"fixed","versions":["6.1+20181013-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"6.1+20181013-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-39537","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-39537","date":"2026-10-08","epss":0.03231,"percentile":0.87888}],"risk":2.6332649999999997,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-39537","description":"An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow."},"relatedVulnerabilities":[{"id":"CVE-2021-39537","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-39537","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-39537","date":"2026-10-08","epss":0.03231,"percentile":0.87888}],"urls":["http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c?rev=1.1&content-type=text/x-cvsweb-markup","http://seclists.org/fulldisclosure/2022/Oct/28","http://seclists.org/fulldisclosure/2022/Oct/41","http://seclists.org/fulldisclosure/2022/Oct/43","http://seclists.org/fulldisclosure/2022/Oct/45","https://lists.debian.org/debian-lts-announce/2023/12/msg00004.html","https://lists.gnu.org/archive/html/bug-ncurses/2020-08/msg00006.html","https://lists.gnu.org/archive/html/bug-ncurses/2021-10/msg00023.html","https://security.netapp.com/advisory/ntap-20230427-0012/","https://support.apple.com/kb/HT213443","https://support.apple.com/kb/HT213444","https://support.apple.com/kb/HT213488"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-39537","description":"An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow."}]},{"artifact":{"id":"398b6a96752d6a52","cpes":["cpe:2.3:a:libtinfo6:libtinfo6:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libtinfo6","purl":"pkg:deb/debian/libtinfo6@6.1%2B20181013-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=ncurses","type":"deb","version":"6.1+20181013-2+deb10u1","language":"","licenses":["sha256:5e8ee902c8906ddb7779fd36dc9979cb08b51fbebf7c0b1a9aeb78af382af590"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo6/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libtinfo6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtinfo6:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libtinfo6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"fix":{"suggestedVersion":"6.1+20181013-2+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-39537","versionConstraint":"< 6.1+20181013-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"ncurses","version":"6.1+20181013-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-39537","fix":{"state":"fixed","versions":["6.1+20181013-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"6.1+20181013-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-39537","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-39537","date":"2026-10-08","epss":0.03231,"percentile":0.87888}],"risk":2.6332649999999997,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-39537","description":"An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow."},"relatedVulnerabilities":[{"id":"CVE-2021-39537","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-39537","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-39537","date":"2026-10-08","epss":0.03231,"percentile":0.87888}],"urls":["http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c?rev=1.1&content-type=text/x-cvsweb-markup","http://seclists.org/fulldisclosure/2022/Oct/28","http://seclists.org/fulldisclosure/2022/Oct/41","http://seclists.org/fulldisclosure/2022/Oct/43","http://seclists.org/fulldisclosure/2022/Oct/45","https://lists.debian.org/debian-lts-announce/2023/12/msg00004.html","https://lists.gnu.org/archive/html/bug-ncurses/2020-08/msg00006.html","https://lists.gnu.org/archive/html/bug-ncurses/2021-10/msg00023.html","https://security.netapp.com/advisory/ntap-20230427-0012/","https://support.apple.com/kb/HT213443","https://support.apple.com/kb/HT213444","https://support.apple.com/kb/HT213488"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-39537","description":"An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow."}]},{"artifact":{"id":"ee327b3210e9495d","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:deb/debian/ncurses-base@6.1%2B20181013-2%2Bdeb10u1?arch=all&distro=debian-10.1&upstream=ncurses","type":"deb","version":"6.1+20181013-2+deb10u1","language":"","licenses":["sha256:5e8ee902c8906ddb7779fd36dc9979cb08b51fbebf7c0b1a9aeb78af382af590"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-base/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/ncurses-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.conffiles","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/ncurses-base.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/ncurses-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.list","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/ncurses-base.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"fix":{"suggestedVersion":"6.1+20181013-2+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-39537","versionConstraint":"< 6.1+20181013-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"ncurses","version":"6.1+20181013-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-39537","fix":{"state":"fixed","versions":["6.1+20181013-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"6.1+20181013-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-39537","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-39537","date":"2026-10-08","epss":0.03231,"percentile":0.87888}],"risk":2.6332649999999997,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-39537","description":"An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow."},"relatedVulnerabilities":[{"id":"CVE-2021-39537","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-39537","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-39537","date":"2026-10-08","epss":0.03231,"percentile":0.87888}],"urls":["http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c?rev=1.1&content-type=text/x-cvsweb-markup","http://seclists.org/fulldisclosure/2022/Oct/28","http://seclists.org/fulldisclosure/2022/Oct/41","http://seclists.org/fulldisclosure/2022/Oct/43","http://seclists.org/fulldisclosure/2022/Oct/45","https://lists.debian.org/debian-lts-announce/2023/12/msg00004.html","https://lists.gnu.org/archive/html/bug-ncurses/2020-08/msg00006.html","https://lists.gnu.org/archive/html/bug-ncurses/2021-10/msg00023.html","https://security.netapp.com/advisory/ntap-20230427-0012/","https://support.apple.com/kb/HT213443","https://support.apple.com/kb/HT213444","https://support.apple.com/kb/HT213488"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-39537","description":"An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow."}]},{"artifact":{"id":"14c95522205f6d31","cpes":["cpe:2.3:a:ncurses-bin:ncurses-bin:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-bin:ncurses_bin:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses-bin:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses_bin:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-bin:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_bin:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"ncurses-bin","purl":"pkg:deb/debian/ncurses-bin@6.1%2B20181013-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=ncurses","type":"deb","version":"6.1+20181013-2+deb10u1","language":"","licenses":["sha256:5e8ee902c8906ddb7779fd36dc9979cb08b51fbebf7c0b1a9aeb78af382af590"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-bin/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/ncurses-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/ncurses-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.list","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/ncurses-bin.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"fix":{"suggestedVersion":"6.1+20181013-2+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-39537","versionConstraint":"< 6.1+20181013-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"ncurses","version":"6.1+20181013-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-39537","fix":{"state":"fixed","versions":["6.1+20181013-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"6.1+20181013-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-39537","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-39537","date":"2026-10-08","epss":0.03231,"percentile":0.87888}],"risk":2.6332649999999997,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-39537","description":"An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow."},"relatedVulnerabilities":[{"id":"CVE-2021-39537","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-39537","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-39537","date":"2026-10-08","epss":0.03231,"percentile":0.87888}],"urls":["http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c?rev=1.1&content-type=text/x-cvsweb-markup","http://seclists.org/fulldisclosure/2022/Oct/28","http://seclists.org/fulldisclosure/2022/Oct/41","http://seclists.org/fulldisclosure/2022/Oct/43","http://seclists.org/fulldisclosure/2022/Oct/45","https://lists.debian.org/debian-lts-announce/2023/12/msg00004.html","https://lists.gnu.org/archive/html/bug-ncurses/2020-08/msg00006.html","https://lists.gnu.org/archive/html/bug-ncurses/2021-10/msg00023.html","https://security.netapp.com/advisory/ntap-20230427-0012/","https://support.apple.com/kb/HT213443","https://support.apple.com/kb/HT213444","https://support.apple.com/kb/HT213488"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-39537","description":"An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow."}]},{"artifact":{"id":"ecf5e89e65014edb","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.64.0-4:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/debian/libcurl4@7.64.0-4?arch=amd64&distro=debian-10.1&upstream=curl","type":"deb","version":"7.64.0-4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.64.0-4+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-8169","versionConstraint":"< 7.64.0-4+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"curl","version":"7.64.0-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-8169","fix":{"state":"fixed","versions":["7.64.0-4+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.64.0-4+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8169","cwe":"CWE-200","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2020-8169","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-8169","date":"2026-10-08","epss":0.03469,"percentile":0.88745}],"risk":2.60175,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4881-1","link":"https://security-tracker.debian.org/tracker/DSA-4881-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-8169","description":"curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s)."},"relatedVulnerabilities":[{"id":"CVE-2020-8169","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8169","cwe":"CWE-200","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2020-8169","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-8169","date":"2026-10-08","epss":0.03469,"percentile":0.88745}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-200951.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://curl.se/docs/CVE-2020-8169.html","https://hackerone.com/reports/874778","https://www.debian.org/security/2021/dsa-4881"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8169","description":"curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s)."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.15.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0240","versionConstraint":"<1.15.13||>=1.16.0-0,<1.16.5 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0240","fix":{"state":"fixed","versions":["1.15.13","1.16.5"],"available":[{"date":"2021-06-03","kind":"release","version":"1.15.13"},{"date":"2021-06-03","kind":"release","version":"1.16.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33196","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33196","date":"2026-10-08","epss":0.03464,"percentile":0.88726}],"risk":2.5979999999999994,"urls":["https://go.googlesource.com/go/+/74242baa4136c7a9132a8ccd9881354442788c8c","https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI","https://go.dev/issue/46242"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/318909","description":"NewReader and OpenReader can cause a panic or an unrecoverable fatal error when reading an archive that claims to contain a large number of files, regardless of its actual size."},"relatedVulnerabilities":[{"id":"CVE-2021-33196","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33196","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33196","date":"2026-10-08","epss":0.03464,"percentile":0.88726}],"urls":["https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI","https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html","https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html","https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html","https://security.gentoo.org/glsa/202208-02"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33196","description":"In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.15.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0240","versionConstraint":"<1.15.13||>=1.16.0-0,<1.16.5 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0240","fix":{"state":"fixed","versions":["1.15.13","1.16.5"],"available":[{"date":"2021-06-03","kind":"release","version":"1.15.13"},{"date":"2021-06-03","kind":"release","version":"1.16.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33196","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33196","date":"2026-10-08","epss":0.03464,"percentile":0.88726}],"risk":2.5979999999999994,"urls":["https://go.googlesource.com/go/+/74242baa4136c7a9132a8ccd9881354442788c8c","https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI","https://go.dev/issue/46242"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/318909","description":"NewReader and OpenReader can cause a panic or an unrecoverable fatal error when reading an archive that claims to contain a large number of files, regardless of its actual size."},"relatedVulnerabilities":[{"id":"CVE-2021-33196","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33196","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33196","date":"2026-10-08","epss":0.03464,"percentile":0.88726}],"urls":["https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI","https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html","https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html","https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html","https://security.gentoo.org/glsa/202208-02"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33196","description":"In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.15.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0242","versionConstraint":"<1.15.13||>=1.16.0-0,<1.16.5 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0242","fix":{"state":"fixed","versions":["1.15.13","1.16.5"],"available":[{"date":"2021-06-03","kind":"release","version":"1.15.13"},{"date":"2021-06-03","kind":"release","version":"1.16.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-33198","date":"2026-10-08","epss":0.03372,"percentile":0.88426}],"risk":2.529,"urls":["https://go.googlesource.com/go/+/6c591f79b0b5327549bd4e94970f7a279efb4ab0","https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI","https://go.dev/issue/45910"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/316149","description":"Rat.SetString and Rat.UnmarshalText may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents."},"relatedVulnerabilities":[{"id":"CVE-2021-33198","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-33198","date":"2026-10-08","epss":0.03372,"percentile":0.88426}],"urls":["https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI","https://security.gentoo.org/glsa/202208-02"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33198","description":"In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.15.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0242","versionConstraint":"<1.15.13||>=1.16.0-0,<1.16.5 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0242","fix":{"state":"fixed","versions":["1.15.13","1.16.5"],"available":[{"date":"2021-06-03","kind":"release","version":"1.15.13"},{"date":"2021-06-03","kind":"release","version":"1.16.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-33198","date":"2026-10-08","epss":0.03372,"percentile":0.88426}],"risk":2.529,"urls":["https://go.googlesource.com/go/+/6c591f79b0b5327549bd4e94970f7a279efb4ab0","https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI","https://go.dev/issue/45910"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/316149","description":"Rat.SetString and Rat.UnmarshalText may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents."},"relatedVulnerabilities":[{"id":"CVE-2021-33198","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-33198","date":"2026-10-08","epss":0.03372,"percentile":0.88426}],"urls":["https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI","https://security.gentoo.org/glsa/202208-02"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33198","description":"In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method."}]},{"artifact":{"id":"7c1ebd3787684a51","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.7-4:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/debian/libgnutls30@3.6.7-4?arch=amd64&distro=debian-10.1&upstream=gnutls28","type":"deb","version":"3.6.7-4","language":"","licenses":["sha256:d35f0abecc61a3676965c20cf13a44815b05d9b4a68985fa1809b13c2aff9090"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.7-4+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-11501","versionConstraint":"< 3.6.7-4+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"gnutls28","version":"3.6.7-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-11501","fix":{"state":"fixed","versions":["3.6.7-4+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.6.7-4+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-11501","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11501","date":"2026-10-08","epss":0.03388,"percentile":0.8847}],"risk":2.52406,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4652-1","link":"https://security-tracker.debian.org/tracker/DSA-4652-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-11501","description":"GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit. The DTLS client always uses 32 '\\0' bytes instead of a random value, and thus contributes no randomness to a DTLS negotiation. This breaks the security guarantees of the DTLS protocol."},"relatedVulnerabilities":[{"id":"CVE-2020-11501","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-11501","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-11501","date":"2026-10-08","epss":0.03388,"percentile":0.8847}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00015.html","https://gitlab.com/gnutls/gnutls/-/commit/5b595e8e52653f6c5726a4cdd8fddeb6e83804d2","https://gitlab.com/gnutls/gnutls/-/issues/960","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ILMOWPKMTZAIMK5F32TUMO34XCABUCFJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WDYY3R4F5CUTFAMXH2C5NKYFVDEJLTT7/","https://security.gentoo.org/glsa/202004-06","https://security.netapp.com/advisory/ntap-20200416-0002/","https://usn.ubuntu.com/4322-1/","https://www.debian.org/security/2020/dsa-4652","https://www.gnutls.org/security-new.html#GNUTLS-SA-2020-03-31"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-11501","description":"GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit. The DTLS client always uses 32 '\\0' bytes instead of a random value, and thus contributes no randomness to a DTLS negotiation. This breaks the security guarantees of the DTLS protocol."}]},{"artifact":{"id":"bca20a7b0a858bf3","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/debian/libssl1.1@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1&upstream=openssl","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1n-0+deb10u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-2097","versionConstraint":"< 1.1.1n-0+deb10u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-2097","fix":{"state":"fixed","versions":["1.1.1n-0+deb10u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1n-0+deb10u4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-2097","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-2097","date":"2026-10-08","epss":0.04899,"percentile":0.91868}],"risk":2.5229850000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-2097","description":"AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of \"in place\" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p)."},"relatedVulnerabilities":[{"id":"CVE-2022-2097","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-2097","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-2097","date":"2026-10-08","epss":0.04899,"percentile":0.91868}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=919925673d6c9cfed3c1085497f5dfbbed5fc431","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=a98f339ddd7e8f487d6e0088d4a9a42324885a93","https://lists.debian.org/debian-lts-announce/2023/02/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R6CK57NBQFTPUMXAPJURCGXUYT76NQAK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6567JERRHHJW2GNGJGKDRNHR7SNPZK7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCMNWKERPBKOEBNL7CLTTX3ZZCZLH7XA/","https://security.gentoo.org/glsa/202210-02","https://security.netapp.com/advisory/ntap-20220715-0011/","https://security.netapp.com/advisory/ntap-20230420-0008/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2023/dsa-5343","https://www.openssl.org/news/secadv/20220705.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-2097","description":"AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of \"in place\" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p)."}]},{"artifact":{"id":"d308e84bddad0b0f","cpes":["cpe:2.3:a:openssl:openssl:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1n-0+deb10u4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-2097","versionConstraint":"< 1.1.1n-0+deb10u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-2097","fix":{"state":"fixed","versions":["1.1.1n-0+deb10u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1n-0+deb10u4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-2097","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-2097","date":"2026-10-08","epss":0.04899,"percentile":0.91868}],"risk":2.5229850000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-2097","description":"AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of \"in place\" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p)."},"relatedVulnerabilities":[{"id":"CVE-2022-2097","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-2097","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-2097","date":"2026-10-08","epss":0.04899,"percentile":0.91868}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=919925673d6c9cfed3c1085497f5dfbbed5fc431","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=a98f339ddd7e8f487d6e0088d4a9a42324885a93","https://lists.debian.org/debian-lts-announce/2023/02/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R6CK57NBQFTPUMXAPJURCGXUYT76NQAK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6567JERRHHJW2GNGJGKDRNHR7SNPZK7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCMNWKERPBKOEBNL7CLTTX3ZZCZLH7XA/","https://security.gentoo.org/glsa/202210-02","https://security.netapp.com/advisory/ntap-20220715-0011/","https://security.netapp.com/advisory/ntap-20230420-0008/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2023/dsa-5343","https://www.openssl.org/news/secadv/20220705.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-2097","description":"AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of \"in place\" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p)."}]},{"artifact":{"id":"de13d9d3b0096104","cpes":["cpe:2.3:a:libp11-kit0:libp11-kit0:0.23.15-2:*:*:*:*:*:*:*","cpe:2.3:a:libp11-kit0:libp11_kit0:0.23.15-2:*:*:*:*:*:*:*","cpe:2.3:a:libp11_kit0:libp11-kit0:0.23.15-2:*:*:*:*:*:*:*","cpe:2.3:a:libp11_kit0:libp11_kit0:0.23.15-2:*:*:*:*:*:*:*","cpe:2.3:a:libp11:libp11-kit0:0.23.15-2:*:*:*:*:*:*:*","cpe:2.3:a:libp11:libp11_kit0:0.23.15-2:*:*:*:*:*:*:*"],"name":"libp11-kit0","purl":"pkg:deb/debian/libp11-kit0@0.23.15-2?arch=amd64&distro=debian-10.1&upstream=p11-kit","type":"deb","version":"0.23.15-2","language":"","licenses":["sha256:7e0942c830cd46f69d01e0806c63b6757bb229b635f0bdd48bcc0e7c32ea4787"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libp11-kit0/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libp11-kit0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libp11-kit0:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libp11-kit0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"p11-kit"}]},"matchDetails":[{"fix":{"suggestedVersion":"0.23.15-2+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-29361","versionConstraint":"< 0.23.15-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"p11-kit","version":"0.23.15-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-29361","fix":{"state":"fixed","versions":["0.23.15-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"0.23.15-2+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-29361","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-29361","date":"2026-10-08","epss":0.03363,"percentile":0.88395}],"risk":2.52225,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4822-1","link":"https://security-tracker.debian.org/tracker/DSA-4822-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-29361","description":"An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are missing before calling realloc or calloc."},"relatedVulnerabilities":[{"id":"CVE-2020-29361","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-29361","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-29361","date":"2026-10-08","epss":0.03363,"percentile":0.88395}],"urls":["https://github.com/p11-glue/p11-kit/releases","https://github.com/p11-glue/p11-kit/security/advisories/GHSA-q4r3-hm6m-mvc2","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/01/msg00002.html","https://www.debian.org/security/2021/dsa-4822"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-29361","description":"An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are missing before calling realloc or calloc."}]},{"artifact":{"id":"c6f08567c3b7bec6","cpes":["cpe:2.3:a:golang:networking:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.0.0-20190404232315-eb5bcb51f2a3","type":"go-module","version":"v0.0.0-20190404232315-eb5bcb51f2a3","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.0.0-20220906165146-f3363e06e74c"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-69cg-p879-7622","versionConstraint":"<0.0.0-20220906165146-f3363e06e74c (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.0.0-20190404232315-eb5bcb51f2a3"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-69cg-p879-7622","fix":{"state":"fixed","versions":["0.0.0-20220906165146-f3363e06e74c"],"available":[{"date":"2023-02-20","kind":"first-observed","version":"0.0.0-20220906165146-f3363e06e74c"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27664","date":"2026-10-08","epss":0.03269,"percentile":0.88055}],"risk":2.4517499999999997,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-27664","https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/x49AQzIVX-s","https://security.gentoo.org/glsa/202209-26","https://pkg.go.dev/vuln/GO-2022-0969","https://go.dev/cl/428735","https://go.dev/issue/54658","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXKTHIGE5F576MAPFYCIJXNRGBSPISUF","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXS2OQ57KZC5XZKK5UW4SYKPVQAHIOJX","https://security.netapp.com/advisory/ntap-20220923-0004"],"severity":"High","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-69cg-p879-7622","description":"golang.org/x/net/http2 Denial of Service vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2022-27664","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27664","date":"2026-10-08","epss":0.03269,"percentile":0.88055}],"urls":["https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/x49AQzIVX-s","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXKTHIGE5F576MAPFYCIJXNRGBSPISUF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXS2OQ57KZC5XZKK5UW4SYKPVQAHIOJX/","https://security.gentoo.org/glsa/202209-26","https://security.netapp.com/advisory/ntap-20220923-0004/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27664","description":"In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error."}]},{"artifact":{"id":"727332619043e05d","cpes":["cpe:2.3:a:golang:networking:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.0.0-20190404232315-eb5bcb51f2a3","type":"go-module","version":"v0.0.0-20190404232315-eb5bcb51f2a3","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.0.0-20220906165146-f3363e06e74c"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-69cg-p879-7622","versionConstraint":"<0.0.0-20220906165146-f3363e06e74c (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.0.0-20190404232315-eb5bcb51f2a3"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-69cg-p879-7622","fix":{"state":"fixed","versions":["0.0.0-20220906165146-f3363e06e74c"],"available":[{"date":"2023-02-20","kind":"first-observed","version":"0.0.0-20220906165146-f3363e06e74c"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27664","date":"2026-10-08","epss":0.03269,"percentile":0.88055}],"risk":2.4517499999999997,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-27664","https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/x49AQzIVX-s","https://security.gentoo.org/glsa/202209-26","https://pkg.go.dev/vuln/GO-2022-0969","https://go.dev/cl/428735","https://go.dev/issue/54658","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXKTHIGE5F576MAPFYCIJXNRGBSPISUF","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXS2OQ57KZC5XZKK5UW4SYKPVQAHIOJX","https://security.netapp.com/advisory/ntap-20220923-0004"],"severity":"High","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-69cg-p879-7622","description":"golang.org/x/net/http2 Denial of Service vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2022-27664","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27664","date":"2026-10-08","epss":0.03269,"percentile":0.88055}],"urls":["https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/x49AQzIVX-s","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXKTHIGE5F576MAPFYCIJXNRGBSPISUF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXS2OQ57KZC5XZKK5UW4SYKPVQAHIOJX/","https://security.gentoo.org/glsa/202209-26","https://security.netapp.com/advisory/ntap-20220923-0004/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27664","description":"In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.18.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0969","versionConstraint":"<1.18.6||>=1.19.0-0,<1.19.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0969","fix":{"state":"fixed","versions":["1.18.6","1.19.1"],"available":[{"date":"2022-09-06","kind":"release","version":"1.18.6"},{"date":"2022-09-06","kind":"release","version":"1.19.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27664","date":"2026-10-08","epss":0.03269,"percentile":0.88055}],"risk":2.4517499999999997,"urls":["https://go.dev/issue/54658","https://go.dev/cl/428735"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://groups.google.com/g/golang-announce/c/x49AQzIVX-s","description":"HTTP/2 server connections can hang forever waiting for a clean shutdown that was preempted by a fatal error. This condition can be exploited by a malicious client to cause a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2022-27664","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27664","date":"2026-10-08","epss":0.03269,"percentile":0.88055}],"urls":["https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/x49AQzIVX-s","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXKTHIGE5F576MAPFYCIJXNRGBSPISUF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXS2OQ57KZC5XZKK5UW4SYKPVQAHIOJX/","https://security.gentoo.org/glsa/202209-26","https://security.netapp.com/advisory/ntap-20220923-0004/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27664","description":"In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error."},{"id":"GHSA-69cg-p879-7622","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27664","date":"2026-10-08","epss":0.03269,"percentile":0.88055}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-27664","https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/x49AQzIVX-s","https://security.gentoo.org/glsa/202209-26","https://pkg.go.dev/vuln/GO-2022-0969","https://go.dev/cl/428735","https://go.dev/issue/54658","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXKTHIGE5F576MAPFYCIJXNRGBSPISUF","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXS2OQ57KZC5XZKK5UW4SYKPVQAHIOJX","https://security.netapp.com/advisory/ntap-20220923-0004"],"severity":"High","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-69cg-p879-7622","description":"golang.org/x/net/http2 Denial of Service vulnerability"}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.18.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0969","versionConstraint":"<1.18.6||>=1.19.0-0,<1.19.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0969","fix":{"state":"fixed","versions":["1.18.6","1.19.1"],"available":[{"date":"2022-09-06","kind":"release","version":"1.18.6"},{"date":"2022-09-06","kind":"release","version":"1.19.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27664","date":"2026-10-08","epss":0.03269,"percentile":0.88055}],"risk":2.4517499999999997,"urls":["https://go.dev/issue/54658","https://go.dev/cl/428735"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://groups.google.com/g/golang-announce/c/x49AQzIVX-s","description":"HTTP/2 server connections can hang forever waiting for a clean shutdown that was preempted by a fatal error. This condition can be exploited by a malicious client to cause a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2022-27664","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27664","date":"2026-10-08","epss":0.03269,"percentile":0.88055}],"urls":["https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/x49AQzIVX-s","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXKTHIGE5F576MAPFYCIJXNRGBSPISUF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXS2OQ57KZC5XZKK5UW4SYKPVQAHIOJX/","https://security.gentoo.org/glsa/202209-26","https://security.netapp.com/advisory/ntap-20220923-0004/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27664","description":"In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error."},{"id":"GHSA-69cg-p879-7622","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27664","date":"2026-10-08","epss":0.03269,"percentile":0.88055}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-27664","https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/x49AQzIVX-s","https://security.gentoo.org/glsa/202209-26","https://pkg.go.dev/vuln/GO-2022-0969","https://go.dev/cl/428735","https://go.dev/issue/54658","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXKTHIGE5F576MAPFYCIJXNRGBSPISUF","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXS2OQ57KZC5XZKK5UW4SYKPVQAHIOJX","https://security.netapp.com/advisory/ntap-20220923-0004"],"severity":"High","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-69cg-p879-7622","description":"golang.org/x/net/http2 Denial of Service vulnerability"}]},{"artifact":{"id":"763298202c68f152","cpes":["cpe:2.3:a:golang:crypto:v0.0.0-20190701094942-4def268fd1a4:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.0.0-20190701094942-4def268fd1a4:*:*:*:*:go:*:*"],"name":"golang.org/x/crypto","purl":"pkg:golang/golang.org/x/crypto@v0.0.0-20190701094942-4def268fd1a4","type":"go-module","version":"v0.0.0-20190701094942-4def268fd1a4","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.0.0-20201216223049-8b5274cf687f"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3vm4-22fp-5rfm","versionConstraint":"<0.0.0-20201216223049-8b5274cf687f (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/crypto","version":"v0.0.0-20190701094942-4def268fd1a4"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-3vm4-22fp-5rfm","fix":{"state":"fixed","versions":["0.0.0-20201216223049-8b5274cf687f"],"available":[{"date":"2023-02-26","kind":"first-observed","version":"0.0.0-20201216223049-8b5274cf687f"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-29652","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-29652","date":"2026-10-08","epss":0.03267,"percentile":0.88049}],"risk":2.4502499999999996,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-29652","https://go-review.googlesource.com/c/crypto/+/278852","https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1","https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E","https://go.dev/cl/278852","https://go.googlesource.com/crypto/+/8b5274cf687fd9316b4108863654cc57385531e8","https://pkg.go.dev/vuln/GO-2021-0227"],"severity":"High","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3vm4-22fp-5rfm","description":"golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2020-29652","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-29652","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-29652","date":"2026-10-08","epss":0.03267,"percentile":0.88049}],"urls":["https://go-review.googlesource.com/c/crypto/+/278852","https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1","https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff%40%3Cnotifications.skywalking.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-29652","description":"A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers."}]},{"artifact":{"id":"524ae46feda9a236","cpes":["cpe:2.3:a:golang:crypto:v0.0.0-20190701094942-4def268fd1a4:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.0.0-20190701094942-4def268fd1a4:*:*:*:*:go:*:*"],"name":"golang.org/x/crypto","purl":"pkg:golang/golang.org/x/crypto@v0.0.0-20190701094942-4def268fd1a4","type":"go-module","version":"v0.0.0-20190701094942-4def268fd1a4","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.0.0-20201216223049-8b5274cf687f"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3vm4-22fp-5rfm","versionConstraint":"<0.0.0-20201216223049-8b5274cf687f (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/crypto","version":"v0.0.0-20190701094942-4def268fd1a4"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-3vm4-22fp-5rfm","fix":{"state":"fixed","versions":["0.0.0-20201216223049-8b5274cf687f"],"available":[{"date":"2023-02-26","kind":"first-observed","version":"0.0.0-20201216223049-8b5274cf687f"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-29652","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-29652","date":"2026-10-08","epss":0.03267,"percentile":0.88049}],"risk":2.4502499999999996,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-29652","https://go-review.googlesource.com/c/crypto/+/278852","https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1","https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E","https://go.dev/cl/278852","https://go.googlesource.com/crypto/+/8b5274cf687fd9316b4108863654cc57385531e8","https://pkg.go.dev/vuln/GO-2021-0227"],"severity":"High","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3vm4-22fp-5rfm","description":"golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2020-29652","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-29652","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-29652","date":"2026-10-08","epss":0.03267,"percentile":0.88049}],"urls":["https://go-review.googlesource.com/c/crypto/+/278852","https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1","https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff%40%3Cnotifications.skywalking.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-29652","description":"A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.16.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0264","versionConstraint":"<1.16.10||>=1.17.0-0,<1.17.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0264","fix":{"state":"fixed","versions":["1.16.10","1.17.3"],"available":[{"date":"2021-11-04","kind":"release","version":"1.16.10"},{"date":"2021-11-04","kind":"release","version":"1.17.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-41772","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-41772","date":"2026-10-08","epss":0.03253,"percentile":0.87975}],"risk":2.43975,"urls":["https://go.googlesource.com/go/+/b24687394b55a93449e2be4e6892ead58ea9a10f","https://groups.google.com/g/golang-announce/c/0fM21h43arc","https://go.dev/issue/48085"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/349770","description":"Previously, opening a zip with (*Reader).Open could result in a panic if the zip contained a file whose name was exclusively made up of slash characters or \"..\" path elements.\n\nOpen could also panic if passed the empty string directly as an argument.\n\nNow, any files in the zip whose name could not be made valid for fs.FS.Open will be skipped, and no longer added to the fs.FS file list, although they are still accessible through (*Reader).File.\n\nNote that it was already the case that a file could be accessible from (*Reader).Open with a name different from the one in (*Reader).File, as the former is the cleaned name, while the latter is the original one.\n\nFinally, the actual panic site was made robust as a defense-in-depth measure."},"relatedVulnerabilities":[{"id":"CVE-2021-41772","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-41772","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-41772","date":"2026-10-08","epss":0.03253,"percentile":0.87975}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf","https://groups.google.com/g/golang-announce/c/0fM21h43arc","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OFS3M3OFB24SWPTIAPARKGPUMQVUY6Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON7BQRRJZBOR5TJHURBAB3WLF4YXFC6Z/","https://security.gentoo.org/glsa/202208-02","https://security.netapp.com/advisory/ntap-20211210-0003/","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-41772","description":"Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.16.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0264","versionConstraint":"<1.16.10||>=1.17.0-0,<1.17.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0264","fix":{"state":"fixed","versions":["1.16.10","1.17.3"],"available":[{"date":"2021-11-04","kind":"release","version":"1.16.10"},{"date":"2021-11-04","kind":"release","version":"1.17.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-41772","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-41772","date":"2026-10-08","epss":0.03253,"percentile":0.87975}],"risk":2.43975,"urls":["https://go.googlesource.com/go/+/b24687394b55a93449e2be4e6892ead58ea9a10f","https://groups.google.com/g/golang-announce/c/0fM21h43arc","https://go.dev/issue/48085"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/349770","description":"Previously, opening a zip with (*Reader).Open could result in a panic if the zip contained a file whose name was exclusively made up of slash characters or \"..\" path elements.\n\nOpen could also panic if passed the empty string directly as an argument.\n\nNow, any files in the zip whose name could not be made valid for fs.FS.Open will be skipped, and no longer added to the fs.FS file list, although they are still accessible through (*Reader).File.\n\nNote that it was already the case that a file could be accessible from (*Reader).Open with a name different from the one in (*Reader).File, as the former is the cleaned name, while the latter is the original one.\n\nFinally, the actual panic site was made robust as a defense-in-depth measure."},"relatedVulnerabilities":[{"id":"CVE-2021-41772","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-41772","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-41772","date":"2026-10-08","epss":0.03253,"percentile":0.87975}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf","https://groups.google.com/g/golang-announce/c/0fM21h43arc","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OFS3M3OFB24SWPTIAPARKGPUMQVUY6Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON7BQRRJZBOR5TJHURBAB3WLF4YXFC6Z/","https://security.gentoo.org/glsa/202208-02","https://security.netapp.com/advisory/ntap-20211210-0003/","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-41772","description":"Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.16.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0347","versionConstraint":"<1.16.15||>=1.17.0-0,<1.17.8 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0347","fix":{"state":"fixed","versions":["1.16.15","1.17.8"],"available":[{"date":"2022-03-03","kind":"release","version":"1.16.15"},{"date":"2022-03-03","kind":"release","version":"1.17.8"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-24921","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-24921","date":"2026-10-08","epss":0.03228,"percentile":0.87881}],"risk":2.4210000000000003,"urls":["https://go.googlesource.com/go/+/452f24ae94f38afa3704d4361d91d51218405c0a","https://go.dev/issue/51112","https://groups.google.com/g/golang-announce/c/RP1hfrBYVuk"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/384616","description":"On 64-bit platforms, an extremely deeply nested expression can cause regexp.Compile to cause goroutine stack exhaustion, forcing the program to exit. Note this applies to very large expressions, on the order of 2MB."},"relatedVulnerabilities":[{"id":"CVE-2022-24921","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-24921","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-24921","date":"2026-10-08","epss":0.03228,"percentile":0.87881}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf","https://groups.google.com/g/golang-announce/c/RP1hfrBYVuk","https://lists.debian.org/debian-lts-announce/2022/04/msg00017.html","https://lists.debian.org/debian-lts-announce/2022/04/msg00018.html","https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html","https://security.gentoo.org/glsa/202208-02","https://security.netapp.com/advisory/ntap-20220325-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-24921","description":"regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.16.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0347","versionConstraint":"<1.16.15||>=1.17.0-0,<1.17.8 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0347","fix":{"state":"fixed","versions":["1.16.15","1.17.8"],"available":[{"date":"2022-03-03","kind":"release","version":"1.16.15"},{"date":"2022-03-03","kind":"release","version":"1.17.8"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-24921","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-24921","date":"2026-10-08","epss":0.03228,"percentile":0.87881}],"risk":2.4210000000000003,"urls":["https://go.googlesource.com/go/+/452f24ae94f38afa3704d4361d91d51218405c0a","https://go.dev/issue/51112","https://groups.google.com/g/golang-announce/c/RP1hfrBYVuk"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/384616","description":"On 64-bit platforms, an extremely deeply nested expression can cause regexp.Compile to cause goroutine stack exhaustion, forcing the program to exit. Note this applies to very large expressions, on the order of 2MB."},"relatedVulnerabilities":[{"id":"CVE-2022-24921","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-24921","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-24921","date":"2026-10-08","epss":0.03228,"percentile":0.87881}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf","https://groups.google.com/g/golang-announce/c/RP1hfrBYVuk","https://lists.debian.org/debian-lts-announce/2022/04/msg00017.html","https://lists.debian.org/debian-lts-announce/2022/04/msg00018.html","https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html","https://security.gentoo.org/glsa/202208-02","https://security.netapp.com/advisory/ntap-20220325-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-24921","description":"regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression."}]},{"artifact":{"id":"ba5663119246d2af","cpes":["cpe:2.3:a:gcc-8-base:gcc-8-base:8.3.0-6:*:*:*:*:*:*:*","cpe:2.3:a:gcc-8-base:gcc_8_base:8.3.0-6:*:*:*:*:*:*:*","cpe:2.3:a:gcc_8_base:gcc-8-base:8.3.0-6:*:*:*:*:*:*:*","cpe:2.3:a:gcc_8_base:gcc_8_base:8.3.0-6:*:*:*:*:*:*:*","cpe:2.3:a:gcc-8:gcc-8-base:8.3.0-6:*:*:*:*:*:*:*","cpe:2.3:a:gcc-8:gcc_8_base:8.3.0-6:*:*:*:*:*:*:*","cpe:2.3:a:gcc_8:gcc-8-base:8.3.0-6:*:*:*:*:*:*:*","cpe:2.3:a:gcc_8:gcc_8_base:8.3.0-6:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-8-base:8.3.0-6:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_8_base:8.3.0-6:*:*:*:*:*:*:*"],"name":"gcc-8-base","purl":"pkg:deb/debian/gcc-8-base@8.3.0-6?arch=amd64&distro=debian-10.1&upstream=gcc-8","type":"deb","version":"8.3.0-6","language":"","licenses":["sha256:9865be517c31de50eb2b36a8957ccd97942807974afad2515578101d1168887a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-8-base/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/gcc-8-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-8-base:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/gcc-8-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-15847","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"gcc-8","version":"8.3.0-6"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-15847","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-15847","cwe":"CWE-331","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-15847","date":"2026-10-08","epss":0.03181,"percentile":0.87681}],"risk":2.38575,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-15847","description":"The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same."},"relatedVulnerabilities":[{"id":"CVE-2019-15847","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-15847","cwe":"CWE-331","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-15847","date":"2026-10-08","epss":0.03181,"percentile":0.87681}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00058.html","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91481"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-15847","description":"The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same."}]},{"artifact":{"id":"ffc1d39eff5a666e","cpes":["cpe:2.3:a:libgcc1:libgcc1:1\\:8.3.0-6:*:*:*:*:*:*:*"],"name":"libgcc1","purl":"pkg:deb/debian/libgcc1@1%3A8.3.0-6?arch=amd64&distro=debian-10.1&upstream=gcc-8%408.3.0-6","type":"deb","version":"1:8.3.0-6","language":"","licenses":["sha256:9865be517c31de50eb2b36a8957ccd97942807974afad2515578101d1168887a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-8-base/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libgcc1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc1:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libgcc1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-8","version":"8.3.0-6"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-15847","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"gcc-8","version":"8.3.0-6"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-15847","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-15847","cwe":"CWE-331","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-15847","date":"2026-10-08","epss":0.03181,"percentile":0.87681}],"risk":2.38575,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-15847","description":"The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same."},"relatedVulnerabilities":[{"id":"CVE-2019-15847","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-15847","cwe":"CWE-331","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-15847","date":"2026-10-08","epss":0.03181,"percentile":0.87681}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00058.html","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91481"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-15847","description":"The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same."}]},{"artifact":{"id":"0ebb89f70b0c2511","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:8.3.0-6:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/debian/libstdc%2B%2B6@8.3.0-6?arch=amd64&distro=debian-10.1&upstream=gcc-8","type":"deb","version":"8.3.0-6","language":"","licenses":["sha256:9865be517c31de50eb2b36a8957ccd97942807974afad2515578101d1168887a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-8-base/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-15847","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"gcc-8","version":"8.3.0-6"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-15847","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-15847","cwe":"CWE-331","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-15847","date":"2026-10-08","epss":0.03181,"percentile":0.87681}],"risk":2.38575,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-15847","description":"The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same."},"relatedVulnerabilities":[{"id":"CVE-2019-15847","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-15847","cwe":"CWE-331","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-15847","date":"2026-10-08","epss":0.03181,"percentile":0.87681}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00058.html","https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91481"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-15847","description":"The POWER9 backend in GNU Compiler Collection (GCC) before version 10 could optimize multiple calls of the __builtin_darn intrinsic into a single call, thus reducing the entropy of the random number generator. This occurred because a volatile operation was not specified. For example, within a single execution of a program, the output of every __builtin_darn() call may be the same."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.15.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0239","versionConstraint":"<1.15.13||>=1.16.0-0,<1.16.5 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0239","fix":{"state":"fixed","versions":["1.15.13","1.16.5"],"available":[{"date":"2021-06-03","kind":"release","version":"1.15.13"},{"date":"2021-06-03","kind":"release","version":"1.16.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33195","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33195","date":"2026-10-08","epss":0.03204,"percentile":0.87775}],"risk":2.3709599999999997,"urls":["https://go.googlesource.com/go/+/c89f1224a544cde464fcb86e78ebb0cc97eedba2","https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI","https://go.dev/issue/46241"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/320949","description":"The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions and their respective methods on the Resolver type may return arbitrary values retrieved from DNS which do not follow the established RFC 1035 rules for domain names. If these names are used without further sanitization, for instance unsafely included in HTML, they may allow for injection of unexpected content. Note that LookupTXT may still return arbitrary values that could require sanitization before further use."},"relatedVulnerabilities":[{"id":"CVE-2021-33195","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33195","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33195","date":"2026-10-08","epss":0.03204,"percentile":0.87775}],"urls":["https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI","https://security.gentoo.org/glsa/202208-02","https://security.netapp.com/advisory/ntap-20210902-0005/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33195","description":"Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.15.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0239","versionConstraint":"<1.15.13||>=1.16.0-0,<1.16.5 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0239","fix":{"state":"fixed","versions":["1.15.13","1.16.5"],"available":[{"date":"2021-06-03","kind":"release","version":"1.15.13"},{"date":"2021-06-03","kind":"release","version":"1.16.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33195","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33195","date":"2026-10-08","epss":0.03204,"percentile":0.87775}],"risk":2.3709599999999997,"urls":["https://go.googlesource.com/go/+/c89f1224a544cde464fcb86e78ebb0cc97eedba2","https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI","https://go.dev/issue/46241"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/320949","description":"The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions and their respective methods on the Resolver type may return arbitrary values retrieved from DNS which do not follow the established RFC 1035 rules for domain names. If these names are used without further sanitization, for instance unsafely included in HTML, they may allow for injection of unexpected content. Note that LookupTXT may still return arbitrary values that could require sanitization before further use."},"relatedVulnerabilities":[{"id":"CVE-2021-33195","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33195","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33195","date":"2026-10-08","epss":0.03204,"percentile":0.87775}],"urls":["https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI","https://security.gentoo.org/glsa/202208-02","https://security.netapp.com/advisory/ntap-20210902-0005/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33195","description":"Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format."}]},{"artifact":{"id":"2d52d7c9fca553cc","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.28-10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.28-10?arch=amd64&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35942","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-35942","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35942","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-35942","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-35942","date":"2026-10-08","epss":0.02605,"percentile":0.84917}],"risk":2.3575250000000003,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-35942","description":"The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations."},"relatedVulnerabilities":[{"id":"CVE-2021-35942","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35942","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-35942","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-35942","date":"2026-10-08","epss":0.02605,"percentile":0.84917}],"urls":["https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://security.gentoo.org/glsa/202208-24","https://security.netapp.com/advisory/ntap-20210827-0005/","https://sourceware.org/bugzilla/show_bug.cgi?id=28011","https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=5adda61f62b77384718b4c0d8336ade8f2b4b35c","https://sourceware.org/glibc/wiki/Security%20Exceptions"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35942","description":"The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations."}]},{"artifact":{"id":"fe0324c22198dabb","cpes":["cpe:2.3:a:libc-l10n:libc-l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc-l10n:libc_l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc-l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc_l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_l10n:2.28-10:*:*:*:*:*:*:*"],"name":"libc-l10n","purl":"pkg:deb/debian/libc-l10n@2.28-10?arch=all&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-l10n/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libc-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libc-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libc-l10n.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35942","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-35942","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35942","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-35942","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-35942","date":"2026-10-08","epss":0.02605,"percentile":0.84917}],"risk":2.3575250000000003,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-35942","description":"The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations."},"relatedVulnerabilities":[{"id":"CVE-2021-35942","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35942","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-35942","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-35942","date":"2026-10-08","epss":0.02605,"percentile":0.84917}],"urls":["https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://security.gentoo.org/glsa/202208-24","https://security.netapp.com/advisory/ntap-20210827-0005/","https://sourceware.org/bugzilla/show_bug.cgi?id=28011","https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=5adda61f62b77384718b4c0d8336ade8f2b4b35c","https://sourceware.org/glibc/wiki/Security%20Exceptions"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35942","description":"The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations."}]},{"artifact":{"id":"4d00fd0f941e584e","cpes":["cpe:2.3:a:libc6:libc6:2.28-10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.28-10?arch=amd64&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35942","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-35942","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35942","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-35942","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-35942","date":"2026-10-08","epss":0.02605,"percentile":0.84917}],"risk":2.3575250000000003,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-35942","description":"The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations."},"relatedVulnerabilities":[{"id":"CVE-2021-35942","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35942","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-35942","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-35942","date":"2026-10-08","epss":0.02605,"percentile":0.84917}],"urls":["https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://security.gentoo.org/glsa/202208-24","https://security.netapp.com/advisory/ntap-20210827-0005/","https://sourceware.org/bugzilla/show_bug.cgi?id=28011","https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=5adda61f62b77384718b4c0d8336ade8f2b4b35c","https://sourceware.org/glibc/wiki/Security%20Exceptions"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35942","description":"The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations."}]},{"artifact":{"id":"c1d71c418353daa4","cpes":["cpe:2.3:a:locales:locales:2.28-10:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/debian/locales@2.28-10?arch=all&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35942","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-35942","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35942","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-35942","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-35942","date":"2026-10-08","epss":0.02605,"percentile":0.84917}],"risk":2.3575250000000003,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-35942","description":"The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations."},"relatedVulnerabilities":[{"id":"CVE-2021-35942","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35942","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-35942","cwe":"CWE-704","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-35942","date":"2026-10-08","epss":0.02605,"percentile":0.84917}],"urls":["https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://security.gentoo.org/glsa/202208-24","https://security.netapp.com/advisory/ntap-20210827-0005/","https://sourceware.org/bugzilla/show_bug.cgi?id=28011","https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=5adda61f62b77384718b4c0d8336ade8f2b4b35c","https://sourceware.org/glibc/wiki/Security%20Exceptions"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35942","description":"The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations."}]},{"artifact":{"id":"09f128b26388fc18","cpes":["cpe:2.3:a:libidn2-0:libidn2-0:2.0.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libidn2-0:libidn2_0:2.0.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libidn2_0:libidn2-0:2.0.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libidn2_0:libidn2_0:2.0.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libidn2:libidn2-0:2.0.5-1:*:*:*:*:*:*:*","cpe:2.3:a:libidn2:libidn2_0:2.0.5-1:*:*:*:*:*:*:*"],"name":"libidn2-0","purl":"pkg:deb/debian/libidn2-0@2.0.5-1?arch=amd64&distro=debian-10.1&upstream=libidn2","type":"deb","version":"2.0.5-1","language":"","licenses":["GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-3","LGPL-3+","Unicode"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libidn2-0/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libidn2-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libidn2-0:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libidn2-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libidn2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-12290","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"libidn2","version":"2.0.5-1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-12290","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-12290","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-12290","date":"2026-10-08","epss":0.03106,"percentile":0.87386}],"risk":2.3295,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-12290","description":"GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated."},"relatedVulnerabilities":[{"id":"CVE-2019-12290","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-12290","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-12290","date":"2026-10-08","epss":0.03106,"percentile":0.87386}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00008.html","http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00009.html","https://gitlab.com/libidn/libidn2/commit/241e8f486134793cb0f4a5b0e5817a97883401f5","https://gitlab.com/libidn/libidn2/commit/614117ef6e4c60e1950d742e3edf0a0ef8d389de","https://gitlab.com/libidn/libidn2/merge_requests/71","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UFT76Y7OSGPZV3EBEHD6ISVUM3DLARM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KXDKYWFV6N2HHVSE67FFDM7G3FEL2ZNE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ONG3GJRRJO35COPGVJXXSZLU4J5Y42AT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSI4TI2JTQWQ3YEUX5X36GTVGKO4QKZ5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6ZXL2RDNQRAHCMKWPOMJFKYJ344X4HL/","https://security.gentoo.org/glsa/202003-63","https://usn.ubuntu.com/4168-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-12290","description":"GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated."}]},{"artifact":{"id":"2d52d7c9fca553cc","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.28-10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.28-10?arch=amd64&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3326","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-3326","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3326","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3326","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3326","date":"2026-10-08","epss":0.03093,"percentile":0.87343}],"risk":2.31975,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-3326","description":"The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2021-3326","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3326","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3326","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3326","date":"2026-10-08","epss":0.03093,"percentile":0.87343}],"urls":["http://www.openwall.com/lists/oss-security/2021/01/28/2","https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://security.gentoo.org/glsa/202107-07","https://security.netapp.com/advisory/ntap-20210304-0007/","https://sourceware.org/bugzilla/show_bug.cgi?id=27256","https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=7d88c6142c6efc160c0ee5e4f85cde382c072888","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3326","description":"The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service."}]},{"artifact":{"id":"fe0324c22198dabb","cpes":["cpe:2.3:a:libc-l10n:libc-l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc-l10n:libc_l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc-l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc_l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_l10n:2.28-10:*:*:*:*:*:*:*"],"name":"libc-l10n","purl":"pkg:deb/debian/libc-l10n@2.28-10?arch=all&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-l10n/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libc-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libc-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libc-l10n.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3326","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-3326","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3326","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3326","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3326","date":"2026-10-08","epss":0.03093,"percentile":0.87343}],"risk":2.31975,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-3326","description":"The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2021-3326","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3326","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3326","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3326","date":"2026-10-08","epss":0.03093,"percentile":0.87343}],"urls":["http://www.openwall.com/lists/oss-security/2021/01/28/2","https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://security.gentoo.org/glsa/202107-07","https://security.netapp.com/advisory/ntap-20210304-0007/","https://sourceware.org/bugzilla/show_bug.cgi?id=27256","https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=7d88c6142c6efc160c0ee5e4f85cde382c072888","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3326","description":"The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service."}]},{"artifact":{"id":"4d00fd0f941e584e","cpes":["cpe:2.3:a:libc6:libc6:2.28-10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.28-10?arch=amd64&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3326","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-3326","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3326","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3326","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3326","date":"2026-10-08","epss":0.03093,"percentile":0.87343}],"risk":2.31975,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-3326","description":"The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2021-3326","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3326","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3326","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3326","date":"2026-10-08","epss":0.03093,"percentile":0.87343}],"urls":["http://www.openwall.com/lists/oss-security/2021/01/28/2","https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://security.gentoo.org/glsa/202107-07","https://security.netapp.com/advisory/ntap-20210304-0007/","https://sourceware.org/bugzilla/show_bug.cgi?id=27256","https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=7d88c6142c6efc160c0ee5e4f85cde382c072888","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3326","description":"The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service."}]},{"artifact":{"id":"c1d71c418353daa4","cpes":["cpe:2.3:a:locales:locales:2.28-10:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/debian/locales@2.28-10?arch=all&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3326","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-3326","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3326","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3326","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3326","date":"2026-10-08","epss":0.03093,"percentile":0.87343}],"risk":2.31975,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-3326","description":"The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2021-3326","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3326","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3326","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3326","date":"2026-10-08","epss":0.03093,"percentile":0.87343}],"urls":["http://www.openwall.com/lists/oss-security/2021/01/28/2","https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://security.gentoo.org/glsa/202107-07","https://security.netapp.com/advisory/ntap-20210304-0007/","https://sourceware.org/bugzilla/show_bug.cgi?id=27256","https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=7d88c6142c6efc160c0ee5e4f85cde382c072888","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3326","description":"The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service."}]},{"artifact":{"id":"bca20a7b0a858bf3","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/debian/libssl1.1@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1&upstream=openssl","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-5678","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-5678","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-5678","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-5678","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-5678","date":"2026-10-08","epss":0.04459,"percentile":0.9119}],"risk":2.296385,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-5678","description":"Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow.  Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays.  Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service.  While DH_check() performs all the necessary checks (as of CVE-2023-3817), DH_check_pub_key() doesn't make any of these checks, and is therefore vulnerable for excessively large P and Q parameters.  Likewise, while DH_generate_key() performs a check for an excessively large P, it doesn't check for an excessively large Q.  An application that calls DH_generate_key() or DH_check_pub_key() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack.  DH_generate_key() and DH_check_pub_key() are also called by a number of other OpenSSL functions.  An application calling any of those other functions may similarly be affected.  The other functions affected by this are DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate().  Also vulnerable are the OpenSSL pkey command line application when using the \"-pubcheck\" option, as well as the OpenSSL genpkey command line application.  The OpenSSL SSL/TLS implementation is not affected by this issue.  The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."},"relatedVulnerabilities":[{"id":"CVE-2023-5678","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-5678","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-5678","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-5678","date":"2026-10-08","epss":0.04459,"percentile":0.9119}],"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=34efaef6c103d636ab507a0cc34dca4d3aecc055","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=710fee740904b6290fef0dd5536fbcedbc38ff0c","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db925ae2e65d0d925adef429afc37f75bd1c2017","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6","https://www.openssl.org/news/secadv/20231106.txt","http://www.openwall.com/lists/oss-security/2024/03/11/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20231130-0010/","https://cert-portal.siemens.com/productcert/html/ssa-093430.html","https://cert-portal.siemens.com/productcert/html/ssa-128433.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-341067.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-556635.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-5678","description":"Issue summary: Generating excessively long X9.42 DH keys or checking\nexcessively long X9.42 DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_generate_key() to\ngenerate an X9.42 DH key may experience long delays.  Likewise, applications\nthat use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()\nto check an X9.42 DH key or X9.42 DH parameters may experience long delays.\nWhere the key or parameters that are being checked have been obtained from\nan untrusted source this may lead to a Denial of Service.\n\nWhile DH_check() performs all the necessary checks (as of CVE-2023-3817),\nDH_check_pub_key() doesn't make any of these checks, and is therefore\nvulnerable for excessively large P and Q parameters.\n\nLikewise, while DH_generate_key() performs a check for an excessively large\nP, it doesn't check for an excessively large Q.\n\nAn application that calls DH_generate_key() or DH_check_pub_key() and\nsupplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nDH_generate_key() and DH_check_pub_key() are also called by a number of\nother OpenSSL functions.  An application calling any of those other\nfunctions may similarly be affected.  The other functions affected by this\nare DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate().\n\nAlso vulnerable are the OpenSSL pkey command line application when using the\n\"-pubcheck\" option, as well as the OpenSSL genpkey command line application.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."}]},{"artifact":{"id":"d308e84bddad0b0f","cpes":["cpe:2.3:a:openssl:openssl:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-5678","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-5678","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-5678","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-5678","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-5678","date":"2026-10-08","epss":0.04459,"percentile":0.9119}],"risk":2.296385,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-5678","description":"Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow.  Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays.  Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service.  While DH_check() performs all the necessary checks (as of CVE-2023-3817), DH_check_pub_key() doesn't make any of these checks, and is therefore vulnerable for excessively large P and Q parameters.  Likewise, while DH_generate_key() performs a check for an excessively large P, it doesn't check for an excessively large Q.  An application that calls DH_generate_key() or DH_check_pub_key() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack.  DH_generate_key() and DH_check_pub_key() are also called by a number of other OpenSSL functions.  An application calling any of those other functions may similarly be affected.  The other functions affected by this are DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate().  Also vulnerable are the OpenSSL pkey command line application when using the \"-pubcheck\" option, as well as the OpenSSL genpkey command line application.  The OpenSSL SSL/TLS implementation is not affected by this issue.  The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."},"relatedVulnerabilities":[{"id":"CVE-2023-5678","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-5678","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-5678","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-5678","date":"2026-10-08","epss":0.04459,"percentile":0.9119}],"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=34efaef6c103d636ab507a0cc34dca4d3aecc055","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=710fee740904b6290fef0dd5536fbcedbc38ff0c","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db925ae2e65d0d925adef429afc37f75bd1c2017","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6","https://www.openssl.org/news/secadv/20231106.txt","http://www.openwall.com/lists/oss-security/2024/03/11/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20231130-0010/","https://cert-portal.siemens.com/productcert/html/ssa-093430.html","https://cert-portal.siemens.com/productcert/html/ssa-128433.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-341067.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-556635.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-5678","description":"Issue summary: Generating excessively long X9.42 DH keys or checking\nexcessively long X9.42 DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_generate_key() to\ngenerate an X9.42 DH key may experience long delays.  Likewise, applications\nthat use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()\nto check an X9.42 DH key or X9.42 DH parameters may experience long delays.\nWhere the key or parameters that are being checked have been obtained from\nan untrusted source this may lead to a Denial of Service.\n\nWhile DH_check() performs all the necessary checks (as of CVE-2023-3817),\nDH_check_pub_key() doesn't make any of these checks, and is therefore\nvulnerable for excessively large P and Q parameters.\n\nLikewise, while DH_generate_key() performs a check for an excessively large\nP, it doesn't check for an excessively large Q.\n\nAn application that calls DH_generate_key() or DH_check_pub_key() and\nsupplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nDH_generate_key() and DH_check_pub_key() are also called by a number of\nother OpenSSL functions.  An application calling any of those other\nfunctions may similarly be affected.  The other functions affected by this\nare DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate().\n\nAlso vulnerable are the OpenSSL pkey command line application when using the\n\"-pubcheck\" option, as well as the OpenSSL genpkey command line application.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."}]},{"artifact":{"id":"d55bfe42f054b394","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.2.6-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.2.6-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=expat","type":"deb","version":"2.2.6-2+deb10u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.6-2+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-22826","versionConstraint":"< 2.2.6-2+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"expat","version":"2.2.6-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-22826","fix":{"state":"fixed","versions":["2.2.6-2+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.6-2+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22826","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-22826","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-22826","date":"2026-10-08","epss":0.02801,"percentile":0.86057}],"risk":2.2828150000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5073-1","link":"https://security-tracker.debian.org/tracker/DSA-5073-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-22826","description":"nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow."},"relatedVulnerabilities":[{"id":"CVE-2022-22826","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22826","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-22826","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-22826","date":"2026-10-08","epss":0.02801,"percentile":0.86057}],"urls":["http://www.openwall.com/lists/oss-security/2022/01/17/3","https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","https://github.com/libexpat/libexpat/pull/539","https://security.gentoo.org/glsa/202209-24","https://www.debian.org/security/2022/dsa-5073","https://www.tenable.com/security/tns-2022-05"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-22826","description":"nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow."}]},{"artifact":{"id":"d55bfe42f054b394","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.2.6-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.2.6-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=expat","type":"deb","version":"2.2.6-2+deb10u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.6-2+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-22827","versionConstraint":"< 2.2.6-2+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"expat","version":"2.2.6-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-22827","fix":{"state":"fixed","versions":["2.2.6-2+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.6-2+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22827","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-22827","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-22827","date":"2026-10-08","epss":0.02801,"percentile":0.86057}],"risk":2.2828150000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5073-1","link":"https://security-tracker.debian.org/tracker/DSA-5073-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-22827","description":"storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow."},"relatedVulnerabilities":[{"id":"CVE-2022-22827","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22827","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-22827","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-22827","date":"2026-10-08","epss":0.02801,"percentile":0.86057}],"urls":["http://www.openwall.com/lists/oss-security/2022/01/17/3","https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","https://github.com/libexpat/libexpat/pull/539","https://security.gentoo.org/glsa/202209-24","https://www.debian.org/security/2022/dsa-5073","https://www.tenable.com/security/tns-2022-05"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-22827","description":"storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow."}]},{"artifact":{"id":"24cab09f870cf7ee","cpes":["cpe:2.3:a:libdb5.3:libdb5.3:5.3.28\\+dfsg1-0.5:*:*:*:*:*:*:*"],"name":"libdb5.3","purl":"pkg:deb/debian/libdb5.3@5.3.28%2Bdfsg1-0.5?arch=amd64&distro=debian-10.1&upstream=db5.3","type":"deb","version":"5.3.28+dfsg1-0.5","language":"","licenses":["sha256:b3bbc6fbb3f2a0e6a487e953eb8c3cc4bdb6f4150f7f51d20b1e9a3c8ef92d3d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdb5.3/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libdb5.3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdb5.3:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libdb5.3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"db5.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-8457","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"db5.3","version":"5.3.28+dfsg1-0.5"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-8457","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Secondary","source":"cve@checkpoint.com"},{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-8457","date":"2026-10-08","epss":0.45426,"percentile":0.98761}],"risk":2.2713,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-8457","description":"SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables."},"relatedVulnerabilities":[{"id":"CVE-2019-8457","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Secondary","source":"cve@checkpoint.com"},{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-8457","date":"2026-10-08","epss":0.45426,"percentile":0.98761}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00074.html","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPKYSWCOM3CL66RI76TYVIG6TJ263RXH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SJPFGA45DI4F5MCF2OAACGH3HQOF4G3M/","https://security.netapp.com/advisory/ntap-20190606-0002/","https://usn.ubuntu.com/4004-1/","https://usn.ubuntu.com/4004-2/","https://usn.ubuntu.com/4019-1/","https://usn.ubuntu.com/4019-2/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.sqlite.org/releaselog/3_28_0.html","https://www.sqlite.org/src/info/90acdbfce9c08858"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-8457","description":"SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables."}]},{"artifact":{"id":"d3f929327cc1f09c","cpes":["cpe:2.3:a:libglib2.0-0:libglib2.0-0:2.58.3-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0-0:libglib2.0_0:2.58.3-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0_0:libglib2.0-0:2.58.3-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0_0:libglib2.0_0:2.58.3-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0:libglib2.0-0:2.58.3-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0:libglib2.0_0:2.58.3-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libglib2.0-0","purl":"pkg:deb/debian/libglib2.0-0@2.58.3-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=glib2.0","type":"deb","version":"2.58.3-2+deb10u1","language":"","licenses":["sha256:ac63a394252c3de7e3afca547269c18fde17b8143b63ab2ddf6ea205339c1271"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libglib2.0-0/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libglib2.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libglib2.0-0:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libglib2.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glib2.0"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.58.3-2+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-27219","versionConstraint":"< 2.58.3-2+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glib2.0","version":"2.58.3-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-27219","fix":{"state":"fixed","versions":["2.58.3-2+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.58.3-2+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-27219","cwe":"CWE-681","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27219","date":"2026-10-08","epss":0.02993,"percentile":0.8694}],"risk":2.24475,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-27219","description":"An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow could potentially lead to memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2021-27219","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-27219","cwe":"CWE-681","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27219","date":"2026-10-08","epss":0.02993,"percentile":0.8694}],"urls":["https://gitlab.gnome.org/GNOME/glib/-/issues/2319","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2022/06/msg00006.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2REA7RVKN7ZHRLJOEGBRQKJIPZQPAELZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JJMPNDO4GDVURYQFYKFOWY5HAF4FTEPN/","https://security.gentoo.org/glsa/202107-13","https://security.netapp.com/advisory/ntap-20210319-0004/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-27219","description":"An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow could potentially lead to memory corruption."}]},{"artifact":{"id":"9c0f03079e497030","cpes":["cpe:2.3:a:libpython3.7-minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-minimal","purl":"pkg:deb/debian/libpython3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-20907","versionConstraint":"< 3.7.3-2+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-20907","fix":{"state":"fixed","versions":["3.7.3-2+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20907","date":"2026-10-08","epss":0.02985,"percentile":0.86903}],"risk":2.23875,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-20907","description":"In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation."},"relatedVulnerabilities":[{"id":"CVE-2019-20907","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20907","date":"2026-10-08","epss":0.02985,"percentile":0.86903}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00051.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00052.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00053.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00056.html","https://bugs.python.org/issue39017","https://github.com/python/cpython/pull/21454","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.debian.org/debian-lts-announce/2020/11/msg00032.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CAXHCY4V3LPAAJOBCJ26ISZ4NUXQXTUZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PDKKRXLNVXRF6VGERZSR3OMQR5D5QI6I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TOGKLGTXZLHQQFBVCAPSUDA6DOOJFNRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YSL3XWVDMSMKO23HR74AJQ6VEM3C2NTS/","https://security.gentoo.org/glsa/202008-01","https://security.netapp.com/advisory/ntap-20200731-0002/","https://usn.ubuntu.com/4428-1/","https://www.oracle.com/security-alerts/cpujan2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-20907","description":"In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation."}]},{"artifact":{"id":"b6d8c37141cd8c0a","cpes":["cpe:2.3:a:libpython3.7-stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-stdlib","purl":"pkg:deb/debian/libpython3.7-stdlib@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-20907","versionConstraint":"< 3.7.3-2+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-20907","fix":{"state":"fixed","versions":["3.7.3-2+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20907","date":"2026-10-08","epss":0.02985,"percentile":0.86903}],"risk":2.23875,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-20907","description":"In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation."},"relatedVulnerabilities":[{"id":"CVE-2019-20907","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20907","date":"2026-10-08","epss":0.02985,"percentile":0.86903}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00051.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00052.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00053.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00056.html","https://bugs.python.org/issue39017","https://github.com/python/cpython/pull/21454","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.debian.org/debian-lts-announce/2020/11/msg00032.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CAXHCY4V3LPAAJOBCJ26ISZ4NUXQXTUZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PDKKRXLNVXRF6VGERZSR3OMQR5D5QI6I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TOGKLGTXZLHQQFBVCAPSUDA6DOOJFNRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YSL3XWVDMSMKO23HR74AJQ6VEM3C2NTS/","https://security.gentoo.org/glsa/202008-01","https://security.netapp.com/advisory/ntap-20200731-0002/","https://usn.ubuntu.com/4428-1/","https://www.oracle.com/security-alerts/cpujan2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-20907","description":"In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation."}]},{"artifact":{"id":"94955c7d71be2bb1","cpes":["cpe:2.3:a:python3.7:python3.7:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7","purl":"pkg:deb/debian/python3.7@3.7.3-2?arch=amd64&distro=debian-10.1","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.list"},{"path":"/var/lib/dpkg/info/python3.7.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.postinst"},{"path":"/var/lib/dpkg/info/python3.7.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u2"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-20907","versionConstraint":"< 3.7.3-2+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-20907","fix":{"state":"fixed","versions":["3.7.3-2+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20907","date":"2026-10-08","epss":0.02985,"percentile":0.86903}],"risk":2.23875,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-20907","description":"In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation."},"relatedVulnerabilities":[{"id":"CVE-2019-20907","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20907","date":"2026-10-08","epss":0.02985,"percentile":0.86903}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00051.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00052.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00053.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00056.html","https://bugs.python.org/issue39017","https://github.com/python/cpython/pull/21454","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.debian.org/debian-lts-announce/2020/11/msg00032.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CAXHCY4V3LPAAJOBCJ26ISZ4NUXQXTUZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PDKKRXLNVXRF6VGERZSR3OMQR5D5QI6I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TOGKLGTXZLHQQFBVCAPSUDA6DOOJFNRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YSL3XWVDMSMKO23HR74AJQ6VEM3C2NTS/","https://security.gentoo.org/glsa/202008-01","https://security.netapp.com/advisory/ntap-20200731-0002/","https://usn.ubuntu.com/4428-1/","https://www.oracle.com/security-alerts/cpujan2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-20907","description":"In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation."}]},{"artifact":{"id":"988c8a69c0d8509e","cpes":["cpe:2.3:a:python3.7-minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7-minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7-minimal","purl":"pkg:deb/debian/python3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.list"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.7-minimal.preinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.prerm"}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-20907","versionConstraint":"< 3.7.3-2+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-20907","fix":{"state":"fixed","versions":["3.7.3-2+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20907","date":"2026-10-08","epss":0.02985,"percentile":0.86903}],"risk":2.23875,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-20907","description":"In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation."},"relatedVulnerabilities":[{"id":"CVE-2019-20907","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20907","date":"2026-10-08","epss":0.02985,"percentile":0.86903}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00051.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00052.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00053.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00056.html","https://bugs.python.org/issue39017","https://github.com/python/cpython/pull/21454","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.debian.org/debian-lts-announce/2020/11/msg00032.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CAXHCY4V3LPAAJOBCJ26ISZ4NUXQXTUZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PDKKRXLNVXRF6VGERZSR3OMQR5D5QI6I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TOGKLGTXZLHQQFBVCAPSUDA6DOOJFNRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YSL3XWVDMSMKO23HR74AJQ6VEM3C2NTS/","https://security.gentoo.org/glsa/202008-01","https://security.netapp.com/advisory/ntap-20200731-0002/","https://usn.ubuntu.com/4428-1/","https://www.oracle.com/security-alerts/cpujan2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-20907","description":"In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation."}]},{"artifact":{"id":"ecf5e89e65014edb","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.64.0-4:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/debian/libcurl4@7.64.0-4?arch=amd64&distro=debian-10.1&upstream=curl","type":"deb","version":"7.64.0-4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.64.0-4+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-27782","versionConstraint":"< 7.64.0-4+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"curl","version":"7.64.0-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-27782","fix":{"state":"fixed","versions":["7.64.0-4+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.64.0-4+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-27782","cwe":"CWE-840","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-27782","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-27782","date":"2026-10-08","epss":0.0293,"percentile":0.86676}],"risk":2.1975000000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-27782","description":"libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily."},"relatedVulnerabilities":[{"id":"CVE-2022-27782","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-27782","cwe":"CWE-840","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-27782","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-27782","date":"2026-10-08","epss":0.0293,"percentile":0.86676}],"urls":["http://www.openwall.com/lists/oss-security/2023/03/20/6","https://hackerone.com/reports/1555796","https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20220609-0009/","https://www.debian.org/security/2022/dsa-5197"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27782","description":"libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily."}]},{"artifact":{"id":"bca20a7b0a858bf3","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/debian/libssl1.1@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1&upstream=openssl","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-4741","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2024-4741","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-4741","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-4741","date":"2026-10-08","epss":0.02925,"percentile":0.86654}],"risk":2.19375,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-4741"},"relatedVulnerabilities":[{"id":"CVE-2024-4741","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-4741","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-4741","date":"2026-10-08","epss":0.02925,"percentile":0.86654}],"urls":["https://github.com/openssl/openssl/commit/704f725b96aa373ee45ecfb23f6abfe8be8d9177","https://github.com/openssl/openssl/commit/b3f0eb0a295f58f16ba43ba99dad70d4ee5c437d","https://github.com/openssl/openssl/commit/c88c3de51020c37e8706bf7a682a162593053aac","https://github.com/openssl/openssl/commit/e5093133c35ca82874ad83697af76f4b0f7e3bd8","https://github.openssl.org/openssl/extended-releases/commit/f7a045f3143fc6da2ee66bf52d8df04829590dd4","https://www.openssl.org/news/secadv/20240528.txt","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240621-0004/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4741","description":"Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause\nmemory to be accessed that was previously freed in some situations\n\nImpact summary: A use after free can have a range of potential consequences such\nas the corruption of valid data, crashes or execution of arbitrary code.\nHowever, only applications that directly call the SSL_free_buffers function are\naffected by this issue. Applications that do not call this function are not\nvulnerable. Our investigations indicate that this function is rarely used by\napplications.\n\nThe SSL_free_buffers function is used to free the internal OpenSSL buffer used\nwhen processing an incoming record from the network. The call is only expected\nto succeed if the buffer is not currently in use. However, two scenarios have\nbeen identified where the buffer is freed even when still in use.\n\nThe first scenario occurs where a record header has been received from the\nnetwork and processed by OpenSSL, but the full record body has not yet arrived.\nIn this case calling SSL_free_buffers will succeed even though a record has only\nbeen partially processed and the buffer is still in use.\n\nThe second scenario occurs where a full record containing application data has\nbeen received and processed by OpenSSL but the application has only read part of\nthis data. Again a call to SSL_free_buffers will succeed even though the buffer\nis still in use.\n\nWhile these scenarios could occur accidentally during normal operation a\nmalicious attacker could attempt to engineer a stituation where this occurs.\nWe are not aware of this issue being actively exploited.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue."}]},{"artifact":{"id":"d308e84bddad0b0f","cpes":["cpe:2.3:a:openssl:openssl:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-4741","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2024-4741","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-4741","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-4741","date":"2026-10-08","epss":0.02925,"percentile":0.86654}],"risk":2.19375,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-4741"},"relatedVulnerabilities":[{"id":"CVE-2024-4741","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-4741","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-4741","date":"2026-10-08","epss":0.02925,"percentile":0.86654}],"urls":["https://github.com/openssl/openssl/commit/704f725b96aa373ee45ecfb23f6abfe8be8d9177","https://github.com/openssl/openssl/commit/b3f0eb0a295f58f16ba43ba99dad70d4ee5c437d","https://github.com/openssl/openssl/commit/c88c3de51020c37e8706bf7a682a162593053aac","https://github.com/openssl/openssl/commit/e5093133c35ca82874ad83697af76f4b0f7e3bd8","https://github.openssl.org/openssl/extended-releases/commit/f7a045f3143fc6da2ee66bf52d8df04829590dd4","https://www.openssl.org/news/secadv/20240528.txt","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240621-0004/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4741","description":"Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause\nmemory to be accessed that was previously freed in some situations\n\nImpact summary: A use after free can have a range of potential consequences such\nas the corruption of valid data, crashes or execution of arbitrary code.\nHowever, only applications that directly call the SSL_free_buffers function are\naffected by this issue. Applications that do not call this function are not\nvulnerable. Our investigations indicate that this function is rarely used by\napplications.\n\nThe SSL_free_buffers function is used to free the internal OpenSSL buffer used\nwhen processing an incoming record from the network. The call is only expected\nto succeed if the buffer is not currently in use. However, two scenarios have\nbeen identified where the buffer is freed even when still in use.\n\nThe first scenario occurs where a record header has been received from the\nnetwork and processed by OpenSSL, but the full record body has not yet arrived.\nIn this case calling SSL_free_buffers will succeed even though a record has only\nbeen partially processed and the buffer is still in use.\n\nThe second scenario occurs where a full record containing application data has\nbeen received and processed by OpenSSL but the application has only read part of\nthis data. Again a call to SSL_free_buffers will succeed even though the buffer\nis still in use.\n\nWhile these scenarios could occur accidentally during normal operation a\nmalicious attacker could attempt to engineer a stituation where this occurs.\nWe are not aware of this issue being actively exploited.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue."}]},{"artifact":{"id":"2d52d7c9fca553cc","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.28-10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.28-10?arch=amd64&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-10228","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2016-10228","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-10228","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-10228","date":"2026-10-08","epss":0.04006,"percentile":0.90284}],"risk":2.18327,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-10228","description":"The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2016-10228","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-10228","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-10228","date":"2026-10-08","epss":0.04006,"percentile":0.90284}],"urls":["http://openwall.com/lists/oss-security/2017/03/01/10","http://www.securityfocus.com/bid/96525","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://security.gentoo.org/glsa/202101-20","https://sourceware.org/bugzilla/show_bug.cgi?id=19519","https://sourceware.org/bugzilla/show_bug.cgi?id=19519#c21","https://sourceware.org/bugzilla/show_bug.cgi?id=26224","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-10228","description":"The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service."}]},{"artifact":{"id":"fe0324c22198dabb","cpes":["cpe:2.3:a:libc-l10n:libc-l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc-l10n:libc_l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc-l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc_l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_l10n:2.28-10:*:*:*:*:*:*:*"],"name":"libc-l10n","purl":"pkg:deb/debian/libc-l10n@2.28-10?arch=all&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-l10n/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libc-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libc-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libc-l10n.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-10228","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2016-10228","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-10228","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-10228","date":"2026-10-08","epss":0.04006,"percentile":0.90284}],"risk":2.18327,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-10228","description":"The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2016-10228","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-10228","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-10228","date":"2026-10-08","epss":0.04006,"percentile":0.90284}],"urls":["http://openwall.com/lists/oss-security/2017/03/01/10","http://www.securityfocus.com/bid/96525","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://security.gentoo.org/glsa/202101-20","https://sourceware.org/bugzilla/show_bug.cgi?id=19519","https://sourceware.org/bugzilla/show_bug.cgi?id=19519#c21","https://sourceware.org/bugzilla/show_bug.cgi?id=26224","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-10228","description":"The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service."}]},{"artifact":{"id":"4d00fd0f941e584e","cpes":["cpe:2.3:a:libc6:libc6:2.28-10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.28-10?arch=amd64&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-10228","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2016-10228","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-10228","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-10228","date":"2026-10-08","epss":0.04006,"percentile":0.90284}],"risk":2.18327,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-10228","description":"The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2016-10228","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-10228","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-10228","date":"2026-10-08","epss":0.04006,"percentile":0.90284}],"urls":["http://openwall.com/lists/oss-security/2017/03/01/10","http://www.securityfocus.com/bid/96525","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://security.gentoo.org/glsa/202101-20","https://sourceware.org/bugzilla/show_bug.cgi?id=19519","https://sourceware.org/bugzilla/show_bug.cgi?id=19519#c21","https://sourceware.org/bugzilla/show_bug.cgi?id=26224","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-10228","description":"The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service."}]},{"artifact":{"id":"c1d71c418353daa4","cpes":["cpe:2.3:a:locales:locales:2.28-10:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/debian/locales@2.28-10?arch=all&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-10228","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2016-10228","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-10228","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-10228","date":"2026-10-08","epss":0.04006,"percentile":0.90284}],"risk":2.18327,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-10228","description":"The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2016-10228","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-10228","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-10228","date":"2026-10-08","epss":0.04006,"percentile":0.90284}],"urls":["http://openwall.com/lists/oss-security/2017/03/01/10","http://www.securityfocus.com/bid/96525","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://security.gentoo.org/glsa/202101-20","https://sourceware.org/bugzilla/show_bug.cgi?id=19519","https://sourceware.org/bugzilla/show_bug.cgi?id=19519#c21","https://sourceware.org/bugzilla/show_bug.cgi?id=26224","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-10228","description":"The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service."}]},{"artifact":{"id":"ecf5e89e65014edb","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.64.0-4:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/debian/libcurl4@7.64.0-4?arch=amd64&distro=debian-10.1&upstream=curl","type":"deb","version":"7.64.0-4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.64.0-4+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-27776","versionConstraint":"< 7.64.0-4+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"curl","version":"7.64.0-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-27776","fix":{"state":"fixed","versions":["7.64.0-4+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.64.0-4+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-27776","cwe":"CWE-522","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-27776","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-27776","date":"2026-10-08","epss":0.03777,"percentile":0.89666}],"risk":2.171775,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-27776","description":"A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number."},"relatedVulnerabilities":[{"id":"CVE-2022-27776","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-27776","cwe":"CWE-522","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-27776","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-27776","date":"2026-10-08","epss":0.03777,"percentile":0.89666}],"urls":["https://hackerone.com/reports/1547048","https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7N5ZBWLNNPZKFK7Q4KEHGCJ2YELQEUJP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKKOQXPYLMBSEVDHFS32BPBR3ZQJKY5B/","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20220609-0008/","https://www.debian.org/security/2022/dsa-5197"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27776","description":"A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number."}]},{"artifact":{"id":"a2c5569d9b015a19","cpes":["cpe:2.3:a:libpcre3:libpcre3:2\\:8.39-12:*:*:*:*:*:*:*"],"name":"libpcre3","purl":"pkg:deb/debian/libpcre3@2%3A8.39-12?arch=amd64&distro=debian-10.1&upstream=pcre3","type":"deb","version":"2:8.39-12","language":"","licenses":["sha256:ac9276490d2fa167442ae1aae33926514ad10c8886baa40046c5e367fccc5938"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre3/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libpcre3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre3:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libpcre3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-14155","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"pcre3","version":"2:8.39-12"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-14155","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-14155","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14155","date":"2026-10-08","epss":0.04182,"percentile":0.90662}],"risk":2.1537300000000004,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-14155","description":"libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring."},"relatedVulnerabilities":[{"id":"CVE-2020-14155","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-14155","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14155","date":"2026-10-08","epss":0.04182,"percentile":0.90662}],"urls":["http://seclists.org/fulldisclosure/2020/Dec/32","http://seclists.org/fulldisclosure/2021/Feb/14","https://about.gitlab.com/releases/2020/07/01/security-release-13-1-2-release/","https://bugs.gentoo.org/717920","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://security.netapp.com/advisory/ntap-20221028-0010/","https://support.apple.com/kb/HT211931","https://support.apple.com/kb/HT212147","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.pcre.org/original/changelog.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-14155","description":"libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring."}]},{"artifact":{"id":"d55bfe42f054b394","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.2.6-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.2.6-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=expat","type":"deb","version":"2.2.6-2+deb10u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.6-2+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-22825","versionConstraint":"< 2.2.6-2+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"expat","version":"2.2.6-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-22825","fix":{"state":"fixed","versions":["2.2.6-2+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.6-2+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22825","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-22825","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-22825","date":"2026-10-08","epss":0.02636,"percentile":0.85107}],"risk":2.14834,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5073-1","link":"https://security-tracker.debian.org/tracker/DSA-5073-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-22825","description":"lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow."},"relatedVulnerabilities":[{"id":"CVE-2022-22825","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22825","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-22825","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-22825","date":"2026-10-08","epss":0.02636,"percentile":0.85107}],"urls":["http://www.openwall.com/lists/oss-security/2022/01/17/3","https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","https://github.com/libexpat/libexpat/pull/539","https://security.gentoo.org/glsa/202209-24","https://www.debian.org/security/2022/dsa-5073","https://www.tenable.com/security/tns-2022-05"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-22825","description":"lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.19.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2023-1703","versionConstraint":"<1.19.8||>=1.20.0-0,<1.20.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2023-1703","fix":{"state":"fixed","versions":["1.19.8","1.20.3"],"available":[{"date":"2023-04-04","kind":"release","version":"1.19.8"},{"date":"2023-04-04","kind":"release","version":"1.20.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24538","cwe":"CWE-94","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24538","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24538","date":"2026-10-08","epss":0.02281,"percentile":0.82616}],"risk":2.14414,"urls":["https://go.dev/cl/482079","https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8"],"severity":"Critical","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/59234","description":"Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected.\n\nBackticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the action can be used to terminate the literal, injecting arbitrary Javascript code into the Go template.\n\nAs ES6 template literals are rather complex, and themselves can do string interpolation, the decision was made to simply disallow Go template actions from being used inside of them (e.g. \"var a = {{.}}\"), since there is no obviously safe way to allow this behavior. This takes the same approach as github.com/google/safehtml.\n\nWith fix, Template.Parse returns an Error when it encounters templates like this, with an ErrorCode of value 12. This ErrorCode is currently unexported, but will be exported in the release of Go 1.21.\n\nUsers who rely on the previous behavior can re-enable it using the GODEBUG flag jstmpllitinterp=1, with the caveat that backticks will now be escaped. This should be used with caution."},"relatedVulnerabilities":[{"id":"CVE-2023-24538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24538","cwe":"CWE-94","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24538","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24538","date":"2026-10-08","epss":0.02281,"percentile":0.82616}],"urls":["https://go.dev/cl/482079","https://go.dev/issue/59234","https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8","https://pkg.go.dev/vuln/GO-2023-1703","https://security.gentoo.org/glsa/202311-09","https://security.netapp.com/advisory/ntap-20241115-0007/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24538","description":"Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the action can be used to terminate the literal, injecting arbitrary Javascript code into the Go template. As ES6 template literals are rather complex, and themselves can do string interpolation, the decision was made to simply disallow Go template actions from being used inside of them (e.g. \"var a = {{.}}\"), since there is no obviously safe way to allow this behavior. This takes the same approach as github.com/google/safehtml. With fix, Template.Parse returns an Error when it encounters templates like this, with an ErrorCode of value 12. This ErrorCode is currently unexported, but will be exported in the release of Go 1.21. Users who rely on the previous behavior can re-enable it using the GODEBUG flag jstmpllitinterp=1, with the caveat that backticks will now be escaped. This should be used with caution."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.19.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2023-1703","versionConstraint":"<1.19.8||>=1.20.0-0,<1.20.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2023-1703","fix":{"state":"fixed","versions":["1.19.8","1.20.3"],"available":[{"date":"2023-04-04","kind":"release","version":"1.19.8"},{"date":"2023-04-04","kind":"release","version":"1.20.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24538","cwe":"CWE-94","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24538","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24538","date":"2026-10-08","epss":0.02281,"percentile":0.82616}],"risk":2.14414,"urls":["https://go.dev/cl/482079","https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8"],"severity":"Critical","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/59234","description":"Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected.\n\nBackticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the action can be used to terminate the literal, injecting arbitrary Javascript code into the Go template.\n\nAs ES6 template literals are rather complex, and themselves can do string interpolation, the decision was made to simply disallow Go template actions from being used inside of them (e.g. \"var a = {{.}}\"), since there is no obviously safe way to allow this behavior. This takes the same approach as github.com/google/safehtml.\n\nWith fix, Template.Parse returns an Error when it encounters templates like this, with an ErrorCode of value 12. This ErrorCode is currently unexported, but will be exported in the release of Go 1.21.\n\nUsers who rely on the previous behavior can re-enable it using the GODEBUG flag jstmpllitinterp=1, with the caveat that backticks will now be escaped. This should be used with caution."},"relatedVulnerabilities":[{"id":"CVE-2023-24538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24538","cwe":"CWE-94","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24538","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24538","date":"2026-10-08","epss":0.02281,"percentile":0.82616}],"urls":["https://go.dev/cl/482079","https://go.dev/issue/59234","https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8","https://pkg.go.dev/vuln/GO-2023-1703","https://security.gentoo.org/glsa/202311-09","https://security.netapp.com/advisory/ntap-20241115-0007/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24538","description":"Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the action can be used to terminate the literal, injecting arbitrary Javascript code into the Go template. As ES6 template literals are rather complex, and themselves can do string interpolation, the decision was made to simply disallow Go template actions from being used inside of them (e.g. \"var a = {{.}}\"), since there is no obviously safe way to allow this behavior. This takes the same approach as github.com/google/safehtml. With fix, Template.Parse returns an Error when it encounters templates like this, with an ErrorCode of value 12. This ErrorCode is currently unexported, but will be exported in the release of Go 1.21. Users who rely on the previous behavior can re-enable it using the GODEBUG flag jstmpllitinterp=1, with the caveat that backticks will now be escaped. This should be used with caution."}]},{"artifact":{"id":"7f19231bca942dc4","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/debian/libldap-2.4-2@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-25709","versionConstraint":"< 2.4.47+dfsg-3+deb10u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-25709","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25709","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-25709","date":"2026-10-08","epss":0.02858,"percentile":0.8633}],"risk":2.1435000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4792-1","link":"https://security-tracker.debian.org/tracker/DSA-4792-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-25709","description":"A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP’s slapd server, to trigger an assertion failure. The highest threat from this vulnerability is to system availability."},"relatedVulnerabilities":[{"id":"CVE-2020-25709","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25709","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-25709","date":"2026-10-08","epss":0.02858,"percentile":0.8633}],"urls":["http://seclists.org/fulldisclosure/2021/Feb/14","https://bugzilla.redhat.com/show_bug.cgi?id=1899675","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00008.html","https://security.netapp.com/advisory/ntap-20210716-0003/","https://support.apple.com/kb/HT212147","https://www.debian.org/security/2020/dsa-4792"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-25709","description":"A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP’s slapd server, to trigger an assertion failure. The highest threat from this vulnerability is to system availability."}]},{"artifact":{"id":"ed53a6639a2640b0","cpes":["cpe:2.3:a:libldap-common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-common","purl":"pkg:deb/debian/libldap-common@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=all&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-common/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.list"}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-25709","versionConstraint":"< 2.4.47+dfsg-3+deb10u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-25709","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25709","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-25709","date":"2026-10-08","epss":0.02858,"percentile":0.8633}],"risk":2.1435000000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4792-1","link":"https://security-tracker.debian.org/tracker/DSA-4792-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-25709","description":"A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP’s slapd server, to trigger an assertion failure. The highest threat from this vulnerability is to system availability."},"relatedVulnerabilities":[{"id":"CVE-2020-25709","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25709","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-25709","date":"2026-10-08","epss":0.02858,"percentile":0.8633}],"urls":["http://seclists.org/fulldisclosure/2021/Feb/14","https://bugzilla.redhat.com/show_bug.cgi?id=1899675","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00008.html","https://security.netapp.com/advisory/ntap-20210716-0003/","https://support.apple.com/kb/HT212147","https://www.debian.org/security/2020/dsa-4792"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-25709","description":"A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP’s slapd server, to trigger an assertion failure. The highest threat from this vulnerability is to system availability."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.16.14"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0317","versionConstraint":"<1.16.14||>=1.17.0-0,<1.17.7 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0317","fix":{"state":"fixed","versions":["1.16.14","1.17.7"],"available":[{"date":"2022-02-09","kind":"release","version":"1.16.14"},{"date":"2022-02-09","kind":"release","version":"1.17.7"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23772","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-23772","date":"2026-10-08","epss":0.02807,"percentile":0.86079}],"risk":2.1052500000000003,"urls":["https://go.googlesource.com/go/+/ad345c265916bbf6c646865e4642eafce6d39e78","https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ","https://go.dev/issue/50699"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/379537","description":"Rat.SetString had an overflow issue that can lead to uncontrolled memory consumption."},"relatedVulnerabilities":[{"id":"CVE-2022-23772","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23772","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-23772","date":"2026-10-08","epss":0.02807,"percentile":0.86079}],"urls":["https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ","https://lists.debian.org/debian-lts-announce/2022/04/msg00017.html","https://lists.debian.org/debian-lts-announce/2022/04/msg00018.html","https://security.gentoo.org/glsa/202208-02","https://security.netapp.com/advisory/ntap-20220225-0006/","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23772","description":"Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.16.14"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0317","versionConstraint":"<1.16.14||>=1.17.0-0,<1.17.7 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0317","fix":{"state":"fixed","versions":["1.16.14","1.17.7"],"available":[{"date":"2022-02-09","kind":"release","version":"1.16.14"},{"date":"2022-02-09","kind":"release","version":"1.17.7"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23772","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-23772","date":"2026-10-08","epss":0.02807,"percentile":0.86079}],"risk":2.1052500000000003,"urls":["https://go.googlesource.com/go/+/ad345c265916bbf6c646865e4642eafce6d39e78","https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ","https://go.dev/issue/50699"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/379537","description":"Rat.SetString had an overflow issue that can lead to uncontrolled memory consumption."},"relatedVulnerabilities":[{"id":"CVE-2022-23772","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23772","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-23772","date":"2026-10-08","epss":0.02807,"percentile":0.86079}],"urls":["https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ","https://lists.debian.org/debian-lts-announce/2022/04/msg00017.html","https://lists.debian.org/debian-lts-announce/2022/04/msg00018.html","https://security.gentoo.org/glsa/202208-02","https://security.netapp.com/advisory/ntap-20220225-0006/","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23772","description":"Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption."}]},{"artifact":{"id":"ecf5e89e65014edb","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.64.0-4:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/debian/libcurl4@7.64.0-4?arch=amd64&distro=debian-10.1&upstream=curl","type":"deb","version":"7.64.0-4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.64.0-4+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-22924","versionConstraint":"< 7.64.0-4+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"curl","version":"7.64.0-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-22924","fix":{"state":"fixed","versions":["7.64.0-4+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.64.0-4+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-22924","cwe":"CWE-20","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2021-22924","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-22924","date":"2026-10-08","epss":0.0627,"percentile":0.93399}],"risk":2.10045,"urls":[],"severity":"Low","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-22924","description":"libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate."},"relatedVulnerabilities":[{"id":"CVE-2021-22924","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-22924","cwe":"CWE-20","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2021-22924","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-22924","date":"2026-10-08","epss":0.0627,"percentile":0.93399}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-732250.pdf","https://hackerone.com/reports/1223565","https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/08/msg00017.html","https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/","https://security.netapp.com/advisory/ntap-20210902-0003/","https://www.debian.org/security/2022/dsa-5197","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-22924","description":"libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate."}]},{"artifact":{"id":"9c0f03079e497030","cpes":["cpe:2.3:a:libpython3.7-minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-minimal","purl":"pkg:deb/debian/libpython3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-20107","versionConstraint":"< 3.7.3-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2015-20107","fix":{"state":"fixed","versions":["3.7.3-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-20107","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2015-20107","cwe":"CWE-77","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2015-20107","date":"2026-10-08","epss":0.0278,"percentile":0.85958}],"risk":2.0988999999999995,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-20107","description":"In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9"},"relatedVulnerabilities":[{"id":"CVE-2015-20107","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:C/A:P","metrics":{"baseScore":8,"impactScore":8.6,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-20107","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2015-20107","cwe":"CWE-77","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2015-20107","date":"2026-10-08","epss":0.0278,"percentile":0.85958}],"urls":["https://bugs.python.org/issue24778","https://github.com/python/cpython/issues/68966","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46KWPTI72SSEOF53DOYQBQOCN4QQB2GE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/53TQZFLS6O3FLIMVSXFEEPZSWLDZLBOX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/57NECACX333A3BBZM2TR2VZ4ZE3UG3SN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DBVY4YC2P6EPZZ2DROOXHDOWZ4BJFLW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIKVSW3H6W2GQGDE5DTIWLGFNH6KKEW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AKGMYDVKI3XNM27B6I6RQ6QV3TVJAUCG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ERYMM2QVDPOJLX4LYXWYIQN5FOIJLDRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F3LNY2NHM6J22O6Q5ANOE3SZRK3OACKR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCIO2W4DUVVMI6L52QCC4TT2B3K5VWHS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FIRUTX47BJD2HYJDLMI7JJBVCYFAPKAQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GPCLGZZJPVXFWUWVV5WCD5FNUAFLKBDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HAI2GBC7WKH7J5NH6J2IW5RT3VF2SF5M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFGV7P2PYFBMK32OKHCAC2ZPJQV5AUDF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAY6VBNVEFUXKJF37WFHYXUSRDEK34N3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MYG3EMFR7ZHC46TDNM7SNWO64A3W7EUF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ONXSGLASNLGFL57YU6WT6Y5YURSFV43U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PTTZGLD2YBMMG6U6F5HOTPOGGPBIURMA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UIOJUZ5JMEMGSKNISTOVI4PDP36FDL5Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W5664BGZVTA46LQDNTYX5THG6CN4FYJX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XO2H6CKWLRGTTZCGUQVELW6LUH437Q3O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4E2WBEJ42CGLGDHD6ZXOLZ2W6G3YOVD/","https://python-security.readthedocs.io/vuln/mailcap-shell-injection.html","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20220616-0001/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-20107","description":"In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9"}]},{"artifact":{"id":"b6d8c37141cd8c0a","cpes":["cpe:2.3:a:libpython3.7-stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-stdlib","purl":"pkg:deb/debian/libpython3.7-stdlib@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-20107","versionConstraint":"< 3.7.3-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2015-20107","fix":{"state":"fixed","versions":["3.7.3-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-20107","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2015-20107","cwe":"CWE-77","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2015-20107","date":"2026-10-08","epss":0.0278,"percentile":0.85958}],"risk":2.0988999999999995,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-20107","description":"In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9"},"relatedVulnerabilities":[{"id":"CVE-2015-20107","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:C/A:P","metrics":{"baseScore":8,"impactScore":8.6,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-20107","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2015-20107","cwe":"CWE-77","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2015-20107","date":"2026-10-08","epss":0.0278,"percentile":0.85958}],"urls":["https://bugs.python.org/issue24778","https://github.com/python/cpython/issues/68966","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46KWPTI72SSEOF53DOYQBQOCN4QQB2GE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/53TQZFLS6O3FLIMVSXFEEPZSWLDZLBOX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/57NECACX333A3BBZM2TR2VZ4ZE3UG3SN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DBVY4YC2P6EPZZ2DROOXHDOWZ4BJFLW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIKVSW3H6W2GQGDE5DTIWLGFNH6KKEW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AKGMYDVKI3XNM27B6I6RQ6QV3TVJAUCG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ERYMM2QVDPOJLX4LYXWYIQN5FOIJLDRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F3LNY2NHM6J22O6Q5ANOE3SZRK3OACKR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCIO2W4DUVVMI6L52QCC4TT2B3K5VWHS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FIRUTX47BJD2HYJDLMI7JJBVCYFAPKAQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GPCLGZZJPVXFWUWVV5WCD5FNUAFLKBDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HAI2GBC7WKH7J5NH6J2IW5RT3VF2SF5M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFGV7P2PYFBMK32OKHCAC2ZPJQV5AUDF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAY6VBNVEFUXKJF37WFHYXUSRDEK34N3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MYG3EMFR7ZHC46TDNM7SNWO64A3W7EUF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ONXSGLASNLGFL57YU6WT6Y5YURSFV43U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PTTZGLD2YBMMG6U6F5HOTPOGGPBIURMA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UIOJUZ5JMEMGSKNISTOVI4PDP36FDL5Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W5664BGZVTA46LQDNTYX5THG6CN4FYJX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XO2H6CKWLRGTTZCGUQVELW6LUH437Q3O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4E2WBEJ42CGLGDHD6ZXOLZ2W6G3YOVD/","https://python-security.readthedocs.io/vuln/mailcap-shell-injection.html","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20220616-0001/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-20107","description":"In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9"}]},{"artifact":{"id":"94955c7d71be2bb1","cpes":["cpe:2.3:a:python3.7:python3.7:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7","purl":"pkg:deb/debian/python3.7@3.7.3-2?arch=amd64&distro=debian-10.1","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.list"},{"path":"/var/lib/dpkg/info/python3.7.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.postinst"},{"path":"/var/lib/dpkg/info/python3.7.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2015-20107","versionConstraint":"< 3.7.3-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2015-20107","fix":{"state":"fixed","versions":["3.7.3-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-20107","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2015-20107","cwe":"CWE-77","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2015-20107","date":"2026-10-08","epss":0.0278,"percentile":0.85958}],"risk":2.0988999999999995,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-20107","description":"In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9"},"relatedVulnerabilities":[{"id":"CVE-2015-20107","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:C/A:P","metrics":{"baseScore":8,"impactScore":8.6,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-20107","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2015-20107","cwe":"CWE-77","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2015-20107","date":"2026-10-08","epss":0.0278,"percentile":0.85958}],"urls":["https://bugs.python.org/issue24778","https://github.com/python/cpython/issues/68966","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46KWPTI72SSEOF53DOYQBQOCN4QQB2GE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/53TQZFLS6O3FLIMVSXFEEPZSWLDZLBOX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/57NECACX333A3BBZM2TR2VZ4ZE3UG3SN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DBVY4YC2P6EPZZ2DROOXHDOWZ4BJFLW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIKVSW3H6W2GQGDE5DTIWLGFNH6KKEW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AKGMYDVKI3XNM27B6I6RQ6QV3TVJAUCG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ERYMM2QVDPOJLX4LYXWYIQN5FOIJLDRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F3LNY2NHM6J22O6Q5ANOE3SZRK3OACKR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCIO2W4DUVVMI6L52QCC4TT2B3K5VWHS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FIRUTX47BJD2HYJDLMI7JJBVCYFAPKAQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GPCLGZZJPVXFWUWVV5WCD5FNUAFLKBDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HAI2GBC7WKH7J5NH6J2IW5RT3VF2SF5M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFGV7P2PYFBMK32OKHCAC2ZPJQV5AUDF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAY6VBNVEFUXKJF37WFHYXUSRDEK34N3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MYG3EMFR7ZHC46TDNM7SNWO64A3W7EUF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ONXSGLASNLGFL57YU6WT6Y5YURSFV43U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PTTZGLD2YBMMG6U6F5HOTPOGGPBIURMA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UIOJUZ5JMEMGSKNISTOVI4PDP36FDL5Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W5664BGZVTA46LQDNTYX5THG6CN4FYJX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XO2H6CKWLRGTTZCGUQVELW6LUH437Q3O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4E2WBEJ42CGLGDHD6ZXOLZ2W6G3YOVD/","https://python-security.readthedocs.io/vuln/mailcap-shell-injection.html","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20220616-0001/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-20107","description":"In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9"}]},{"artifact":{"id":"988c8a69c0d8509e","cpes":["cpe:2.3:a:python3.7-minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7-minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7-minimal","purl":"pkg:deb/debian/python3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.list"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.7-minimal.preinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.prerm"}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-20107","versionConstraint":"< 3.7.3-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2015-20107","fix":{"state":"fixed","versions":["3.7.3-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-20107","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2015-20107","cwe":"CWE-77","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2015-20107","date":"2026-10-08","epss":0.0278,"percentile":0.85958}],"risk":2.0988999999999995,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-20107","description":"In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9"},"relatedVulnerabilities":[{"id":"CVE-2015-20107","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:C/A:P","metrics":{"baseScore":8,"impactScore":8.6,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-20107","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2015-20107","cwe":"CWE-77","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2015-20107","date":"2026-10-08","epss":0.0278,"percentile":0.85958}],"urls":["https://bugs.python.org/issue24778","https://github.com/python/cpython/issues/68966","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46KWPTI72SSEOF53DOYQBQOCN4QQB2GE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/53TQZFLS6O3FLIMVSXFEEPZSWLDZLBOX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/57NECACX333A3BBZM2TR2VZ4ZE3UG3SN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DBVY4YC2P6EPZZ2DROOXHDOWZ4BJFLW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIKVSW3H6W2GQGDE5DTIWLGFNH6KKEW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AKGMYDVKI3XNM27B6I6RQ6QV3TVJAUCG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ERYMM2QVDPOJLX4LYXWYIQN5FOIJLDRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F3LNY2NHM6J22O6Q5ANOE3SZRK3OACKR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCIO2W4DUVVMI6L52QCC4TT2B3K5VWHS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FIRUTX47BJD2HYJDLMI7JJBVCYFAPKAQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GPCLGZZJPVXFWUWVV5WCD5FNUAFLKBDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HAI2GBC7WKH7J5NH6J2IW5RT3VF2SF5M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFGV7P2PYFBMK32OKHCAC2ZPJQV5AUDF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAY6VBNVEFUXKJF37WFHYXUSRDEK34N3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MYG3EMFR7ZHC46TDNM7SNWO64A3W7EUF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ONXSGLASNLGFL57YU6WT6Y5YURSFV43U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PTTZGLD2YBMMG6U6F5HOTPOGGPBIURMA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UIOJUZ5JMEMGSKNISTOVI4PDP36FDL5Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W5664BGZVTA46LQDNTYX5THG6CN4FYJX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XO2H6CKWLRGTTZCGUQVELW6LUH437Q3O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4E2WBEJ42CGLGDHD6ZXOLZ2W6G3YOVD/","https://python-security.readthedocs.io/vuln/mailcap-shell-injection.html","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20220616-0001/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-20107","description":"In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9"}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.20.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2023-2185","versionConstraint":"<1.20.11||>=1.21.0-0,<1.21.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2023-2185","fix":{"state":"fixed","versions":["1.20.11","1.21.4"],"available":[{"date":"2023-11-07","kind":"release","version":"1.20.11"},{"date":"2023-11-07","kind":"release","version":"1.21.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45283","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-45283","date":"2026-10-08","epss":0.02758,"percentile":0.85831}],"risk":2.0685000000000002,"urls":["https://go.dev/cl/540277","https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY","https://go.dev/issue/64028","https://go.dev/cl/541175","https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/63713","description":"The filepath package does not recognize paths with a \\??\\ prefix as special.\n\nOn Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x.\n\nBefore fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b.\n\nSimilarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b.\n\nIn addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name.\n\nUPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored."},"relatedVulnerabilities":[{"id":"CVE-2023-45283","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45283","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-45283","date":"2026-10-08","epss":0.02758,"percentile":0.85831}],"urls":["http://www.openwall.com/lists/oss-security/2023/12/05/2","https://go.dev/cl/540277","https://go.dev/cl/541175","https://go.dev/issue/63713","https://go.dev/issue/64028","https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY","https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ","https://pkg.go.dev/vuln/GO-2023-2185","https://security.netapp.com/advisory/ntap-20231214-0008/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45283","description":"The filepath package does not recognize paths with a \\??\\ prefix as special. On Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x. Before fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b. Similarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b. In addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.20.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2023-2185","versionConstraint":"<1.20.11||>=1.21.0-0,<1.21.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2023-2185","fix":{"state":"fixed","versions":["1.20.11","1.21.4"],"available":[{"date":"2023-11-07","kind":"release","version":"1.20.11"},{"date":"2023-11-07","kind":"release","version":"1.21.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45283","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-45283","date":"2026-10-08","epss":0.02758,"percentile":0.85831}],"risk":2.0685000000000002,"urls":["https://go.dev/cl/540277","https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY","https://go.dev/issue/64028","https://go.dev/cl/541175","https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/63713","description":"The filepath package does not recognize paths with a \\??\\ prefix as special.\n\nOn Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x.\n\nBefore fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b.\n\nSimilarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b.\n\nIn addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name.\n\nUPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored."},"relatedVulnerabilities":[{"id":"CVE-2023-45283","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-45283","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-45283","date":"2026-10-08","epss":0.02758,"percentile":0.85831}],"urls":["http://www.openwall.com/lists/oss-security/2023/12/05/2","https://go.dev/cl/540277","https://go.dev/cl/541175","https://go.dev/issue/63713","https://go.dev/issue/64028","https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY","https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ","https://pkg.go.dev/vuln/GO-2023-2185","https://security.netapp.com/advisory/ntap-20231214-0008/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-45283","description":"The filepath package does not recognize paths with a \\??\\ prefix as special. On Windows, a path beginning with \\??\\ is a Root Local Device path equivalent to a path beginning with \\\\?\\. Paths with a \\??\\ prefix may be used to access arbitrary locations on the system. For example, the path \\??\\c:\\x is equivalent to the more common path c:\\x. Before fix, Clean could convert a rooted path such as \\a\\..\\??\\b into the root local device path \\??\\b. Clean will now convert this to .\\??\\b. Similarly, Join(\\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \\??\\b. Join will now convert this to \\.\\??\\b. In addition, with fix, IsAbs now correctly reports paths beginning with \\??\\ as absolute, and VolumeName correctly reports the \\??\\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \\?, resulting in filepath.Clean(\\?\\c:) returning \\?\\c: rather than \\?\\c:\\ (among other effects). The previous behavior has been restored."}]},{"artifact":{"id":"55c72a3cae1cb771","cpes":["cpe:2.3:a:libonig5:libonig5:6.9.1-1:*:*:*:*:*:*:*"],"name":"libonig5","purl":"pkg:deb/debian/libonig5@6.9.1-1?arch=amd64&distro=debian-10.1&upstream=libonig","type":"deb","version":"6.9.1-1","language":"","licenses":["BSD-2-clause","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libonig5/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libonig5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libonig5:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libonig5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libonig"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-19204","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"libonig","version":"6.9.1-1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-19204","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-19204","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19204","date":"2026-10-08","epss":0.06889,"percentile":0.93909}],"risk":2.0667,"urls":[],"severity":"Low","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-19204","description":"An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function fetch_interval_quantifier (formerly known as fetch_range_quantifier) in regparse.c, PFETCH is called without checking PEND. This leads to a heap-based buffer over-read."},"relatedVulnerabilities":[{"id":"CVE-2019-19204","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19204","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19204","date":"2026-10-08","epss":0.06889,"percentile":0.93909}],"urls":["https://github.com/ManhNDd/CVE-2019-19204","https://github.com/kkos/oniguruma/issues/162","https://github.com/kkos/oniguruma/releases/tag/v6.9.4_rc2","https://github.com/tarantula-team/CVE-2019-19204","https://lists.debian.org/debian-lts-announce/2019/12/msg00002.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NO267PLHGYZSWX3XTRPKYBKD4J3YOU5V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3MBNW6Z4DOXSCNWGBLQ7OA3OGUJ44WL/","https://usn.ubuntu.com/4460-1/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19204","description":"An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function fetch_interval_quantifier (formerly known as fetch_range_quantifier) in regparse.c, PFETCH is called without checking PEND. This leads to a heap-based buffer over-read."}]},{"artifact":{"id":"ecf5e89e65014edb","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.64.0-4:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/debian/libcurl4@7.64.0-4?arch=amd64&distro=debian-10.1&upstream=curl","type":"deb","version":"7.64.0-4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.64.0-4+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-27781","versionConstraint":"< 7.64.0-4+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"curl","version":"7.64.0-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-27781","fix":{"state":"fixed","versions":["7.64.0-4+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.64.0-4+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-27781","cwe":"CWE-400","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-27781","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-27781","date":"2026-10-08","epss":0.02747,"percentile":0.85771}],"risk":2.0602500000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-27781","description":"libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation."},"relatedVulnerabilities":[{"id":"CVE-2022-27781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-27781","cwe":"CWE-400","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-27781","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-27781","date":"2026-10-08","epss":0.02747,"percentile":0.85771}],"urls":["https://hackerone.com/reports/1555441","https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20220609-0009/","https://www.debian.org/security/2022/dsa-5197"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27781","description":"libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation."}]},{"artifact":{"id":"bca20a7b0a858bf3","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/debian/libssl1.1@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1&upstream=openssl","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1d-0+deb10u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-4160","versionConstraint":"< 1.1.1d-0+deb10u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-4160","fix":{"state":"fixed","versions":["1.1.1d-0+deb10u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1d-0+deb10u8"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-4160","date":"2026-10-08","epss":0.03772,"percentile":0.89654}],"risk":2.05574,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5103-1","link":"https://security-tracker.debian.org/tracker/DSA-5103-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-4160","description":"There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and include reusing private keys. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH private key among multiple clients, which is no longer an option since CVE-2016-0701. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0.0. It was addressed in the releases of 1.1.1m and 3.0.1 on the 15th of December 2021. For the 1.0.2 release it is addressed in git commit 6fc1aaaf3 that is available to premium support customers only. It will be made available in 1.0.2zc when it is released. The issue only affects OpenSSL on MIPS platforms. Fixed in OpenSSL 3.0.1 (Affected 3.0.0). Fixed in OpenSSL 1.1.1m (Affected 1.1.1-1.1.1l). Fixed in OpenSSL 1.0.2zc-dev (Affected 1.0.2-1.0.2zb)."},"relatedVulnerabilities":[{"id":"CVE-2021-4160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-4160","date":"2026-10-08","epss":0.03772,"percentile":0.89654}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3bf7b73ea7123045b8f972badc67ed6878e6c37f","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6fc1aaaf303185aa5e483e06bdfae16daa9193a7","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e9e726506cd2a3fd9c0f12daf8cc1fe934c7dddb","https://security.gentoo.org/glsa/202210-02","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2022/dsa-5103","https://www.openssl.org/news/secadv/20220128.txt","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-4160","description":"There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and include reusing private keys. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH private key among multiple clients, which is no longer an option since CVE-2016-0701. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0.0. It was addressed in the releases of 1.1.1m and 3.0.1 on the 15th of December 2021. For the 1.0.2 release it is addressed in git commit 6fc1aaaf3 that is available to premium support customers only. It will be made available in 1.0.2zc when it is released. The issue only affects OpenSSL on MIPS platforms. Fixed in OpenSSL 3.0.1 (Affected 3.0.0). Fixed in OpenSSL 1.1.1m (Affected 1.1.1-1.1.1l). Fixed in OpenSSL 1.0.2zc-dev (Affected 1.0.2-1.0.2zb)."}]},{"artifact":{"id":"d308e84bddad0b0f","cpes":["cpe:2.3:a:openssl:openssl:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1d-0+deb10u8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-4160","versionConstraint":"< 1.1.1d-0+deb10u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-4160","fix":{"state":"fixed","versions":["1.1.1d-0+deb10u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1d-0+deb10u8"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-4160","date":"2026-10-08","epss":0.03772,"percentile":0.89654}],"risk":2.05574,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5103-1","link":"https://security-tracker.debian.org/tracker/DSA-5103-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-4160","description":"There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and include reusing private keys. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH private key among multiple clients, which is no longer an option since CVE-2016-0701. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0.0. It was addressed in the releases of 1.1.1m and 3.0.1 on the 15th of December 2021. For the 1.0.2 release it is addressed in git commit 6fc1aaaf3 that is available to premium support customers only. It will be made available in 1.0.2zc when it is released. The issue only affects OpenSSL on MIPS platforms. Fixed in OpenSSL 3.0.1 (Affected 3.0.0). Fixed in OpenSSL 1.1.1m (Affected 1.1.1-1.1.1l). Fixed in OpenSSL 1.0.2zc-dev (Affected 1.0.2-1.0.2zb)."},"relatedVulnerabilities":[{"id":"CVE-2021-4160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-4160","date":"2026-10-08","epss":0.03772,"percentile":0.89654}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3bf7b73ea7123045b8f972badc67ed6878e6c37f","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6fc1aaaf303185aa5e483e06bdfae16daa9193a7","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e9e726506cd2a3fd9c0f12daf8cc1fe934c7dddb","https://security.gentoo.org/glsa/202210-02","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2022/dsa-5103","https://www.openssl.org/news/secadv/20220128.txt","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-4160","description":"There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and include reusing private keys. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH private key among multiple clients, which is no longer an option since CVE-2016-0701. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0.0. It was addressed in the releases of 1.1.1m and 3.0.1 on the 15th of December 2021. For the 1.0.2 release it is addressed in git commit 6fc1aaaf3 that is available to premium support customers only. It will be made available in 1.0.2zc when it is released. The issue only affects OpenSSL on MIPS platforms. Fixed in OpenSSL 3.0.1 (Affected 3.0.0). Fixed in OpenSSL 1.1.1m (Affected 1.1.1-1.1.1l). Fixed in OpenSSL 1.0.2zc-dev (Affected 1.0.2-1.0.2zb)."}]},{"artifact":{"id":"72c1823bc1859d07","cpes":["cpe:2.3:a:libhogweed4:libhogweed4:3.4.1-1:*:*:*:*:*:*:*"],"name":"libhogweed4","purl":"pkg:deb/debian/libhogweed4@3.4.1-1?arch=amd64&distro=debian-10.1&upstream=nettle","type":"deb","version":"3.4.1-1","language":"","licenses":["GAP","GPL","GPL-2","GPL-2+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1+","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnettle6/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libhogweed4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libhogweed4:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libhogweed4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nettle"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.1-1+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3580","versionConstraint":"< 3.4.1-1+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"nettle","version":"3.4.1-1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-3580","fix":{"state":"fixed","versions":["3.4.1-1+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.4.1-1+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3580","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3580","cwe":"CWE-20","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3580","date":"2026-10-08","epss":0.02708,"percentile":0.85537}],"risk":2.031,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4933-1","link":"https://security-tracker.debian.org/tracker/DSA-4933-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-3580","description":"A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service."},"relatedVulnerabilities":[{"id":"CVE-2021-3580","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3580","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3580","cwe":"CWE-20","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3580","date":"2026-10-08","epss":0.02708,"percentile":0.85537}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1967983","https://lists.debian.org/debian-lts-announce/2021/09/msg00008.html","https://security.gentoo.org/glsa/202401-24","https://security.netapp.com/advisory/ntap-20211104-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3580","description":"A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service."}]},{"artifact":{"id":"ecafc2436bdacd60","cpes":["cpe:2.3:a:libnettle6:libnettle6:3.4.1-1:*:*:*:*:*:*:*"],"name":"libnettle6","purl":"pkg:deb/debian/libnettle6@3.4.1-1?arch=amd64&distro=debian-10.1&upstream=nettle","type":"deb","version":"3.4.1-1","language":"","licenses":["GAP","GPL","GPL-2","GPL-2+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1+","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnettle6/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libnettle6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnettle6:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libnettle6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nettle"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.1-1+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3580","versionConstraint":"< 3.4.1-1+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"nettle","version":"3.4.1-1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-3580","fix":{"state":"fixed","versions":["3.4.1-1+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.4.1-1+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3580","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3580","cwe":"CWE-20","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3580","date":"2026-10-08","epss":0.02708,"percentile":0.85537}],"risk":2.031,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4933-1","link":"https://security-tracker.debian.org/tracker/DSA-4933-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-3580","description":"A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service."},"relatedVulnerabilities":[{"id":"CVE-2021-3580","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3580","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3580","cwe":"CWE-20","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3580","date":"2026-10-08","epss":0.02708,"percentile":0.85537}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1967983","https://lists.debian.org/debian-lts-announce/2021/09/msg00008.html","https://security.gentoo.org/glsa/202401-24","https://security.netapp.com/advisory/ntap-20211104-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3580","description":"A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.14.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0226","versionConstraint":"<1.14.8||>=1.15.0-0,<1.15.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0226","fix":{"state":"fixed","versions":["1.14.8","1.15.1"],"available":[{"date":"2020-09-01","kind":"release","version":"1.14.8"},{"date":"2020-09-01","kind":"release","version":"1.15.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-24553","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-24553","date":"2026-10-08","epss":0.03646,"percentile":0.89288}],"risk":2.0235299999999996,"urls":["https://go.googlesource.com/go/+/4f5cd0c0331943c7ec72df3b827d972584f77833","https://groups.google.com/g/golang-announce/c/8wqlSbkLdPs","https://go.dev/issue/40928"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/252179","description":"When a Handler does not explicitly set the Content-Type header, the the package would default to “text/html”, which could cause a Cross-Site Scripting vulnerability if an attacker can control any part of the contents of a response.\n\nThe Content-Type header is now set based on the contents of the first Write using http.DetectContentType, which is consistent with the behavior of the net/http package.\n\nAlthough this protects some applications that validate the contents of uploaded files, not setting the Content-Type header explicitly on any attacker-controlled file is unsafe and should be avoided."},"relatedVulnerabilities":[{"id":"CVE-2020-24553","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-24553","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-24553","date":"2026-10-08","epss":0.03646,"percentile":0.89288}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00000.html","http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00002.html","http://packetstormsecurity.com/files/159049/Go-CGI-FastCGI-Transport-Cross-Site-Scripting.html","http://seclists.org/fulldisclosure/2020/Sep/5","https://groups.google.com/forum/#%21topic/golang-announce/8wqlSbkLdPs","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CZBO7Q73GGWBVYIKNH2HNN44Q5IQND5W/","https://security.netapp.com/advisory/ntap-20200924-0003/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.redteam-pentesting.de/advisories/rt-sa-2020-004"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-24553","description":"Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.14.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0226","versionConstraint":"<1.14.8||>=1.15.0-0,<1.15.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0226","fix":{"state":"fixed","versions":["1.14.8","1.15.1"],"available":[{"date":"2020-09-01","kind":"release","version":"1.14.8"},{"date":"2020-09-01","kind":"release","version":"1.15.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-24553","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-24553","date":"2026-10-08","epss":0.03646,"percentile":0.89288}],"risk":2.0235299999999996,"urls":["https://go.googlesource.com/go/+/4f5cd0c0331943c7ec72df3b827d972584f77833","https://groups.google.com/g/golang-announce/c/8wqlSbkLdPs","https://go.dev/issue/40928"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/252179","description":"When a Handler does not explicitly set the Content-Type header, the the package would default to “text/html”, which could cause a Cross-Site Scripting vulnerability if an attacker can control any part of the contents of a response.\n\nThe Content-Type header is now set based on the contents of the first Write using http.DetectContentType, which is consistent with the behavior of the net/http package.\n\nAlthough this protects some applications that validate the contents of uploaded files, not setting the Content-Type header explicitly on any attacker-controlled file is unsafe and should be avoided."},"relatedVulnerabilities":[{"id":"CVE-2020-24553","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-24553","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-24553","date":"2026-10-08","epss":0.03646,"percentile":0.89288}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00000.html","http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00002.html","http://packetstormsecurity.com/files/159049/Go-CGI-FastCGI-Transport-Cross-Site-Scripting.html","http://seclists.org/fulldisclosure/2020/Sep/5","https://groups.google.com/forum/#%21topic/golang-announce/8wqlSbkLdPs","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CZBO7Q73GGWBVYIKNH2HNN44Q5IQND5W/","https://security.netapp.com/advisory/ntap-20200924-0003/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.redteam-pentesting.de/advisories/rt-sa-2020-004"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-24553","description":"Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header."}]},{"artifact":{"id":"727332619043e05d","cpes":["cpe:2.3:a:golang:networking:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.0.0-20190404232315-eb5bcb51f2a3","type":"go-module","version":"v0.0.0-20190404232315-eb5bcb51f2a3","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.0.0-20210428140749-89ef3d95e781"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h86h-8ppg-mxmh","versionConstraint":"<0.0.0-20210428140749-89ef3d95e781 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.0.0-20190404232315-eb5bcb51f2a3"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-h86h-8ppg-mxmh","fix":{"state":"fixed","versions":["0.0.0-20210428140749-89ef3d95e781"],"available":[{"date":"2023-02-26","kind":"first-observed","version":"0.0.0-20210428140749-89ef3d95e781"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-31525","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-31525","date":"2026-10-08","epss":0.03692,"percentile":0.89413}],"risk":2.01214,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-31525","https://github.com/golang/go/issues/45710","https://groups.google.com/g/golang-announce/c/cu9SP4eSXMc","https://security.gentoo.org/glsa/202208-02","https://go.dev/cl/313069","https://go.dev/issue/45710","https://go.googlesource.com/net/+/89ef3d95e781148a0951956029c92a211477f7f9","https://pkg.go.dev/vuln/GO-2022-0236","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ISRZZ6NY5R2TBYE72KZFOCO25TEUQTBF"],"severity":"Medium","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h86h-8ppg-mxmh","description":"golang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion"},"relatedVulnerabilities":[{"id":"CVE-2021-31525","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:N/A:P","metrics":{"baseScore":2.6,"impactScore":2.9,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-31525","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-31525","date":"2026-10-08","epss":0.03692,"percentile":0.89413}],"urls":["https://github.com/golang/go/issues/45710","https://groups.google.com/g/golang-announce/c/cu9SP4eSXMc","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ISRZZ6NY5R2TBYE72KZFOCO25TEUQTBF/","https://security.gentoo.org/glsa/202208-02"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-31525","description":"net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations."}]},{"artifact":{"id":"c6f08567c3b7bec6","cpes":["cpe:2.3:a:golang:networking:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.0.0-20190404232315-eb5bcb51f2a3:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.0.0-20190404232315-eb5bcb51f2a3","type":"go-module","version":"v0.0.0-20190404232315-eb5bcb51f2a3","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.0.0-20210428140749-89ef3d95e781"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h86h-8ppg-mxmh","versionConstraint":"<0.0.0-20210428140749-89ef3d95e781 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.0.0-20190404232315-eb5bcb51f2a3"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-h86h-8ppg-mxmh","fix":{"state":"fixed","versions":["0.0.0-20210428140749-89ef3d95e781"],"available":[{"date":"2023-02-26","kind":"first-observed","version":"0.0.0-20210428140749-89ef3d95e781"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-31525","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-31525","date":"2026-10-08","epss":0.03692,"percentile":0.89413}],"risk":2.01214,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-31525","https://github.com/golang/go/issues/45710","https://groups.google.com/g/golang-announce/c/cu9SP4eSXMc","https://security.gentoo.org/glsa/202208-02","https://go.dev/cl/313069","https://go.dev/issue/45710","https://go.googlesource.com/net/+/89ef3d95e781148a0951956029c92a211477f7f9","https://pkg.go.dev/vuln/GO-2022-0236","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ISRZZ6NY5R2TBYE72KZFOCO25TEUQTBF"],"severity":"Medium","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h86h-8ppg-mxmh","description":"golang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion"},"relatedVulnerabilities":[{"id":"CVE-2021-31525","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:N/A:P","metrics":{"baseScore":2.6,"impactScore":2.9,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-31525","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-31525","date":"2026-10-08","epss":0.03692,"percentile":0.89413}],"urls":["https://github.com/golang/go/issues/45710","https://groups.google.com/g/golang-announce/c/cu9SP4eSXMc","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ISRZZ6NY5R2TBYE72KZFOCO25TEUQTBF/","https://security.gentoo.org/glsa/202208-02"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-31525","description":"net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.15.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0236","versionConstraint":"<1.15.12||>=1.16.0-0,<1.16.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0236","fix":{"state":"fixed","versions":["1.15.12","1.16.4"],"available":[{"date":"2021-05-06","kind":"release","version":"1.15.12"},{"date":"2021-05-06","kind":"release","version":"1.16.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-31525","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-31525","date":"2026-10-08","epss":0.03692,"percentile":0.89413}],"risk":2.01214,"urls":["https://go.googlesource.com/net/+/89ef3d95e781148a0951956029c92a211477f7f9","https://go.dev/issue/45710","https://groups.google.com/g/golang-announce/c/cu9SP4eSXMc"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/313069","description":"A malicious HTTP server or client can cause the net/http client or server to panic.\n\nReadRequest and ReadResponse can hit an unrecoverable panic when reading a very large header (over 7MB on 64-bit architectures, or over 4MB on 32-bit ones). Transport and Client are vulnerable and the program can be made to crash by a malicious server. Server is not vulnerable by default, but can be if the default max header of 1MB is overridden by setting Server.MaxHeaderBytes to a higher value, in which case the program can be made to crash by a malicious client.\n\nThis also affects golang.org/x/net/http2/h2c and HeaderValuesContainsToken in golang.org/x/net/http/httpguts."},"relatedVulnerabilities":[{"id":"CVE-2021-31525","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:N/A:P","metrics":{"baseScore":2.6,"impactScore":2.9,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-31525","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-31525","date":"2026-10-08","epss":0.03692,"percentile":0.89413}],"urls":["https://github.com/golang/go/issues/45710","https://groups.google.com/g/golang-announce/c/cu9SP4eSXMc","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ISRZZ6NY5R2TBYE72KZFOCO25TEUQTBF/","https://security.gentoo.org/glsa/202208-02"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-31525","description":"net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations."},{"id":"GHSA-h86h-8ppg-mxmh","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-31525","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-31525","date":"2026-10-08","epss":0.03692,"percentile":0.89413}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-31525","https://github.com/golang/go/issues/45710","https://groups.google.com/g/golang-announce/c/cu9SP4eSXMc","https://security.gentoo.org/glsa/202208-02","https://go.dev/cl/313069","https://go.dev/issue/45710","https://go.googlesource.com/net/+/89ef3d95e781148a0951956029c92a211477f7f9","https://pkg.go.dev/vuln/GO-2022-0236","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ISRZZ6NY5R2TBYE72KZFOCO25TEUQTBF"],"severity":"Medium","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-h86h-8ppg-mxmh","description":"golang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion"}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.15.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0236","versionConstraint":"<1.15.12||>=1.16.0-0,<1.16.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0236","fix":{"state":"fixed","versions":["1.15.12","1.16.4"],"available":[{"date":"2021-05-06","kind":"release","version":"1.15.12"},{"date":"2021-05-06","kind":"release","version":"1.16.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-31525","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-31525","date":"2026-10-08","epss":0.03692,"percentile":0.89413}],"risk":2.01214,"urls":["https://go.googlesource.com/net/+/89ef3d95e781148a0951956029c92a211477f7f9","https://go.dev/issue/45710","https://groups.google.com/g/golang-announce/c/cu9SP4eSXMc"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/313069","description":"A malicious HTTP server or client can cause the net/http client or server to panic.\n\nReadRequest and ReadResponse can hit an unrecoverable panic when reading a very large header (over 7MB on 64-bit architectures, or over 4MB on 32-bit ones). Transport and Client are vulnerable and the program can be made to crash by a malicious server. Server is not vulnerable by default, but can be if the default max header of 1MB is overridden by setting Server.MaxHeaderBytes to a higher value, in which case the program can be made to crash by a malicious client.\n\nThis also affects golang.org/x/net/http2/h2c and HeaderValuesContainsToken in golang.org/x/net/http/httpguts."},"relatedVulnerabilities":[{"id":"CVE-2021-31525","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:N/A:P","metrics":{"baseScore":2.6,"impactScore":2.9,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-31525","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-31525","date":"2026-10-08","epss":0.03692,"percentile":0.89413}],"urls":["https://github.com/golang/go/issues/45710","https://groups.google.com/g/golang-announce/c/cu9SP4eSXMc","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ISRZZ6NY5R2TBYE72KZFOCO25TEUQTBF/","https://security.gentoo.org/glsa/202208-02"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-31525","description":"net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations."},{"id":"GHSA-h86h-8ppg-mxmh","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-31525","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-31525","date":"2026-10-08","epss":0.03692,"percentile":0.89413}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-31525","https://github.com/golang/go/issues/45710","https://groups.google.com/g/golang-announce/c/cu9SP4eSXMc","https://security.gentoo.org/glsa/202208-02","https://go.dev/cl/313069","https://go.dev/issue/45710","https://go.googlesource.com/net/+/89ef3d95e781148a0951956029c92a211477f7f9","https://pkg.go.dev/vuln/GO-2022-0236","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ISRZZ6NY5R2TBYE72KZFOCO25TEUQTBF"],"severity":"Medium","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-h86h-8ppg-mxmh","description":"golang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion"}]},{"artifact":{"id":"7f19231bca942dc4","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/debian/libldap-2.4-2@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-25710","versionConstraint":"< 2.4.47+dfsg-3+deb10u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-25710","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25710","cwe":"CWE-617","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25710","date":"2026-10-08","epss":0.02666,"percentile":0.85292}],"risk":1.9994999999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4792-1","link":"https://security-tracker.debian.org/tracker/DSA-4792-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-25710","description":"A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this vulnerability is to system availability."},"relatedVulnerabilities":[{"id":"CVE-2020-25710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25710","cwe":"CWE-617","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25710","date":"2026-10-08","epss":0.02666,"percentile":0.85292}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1899678","https://git.openldap.org/openldap/openldap/-/commit/ab3915154e69920d480205b4bf5ccb2b391a0a1f#a2feb6ed0257c21c6672793ee2f94eaadc10c72c","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00008.html","https://security.netapp.com/advisory/ntap-20210716-0003/","https://www.debian.org/security/2020/dsa-4792"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-25710","description":"A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this vulnerability is to system availability."}]},{"artifact":{"id":"ed53a6639a2640b0","cpes":["cpe:2.3:a:libldap-common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-common","purl":"pkg:deb/debian/libldap-common@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=all&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-common/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.list"}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-25710","versionConstraint":"< 2.4.47+dfsg-3+deb10u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-25710","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25710","cwe":"CWE-617","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25710","date":"2026-10-08","epss":0.02666,"percentile":0.85292}],"risk":1.9994999999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4792-1","link":"https://security-tracker.debian.org/tracker/DSA-4792-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-25710","description":"A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this vulnerability is to system availability."},"relatedVulnerabilities":[{"id":"CVE-2020-25710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25710","cwe":"CWE-617","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25710","date":"2026-10-08","epss":0.02666,"percentile":0.85292}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1899678","https://git.openldap.org/openldap/openldap/-/commit/ab3915154e69920d480205b4bf5ccb2b391a0a1f#a2feb6ed0257c21c6672793ee2f94eaadc10c72c","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00008.html","https://security.netapp.com/advisory/ntap-20210716-0003/","https://www.debian.org/security/2020/dsa-4792"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-25710","description":"A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this vulnerability is to system availability."}]},{"artifact":{"id":"ecf5e89e65014edb","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.64.0-4:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/debian/libcurl4@7.64.0-4?arch=amd64&distro=debian-10.1&upstream=curl","type":"deb","version":"7.64.0-4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.64.0-4+deb10u7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-38546","versionConstraint":"< 7.64.0-4+deb10u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"curl","version":"7.64.0-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-38546","fix":{"state":"fixed","versions":["7.64.0-4+deb10u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.64.0-4+deb10u7"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-38546","date":"2026-10-08","epss":0.05956,"percentile":0.931}],"risk":1.9952599999999998,"urls":[],"severity":"Low","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-38546","description":"This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met.  libcurl performs transfers. In its API, an application creates \"easy handles\" that are the individual handles for single transfers.  libcurl provides a function call that duplicates en easy handle called [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html).  If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as `none` (using the four ASCII letters, no quotes).  Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course."},"relatedVulnerabilities":[{"id":"CVE-2023-38546","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-38546","date":"2026-10-08","epss":0.05956,"percentile":0.931}],"urls":["http://seclists.org/fulldisclosure/2024/Jan/34","http://seclists.org/fulldisclosure/2024/Jan/37","http://seclists.org/fulldisclosure/2024/Jan/38","https://curl.se/docs/CVE-2023-38546.html","https://forum.vmssoftware.com/viewtopic.php?f=8&t=8868","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ/","https://support.apple.com/kb/HT214036","https://support.apple.com/kb/HT214057","https://support.apple.com/kb/HT214058","https://support.apple.com/kb/HT214063","https://lists.debian.org/debian-lts-announce/2023/10/msg00016.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-093430.html","https://cert-portal.siemens.com/productcert/html/ssa-832273.html","https://cert-portal.siemens.com/productcert/html/ssa-943925.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-38546","description":"This flaw allows an attacker to insert cookies at will into a running program\nusing libcurl, if the specific series of conditions are met.\n\nlibcurl performs transfers. In its API, an application creates \"easy handles\"\nthat are the individual handles for single transfers.\n\nlibcurl provides a function call that duplicates en easy handle called\n[curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html).\n\nIf a transfer has cookies enabled when the handle is duplicated, the\ncookie-enable state is also cloned - but without cloning the actual\ncookies. If the source handle did not read any cookies from a specific file on\ndisk, the cloned version of the handle would instead store the file name as\n`none` (using the four ASCII letters, no quotes).\n\nSubsequent use of the cloned handle that does not explicitly set a source to\nload cookies from would then inadvertently load cookies from a file named\n`none` - if such a file exists and is readable in the current directory of the\nprogram using libcurl. And if using the correct file format of course."}]},{"artifact":{"id":"fd336d60afd415f8","cpes":["cpe:2.3:a:libtasn1-6:libtasn1-6:4.13-3:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1-6:libtasn1_6:4.13-3:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1-6:4.13-3:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1_6:4.13-3:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1-6:4.13-3:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1_6:4.13-3:*:*:*:*:*:*:*"],"name":"libtasn1-6","purl":"pkg:deb/debian/libtasn1-6@4.13-3?arch=amd64&distro=debian-10.1","type":"deb","version":"4.13-3","language":"","licenses":["sha256:dc1e5deaae0e497cdf0833a38742749695ad77fb8cfb5ef1e608724e6add9c81"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtasn1-6/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libtasn1-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.13-3+deb10u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-46848","versionConstraint":"< 4.13-3+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"libtasn1-6","version":"4.13-3"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-46848","fix":{"state":"fixed","versions":["4.13-3+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"4.13-3+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-46848","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-46848","cwe":"CWE-193","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-46848","date":"2026-10-08","epss":0.02203,"percentile":0.81992}],"risk":1.9937150000000001,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-46848","description":"GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der."},"relatedVulnerabilities":[{"id":"CVE-2021-46848","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-46848","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-46848","cwe":"CWE-193","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-46848","date":"2026-10-08","epss":0.02203,"percentile":0.81992}],"urls":["https://bugs.gentoo.org/866237","https://gitlab.com/gnutls/libtasn1/-/commit/44a700d2051a666235748970c2df047ff207aeb5","https://gitlab.com/gnutls/libtasn1/-/issues/32","https://lists.debian.org/debian-lts-announce/2023/01/msg00003.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AV4SHDJF2XLB4CUPTBPQQ6CLGZ5LKXPZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ECM2ELTVRYV4BZ5L5GMIRQE27RFHPAQ6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGO7XST4EIJGX4B2ITZCYSWM24534BSU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V5LWOGF7QRMNFRUCZY6TDYQJVFI6MOQ2/","https://security.netapp.com/advisory/ntap-20221118-0006/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-46848","description":"GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der."}]},{"artifact":{"id":"9c0f03079e497030","cpes":["cpe:2.3:a:libpython3.7-minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-minimal","purl":"pkg:deb/debian/libpython3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-45061","versionConstraint":"< 3.7.3-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-45061","fix":{"state":"fixed","versions":["3.7.3-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-45061","cwe":"CWE-407","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-45061","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-45061","date":"2026-10-08","epss":0.02653,"percentile":0.85219}],"risk":1.9897500000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-45061","description":"An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16."},"relatedVulnerabilities":[{"id":"CVE-2022-45061","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-45061","cwe":"CWE-407","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-45061","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-45061","date":"2026-10-08","epss":0.02653,"percentile":0.85219}],"urls":["https://github.com/python/cpython/issues/98433","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2AOUKI72ACV6CHY2QUFO6VK2DNMVJ2MB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35YDIWCUMWTMDBWFRAVENFH6BLB65D6S/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4WBZJNSALFGMPYTINIF57HAAK46U72WQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FS6VHY4DCS74HBTEINUDOECQ2X6ZCH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WQPHKGNXUJC3TC3BDW5RKGROWRJVSFR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B3YI6JYARWU6GULWOHNUROSACT54XFFS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4MYQ3IV6NWA4CKSXEHW45CH2YNDHEPH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BWJREJHWVRBYDP43YB5WRL3QC7UBA7BR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTPVDZDATRQFE6KAT6B4BQIQ4GRHIIIJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN26PWZTYG6IF3APLRXQJBVACQHZUPT2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCDJXNBHWXNYUTOEV4H2HCFSRKV3SYL3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JTYVESWVBPD57ZJC35G5722Q6TS37WSB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KNE4GMD45RGC2HWUAAIGTDHT5VJ2E4O4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKWAMPURWUV3DCCT4J7VHRF4NT2CFVBR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O67LRHDTJWH544KXB6KY4HMHQLYDXFPK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORVCQGJCCAVLN4DJDTWGREFCUWXKQRML/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLQ2BNZVBBAQPV3SPRU24ZD37UYJJS7W/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QCKD4AFBHXIMHS64ZER2U7QRT33HNE7L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QLUGZSEAO3MBWGKCUSMKQIRYJZKJCIOB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDK3ZZBRYFO47ET3N4BNTKVXN47U6ICY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RH57BNT4VQERGEJ5SXNXSVMDYP66YD4H/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTN2OOLKYTG34DODUEJGT5MLC2PFGPBA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T3D5TX4TDJPXHXD2QICKTY3OCQC3JARP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UHVW73QZJMHA4MK7JBT7CXX7XSNYQEGF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCMDX6IFKLOA3NXUQEV524L5LHTPI2JI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3EJ6J7PXVQOULBQZQGBXCXY6LFF6LZD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XXZJL3CNAFS5PAIR7K4RL62S3Y7THR7O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPNWZKXPKTNHS5FVMN7UQZ2UPCSEFJUK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB5YCMIRVX35RUB6XPOWKENCVCJEVDRK/","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20221209-0007/","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://discuss.python.org/t/python-3-11-1-3-10-9-3-9-16-3-8-16-3-7-16-and-3-12-0-alpha-3-are-now-available/21724"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-45061","description":"An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16."}]},{"artifact":{"id":"b6d8c37141cd8c0a","cpes":["cpe:2.3:a:libpython3.7-stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-stdlib","purl":"pkg:deb/debian/libpython3.7-stdlib@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-45061","versionConstraint":"< 3.7.3-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-45061","fix":{"state":"fixed","versions":["3.7.3-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-45061","cwe":"CWE-407","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-45061","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-45061","date":"2026-10-08","epss":0.02653,"percentile":0.85219}],"risk":1.9897500000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-45061","description":"An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16."},"relatedVulnerabilities":[{"id":"CVE-2022-45061","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-45061","cwe":"CWE-407","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-45061","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-45061","date":"2026-10-08","epss":0.02653,"percentile":0.85219}],"urls":["https://github.com/python/cpython/issues/98433","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2AOUKI72ACV6CHY2QUFO6VK2DNMVJ2MB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35YDIWCUMWTMDBWFRAVENFH6BLB65D6S/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4WBZJNSALFGMPYTINIF57HAAK46U72WQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FS6VHY4DCS74HBTEINUDOECQ2X6ZCH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WQPHKGNXUJC3TC3BDW5RKGROWRJVSFR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B3YI6JYARWU6GULWOHNUROSACT54XFFS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4MYQ3IV6NWA4CKSXEHW45CH2YNDHEPH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BWJREJHWVRBYDP43YB5WRL3QC7UBA7BR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTPVDZDATRQFE6KAT6B4BQIQ4GRHIIIJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN26PWZTYG6IF3APLRXQJBVACQHZUPT2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCDJXNBHWXNYUTOEV4H2HCFSRKV3SYL3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JTYVESWVBPD57ZJC35G5722Q6TS37WSB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KNE4GMD45RGC2HWUAAIGTDHT5VJ2E4O4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKWAMPURWUV3DCCT4J7VHRF4NT2CFVBR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O67LRHDTJWH544KXB6KY4HMHQLYDXFPK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORVCQGJCCAVLN4DJDTWGREFCUWXKQRML/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLQ2BNZVBBAQPV3SPRU24ZD37UYJJS7W/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QCKD4AFBHXIMHS64ZER2U7QRT33HNE7L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QLUGZSEAO3MBWGKCUSMKQIRYJZKJCIOB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDK3ZZBRYFO47ET3N4BNTKVXN47U6ICY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RH57BNT4VQERGEJ5SXNXSVMDYP66YD4H/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTN2OOLKYTG34DODUEJGT5MLC2PFGPBA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T3D5TX4TDJPXHXD2QICKTY3OCQC3JARP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UHVW73QZJMHA4MK7JBT7CXX7XSNYQEGF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCMDX6IFKLOA3NXUQEV524L5LHTPI2JI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3EJ6J7PXVQOULBQZQGBXCXY6LFF6LZD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XXZJL3CNAFS5PAIR7K4RL62S3Y7THR7O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPNWZKXPKTNHS5FVMN7UQZ2UPCSEFJUK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB5YCMIRVX35RUB6XPOWKENCVCJEVDRK/","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20221209-0007/","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://discuss.python.org/t/python-3-11-1-3-10-9-3-9-16-3-8-16-3-7-16-and-3-12-0-alpha-3-are-now-available/21724"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-45061","description":"An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16."}]},{"artifact":{"id":"94955c7d71be2bb1","cpes":["cpe:2.3:a:python3.7:python3.7:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7","purl":"pkg:deb/debian/python3.7@3.7.3-2?arch=amd64&distro=debian-10.1","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.list"},{"path":"/var/lib/dpkg/info/python3.7.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.postinst"},{"path":"/var/lib/dpkg/info/python3.7.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-45061","versionConstraint":"< 3.7.3-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-45061","fix":{"state":"fixed","versions":["3.7.3-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-45061","cwe":"CWE-407","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-45061","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-45061","date":"2026-10-08","epss":0.02653,"percentile":0.85219}],"risk":1.9897500000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-45061","description":"An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16."},"relatedVulnerabilities":[{"id":"CVE-2022-45061","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-45061","cwe":"CWE-407","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-45061","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-45061","date":"2026-10-08","epss":0.02653,"percentile":0.85219}],"urls":["https://github.com/python/cpython/issues/98433","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2AOUKI72ACV6CHY2QUFO6VK2DNMVJ2MB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35YDIWCUMWTMDBWFRAVENFH6BLB65D6S/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4WBZJNSALFGMPYTINIF57HAAK46U72WQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FS6VHY4DCS74HBTEINUDOECQ2X6ZCH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WQPHKGNXUJC3TC3BDW5RKGROWRJVSFR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B3YI6JYARWU6GULWOHNUROSACT54XFFS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4MYQ3IV6NWA4CKSXEHW45CH2YNDHEPH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BWJREJHWVRBYDP43YB5WRL3QC7UBA7BR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTPVDZDATRQFE6KAT6B4BQIQ4GRHIIIJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN26PWZTYG6IF3APLRXQJBVACQHZUPT2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCDJXNBHWXNYUTOEV4H2HCFSRKV3SYL3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JTYVESWVBPD57ZJC35G5722Q6TS37WSB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KNE4GMD45RGC2HWUAAIGTDHT5VJ2E4O4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKWAMPURWUV3DCCT4J7VHRF4NT2CFVBR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O67LRHDTJWH544KXB6KY4HMHQLYDXFPK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORVCQGJCCAVLN4DJDTWGREFCUWXKQRML/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLQ2BNZVBBAQPV3SPRU24ZD37UYJJS7W/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QCKD4AFBHXIMHS64ZER2U7QRT33HNE7L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QLUGZSEAO3MBWGKCUSMKQIRYJZKJCIOB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDK3ZZBRYFO47ET3N4BNTKVXN47U6ICY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RH57BNT4VQERGEJ5SXNXSVMDYP66YD4H/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTN2OOLKYTG34DODUEJGT5MLC2PFGPBA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T3D5TX4TDJPXHXD2QICKTY3OCQC3JARP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UHVW73QZJMHA4MK7JBT7CXX7XSNYQEGF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCMDX6IFKLOA3NXUQEV524L5LHTPI2JI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3EJ6J7PXVQOULBQZQGBXCXY6LFF6LZD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XXZJL3CNAFS5PAIR7K4RL62S3Y7THR7O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPNWZKXPKTNHS5FVMN7UQZ2UPCSEFJUK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB5YCMIRVX35RUB6XPOWKENCVCJEVDRK/","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20221209-0007/","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://discuss.python.org/t/python-3-11-1-3-10-9-3-9-16-3-8-16-3-7-16-and-3-12-0-alpha-3-are-now-available/21724"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-45061","description":"An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16."}]},{"artifact":{"id":"988c8a69c0d8509e","cpes":["cpe:2.3:a:python3.7-minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7-minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7-minimal","purl":"pkg:deb/debian/python3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.list"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.7-minimal.preinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.prerm"}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-45061","versionConstraint":"< 3.7.3-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-45061","fix":{"state":"fixed","versions":["3.7.3-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-45061","cwe":"CWE-407","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-45061","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-45061","date":"2026-10-08","epss":0.02653,"percentile":0.85219}],"risk":1.9897500000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-45061","description":"An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16."},"relatedVulnerabilities":[{"id":"CVE-2022-45061","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-45061","cwe":"CWE-407","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-45061","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-45061","date":"2026-10-08","epss":0.02653,"percentile":0.85219}],"urls":["https://github.com/python/cpython/issues/98433","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2AOUKI72ACV6CHY2QUFO6VK2DNMVJ2MB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35YDIWCUMWTMDBWFRAVENFH6BLB65D6S/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4WBZJNSALFGMPYTINIF57HAAK46U72WQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FS6VHY4DCS74HBTEINUDOECQ2X6ZCH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WQPHKGNXUJC3TC3BDW5RKGROWRJVSFR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B3YI6JYARWU6GULWOHNUROSACT54XFFS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4MYQ3IV6NWA4CKSXEHW45CH2YNDHEPH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BWJREJHWVRBYDP43YB5WRL3QC7UBA7BR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTPVDZDATRQFE6KAT6B4BQIQ4GRHIIIJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN26PWZTYG6IF3APLRXQJBVACQHZUPT2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCDJXNBHWXNYUTOEV4H2HCFSRKV3SYL3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JTYVESWVBPD57ZJC35G5722Q6TS37WSB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KNE4GMD45RGC2HWUAAIGTDHT5VJ2E4O4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKWAMPURWUV3DCCT4J7VHRF4NT2CFVBR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O67LRHDTJWH544KXB6KY4HMHQLYDXFPK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORVCQGJCCAVLN4DJDTWGREFCUWXKQRML/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLQ2BNZVBBAQPV3SPRU24ZD37UYJJS7W/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QCKD4AFBHXIMHS64ZER2U7QRT33HNE7L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QLUGZSEAO3MBWGKCUSMKQIRYJZKJCIOB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDK3ZZBRYFO47ET3N4BNTKVXN47U6ICY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RH57BNT4VQERGEJ5SXNXSVMDYP66YD4H/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTN2OOLKYTG34DODUEJGT5MLC2PFGPBA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T3D5TX4TDJPXHXD2QICKTY3OCQC3JARP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UHVW73QZJMHA4MK7JBT7CXX7XSNYQEGF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCMDX6IFKLOA3NXUQEV524L5LHTPI2JI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3EJ6J7PXVQOULBQZQGBXCXY6LFF6LZD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XXZJL3CNAFS5PAIR7K4RL62S3Y7THR7O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPNWZKXPKTNHS5FVMN7UQZ2UPCSEFJUK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB5YCMIRVX35RUB6XPOWKENCVCJEVDRK/","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20221209-0007/","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://discuss.python.org/t/python-3-11-1-3-10-9-3-9-16-3-8-16-3-7-16-and-3-12-0-alpha-3-are-now-available/21724"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-45061","description":"An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16."}]},{"artifact":{"id":"763298202c68f152","cpes":["cpe:2.3:a:golang:crypto:v0.0.0-20190701094942-4def268fd1a4:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.0.0-20190701094942-4def268fd1a4:*:*:*:*:go:*:*"],"name":"golang.org/x/crypto","purl":"pkg:golang/golang.org/x/crypto@v0.0.0-20190701094942-4def268fd1a4","type":"go-module","version":"v0.0.0-20190701094942-4def268fd1a4","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.0.0-20200124225646-8b5121be2f68"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cjjc-xp8v-855w","versionConstraint":"<0.0.0-20200124225646-8b5121be2f68 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/crypto","version":"v0.0.0-20190701094942-4def268fd1a4"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-cjjc-xp8v-855w","fix":{"state":"fixed","versions":["0.0.0-20200124225646-8b5121be2f68"],"available":[{"date":"2023-02-18","kind":"first-observed","version":"0.0.0-20200124225646-8b5121be2f68"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-7919","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-7919","date":"2026-10-08","epss":0.02647,"percentile":0.85169}],"risk":1.9852500000000002,"urls":["https://github.com/helm/helm/security/advisories/GHSA-cjjc-xp8v-855w","https://nvd.nist.gov/vuln/detail/CVE-2020-7919","https://groups.google.com/forum/#!forum/golang-announce","https://groups.google.com/forum/#!topic/golang-announce/-sdUB4VEQkA","https://groups.google.com/forum/#!topic/golang-announce/Hsw4mHYc470","https://www.debian.org/security/2021/dsa-4848","https://www.oracle.com/security-alerts/cpuApr2021.html","https://go.dev/cl/216677","https://go.dev/cl/216680","https://go.dev/issue/36837","https://go.googlesource.com/go/+/b13ce14c4a6aa59b7b041ad2b6eed2d23e15b574","https://groups.google.com/g/golang-announce/c/Hsw4mHYc470","https://pkg.go.dev/vuln/GO-2022-0229","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S43VLYRURELDWX4D5RFOYBNFGO6CGBBC","https://security.netapp.com/advisory/ntap-20200327-0001"],"severity":"High","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cjjc-xp8v-855w","description":"Helm uses crypto package vulnerable to panic from malformed X.509 certificate"},"relatedVulnerabilities":[{"id":"CVE-2020-7919","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-7919","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-7919","date":"2026-10-08","epss":0.02647,"percentile":0.85169}],"urls":["https://groups.google.com/forum/#%21forum/golang-announce","https://groups.google.com/forum/#%21topic/golang-announce/-sdUB4VEQkA","https://groups.google.com/forum/#%21topic/golang-announce/Hsw4mHYc470","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S43VLYRURELDWX4D5RFOYBNFGO6CGBBC/","https://security.netapp.com/advisory/ntap-20200327-0001/","https://www.debian.org/security/2021/dsa-4848","https://www.oracle.com/security-alerts/cpuApr2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7919","description":"Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate."}]},{"artifact":{"id":"524ae46feda9a236","cpes":["cpe:2.3:a:golang:crypto:v0.0.0-20190701094942-4def268fd1a4:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.0.0-20190701094942-4def268fd1a4:*:*:*:*:go:*:*"],"name":"golang.org/x/crypto","purl":"pkg:golang/golang.org/x/crypto@v0.0.0-20190701094942-4def268fd1a4","type":"go-module","version":"v0.0.0-20190701094942-4def268fd1a4","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.0.0-20200124225646-8b5121be2f68"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cjjc-xp8v-855w","versionConstraint":"<0.0.0-20200124225646-8b5121be2f68 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/crypto","version":"v0.0.0-20190701094942-4def268fd1a4"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-cjjc-xp8v-855w","fix":{"state":"fixed","versions":["0.0.0-20200124225646-8b5121be2f68"],"available":[{"date":"2023-02-18","kind":"first-observed","version":"0.0.0-20200124225646-8b5121be2f68"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-7919","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-7919","date":"2026-10-08","epss":0.02647,"percentile":0.85169}],"risk":1.9852500000000002,"urls":["https://github.com/helm/helm/security/advisories/GHSA-cjjc-xp8v-855w","https://nvd.nist.gov/vuln/detail/CVE-2020-7919","https://groups.google.com/forum/#!forum/golang-announce","https://groups.google.com/forum/#!topic/golang-announce/-sdUB4VEQkA","https://groups.google.com/forum/#!topic/golang-announce/Hsw4mHYc470","https://www.debian.org/security/2021/dsa-4848","https://www.oracle.com/security-alerts/cpuApr2021.html","https://go.dev/cl/216677","https://go.dev/cl/216680","https://go.dev/issue/36837","https://go.googlesource.com/go/+/b13ce14c4a6aa59b7b041ad2b6eed2d23e15b574","https://groups.google.com/g/golang-announce/c/Hsw4mHYc470","https://pkg.go.dev/vuln/GO-2022-0229","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S43VLYRURELDWX4D5RFOYBNFGO6CGBBC","https://security.netapp.com/advisory/ntap-20200327-0001"],"severity":"High","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cjjc-xp8v-855w","description":"Helm uses crypto package vulnerable to panic from malformed X.509 certificate"},"relatedVulnerabilities":[{"id":"CVE-2020-7919","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-7919","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-7919","date":"2026-10-08","epss":0.02647,"percentile":0.85169}],"urls":["https://groups.google.com/forum/#%21forum/golang-announce","https://groups.google.com/forum/#%21topic/golang-announce/-sdUB4VEQkA","https://groups.google.com/forum/#%21topic/golang-announce/Hsw4mHYc470","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S43VLYRURELDWX4D5RFOYBNFGO6CGBBC/","https://security.netapp.com/advisory/ntap-20200327-0001/","https://www.debian.org/security/2021/dsa-4848","https://www.oracle.com/security-alerts/cpuApr2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7919","description":"Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.13.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0229","versionConstraint":"<1.12.16||>=1.13.0-0,<1.13.7 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0229","fix":{"state":"fixed","versions":["1.12.16","1.13.7"],"available":[{"date":"2020-01-27","kind":"release","version":"1.12.16"},{"date":"2020-01-27","kind":"release","version":"1.13.7"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-7919","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-7919","date":"2026-10-08","epss":0.02647,"percentile":0.85169}],"risk":1.9852500000000002,"urls":["https://go.googlesource.com/go/+/b13ce14c4a6aa59b7b041ad2b6eed2d23e15b574","https://go.dev/cl/216677","https://go.dev/issue/36837","https://groups.google.com/g/golang-announce/c/Hsw4mHYc470"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/216680","description":"On 32-bit architectures, a malformed input to crypto/x509 or the ASN.1 parsing functions of golang.org/x/crypto/cryptobyte can lead to a panic.\n\nThe malformed certificate can be delivered via a crypto/tls connection to a client, or to a server that accepts client certificates. net/http clients can be made to crash by an HTTPS server, while net/http servers that accept client certificates will recover the panic and are unaffected."},"relatedVulnerabilities":[{"id":"CVE-2020-7919","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-7919","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-7919","date":"2026-10-08","epss":0.02647,"percentile":0.85169}],"urls":["https://groups.google.com/forum/#%21forum/golang-announce","https://groups.google.com/forum/#%21topic/golang-announce/-sdUB4VEQkA","https://groups.google.com/forum/#%21topic/golang-announce/Hsw4mHYc470","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S43VLYRURELDWX4D5RFOYBNFGO6CGBBC/","https://security.netapp.com/advisory/ntap-20200327-0001/","https://www.debian.org/security/2021/dsa-4848","https://www.oracle.com/security-alerts/cpuApr2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7919","description":"Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate."},{"id":"GHSA-cjjc-xp8v-855w","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-7919","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-7919","date":"2026-10-08","epss":0.02647,"percentile":0.85169}],"urls":["https://github.com/helm/helm/security/advisories/GHSA-cjjc-xp8v-855w","https://nvd.nist.gov/vuln/detail/CVE-2020-7919","https://groups.google.com/forum/#!forum/golang-announce","https://groups.google.com/forum/#!topic/golang-announce/-sdUB4VEQkA","https://groups.google.com/forum/#!topic/golang-announce/Hsw4mHYc470","https://www.debian.org/security/2021/dsa-4848","https://www.oracle.com/security-alerts/cpuApr2021.html","https://go.dev/cl/216677","https://go.dev/cl/216680","https://go.dev/issue/36837","https://go.googlesource.com/go/+/b13ce14c4a6aa59b7b041ad2b6eed2d23e15b574","https://groups.google.com/g/golang-announce/c/Hsw4mHYc470","https://pkg.go.dev/vuln/GO-2022-0229","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S43VLYRURELDWX4D5RFOYBNFGO6CGBBC","https://security.netapp.com/advisory/ntap-20200327-0001"],"severity":"High","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-cjjc-xp8v-855w","description":"Helm uses crypto package vulnerable to panic from malformed X.509 certificate"}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.13.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0229","versionConstraint":"<1.12.16||>=1.13.0-0,<1.13.7 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0229","fix":{"state":"fixed","versions":["1.12.16","1.13.7"],"available":[{"date":"2020-01-27","kind":"release","version":"1.12.16"},{"date":"2020-01-27","kind":"release","version":"1.13.7"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-7919","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-7919","date":"2026-10-08","epss":0.02647,"percentile":0.85169}],"risk":1.9852500000000002,"urls":["https://go.googlesource.com/go/+/b13ce14c4a6aa59b7b041ad2b6eed2d23e15b574","https://go.dev/cl/216677","https://go.dev/issue/36837","https://groups.google.com/g/golang-announce/c/Hsw4mHYc470"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/216680","description":"On 32-bit architectures, a malformed input to crypto/x509 or the ASN.1 parsing functions of golang.org/x/crypto/cryptobyte can lead to a panic.\n\nThe malformed certificate can be delivered via a crypto/tls connection to a client, or to a server that accepts client certificates. net/http clients can be made to crash by an HTTPS server, while net/http servers that accept client certificates will recover the panic and are unaffected."},"relatedVulnerabilities":[{"id":"CVE-2020-7919","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-7919","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-7919","date":"2026-10-08","epss":0.02647,"percentile":0.85169}],"urls":["https://groups.google.com/forum/#%21forum/golang-announce","https://groups.google.com/forum/#%21topic/golang-announce/-sdUB4VEQkA","https://groups.google.com/forum/#%21topic/golang-announce/Hsw4mHYc470","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S43VLYRURELDWX4D5RFOYBNFGO6CGBBC/","https://security.netapp.com/advisory/ntap-20200327-0001/","https://www.debian.org/security/2021/dsa-4848","https://www.oracle.com/security-alerts/cpuApr2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7919","description":"Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate."},{"id":"GHSA-cjjc-xp8v-855w","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-7919","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-7919","date":"2026-10-08","epss":0.02647,"percentile":0.85169}],"urls":["https://github.com/helm/helm/security/advisories/GHSA-cjjc-xp8v-855w","https://nvd.nist.gov/vuln/detail/CVE-2020-7919","https://groups.google.com/forum/#!forum/golang-announce","https://groups.google.com/forum/#!topic/golang-announce/-sdUB4VEQkA","https://groups.google.com/forum/#!topic/golang-announce/Hsw4mHYc470","https://www.debian.org/security/2021/dsa-4848","https://www.oracle.com/security-alerts/cpuApr2021.html","https://go.dev/cl/216677","https://go.dev/cl/216680","https://go.dev/issue/36837","https://go.googlesource.com/go/+/b13ce14c4a6aa59b7b041ad2b6eed2d23e15b574","https://groups.google.com/g/golang-announce/c/Hsw4mHYc470","https://pkg.go.dev/vuln/GO-2022-0229","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S43VLYRURELDWX4D5RFOYBNFGO6CGBBC","https://security.netapp.com/advisory/ntap-20200327-0001"],"severity":"High","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-cjjc-xp8v-855w","description":"Helm uses crypto package vulnerable to panic from malformed X.509 certificate"}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.17.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0537","versionConstraint":"<1.17.13||>=1.18.0-0,<1.18.5 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0537","fix":{"state":"fixed","versions":["1.17.13","1.18.5"],"available":[{"date":"2022-08-01","kind":"release","version":"1.17.13"},{"date":"2022-08-01","kind":"release","version":"1.18.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-32189","date":"2026-10-08","epss":0.02629,"percentile":0.85058}],"risk":1.97175,"urls":["https://go.googlesource.com/go/+/055113ef364337607e3e72ed7d48df67fde6fc66","https://go.dev/issue/53871","https://groups.google.com/g/golang-announce/c/YqYYG87xB10"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/417774","description":"Decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2022-32189","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-32189","date":"2026-10-08","epss":0.02629,"percentile":0.85058}],"urls":["https://go.dev/cl/417774","https://go.dev/issue/53871","https://go.googlesource.com/go/+/055113ef364337607e3e72ed7d48df67fde6fc66","https://groups.google.com/g/golang-announce/c/YqYYG87xB10","https://pkg.go.dev/vuln/GO-2022-0537"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-32189","description":"A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.17.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0537","versionConstraint":"<1.17.13||>=1.18.0-0,<1.18.5 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0537","fix":{"state":"fixed","versions":["1.17.13","1.18.5"],"available":[{"date":"2022-08-01","kind":"release","version":"1.17.13"},{"date":"2022-08-01","kind":"release","version":"1.18.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-32189","date":"2026-10-08","epss":0.02629,"percentile":0.85058}],"risk":1.97175,"urls":["https://go.googlesource.com/go/+/055113ef364337607e3e72ed7d48df67fde6fc66","https://go.dev/issue/53871","https://groups.google.com/g/golang-announce/c/YqYYG87xB10"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/417774","description":"Decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2022-32189","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-32189","date":"2026-10-08","epss":0.02629,"percentile":0.85058}],"urls":["https://go.dev/cl/417774","https://go.dev/issue/53871","https://go.googlesource.com/go/+/055113ef364337607e3e72ed7d48df67fde6fc66","https://groups.google.com/g/golang-announce/c/YqYYG87xB10","https://pkg.go.dev/vuln/GO-2022-0537"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-32189","description":"A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service."}]},{"artifact":{"id":"2d52d7c9fca553cc","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.28-10:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.28-10?arch=amd64&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-25013","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-25013","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-25013","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-25013","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-25013","date":"2026-10-08","epss":0.03565,"percentile":0.89034}],"risk":1.9429250000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-25013","description":"The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read."},"relatedVulnerabilities":[{"id":"CVE-2019-25013","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-25013","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-25013","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-25013","date":"2026-10-08","epss":0.03565,"percentile":0.89034}],"urls":["https://lists.apache.org/thread.html/r32d767ac804e9b8aad4355bb85960a6a1385eab7afff549a5e98660f%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r448bb851cc8e6e3f93f3c28c70032b37062625d81214744474ac49e7%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r4806a391091e082bdea17266452ca656ebc176e51bb3932733b3a0a2%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r499e4f96d0b5109ef083f2feccd33c51650c1b7d7068aa3bd47efca9%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r5af4430421bb6f9973294691a7904bbd260937e9eef96b20556f43ff%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r750eee18542bc02bd8350861c424ee60a9b9b225568fa09436a37ece%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r7a2e94adfe0a2f0a1d42e4927e8c32ecac97d37db9cb68095fe9ddbc%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd2354f9ccce41e494fbadcbc5ad87218de6ec0fff8a7b54c8462226c%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4Y6TX47P47KABSFOL26FLDNVCWXDKDEZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TVCUNLQ3HXGS4VPUQKWTJGRAW2KTFGXS/","https://security.gentoo.org/glsa/202107-07","https://security.netapp.com/advisory/ntap-20210205-0004/","https://sourceware.org/bugzilla/show_bug.cgi?id=24973","https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=ee7a3144c9922808181009b7b3e50e852fb4999b","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-25013","description":"The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read."}]},{"artifact":{"id":"fe0324c22198dabb","cpes":["cpe:2.3:a:libc-l10n:libc-l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc-l10n:libc_l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc-l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc_l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-l10n:2.28-10:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_l10n:2.28-10:*:*:*:*:*:*:*"],"name":"libc-l10n","purl":"pkg:deb/debian/libc-l10n@2.28-10?arch=all&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-l10n/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libc-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libc-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libc-l10n.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-25013","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-25013","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-25013","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-25013","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-25013","date":"2026-10-08","epss":0.03565,"percentile":0.89034}],"risk":1.9429250000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-25013","description":"The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read."},"relatedVulnerabilities":[{"id":"CVE-2019-25013","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-25013","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-25013","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-25013","date":"2026-10-08","epss":0.03565,"percentile":0.89034}],"urls":["https://lists.apache.org/thread.html/r32d767ac804e9b8aad4355bb85960a6a1385eab7afff549a5e98660f%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r448bb851cc8e6e3f93f3c28c70032b37062625d81214744474ac49e7%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r4806a391091e082bdea17266452ca656ebc176e51bb3932733b3a0a2%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r499e4f96d0b5109ef083f2feccd33c51650c1b7d7068aa3bd47efca9%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r5af4430421bb6f9973294691a7904bbd260937e9eef96b20556f43ff%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r750eee18542bc02bd8350861c424ee60a9b9b225568fa09436a37ece%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r7a2e94adfe0a2f0a1d42e4927e8c32ecac97d37db9cb68095fe9ddbc%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd2354f9ccce41e494fbadcbc5ad87218de6ec0fff8a7b54c8462226c%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4Y6TX47P47KABSFOL26FLDNVCWXDKDEZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TVCUNLQ3HXGS4VPUQKWTJGRAW2KTFGXS/","https://security.gentoo.org/glsa/202107-07","https://security.netapp.com/advisory/ntap-20210205-0004/","https://sourceware.org/bugzilla/show_bug.cgi?id=24973","https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=ee7a3144c9922808181009b7b3e50e852fb4999b","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-25013","description":"The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read."}]},{"artifact":{"id":"4d00fd0f941e584e","cpes":["cpe:2.3:a:libc6:libc6:2.28-10:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.28-10?arch=amd64&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-25013","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-25013","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-25013","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-25013","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-25013","date":"2026-10-08","epss":0.03565,"percentile":0.89034}],"risk":1.9429250000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-25013","description":"The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read."},"relatedVulnerabilities":[{"id":"CVE-2019-25013","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-25013","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-25013","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-25013","date":"2026-10-08","epss":0.03565,"percentile":0.89034}],"urls":["https://lists.apache.org/thread.html/r32d767ac804e9b8aad4355bb85960a6a1385eab7afff549a5e98660f%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r448bb851cc8e6e3f93f3c28c70032b37062625d81214744474ac49e7%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r4806a391091e082bdea17266452ca656ebc176e51bb3932733b3a0a2%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r499e4f96d0b5109ef083f2feccd33c51650c1b7d7068aa3bd47efca9%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r5af4430421bb6f9973294691a7904bbd260937e9eef96b20556f43ff%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r750eee18542bc02bd8350861c424ee60a9b9b225568fa09436a37ece%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r7a2e94adfe0a2f0a1d42e4927e8c32ecac97d37db9cb68095fe9ddbc%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd2354f9ccce41e494fbadcbc5ad87218de6ec0fff8a7b54c8462226c%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4Y6TX47P47KABSFOL26FLDNVCWXDKDEZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TVCUNLQ3HXGS4VPUQKWTJGRAW2KTFGXS/","https://security.gentoo.org/glsa/202107-07","https://security.netapp.com/advisory/ntap-20210205-0004/","https://sourceware.org/bugzilla/show_bug.cgi?id=24973","https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=ee7a3144c9922808181009b7b3e50e852fb4999b","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-25013","description":"The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read."}]},{"artifact":{"id":"c1d71c418353daa4","cpes":["cpe:2.3:a:locales:locales:2.28-10:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/debian/locales@2.28-10?arch=all&distro=debian-10.1&upstream=glibc","type":"deb","version":"2.28-10","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.28-10+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-25013","versionConstraint":"< 2.28-10+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glibc","version":"2.28-10"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-25013","fix":{"state":"fixed","versions":["2.28-10+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.28-10+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-25013","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-25013","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-25013","date":"2026-10-08","epss":0.03565,"percentile":0.89034}],"risk":1.9429250000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-25013","description":"The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read."},"relatedVulnerabilities":[{"id":"CVE-2019-25013","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-25013","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-25013","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-25013","date":"2026-10-08","epss":0.03565,"percentile":0.89034}],"urls":["https://lists.apache.org/thread.html/r32d767ac804e9b8aad4355bb85960a6a1385eab7afff549a5e98660f%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r448bb851cc8e6e3f93f3c28c70032b37062625d81214744474ac49e7%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r4806a391091e082bdea17266452ca656ebc176e51bb3932733b3a0a2%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r499e4f96d0b5109ef083f2feccd33c51650c1b7d7068aa3bd47efca9%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r5af4430421bb6f9973294691a7904bbd260937e9eef96b20556f43ff%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r750eee18542bc02bd8350861c424ee60a9b9b225568fa09436a37ece%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r7a2e94adfe0a2f0a1d42e4927e8c32ecac97d37db9cb68095fe9ddbc%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd2354f9ccce41e494fbadcbc5ad87218de6ec0fff8a7b54c8462226c%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4Y6TX47P47KABSFOL26FLDNVCWXDKDEZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TVCUNLQ3HXGS4VPUQKWTJGRAW2KTFGXS/","https://security.gentoo.org/glsa/202107-07","https://security.netapp.com/advisory/ntap-20210205-0004/","https://sourceware.org/bugzilla/show_bug.cgi?id=24973","https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=ee7a3144c9922808181009b7b3e50e852fb4999b","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-25013","description":"The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read."}]},{"artifact":{"id":"d55bfe42f054b394","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.2.6-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.2.6-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=expat","type":"deb","version":"2.2.6-2+deb10u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.6-2+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-25313","versionConstraint":"< 2.2.6-2+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"expat","version":"2.2.6-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-25313","fix":{"state":"fixed","versions":["2.2.6-2+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.6-2+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-25313","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-25313","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-25313","date":"2026-10-08","epss":0.03295,"percentile":0.88164}],"risk":1.8946249999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5085-1","link":"https://security-tracker.debian.org/tracker/DSA-5085-1"},{"id":"DSA-5085-2","link":"https://security-tracker.debian.org/tracker/DSA-5085-2"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-25313","description":"In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element."},"relatedVulnerabilities":[{"id":"CVE-2022-25313","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-25313","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-25313","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-25313","date":"2026-10-08","epss":0.03295,"percentile":0.88164}],"urls":["http://www.openwall.com/lists/oss-security/2022/02/19/1","https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","https://github.com/libexpat/libexpat/pull/558","https://lists.debian.org/debian-lts-announce/2022/03/msg00007.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UFRBA3UQVIQKXTBUQXDWQOVWNBKLERU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y27XO3JMKAOMQZVPS3B4MJGEAHCZF5OM/","https://security.gentoo.org/glsa/202209-24","https://security.netapp.com/advisory/ntap-20220303-0008/","https://www.debian.org/security/2022/dsa-5085","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25313","description":"In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.15.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0234","versionConstraint":"<1.15.9||>=1.16.0-0,<1.16.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0234","fix":{"state":"fixed","versions":["1.15.9","1.16.1"],"available":[{"date":"2021-03-10","kind":"release","version":"1.15.9"},{"date":"2021-03-10","kind":"release","version":"1.16.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-27918","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27918","date":"2026-10-08","epss":0.02474,"percentile":0.84056}],"risk":1.8555000000000001,"urls":["https://go.googlesource.com/go/+/d0b79e3513a29628f3599dc8860666b6eed75372","https://go.dev/issue/44913","https://groups.google.com/g/golang-announce/c/MfiLYjG-RAw"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/300391","description":"The Decode, DecodeElement, and Skip methods of an xml.Decoder provided by xml.NewTokenDecoder may enter an infinite loop when operating on a custom xml.TokenReader which returns an EOF in the middle of an open XML element."},"relatedVulnerabilities":[{"id":"CVE-2021-27918","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-27918","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27918","date":"2026-10-08","epss":0.02474,"percentile":0.84056}],"urls":["https://groups.google.com/g/golang-announce/c/MfiLYjG-RAw","https://security.gentoo.org/glsa/202208-02"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-27918","description":"encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.15.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0234","versionConstraint":"<1.15.9||>=1.16.0-0,<1.16.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0234","fix":{"state":"fixed","versions":["1.15.9","1.16.1"],"available":[{"date":"2021-03-10","kind":"release","version":"1.15.9"},{"date":"2021-03-10","kind":"release","version":"1.16.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-27918","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27918","date":"2026-10-08","epss":0.02474,"percentile":0.84056}],"risk":1.8555000000000001,"urls":["https://go.googlesource.com/go/+/d0b79e3513a29628f3599dc8860666b6eed75372","https://go.dev/issue/44913","https://groups.google.com/g/golang-announce/c/MfiLYjG-RAw"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/300391","description":"The Decode, DecodeElement, and Skip methods of an xml.Decoder provided by xml.NewTokenDecoder may enter an infinite loop when operating on a custom xml.TokenReader which returns an EOF in the middle of an open XML element."},"relatedVulnerabilities":[{"id":"CVE-2021-27918","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-27918","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27918","date":"2026-10-08","epss":0.02474,"percentile":0.84056}],"urls":["https://groups.google.com/g/golang-announce/c/MfiLYjG-RAw","https://security.gentoo.org/glsa/202208-02"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-27918","description":"encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method."}]},{"artifact":{"id":"d55bfe42f054b394","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.2.6-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.2.6-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=expat","type":"deb","version":"2.2.6-2+deb10u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.6-2+deb10u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-43680","versionConstraint":"< 2.2.6-2+deb10u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"expat","version":"2.2.6-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-43680","fix":{"state":"fixed","versions":["2.2.6-2+deb10u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.6-2+deb10u6"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-43680","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-43680","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-43680","date":"2026-10-08","epss":0.02457,"percentile":0.83939}],"risk":1.8427499999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-43680","description":"In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations."},"relatedVulnerabilities":[{"id":"CVE-2022-43680","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-43680","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-43680","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-43680","date":"2026-10-08","epss":0.02457,"percentile":0.83939}],"urls":["http://www.openwall.com/lists/oss-security/2023/12/28/5","http://www.openwall.com/lists/oss-security/2024/01/03/5","https://github.com/libexpat/libexpat/issues/649","https://github.com/libexpat/libexpat/pull/616","https://github.com/libexpat/libexpat/pull/650","https://lists.debian.org/debian-lts-announce/2022/10/msg00033.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AJ5VY2VYXE4WTRGQ6LMGLF6FV3SY37YE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BY4OPSIB33ETNUXZY2UPZ4NGQ3OKDY4D/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPQVIF6TOJNY2T3ZZETFKR4G34FFREBQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFCOMBSOJKLIKCGCJWHLJXO4EVYBG7AR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUJ2BULJTZ2BMSKQHB6US674P55UCWWS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XG5XOOB7CD55CEE6OJYKSACSIMQ4RWQ6/","https://security.gentoo.org/glsa/202210-38","https://security.netapp.com/advisory/ntap-20221118-0007/","https://www.debian.org/security/2022/dsa-5266"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-43680","description":"In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.21.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2024-2887","versionConstraint":"<1.21.11||>=1.22.0-0,<1.22.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2024-2887","fix":{"state":"fixed","versions":["1.21.11","1.22.4"],"available":[{"date":"2024-06-04","kind":"release","version":"1.21.11"},{"date":"2024-06-04","kind":"release","version":"1.22.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-24790","date":"2026-10-08","epss":0.01952,"percentile":0.79639}],"risk":1.8348800000000003,"urls":["https://go.dev/issue/67680","https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ"],"severity":"Critical","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/590316","description":"The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms."},"relatedVulnerabilities":[{"id":"CVE-2024-24790","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-24790","date":"2026-10-08","epss":0.01952,"percentile":0.79639}],"urls":["http://www.openwall.com/lists/oss-security/2024/06/04/1","https://go.dev/cl/590316","https://go.dev/issue/67680","https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ","https://pkg.go.dev/vuln/GO-2024-2887","https://security.netapp.com/advisory/ntap-20240905-0002/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-24790","description":"The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.21.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2024-2887","versionConstraint":"<1.21.11||>=1.22.0-0,<1.22.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2024-2887","fix":{"state":"fixed","versions":["1.21.11","1.22.4"],"available":[{"date":"2024-06-04","kind":"release","version":"1.21.11"},{"date":"2024-06-04","kind":"release","version":"1.22.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-24790","date":"2026-10-08","epss":0.01952,"percentile":0.79639}],"risk":1.8348800000000003,"urls":["https://go.dev/issue/67680","https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ"],"severity":"Critical","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/590316","description":"The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms."},"relatedVulnerabilities":[{"id":"CVE-2024-24790","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-24790","date":"2026-10-08","epss":0.01952,"percentile":0.79639}],"urls":["http://www.openwall.com/lists/oss-security/2024/06/04/1","https://go.dev/cl/590316","https://go.dev/issue/67680","https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ","https://pkg.go.dev/vuln/GO-2024-2887","https://security.netapp.com/advisory/ntap-20240905-0002/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-24790","description":"The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.17.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0521","versionConstraint":"<1.17.12||>=1.18.0-0,<1.18.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0521","fix":{"state":"fixed","versions":["1.17.12","1.18.4"],"available":[{"date":"2022-07-12","kind":"release","version":"1.17.12"},{"date":"2022-07-12","kind":"release","version":"1.18.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-28131","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-28131","date":"2026-10-08","epss":0.02418,"percentile":0.83666}],"risk":1.8135,"urls":["https://go.googlesource.com/go/+/08c46ed43d80bbb67cb904944ea3417989be4af3","https://go.dev/issue/53614","https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/417062","description":"Calling Decoder.Skip when parsing a deeply nested XML document can cause a panic due to stack exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2022-28131","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-28131","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-28131","date":"2026-10-08","epss":0.02418,"percentile":0.83666}],"urls":["https://go.dev/cl/417062","https://go.dev/issue/53614","https://go.googlesource.com/go/+/08c46ed43d80bbb67cb904944ea3417989be4af3","https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE","https://pkg.go.dev/vuln/GO-2022-0521"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-28131","description":"Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.17.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0521","versionConstraint":"<1.17.12||>=1.18.0-0,<1.18.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0521","fix":{"state":"fixed","versions":["1.17.12","1.18.4"],"available":[{"date":"2022-07-12","kind":"release","version":"1.17.12"},{"date":"2022-07-12","kind":"release","version":"1.18.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-28131","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-28131","date":"2026-10-08","epss":0.02418,"percentile":0.83666}],"risk":1.8135,"urls":["https://go.googlesource.com/go/+/08c46ed43d80bbb67cb904944ea3417989be4af3","https://go.dev/issue/53614","https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/417062","description":"Calling Decoder.Skip when parsing a deeply nested XML document can cause a panic due to stack exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2022-28131","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-28131","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-28131","date":"2026-10-08","epss":0.02418,"percentile":0.83666}],"urls":["https://go.dev/cl/417062","https://go.dev/issue/53614","https://go.googlesource.com/go/+/08c46ed43d80bbb67cb904944ea3417989be4af3","https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE","https://pkg.go.dev/vuln/GO-2022-0521"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-28131","description":"Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document."}]},{"artifact":{"id":"1a6e30a7791fdf6e","cpes":["cpe:2.3:a:syslog-ng-core:syslog-ng-core:3.19.1-5:*:*:*:*:*:*:*","cpe:2.3:a:syslog-ng-core:syslog_ng_core:3.19.1-5:*:*:*:*:*:*:*","cpe:2.3:a:syslog_ng_core:syslog-ng-core:3.19.1-5:*:*:*:*:*:*:*","cpe:2.3:a:syslog_ng_core:syslog_ng_core:3.19.1-5:*:*:*:*:*:*:*","cpe:2.3:a:syslog-ng:syslog-ng-core:3.19.1-5:*:*:*:*:*:*:*","cpe:2.3:a:syslog-ng:syslog_ng_core:3.19.1-5:*:*:*:*:*:*:*","cpe:2.3:a:syslog_ng:syslog-ng-core:3.19.1-5:*:*:*:*:*:*:*","cpe:2.3:a:syslog_ng:syslog_ng_core:3.19.1-5:*:*:*:*:*:*:*","cpe:2.3:a:syslog:syslog-ng-core:3.19.1-5:*:*:*:*:*:*:*","cpe:2.3:a:syslog:syslog_ng_core:3.19.1-5:*:*:*:*:*:*:*"],"name":"syslog-ng-core","purl":"pkg:deb/debian/syslog-ng-core@3.19.1-5?arch=amd64&distro=debian-10.1&upstream=syslog-ng","type":"deb","version":"3.19.1-5","language":"","licenses":["Apache-2.0","BSD-3-clause","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","MPL","ivykis-man"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/syslog-ng-core/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/syslog-ng-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/syslog-ng-core.conffiles","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/syslog-ng-core.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/syslog-ng-core.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/syslog-ng-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/syslog-ng-core.list","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/syslog-ng-core.list"},{"path":"/var/lib/dpkg/info/syslog-ng-core.postinst","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/syslog-ng-core.postinst"},{"path":"/var/lib/dpkg/info/syslog-ng-core.postrm","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/syslog-ng-core.postrm"},{"path":"/var/lib/dpkg/info/syslog-ng-core.preinst","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/syslog-ng-core.preinst"},{"path":"/var/lib/dpkg/info/syslog-ng-core.prerm","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/syslog-ng-core.prerm"},{"path":"/var/lib/dpkg/info/syslog-ng-core.shlibs","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/syslog-ng-core.shlibs"}],"upstreams":[{"name":"syslog-ng"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.19.1-5+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-38725","versionConstraint":"< 3.19.1-5+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"syslog-ng","version":"3.19.1-5"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-38725","fix":{"state":"fixed","versions":["3.19.1-5+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.19.1-5+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-38725","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-38725","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-38725","date":"2026-10-08","epss":0.02403,"percentile":0.83542}],"risk":1.8022500000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-38725","description":"An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service via crafted syslog input that is mishandled by the tcp or network function. syslog-ng Premium Edition 7.0.30 and syslog-ng Store Box 6.10.0 are also affected."},"relatedVulnerabilities":[{"id":"CVE-2022-38725","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-38725","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-38725","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-38725","date":"2026-10-08","epss":0.02403,"percentile":0.83542}],"urls":["https://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-7932-4fc6-pvmc","https://lists.balabit.hu/pipermail/syslog-ng/","https://lists.debian.org/debian-lts-announce/2023/02/msg00043.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J3TZ7U2GQTAHVHJXSSEHQS5D2Q5T6SZB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QU36HCM3VZYANUYFC6XFYEYJEKQPA2Q7/","https://security.gentoo.org/glsa/202305-09","https://www.debian.org/security/2023/dsa-5369"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-38725","description":"An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service via crafted syslog input that is mishandled by the tcp or network function. syslog-ng Premium Edition 7.0.30 and syslog-ng Store Box 6.10.0 are also affected."}]},{"artifact":{"id":"c234723c8aa384fa","cpes":["cpe:2.3:a:syslog-ng-mod-journal:syslog-ng-mod-journal:3.19.1-5:*:*:*:*:*:*:*","cpe:2.3:a:syslog-ng-mod-journal:syslog_ng_mod_journal:3.19.1-5:*:*:*:*:*:*:*","cpe:2.3:a:syslog_ng_mod_journal:syslog-ng-mod-journal:3.19.1-5:*:*:*:*:*:*:*","cpe:2.3:a:syslog_ng_mod_journal:syslog_ng_mod_journal:3.19.1-5:*:*:*:*:*:*:*","cpe:2.3:a:syslog-ng-mod:syslog-ng-mod-journal:3.19.1-5:*:*:*:*:*:*:*","cpe:2.3:a:syslog-ng-mod:syslog_ng_mod_journal:3.19.1-5:*:*:*:*:*:*:*","cpe:2.3:a:syslog_ng_mod:syslog-ng-mod-journal:3.19.1-5:*:*:*:*:*:*:*","cpe:2.3:a:syslog_ng_mod:syslog_ng_mod_journal:3.19.1-5:*:*:*:*:*:*:*","cpe:2.3:a:syslog-ng:syslog-ng-mod-journal:3.19.1-5:*:*:*:*:*:*:*","cpe:2.3:a:syslog-ng:syslog_ng_mod_journal:3.19.1-5:*:*:*:*:*:*:*","cpe:2.3:a:syslog_ng:syslog-ng-mod-journal:3.19.1-5:*:*:*:*:*:*:*","cpe:2.3:a:syslog_ng:syslog_ng_mod_journal:3.19.1-5:*:*:*:*:*:*:*","cpe:2.3:a:syslog:syslog-ng-mod-journal:3.19.1-5:*:*:*:*:*:*:*","cpe:2.3:a:syslog:syslog_ng_mod_journal:3.19.1-5:*:*:*:*:*:*:*"],"name":"syslog-ng-mod-journal","purl":"pkg:deb/debian/syslog-ng-mod-journal@3.19.1-5?arch=amd64&distro=debian-10.1&upstream=syslog-ng","type":"deb","version":"3.19.1-5","language":"","licenses":["Apache-2.0","BSD-3-clause","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","MPL","ivykis-man"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/syslog-ng-mod-journal/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/syslog-ng-mod-journal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/syslog-ng-mod-journal.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/syslog-ng-mod-journal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/syslog-ng-mod-journal.list","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/syslog-ng-mod-journal.list"}],"upstreams":[{"name":"syslog-ng"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.19.1-5+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-38725","versionConstraint":"< 3.19.1-5+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"syslog-ng","version":"3.19.1-5"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-38725","fix":{"state":"fixed","versions":["3.19.1-5+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.19.1-5+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-38725","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-38725","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-38725","date":"2026-10-08","epss":0.02403,"percentile":0.83542}],"risk":1.8022500000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-38725","description":"An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service via crafted syslog input that is mishandled by the tcp or network function. syslog-ng Premium Edition 7.0.30 and syslog-ng Store Box 6.10.0 are also affected."},"relatedVulnerabilities":[{"id":"CVE-2022-38725","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-38725","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-38725","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-38725","date":"2026-10-08","epss":0.02403,"percentile":0.83542}],"urls":["https://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-7932-4fc6-pvmc","https://lists.balabit.hu/pipermail/syslog-ng/","https://lists.debian.org/debian-lts-announce/2023/02/msg00043.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J3TZ7U2GQTAHVHJXSSEHQS5D2Q5T6SZB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QU36HCM3VZYANUYFC6XFYEYJEKQPA2Q7/","https://security.gentoo.org/glsa/202305-09","https://www.debian.org/security/2023/dsa-5369"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-38725","description":"An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service via crafted syslog input that is mishandled by the tcp or network function. syslog-ng Premium Edition 7.0.30 and syslog-ng Store Box 6.10.0 are also affected."}]},{"artifact":{"id":"ecf5e89e65014edb","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.64.0-4:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/debian/libcurl4@7.64.0-4?arch=amd64&distro=debian-10.1&upstream=curl","type":"deb","version":"7.64.0-4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.64.0-4+deb10u9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-27534","versionConstraint":"< 7.64.0-4+deb10u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"curl","version":"7.64.0-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-27534","fix":{"state":"fixed","versions":["7.64.0-4+deb10u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.64.0-4+deb10u9"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27534","cwe":"CWE-22","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2023-27534","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-27534","date":"2026-10-08","epss":0.02195,"percentile":0.81928}],"risk":1.7889250000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-27534","description":"A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user."},"relatedVulnerabilities":[{"id":"CVE-2023-27534","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27534","cwe":"CWE-22","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2023-27534","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-27534","date":"2026-10-08","epss":0.02195,"percentile":0.81928}],"urls":["https://hackerone.com/reports/1892351","https://lists.debian.org/debian-lts-announce/2024/03/msg00016.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/","https://security.gentoo.org/glsa/202310-12","https://security.netapp.com/advisory/ntap-20230420-0012/","https://advisory.splunk.com/advisories/SVD-2023-0809","https://curl.se/docs/CVE-2023-27534.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-27534","description":"A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user."}]},{"artifact":{"id":"c04f9fd6220b7155","cpes":["cpe:2.3:a:libgcrypt20:libgcrypt20:1.8.4-5:*:*:*:*:*:*:*"],"name":"libgcrypt20","purl":"pkg:deb/debian/libgcrypt20@1.8.4-5?arch=amd64&distro=debian-10.1","type":"deb","version":"1.8.4-5","language":"","licenses":["sha256:26c21767c3a769ed688e2fe3d890963bd0992b5a53ee9cd18babd680e665f131"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgcrypt20/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libgcrypt20/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcrypt20:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libgcrypt20:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-33560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"libgcrypt20","version":"1.8.4-5"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-33560","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33560","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-33560","cwe":"CWE-325","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-33560","date":"2026-10-08","epss":0.02342,"percentile":0.83115}],"risk":1.7565000000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-33560","description":"Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP."},"relatedVulnerabilities":[{"id":"CVE-2021-33560","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33560","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-33560","cwe":"CWE-325","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-33560","date":"2026-10-08","epss":0.02342,"percentile":0.83115}],"urls":["https://dev.gnupg.org/T5305","https://dev.gnupg.org/T5328","https://dev.gnupg.org/T5466","https://dev.gnupg.org/rCe8b7f10be275bcedb5fc05ed4837a89bfd605c61","https://lists.debian.org/debian-lts-announce/2021/06/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BKKTOIGFW2SGN3DO2UHHVZ7MJSYN4AAB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7OAPCUGPF3VLA7QAJUQSL255D4ITVTL/","https://security.gentoo.org/glsa/202210-13","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33560","description":"Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4341","versionConstraint":"<1.24.12||>=1.25.0,<1.25.6 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4341","fix":{"state":"fixed","versions":["1.24.12","1.25.6"],"available":[{"date":"2026-01-15","kind":"release","version":"1.24.12"},{"date":"2026-01-15","kind":"release","version":"1.25.6"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61726","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-61726","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-61726","date":"2026-10-08","epss":0.02326,"percentile":0.82985}],"risk":1.7445,"urls":["https://go.dev/issue/77101","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/736712","description":"The net/url package does not set a limit on the number of query parameters in a query.\n\nWhile the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption."},"relatedVulnerabilities":[{"id":"CVE-2025-61726","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61726","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-61726","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-61726","date":"2026-10-08","epss":0.02326,"percentile":0.82985}],"urls":["https://go.dev/cl/736712","https://go.dev/issue/77101","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc","https://pkg.go.dev/vuln/GO-2026-4341","https://access.redhat.com/errata/RHSA-2026:10096","https://access.redhat.com/errata/RHSA-2026:10104","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:10225","https://access.redhat.com/errata/RHSA-2026:10250","https://access.redhat.com/errata/RHSA-2026:11408","https://access.redhat.com/errata/RHSA-2026:11414","https://access.redhat.com/errata/RHSA-2026:11747","https://access.redhat.com/errata/RHSA-2026:11749","https://access.redhat.com/errata/RHSA-2026:12028","https://access.redhat.com/errata/RHSA-2026:12029","https://access.redhat.com/errata/RHSA-2026:12030","https://access.redhat.com/errata/RHSA-2026:12031","https://access.redhat.com/errata/RHSA-2026:12032","https://access.redhat.com/errata/RHSA-2026:12033","https://access.redhat.com/errata/RHSA-2026:12279","https://access.redhat.com/errata/RHSA-2026:12282","https://access.redhat.com/errata/RHSA-2026:13542","https://access.redhat.com/errata/RHSA-2026:13548","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:14100","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:14868","https://access.redhat.com/errata/RHSA-2026:14879","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:15984","https://access.redhat.com/errata/RHSA-2026:16102","https://access.redhat.com/errata/RHSA-2026:16696","https://access.redhat.com/errata/RHSA-2026:17040","https://access.redhat.com/errata/RHSA-2026:17084","https://access.redhat.com/errata/RHSA-2026:17446","https://access.redhat.com/errata/RHSA-2026:17460","https://access.redhat.com/errata/RHSA-2026:17463","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17595","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:18913","https://access.redhat.com/errata/RHSA-2026:19013","https://access.redhat.com/errata/RHSA-2026:19132","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:19634","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21657","https://access.redhat.com/errata/RHSA-2026:21691","https://access.redhat.com/errata/RHSA-2026:22450","https://access.redhat.com/errata/RHSA-2026:22627","https://access.redhat.com/errata/RHSA-2026:22714","https://access.redhat.com/errata/RHSA-2026:22937","https://access.redhat.com/errata/RHSA-2026:23228","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:25127","https://access.redhat.com/errata/RHSA-2026:25248","https://access.redhat.com/errata/RHSA-2026:25250","https://access.redhat.com/errata/RHSA-2026:25251","https://access.redhat.com/errata/RHSA-2026:25252","https://access.redhat.com/errata/RHSA-2026:25253","https://access.redhat.com/errata/RHSA-2026:26420","https://access.redhat.com/errata/RHSA-2026:26527","https://access.redhat.com/errata/RHSA-2026:26541","https://access.redhat.com/errata/RHSA-2026:26636","https://access.redhat.com/errata/RHSA-2026:2681","https://access.redhat.com/errata/RHSA-2026:2706","https://access.redhat.com/errata/RHSA-2026:2708","https://access.redhat.com/errata/RHSA-2026:2709","https://access.redhat.com/errata/RHSA-2026:2754","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:2844","https://access.redhat.com/errata/RHSA-2026:28441","https://access.redhat.com/errata/RHSA-2026:28886","https://access.redhat.com/errata/RHSA-2026:28961","https://access.redhat.com/errata/RHSA-2026:2914","https://access.redhat.com/errata/RHSA-2026:2920","https://access.redhat.com/errata/RHSA-2026:3035","https://access.redhat.com/errata/RHSA-2026:3040","https://access.redhat.com/errata/RHSA-2026:3089","https://access.redhat.com/errata/RHSA-2026:3092","https://access.redhat.com/errata/RHSA-2026:3184","https://access.redhat.com/errata/RHSA-2026:3186","https://access.redhat.com/errata/RHSA-2026:3187","https://access.redhat.com/errata/RHSA-2026:3188","https://access.redhat.com/errata/RHSA-2026:3192","https://access.redhat.com/errata/RHSA-2026:3193","https://access.redhat.com/errata/RHSA-2026:3291","https://access.redhat.com/errata/RHSA-2026:3296","https://access.redhat.com/errata/RHSA-2026:3297","https://access.redhat.com/errata/RHSA-2026:3298","https://access.redhat.com/errata/RHSA-2026:3336","https://access.redhat.com/errata/RHSA-2026:3337","https://access.redhat.com/errata/RHSA-2026:3340","https://access.redhat.com/errata/RHSA-2026:3341","https://access.redhat.com/errata/RHSA-2026:3343","https://access.redhat.com/errata/RHSA-2026:3391","https://access.redhat.com/errata/RHSA-2026:3416","https://access.redhat.com/errata/RHSA-2026:3427","https://access.redhat.com/errata/RHSA-2026:3459","https://access.redhat.com/errata/RHSA-2026:3468","https://access.redhat.com/errata/RHSA-2026:3469","https://access.redhat.com/errata/RHSA-2026:3470","https://access.redhat.com/errata/RHSA-2026:3471","https://access.redhat.com/errata/RHSA-2026:3472","https://access.redhat.com/errata/RHSA-2026:3473","https://access.redhat.com/errata/RHSA-2026:3489","https://access.redhat.com/errata/RHSA-2026:3506","https://access.redhat.com/errata/RHSA-2026:3556","https://access.redhat.com/errata/RHSA-2026:3559","https://access.redhat.com/errata/RHSA-2026:3668","https://access.redhat.com/errata/RHSA-2026:3669","https://access.redhat.com/errata/RHSA-2026:36873","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:3699","https://access.redhat.com/errata/RHSA-2026:3713","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:3752","https://access.redhat.com/errata/RHSA-2026:3753","https://access.redhat.com/errata/RHSA-2026:3782","https://access.redhat.com/errata/RHSA-2026:3812","https://access.redhat.com/errata/RHSA-2026:3813","https://access.redhat.com/errata/RHSA-2026:3814","https://access.redhat.com/errata/RHSA-2026:3815","https://access.redhat.com/errata/RHSA-2026:3816","https://access.redhat.com/errata/RHSA-2026:3817","https://access.redhat.com/errata/RHSA-2026:3818","https://access.redhat.com/errata/RHSA-2026:3820","https://access.redhat.com/errata/RHSA-2026:3821","https://access.redhat.com/errata/RHSA-2026:3822","https://access.redhat.com/errata/RHSA-2026:3831","https://access.redhat.com/errata/RHSA-2026:3833","https://access.redhat.com/errata/RHSA-2026:3835","https://access.redhat.com/errata/RHSA-2026:3836","https://access.redhat.com/errata/RHSA-2026:3838","https://access.redhat.com/errata/RHSA-2026:3839","https://access.redhat.com/errata/RHSA-2026:3840","https://access.redhat.com/errata/RHSA-2026:3841","https://access.redhat.com/errata/RHSA-2026:3843","https://access.redhat.com/errata/RHSA-2026:3854","https://access.redhat.com/errata/RHSA-2026:3855","https://access.redhat.com/errata/RHSA-2026:3856","https://access.redhat.com/errata/RHSA-2026:3864","https://access.redhat.com/errata/RHSA-2026:3869","https://access.redhat.com/errata/RHSA-2026:3874","https://access.redhat.com/errata/RHSA-2026:3875","https://access.redhat.com/errata/RHSA-2026:3879","https://access.redhat.com/errata/RHSA-2026:3880","https://access.redhat.com/errata/RHSA-2026:3884","https://access.redhat.com/errata/RHSA-2026:3898","https://access.redhat.com/errata/RHSA-2026:3905","https://access.redhat.com/errata/RHSA-2026:3906","https://access.redhat.com/errata/RHSA-2026:3928","https://access.redhat.com/errata/RHSA-2026:3929","https://access.redhat.com/errata/RHSA-2026:3930","https://access.redhat.com/errata/RHSA-2026:3931","https://access.redhat.com/errata/RHSA-2026:3932","https://access.redhat.com/errata/RHSA-2026:3958","https://access.redhat.com/errata/RHSA-2026:3959","https://access.redhat.com/errata/RHSA-2026:3960","https://access.redhat.com/errata/RHSA-2026:3970","https://access.redhat.com/errata/RHSA-2026:3971","https://access.redhat.com/errata/RHSA-2026:3972","https://access.redhat.com/errata/RHSA-2026:3973","https://access.redhat.com/errata/RHSA-2026:3974","https://access.redhat.com/errata/RHSA-2026:3977","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:3985","https://access.redhat.com/errata/RHSA-2026:40924","https://access.redhat.com/errata/RHSA-2026:4164","https://access.redhat.com/errata/RHSA-2026:4166","https://access.redhat.com/errata/RHSA-2026:4170","https://access.redhat.com/errata/RHSA-2026:4174","https://access.redhat.com/errata/RHSA-2026:4177","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:4211","https://access.redhat.com/errata/RHSA-2026:4220","https://access.redhat.com/errata/RHSA-2026:4256","https://access.redhat.com/errata/RHSA-2026:4264","https://access.redhat.com/errata/RHSA-2026:4267","https://access.redhat.com/errata/RHSA-2026:4270","https://access.redhat.com/errata/RHSA-2026:4276","https://access.redhat.com/errata/RHSA-2026:4434","https://access.redhat.com/errata/RHSA-2026:4435","https://access.redhat.com/errata/RHSA-2026:4460","https://access.redhat.com/errata/RHSA-2026:4466","https://access.redhat.com/errata/RHSA-2026:4467","https://access.redhat.com/errata/RHSA-2026:4498","https://access.redhat.com/errata/RHSA-2026:4500","https://access.redhat.com/errata/RHSA-2026:4510","https://access.redhat.com/errata/RHSA-2026:4511","https://access.redhat.com/errata/RHSA-2026:4672","https://access.redhat.com/errata/RHSA-2026:46903","https://access.redhat.com/errata/RHSA-2026:4753","https://access.redhat.com/errata/RHSA-2026:4892","https://access.redhat.com/errata/RHSA-2026:4901","https://access.redhat.com/errata/RHSA-2026:4907","https://access.redhat.com/errata/RHSA-2026:4939","https://access.redhat.com/errata/RHSA-2026:4942","https://access.redhat.com/errata/RHSA-2026:4943","https://access.redhat.com/errata/RHSA-2026:4952","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:5022","https://access.redhat.com/errata/RHSA-2026:5030","https://access.redhat.com/errata/RHSA-2026:5031","https://access.redhat.com/errata/RHSA-2026:5076","https://access.redhat.com/errata/RHSA-2026:5077","https://access.redhat.com/errata/RHSA-2026:5078","https://access.redhat.com/errata/RHSA-2026:5079","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:5110","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:5129","https://access.redhat.com/errata/RHSA-2026:5130","https://access.redhat.com/errata/RHSA-2026:5131","https://access.redhat.com/errata/RHSA-2026:5132","https://access.redhat.com/errata/RHSA-2026:5145","https://access.redhat.com/errata/RHSA-2026:5146","https://access.redhat.com/errata/RHSA-2026:5168","https://access.redhat.com/errata/RHSA-2026:5327","https://access.redhat.com/errata/RHSA-2026:5394","https://access.redhat.com/errata/RHSA-2026:5439","https://access.redhat.com/errata/RHSA-2026:5444","https://access.redhat.com/errata/RHSA-2026:5447","https://access.redhat.com/errata/RHSA-2026:5452","https://access.redhat.com/errata/RHSA-2026:5461","https://access.redhat.com/errata/RHSA-2026:5463","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:5533","https://access.redhat.com/errata/RHSA-2026:5544","https://access.redhat.com/errata/RHSA-2026:5549","https://access.redhat.com/errata/RHSA-2026:5636","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:5645","https://access.redhat.com/errata/RHSA-2026:5649","https://access.redhat.com/errata/RHSA-2026:5665","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:5807","https://access.redhat.com/errata/RHSA-2026:5851","https://access.redhat.com/errata/RHSA-2026:5852","https://access.redhat.com/errata/RHSA-2026:5853","https://access.redhat.com/errata/RHSA-2026:5948","https://access.redhat.com/errata/RHSA-2026:5950","https://access.redhat.com/errata/RHSA-2026:5952","https://access.redhat.com/errata/RHSA-2026:5968","https://access.redhat.com/errata/RHSA-2026:6184","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6226","https://access.redhat.com/errata/RHSA-2026:6251","https://access.redhat.com/errata/RHSA-2026:6277","https://access.redhat.com/errata/RHSA-2026:6278","https://access.redhat.com/errata/RHSA-2026:6428","https://access.redhat.com/errata/RHSA-2026:6429","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6554","https://access.redhat.com/errata/RHSA-2026:6564","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:6568","https://access.redhat.com/errata/RHSA-2026:66401","https://access.redhat.com/errata/RHSA-2026:7052","https://access.redhat.com/errata/RHSA-2026:7249","https://access.redhat.com/errata/RHSA-2026:7291","https://access.redhat.com/errata/RHSA-2026:7385","https://access.redhat.com/errata/RHSA-2026:7676","https://access.redhat.com/errata/RHSA-2026:7854","https://access.redhat.com/errata/RHSA-2026:7942","https://access.redhat.com/errata/RHSA-2026:8151","https://access.redhat.com/errata/RHSA-2026:8167","https://access.redhat.com/errata/RHSA-2026:8218","https://access.redhat.com/errata/RHSA-2026:8229","https://access.redhat.com/errata/RHSA-2026:8337","https://access.redhat.com/errata/RHSA-2026:8338","https://access.redhat.com/errata/RHSA-2026:8431","https://access.redhat.com/errata/RHSA-2026:8433","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:9097","https://access.redhat.com/errata/RHSA-2026:9098","https://access.redhat.com/errata/RHSA-2026:9108","https://access.redhat.com/errata/RHSA-2026:9109","https://access.redhat.com/errata/RHSA-2026:9848","https://access.redhat.com/security/cve/CVE-2025-61726","https://bugzilla.redhat.com/show_bug.cgi?id=2434432","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61726.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61726","description":"The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4341","versionConstraint":"<1.24.12||>=1.25.0,<1.25.6 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4341","fix":{"state":"fixed","versions":["1.24.12","1.25.6"],"available":[{"date":"2026-01-15","kind":"release","version":"1.24.12"},{"date":"2026-01-15","kind":"release","version":"1.25.6"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61726","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-61726","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-61726","date":"2026-10-08","epss":0.02326,"percentile":0.82985}],"risk":1.7445,"urls":["https://go.dev/issue/77101","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/736712","description":"The net/url package does not set a limit on the number of query parameters in a query.\n\nWhile the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption."},"relatedVulnerabilities":[{"id":"CVE-2025-61726","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61726","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-61726","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-61726","date":"2026-10-08","epss":0.02326,"percentile":0.82985}],"urls":["https://go.dev/cl/736712","https://go.dev/issue/77101","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc","https://pkg.go.dev/vuln/GO-2026-4341","https://access.redhat.com/errata/RHSA-2026:10096","https://access.redhat.com/errata/RHSA-2026:10104","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:10225","https://access.redhat.com/errata/RHSA-2026:10250","https://access.redhat.com/errata/RHSA-2026:11408","https://access.redhat.com/errata/RHSA-2026:11414","https://access.redhat.com/errata/RHSA-2026:11747","https://access.redhat.com/errata/RHSA-2026:11749","https://access.redhat.com/errata/RHSA-2026:12028","https://access.redhat.com/errata/RHSA-2026:12029","https://access.redhat.com/errata/RHSA-2026:12030","https://access.redhat.com/errata/RHSA-2026:12031","https://access.redhat.com/errata/RHSA-2026:12032","https://access.redhat.com/errata/RHSA-2026:12033","https://access.redhat.com/errata/RHSA-2026:12279","https://access.redhat.com/errata/RHSA-2026:12282","https://access.redhat.com/errata/RHSA-2026:13542","https://access.redhat.com/errata/RHSA-2026:13548","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:14100","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:14868","https://access.redhat.com/errata/RHSA-2026:14879","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:15984","https://access.redhat.com/errata/RHSA-2026:16102","https://access.redhat.com/errata/RHSA-2026:16696","https://access.redhat.com/errata/RHSA-2026:17040","https://access.redhat.com/errata/RHSA-2026:17084","https://access.redhat.com/errata/RHSA-2026:17446","https://access.redhat.com/errata/RHSA-2026:17460","https://access.redhat.com/errata/RHSA-2026:17463","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17595","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:18913","https://access.redhat.com/errata/RHSA-2026:19013","https://access.redhat.com/errata/RHSA-2026:19132","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:19634","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21657","https://access.redhat.com/errata/RHSA-2026:21691","https://access.redhat.com/errata/RHSA-2026:22450","https://access.redhat.com/errata/RHSA-2026:22627","https://access.redhat.com/errata/RHSA-2026:22714","https://access.redhat.com/errata/RHSA-2026:22937","https://access.redhat.com/errata/RHSA-2026:23228","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:25127","https://access.redhat.com/errata/RHSA-2026:25248","https://access.redhat.com/errata/RHSA-2026:25250","https://access.redhat.com/errata/RHSA-2026:25251","https://access.redhat.com/errata/RHSA-2026:25252","https://access.redhat.com/errata/RHSA-2026:25253","https://access.redhat.com/errata/RHSA-2026:26420","https://access.redhat.com/errata/RHSA-2026:26527","https://access.redhat.com/errata/RHSA-2026:26541","https://access.redhat.com/errata/RHSA-2026:26636","https://access.redhat.com/errata/RHSA-2026:2681","https://access.redhat.com/errata/RHSA-2026:2706","https://access.redhat.com/errata/RHSA-2026:2708","https://access.redhat.com/errata/RHSA-2026:2709","https://access.redhat.com/errata/RHSA-2026:2754","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:2844","https://access.redhat.com/errata/RHSA-2026:28441","https://access.redhat.com/errata/RHSA-2026:28886","https://access.redhat.com/errata/RHSA-2026:28961","https://access.redhat.com/errata/RHSA-2026:2914","https://access.redhat.com/errata/RHSA-2026:2920","https://access.redhat.com/errata/RHSA-2026:3035","https://access.redhat.com/errata/RHSA-2026:3040","https://access.redhat.com/errata/RHSA-2026:3089","https://access.redhat.com/errata/RHSA-2026:3092","https://access.redhat.com/errata/RHSA-2026:3184","https://access.redhat.com/errata/RHSA-2026:3186","https://access.redhat.com/errata/RHSA-2026:3187","https://access.redhat.com/errata/RHSA-2026:3188","https://access.redhat.com/errata/RHSA-2026:3192","https://access.redhat.com/errata/RHSA-2026:3193","https://access.redhat.com/errata/RHSA-2026:3291","https://access.redhat.com/errata/RHSA-2026:3296","https://access.redhat.com/errata/RHSA-2026:3297","https://access.redhat.com/errata/RHSA-2026:3298","https://access.redhat.com/errata/RHSA-2026:3336","https://access.redhat.com/errata/RHSA-2026:3337","https://access.redhat.com/errata/RHSA-2026:3340","https://access.redhat.com/errata/RHSA-2026:3341","https://access.redhat.com/errata/RHSA-2026:3343","https://access.redhat.com/errata/RHSA-2026:3391","https://access.redhat.com/errata/RHSA-2026:3416","https://access.redhat.com/errata/RHSA-2026:3427","https://access.redhat.com/errata/RHSA-2026:3459","https://access.redhat.com/errata/RHSA-2026:3468","https://access.redhat.com/errata/RHSA-2026:3469","https://access.redhat.com/errata/RHSA-2026:3470","https://access.redhat.com/errata/RHSA-2026:3471","https://access.redhat.com/errata/RHSA-2026:3472","https://access.redhat.com/errata/RHSA-2026:3473","https://access.redhat.com/errata/RHSA-2026:3489","https://access.redhat.com/errata/RHSA-2026:3506","https://access.redhat.com/errata/RHSA-2026:3556","https://access.redhat.com/errata/RHSA-2026:3559","https://access.redhat.com/errata/RHSA-2026:3668","https://access.redhat.com/errata/RHSA-2026:3669","https://access.redhat.com/errata/RHSA-2026:36873","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:3699","https://access.redhat.com/errata/RHSA-2026:3713","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:3752","https://access.redhat.com/errata/RHSA-2026:3753","https://access.redhat.com/errata/RHSA-2026:3782","https://access.redhat.com/errata/RHSA-2026:3812","https://access.redhat.com/errata/RHSA-2026:3813","https://access.redhat.com/errata/RHSA-2026:3814","https://access.redhat.com/errata/RHSA-2026:3815","https://access.redhat.com/errata/RHSA-2026:3816","https://access.redhat.com/errata/RHSA-2026:3817","https://access.redhat.com/errata/RHSA-2026:3818","https://access.redhat.com/errata/RHSA-2026:3820","https://access.redhat.com/errata/RHSA-2026:3821","https://access.redhat.com/errata/RHSA-2026:3822","https://access.redhat.com/errata/RHSA-2026:3831","https://access.redhat.com/errata/RHSA-2026:3833","https://access.redhat.com/errata/RHSA-2026:3835","https://access.redhat.com/errata/RHSA-2026:3836","https://access.redhat.com/errata/RHSA-2026:3838","https://access.redhat.com/errata/RHSA-2026:3839","https://access.redhat.com/errata/RHSA-2026:3840","https://access.redhat.com/errata/RHSA-2026:3841","https://access.redhat.com/errata/RHSA-2026:3843","https://access.redhat.com/errata/RHSA-2026:3854","https://access.redhat.com/errata/RHSA-2026:3855","https://access.redhat.com/errata/RHSA-2026:3856","https://access.redhat.com/errata/RHSA-2026:3864","https://access.redhat.com/errata/RHSA-2026:3869","https://access.redhat.com/errata/RHSA-2026:3874","https://access.redhat.com/errata/RHSA-2026:3875","https://access.redhat.com/errata/RHSA-2026:3879","https://access.redhat.com/errata/RHSA-2026:3880","https://access.redhat.com/errata/RHSA-2026:3884","https://access.redhat.com/errata/RHSA-2026:3898","https://access.redhat.com/errata/RHSA-2026:3905","https://access.redhat.com/errata/RHSA-2026:3906","https://access.redhat.com/errata/RHSA-2026:3928","https://access.redhat.com/errata/RHSA-2026:3929","https://access.redhat.com/errata/RHSA-2026:3930","https://access.redhat.com/errata/RHSA-2026:3931","https://access.redhat.com/errata/RHSA-2026:3932","https://access.redhat.com/errata/RHSA-2026:3958","https://access.redhat.com/errata/RHSA-2026:3959","https://access.redhat.com/errata/RHSA-2026:3960","https://access.redhat.com/errata/RHSA-2026:3970","https://access.redhat.com/errata/RHSA-2026:3971","https://access.redhat.com/errata/RHSA-2026:3972","https://access.redhat.com/errata/RHSA-2026:3973","https://access.redhat.com/errata/RHSA-2026:3974","https://access.redhat.com/errata/RHSA-2026:3977","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:3985","https://access.redhat.com/errata/RHSA-2026:40924","https://access.redhat.com/errata/RHSA-2026:4164","https://access.redhat.com/errata/RHSA-2026:4166","https://access.redhat.com/errata/RHSA-2026:4170","https://access.redhat.com/errata/RHSA-2026:4174","https://access.redhat.com/errata/RHSA-2026:4177","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:4211","https://access.redhat.com/errata/RHSA-2026:4220","https://access.redhat.com/errata/RHSA-2026:4256","https://access.redhat.com/errata/RHSA-2026:4264","https://access.redhat.com/errata/RHSA-2026:4267","https://access.redhat.com/errata/RHSA-2026:4270","https://access.redhat.com/errata/RHSA-2026:4276","https://access.redhat.com/errata/RHSA-2026:4434","https://access.redhat.com/errata/RHSA-2026:4435","https://access.redhat.com/errata/RHSA-2026:4460","https://access.redhat.com/errata/RHSA-2026:4466","https://access.redhat.com/errata/RHSA-2026:4467","https://access.redhat.com/errata/RHSA-2026:4498","https://access.redhat.com/errata/RHSA-2026:4500","https://access.redhat.com/errata/RHSA-2026:4510","https://access.redhat.com/errata/RHSA-2026:4511","https://access.redhat.com/errata/RHSA-2026:4672","https://access.redhat.com/errata/RHSA-2026:46903","https://access.redhat.com/errata/RHSA-2026:4753","https://access.redhat.com/errata/RHSA-2026:4892","https://access.redhat.com/errata/RHSA-2026:4901","https://access.redhat.com/errata/RHSA-2026:4907","https://access.redhat.com/errata/RHSA-2026:4939","https://access.redhat.com/errata/RHSA-2026:4942","https://access.redhat.com/errata/RHSA-2026:4943","https://access.redhat.com/errata/RHSA-2026:4952","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:5022","https://access.redhat.com/errata/RHSA-2026:5030","https://access.redhat.com/errata/RHSA-2026:5031","https://access.redhat.com/errata/RHSA-2026:5076","https://access.redhat.com/errata/RHSA-2026:5077","https://access.redhat.com/errata/RHSA-2026:5078","https://access.redhat.com/errata/RHSA-2026:5079","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:5110","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:5129","https://access.redhat.com/errata/RHSA-2026:5130","https://access.redhat.com/errata/RHSA-2026:5131","https://access.redhat.com/errata/RHSA-2026:5132","https://access.redhat.com/errata/RHSA-2026:5145","https://access.redhat.com/errata/RHSA-2026:5146","https://access.redhat.com/errata/RHSA-2026:5168","https://access.redhat.com/errata/RHSA-2026:5327","https://access.redhat.com/errata/RHSA-2026:5394","https://access.redhat.com/errata/RHSA-2026:5439","https://access.redhat.com/errata/RHSA-2026:5444","https://access.redhat.com/errata/RHSA-2026:5447","https://access.redhat.com/errata/RHSA-2026:5452","https://access.redhat.com/errata/RHSA-2026:5461","https://access.redhat.com/errata/RHSA-2026:5463","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:5533","https://access.redhat.com/errata/RHSA-2026:5544","https://access.redhat.com/errata/RHSA-2026:5549","https://access.redhat.com/errata/RHSA-2026:5636","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:5645","https://access.redhat.com/errata/RHSA-2026:5649","https://access.redhat.com/errata/RHSA-2026:5665","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:5807","https://access.redhat.com/errata/RHSA-2026:5851","https://access.redhat.com/errata/RHSA-2026:5852","https://access.redhat.com/errata/RHSA-2026:5853","https://access.redhat.com/errata/RHSA-2026:5948","https://access.redhat.com/errata/RHSA-2026:5950","https://access.redhat.com/errata/RHSA-2026:5952","https://access.redhat.com/errata/RHSA-2026:5968","https://access.redhat.com/errata/RHSA-2026:6184","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6226","https://access.redhat.com/errata/RHSA-2026:6251","https://access.redhat.com/errata/RHSA-2026:6277","https://access.redhat.com/errata/RHSA-2026:6278","https://access.redhat.com/errata/RHSA-2026:6428","https://access.redhat.com/errata/RHSA-2026:6429","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6554","https://access.redhat.com/errata/RHSA-2026:6564","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:6568","https://access.redhat.com/errata/RHSA-2026:66401","https://access.redhat.com/errata/RHSA-2026:7052","https://access.redhat.com/errata/RHSA-2026:7249","https://access.redhat.com/errata/RHSA-2026:7291","https://access.redhat.com/errata/RHSA-2026:7385","https://access.redhat.com/errata/RHSA-2026:7676","https://access.redhat.com/errata/RHSA-2026:7854","https://access.redhat.com/errata/RHSA-2026:7942","https://access.redhat.com/errata/RHSA-2026:8151","https://access.redhat.com/errata/RHSA-2026:8167","https://access.redhat.com/errata/RHSA-2026:8218","https://access.redhat.com/errata/RHSA-2026:8229","https://access.redhat.com/errata/RHSA-2026:8337","https://access.redhat.com/errata/RHSA-2026:8338","https://access.redhat.com/errata/RHSA-2026:8431","https://access.redhat.com/errata/RHSA-2026:8433","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:9097","https://access.redhat.com/errata/RHSA-2026:9098","https://access.redhat.com/errata/RHSA-2026:9108","https://access.redhat.com/errata/RHSA-2026:9109","https://access.redhat.com/errata/RHSA-2026:9848","https://access.redhat.com/security/cve/CVE-2025-61726","https://bugzilla.redhat.com/show_bug.cgi?id=2434432","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61726.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61726","description":"The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption."}]},{"artifact":{"id":"d55bfe42f054b394","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.2.6-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.2.6-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=expat","type":"deb","version":"2.2.6-2+deb10u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.6-2+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-40674","versionConstraint":"< 2.2.6-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"expat","version":"2.2.6-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-40674","fix":{"state":"fixed","versions":["2.2.6-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.6-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-40674","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-40674","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-40674","date":"2026-10-08","epss":0.02223,"percentile":0.82161}],"risk":1.73394,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-40674","description":"libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c."},"relatedVulnerabilities":[{"id":"CVE-2022-40674","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-40674","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-40674","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-40674","date":"2026-10-08","epss":0.02223,"percentile":0.82161}],"urls":["https://github.com/libexpat/libexpat/pull/629","https://github.com/libexpat/libexpat/pull/640","https://lists.debian.org/debian-lts-announce/2022/09/msg00029.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GSVZN3IJ6OCPSJL7AEX3ZHSHAHFOGESK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J2IGJNHFV53PYST7VQV3T4NHVYAMXA36/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LQB6FJAM5YQ35SF5B2MN25Y2FX56EOEZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2ZKEPGFCZ7R6DRVH3K6RBJPT42ZBEG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCGBVQQ47URGJAZWHCISHDWF6QBTV2LE/","https://security.gentoo.org/glsa/202209-24","https://security.gentoo.org/glsa/202211-06","https://security.netapp.com/advisory/ntap-20221028-0008/","https://www.debian.org/security/2022/dsa-5236"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-40674","description":"libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c."}]},{"artifact":{"id":"d8ff810652b69ff8","cpes":["cpe:2.3:a:rsync:rsync:3.1.3-6:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/debian/rsync@3.1.3-6?arch=amd64&distro=debian-10.1","type":"deb","version":"3.1.3-6","language":"","licenses":["sha256:80834d03d0da9ca141f532b343fe5bb5d8f2a4e60c11d667c99755fa17fce838"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-29154","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"rsync","version":"3.1.3-6"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-29154","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-29154","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-29154","date":"2026-10-08","epss":0.02313,"percentile":0.82881}],"risk":1.723185,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-29154","description":"An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file)."},"relatedVulnerabilities":[{"id":"CVE-2022-29154","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-29154","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-29154","date":"2026-10-08","epss":0.02313,"percentile":0.82881}],"urls":["http://www.openwall.com/lists/oss-security/2022/08/02/1","https://github.com/WayneD/rsync/tags","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMBOJ77A7T7PQCARMDUK75TE6LLESZ3O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YRQAI7H4M4RQZ2IWZUEEXECBE5D56BH2/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-29154","description":"An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file)."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.15.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0245","versionConstraint":"<1.15.15||>=1.16.0-0,<1.16.7 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0245","fix":{"state":"fixed","versions":["1.15.15","1.16.7"],"available":[{"date":"2021-08-04","kind":"release","version":"1.15.15"},{"date":"2021-08-04","kind":"release","version":"1.16.7"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-36221","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-36221","date":"2026-10-08","epss":0.03114,"percentile":0.87418}],"risk":1.6971300000000002,"urls":["https://go.googlesource.com/go/+/b7a85e0003cedb1b48a1fd3ae5b746ec6330102e","https://groups.google.com/g/golang-announce/c/uHACNfXAZqk","https://go.dev/issue/46866"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/333191","description":"ReverseProxy can panic after encountering a problem copying a proxied response body."},"relatedVulnerabilities":[{"id":"CVE-2021-36221","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-36221","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-36221","date":"2026-10-08","epss":0.03114,"percentile":0.87418}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf","https://groups.google.com/forum/#%21forum/golang-announce","https://groups.google.com/g/golang-announce/c/JvWG9FUUYT0","https://groups.google.com/g/golang-announce/c/uHACNfXAZqk","https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html","https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html","https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MU47VKTNXX33ZDLTI2ORRUY3KLJKU6G/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HM7U5JNS5WU66Q3S26PFIU2ITB2ATTQ4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4AMYYHGBYMIWCCR5RCDFI5RAUJOPO5L/","https://security.gentoo.org/glsa/202208-02","https://www.oracle.com/security-alerts/cpujan2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-36221","description":"Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.15.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0245","versionConstraint":"<1.15.15||>=1.16.0-0,<1.16.7 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0245","fix":{"state":"fixed","versions":["1.15.15","1.16.7"],"available":[{"date":"2021-08-04","kind":"release","version":"1.15.15"},{"date":"2021-08-04","kind":"release","version":"1.16.7"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-36221","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-36221","date":"2026-10-08","epss":0.03114,"percentile":0.87418}],"risk":1.6971300000000002,"urls":["https://go.googlesource.com/go/+/b7a85e0003cedb1b48a1fd3ae5b746ec6330102e","https://groups.google.com/g/golang-announce/c/uHACNfXAZqk","https://go.dev/issue/46866"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/333191","description":"ReverseProxy can panic after encountering a problem copying a proxied response body."},"relatedVulnerabilities":[{"id":"CVE-2021-36221","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-36221","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-36221","date":"2026-10-08","epss":0.03114,"percentile":0.87418}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf","https://groups.google.com/forum/#%21forum/golang-announce","https://groups.google.com/g/golang-announce/c/JvWG9FUUYT0","https://groups.google.com/g/golang-announce/c/uHACNfXAZqk","https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html","https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html","https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MU47VKTNXX33ZDLTI2ORRUY3KLJKU6G/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HM7U5JNS5WU66Q3S26PFIU2ITB2ATTQ4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J4AMYYHGBYMIWCCR5RCDFI5RAUJOPO5L/","https://security.gentoo.org/glsa/202208-02","https://www.oracle.com/security-alerts/cpujan2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-36221","description":"Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.17.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0533","versionConstraint":"<1.17.11||>=1.18.0-0,<1.18.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0533","fix":{"state":"fixed","versions":["1.17.11","1.18.3"],"available":[{"date":"2022-06-01","kind":"release","version":"1.17.11"},{"date":"2022-06-01","kind":"release","version":"1.18.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-29804","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-29804","date":"2026-10-08","epss":0.02261,"percentile":0.82453}],"risk":1.69575,"urls":["https://go.googlesource.com/go/+/9cd1818a7d019c02fa4898b3e45a323e35033290","https://go.dev/issue/52476","https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/401595","description":"On Windows, the filepath.Clean function can convert certain invalid paths to valid, absolute paths, potentially allowing a directory traversal attack.\n\nFor example, Clean(\".\\c:\") returns \"c:\"."},"relatedVulnerabilities":[{"id":"CVE-2022-29804","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-29804","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-29804","date":"2026-10-08","epss":0.02261,"percentile":0.82453}],"urls":["https://go.dev/cl/401595","https://go.dev/issue/52476","https://go.googlesource.com/go/+/9cd1818a7d019c02fa4898b3e45a323e35033290","https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ","https://pkg.go.dev/vuln/GO-2022-0533"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-29804","description":"Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.17.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0533","versionConstraint":"<1.17.11||>=1.18.0-0,<1.18.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0533","fix":{"state":"fixed","versions":["1.17.11","1.18.3"],"available":[{"date":"2022-06-01","kind":"release","version":"1.17.11"},{"date":"2022-06-01","kind":"release","version":"1.18.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-29804","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-29804","date":"2026-10-08","epss":0.02261,"percentile":0.82453}],"risk":1.69575,"urls":["https://go.googlesource.com/go/+/9cd1818a7d019c02fa4898b3e45a323e35033290","https://go.dev/issue/52476","https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/401595","description":"On Windows, the filepath.Clean function can convert certain invalid paths to valid, absolute paths, potentially allowing a directory traversal attack.\n\nFor example, Clean(\".\\c:\") returns \"c:\"."},"relatedVulnerabilities":[{"id":"CVE-2022-29804","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-29804","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-29804","date":"2026-10-08","epss":0.02261,"percentile":0.82453}],"urls":["https://go.dev/cl/401595","https://go.dev/issue/52476","https://go.googlesource.com/go/+/9cd1818a7d019c02fa4898b3e45a323e35033290","https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ","https://pkg.go.dev/vuln/GO-2022-0533"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-29804","description":"Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.17.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0477","versionConstraint":"<1.17.11||>=1.18.0-0,<1.18.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0477","fix":{"state":"fixed","versions":["1.17.11","1.18.3"],"available":[{"date":"2022-06-01","kind":"release","version":"1.17.11"},{"date":"2022-06-01","kind":"release","version":"1.18.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-30634","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-30634","date":"2026-10-08","epss":0.0226,"percentile":0.82442}],"risk":1.695,"urls":["https://go.googlesource.com/go/+/bb1f4416180511231de6d17a1f2f55c82aafc863","https://go.dev/issue/52561","https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/402257","description":"On Windows, rand.Read will hang indefinitely if passed a buffer larger than 1 << 32 - 1 bytes."},"relatedVulnerabilities":[{"id":"CVE-2022-30634","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-30634","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-30634","date":"2026-10-08","epss":0.0226,"percentile":0.82442}],"urls":["https://go.dev/cl/402257","https://go.dev/issue/52561","https://go.googlesource.com/go/+/bb1f4416180511231de6d17a1f2f55c82aafc863","https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ","https://pkg.go.dev/vuln/GO-2022-0477"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-30634","description":"Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.17.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0477","versionConstraint":"<1.17.11||>=1.18.0-0,<1.18.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0477","fix":{"state":"fixed","versions":["1.17.11","1.18.3"],"available":[{"date":"2022-06-01","kind":"release","version":"1.17.11"},{"date":"2022-06-01","kind":"release","version":"1.18.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-30634","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-30634","date":"2026-10-08","epss":0.0226,"percentile":0.82442}],"risk":1.695,"urls":["https://go.googlesource.com/go/+/bb1f4416180511231de6d17a1f2f55c82aafc863","https://go.dev/issue/52561","https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/402257","description":"On Windows, rand.Read will hang indefinitely if passed a buffer larger than 1 << 32 - 1 bytes."},"relatedVulnerabilities":[{"id":"CVE-2022-30634","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-30634","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-30634","date":"2026-10-08","epss":0.0226,"percentile":0.82442}],"urls":["https://go.dev/cl/402257","https://go.dev/issue/52561","https://go.googlesource.com/go/+/bb1f4416180511231de6d17a1f2f55c82aafc863","https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ","https://pkg.go.dev/vuln/GO-2022-0477"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-30634","description":"Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes."}]},{"artifact":{"id":"ba5663119246d2af","cpes":["cpe:2.3:a:gcc-8-base:gcc-8-base:8.3.0-6:*:*:*:*:*:*:*","cpe:2.3:a:gcc-8-base:gcc_8_base:8.3.0-6:*:*:*:*:*:*:*","cpe:2.3:a:gcc_8_base:gcc-8-base:8.3.0-6:*:*:*:*:*:*:*","cpe:2.3:a:gcc_8_base:gcc_8_base:8.3.0-6:*:*:*:*:*:*:*","cpe:2.3:a:gcc-8:gcc-8-base:8.3.0-6:*:*:*:*:*:*:*","cpe:2.3:a:gcc-8:gcc_8_base:8.3.0-6:*:*:*:*:*:*:*","cpe:2.3:a:gcc_8:gcc-8-base:8.3.0-6:*:*:*:*:*:*:*","cpe:2.3:a:gcc_8:gcc_8_base:8.3.0-6:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-8-base:8.3.0-6:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_8_base:8.3.0-6:*:*:*:*:*:*:*"],"name":"gcc-8-base","purl":"pkg:deb/debian/gcc-8-base@8.3.0-6?arch=amd64&distro=debian-10.1&upstream=gcc-8","type":"deb","version":"8.3.0-6","language":"","licenses":["sha256:9865be517c31de50eb2b36a8957ccd97942807974afad2515578101d1168887a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-8-base/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/gcc-8-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-8-base:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/gcc-8-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12886","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"gcc-8","version":"8.3.0-6"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2018-12886","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"risk":1.6933800000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against."},"relatedVulnerabilities":[{"id":"CVE-2018-12886","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"urls":["https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markup","https://www.gnu.org/software/gcc/gcc-8/changes.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against."}]},{"artifact":{"id":"ffc1d39eff5a666e","cpes":["cpe:2.3:a:libgcc1:libgcc1:1\\:8.3.0-6:*:*:*:*:*:*:*"],"name":"libgcc1","purl":"pkg:deb/debian/libgcc1@1%3A8.3.0-6?arch=amd64&distro=debian-10.1&upstream=gcc-8%408.3.0-6","type":"deb","version":"1:8.3.0-6","language":"","licenses":["sha256:9865be517c31de50eb2b36a8957ccd97942807974afad2515578101d1168887a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-8-base/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libgcc1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc1:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libgcc1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-8","version":"8.3.0-6"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12886","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"gcc-8","version":"8.3.0-6"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2018-12886","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"risk":1.6933800000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against."},"relatedVulnerabilities":[{"id":"CVE-2018-12886","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"urls":["https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markup","https://www.gnu.org/software/gcc/gcc-8/changes.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against."}]},{"artifact":{"id":"0ebb89f70b0c2511","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:8.3.0-6:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/debian/libstdc%2B%2B6@8.3.0-6?arch=amd64&distro=debian-10.1&upstream=gcc-8","type":"deb","version":"8.3.0-6","language":"","licenses":["sha256:9865be517c31de50eb2b36a8957ccd97942807974afad2515578101d1168887a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-8-base/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-8"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12886","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"gcc-8","version":"8.3.0-6"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2018-12886","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"risk":1.6933800000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against."},"relatedVulnerabilities":[{"id":"CVE-2018-12886","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12886","cwe":"CWE-209","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12886","date":"2026-10-08","epss":0.02171,"percentile":0.81734}],"urls":["https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markup","https://www.gnu.org/software/gcc/gcc-8/changes.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12886","description":"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against."}]},{"artifact":{"id":"ecf5e89e65014edb","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.64.0-4:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/debian/libcurl4@7.64.0-4?arch=amd64&distro=debian-10.1&upstream=curl","type":"deb","version":"7.64.0-4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.64.0-4+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-22576","versionConstraint":"< 7.64.0-4+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"curl","version":"7.64.0-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-22576","fix":{"state":"fixed","versions":["7.64.0-4+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.64.0-4+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22576","cwe":"CWE-287","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-22576","cwe":"CWE-306","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-22576","date":"2026-10-08","epss":0.02161,"percentile":0.8166}],"risk":1.68558,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-22576","description":"An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only)."},"relatedVulnerabilities":[{"id":"CVE-2022-22576","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:N","metrics":{"baseScore":5.5,"impactScore":5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22576","cwe":"CWE-287","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-22576","cwe":"CWE-306","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-22576","date":"2026-10-08","epss":0.02161,"percentile":0.8166}],"urls":["https://hackerone.com/reports/1526328","https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20220609-0008/","https://www.debian.org/security/2022/dsa-5197"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-22576","description":"An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only)."}]},{"artifact":{"id":"bca20a7b0a858bf3","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/debian/libssl1.1@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1&upstream=openssl","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-0727","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2024-0727","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0727","date":"2026-10-08","epss":0.03187,"percentile":0.877}],"risk":1.6731750000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-0727","description":"Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack  Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly.  A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue.  OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass().  We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant.  The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue."},"relatedVulnerabilities":[{"id":"CVE-2024-0727","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0727","date":"2026-10-08","epss":0.03187,"percentile":0.877}],"urls":["https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2","https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a","https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c","https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8","https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539","https://www.openssl.org/news/secadv/20240125.txt","http://www.openwall.com/lists/oss-security/2024/03/11/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240208-0006/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0727","description":"Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from an untrusted source using the OpenSSL APIs then that application will\nbe vulnerable to this issue.\n\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\nand PKCS12_newpass().\n\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\nfunction is related to writing data we do not consider it security significant.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue."}]},{"artifact":{"id":"d308e84bddad0b0f","cpes":["cpe:2.3:a:openssl:openssl:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-0727","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2024-0727","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0727","date":"2026-10-08","epss":0.03187,"percentile":0.877}],"risk":1.6731750000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-0727","description":"Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack  Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly.  A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue.  OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass().  We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant.  The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue."},"relatedVulnerabilities":[{"id":"CVE-2024-0727","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0727","date":"2026-10-08","epss":0.03187,"percentile":0.877}],"urls":["https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2","https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a","https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c","https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8","https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539","https://www.openssl.org/news/secadv/20240125.txt","http://www.openwall.com/lists/oss-security/2024/03/11/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240208-0006/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0727","description":"Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from an untrusted source using the OpenSSL APIs then that application will\nbe vulnerable to this issue.\n\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\nand PKCS12_newpass().\n\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\nfunction is related to writing data we do not consider it security significant.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue."}]},{"artifact":{"id":"7f19231bca942dc4","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/debian/libldap-2.4-2@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-25692","versionConstraint":"< 2.4.47+dfsg-3+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-25692","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25692","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25692","date":"2026-10-08","epss":0.02209,"percentile":0.82048}],"risk":1.65675,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4782-1","link":"https://security-tracker.debian.org/tracker/DSA-4782-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-25692","description":"A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. An unauthenticated attacker could remotely crash the slapd process by sending a specially crafted request, causing a Denial of Service."},"relatedVulnerabilities":[{"id":"CVE-2020-25692","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25692","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25692","date":"2026-10-08","epss":0.02209,"percentile":0.82048}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1894567","https://security.netapp.com/advisory/ntap-20210108-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-25692","description":"A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. An unauthenticated attacker could remotely crash the slapd process by sending a specially crafted request, causing a Denial of Service."}]},{"artifact":{"id":"ed53a6639a2640b0","cpes":["cpe:2.3:a:libldap-common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-common","purl":"pkg:deb/debian/libldap-common@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=all&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-common/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.list"}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.47+dfsg-3+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-25692","versionConstraint":"< 2.4.47+dfsg-3+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-25692","fix":{"state":"fixed","versions":["2.4.47+dfsg-3+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.47+dfsg-3+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25692","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25692","date":"2026-10-08","epss":0.02209,"percentile":0.82048}],"risk":1.65675,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4782-1","link":"https://security-tracker.debian.org/tracker/DSA-4782-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-25692","description":"A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. An unauthenticated attacker could remotely crash the slapd process by sending a specially crafted request, causing a Denial of Service."},"relatedVulnerabilities":[{"id":"CVE-2020-25692","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-25692","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-25692","date":"2026-10-08","epss":0.02209,"percentile":0.82048}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1894567","https://security.netapp.com/advisory/ntap-20210108-0006/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-25692","description":"A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. An unauthenticated attacker could remotely crash the slapd process by sending a specially crafted request, causing a Denial of Service."}]},{"artifact":{"id":"9c0f03079e497030","cpes":["cpe:2.3:a:libpython3.7-minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-minimal","purl":"pkg:deb/debian/libpython3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-4189","versionConstraint":"< 3.7.3-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-4189","fix":{"state":"fixed","versions":["3.7.3-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-4189","cwe":"CWE-252","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-4189","cwe":"CWE-252","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-4189","date":"2026-10-08","epss":0.03196,"percentile":0.87739}],"risk":1.6459400000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-4189","description":"A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible."},"relatedVulnerabilities":[{"id":"CVE-2021-4189","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-4189","cwe":"CWE-252","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-4189","cwe":"CWE-252","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-4189","date":"2026-10-08","epss":0.03196,"percentile":0.87739}],"urls":["https://access.redhat.com/security/cve/CVE-2021-4189","https://bugs.python.org/issue43285","https://bugzilla.redhat.com/show_bug.cgi?id=2036020","https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://python-security.readthedocs.io/vuln/ftplib-pasv.html","https://security-tracker.debian.org/tracker/CVE-2021-4189","https://security.netapp.com/advisory/ntap-20221104-0004/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-4189","description":"A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible."}]},{"artifact":{"id":"b6d8c37141cd8c0a","cpes":["cpe:2.3:a:libpython3.7-stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-stdlib","purl":"pkg:deb/debian/libpython3.7-stdlib@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-4189","versionConstraint":"< 3.7.3-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-4189","fix":{"state":"fixed","versions":["3.7.3-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-4189","cwe":"CWE-252","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-4189","cwe":"CWE-252","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-4189","date":"2026-10-08","epss":0.03196,"percentile":0.87739}],"risk":1.6459400000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-4189","description":"A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible."},"relatedVulnerabilities":[{"id":"CVE-2021-4189","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-4189","cwe":"CWE-252","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-4189","cwe":"CWE-252","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-4189","date":"2026-10-08","epss":0.03196,"percentile":0.87739}],"urls":["https://access.redhat.com/security/cve/CVE-2021-4189","https://bugs.python.org/issue43285","https://bugzilla.redhat.com/show_bug.cgi?id=2036020","https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://python-security.readthedocs.io/vuln/ftplib-pasv.html","https://security-tracker.debian.org/tracker/CVE-2021-4189","https://security.netapp.com/advisory/ntap-20221104-0004/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-4189","description":"A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible."}]},{"artifact":{"id":"94955c7d71be2bb1","cpes":["cpe:2.3:a:python3.7:python3.7:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7","purl":"pkg:deb/debian/python3.7@3.7.3-2?arch=amd64&distro=debian-10.1","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.list"},{"path":"/var/lib/dpkg/info/python3.7.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.postinst"},{"path":"/var/lib/dpkg/info/python3.7.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-4189","versionConstraint":"< 3.7.3-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-4189","fix":{"state":"fixed","versions":["3.7.3-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-4189","cwe":"CWE-252","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-4189","cwe":"CWE-252","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-4189","date":"2026-10-08","epss":0.03196,"percentile":0.87739}],"risk":1.6459400000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-4189","description":"A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible."},"relatedVulnerabilities":[{"id":"CVE-2021-4189","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-4189","cwe":"CWE-252","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-4189","cwe":"CWE-252","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-4189","date":"2026-10-08","epss":0.03196,"percentile":0.87739}],"urls":["https://access.redhat.com/security/cve/CVE-2021-4189","https://bugs.python.org/issue43285","https://bugzilla.redhat.com/show_bug.cgi?id=2036020","https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://python-security.readthedocs.io/vuln/ftplib-pasv.html","https://security-tracker.debian.org/tracker/CVE-2021-4189","https://security.netapp.com/advisory/ntap-20221104-0004/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-4189","description":"A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible."}]},{"artifact":{"id":"988c8a69c0d8509e","cpes":["cpe:2.3:a:python3.7-minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7-minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7-minimal","purl":"pkg:deb/debian/python3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.list"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.7-minimal.preinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.prerm"}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-4189","versionConstraint":"< 3.7.3-2+deb10u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-4189","fix":{"state":"fixed","versions":["3.7.3-2+deb10u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-4189","cwe":"CWE-252","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-4189","cwe":"CWE-252","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-4189","date":"2026-10-08","epss":0.03196,"percentile":0.87739}],"risk":1.6459400000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-4189","description":"A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible."},"relatedVulnerabilities":[{"id":"CVE-2021-4189","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-4189","cwe":"CWE-252","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-4189","cwe":"CWE-252","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-4189","date":"2026-10-08","epss":0.03196,"percentile":0.87739}],"urls":["https://access.redhat.com/security/cve/CVE-2021-4189","https://bugs.python.org/issue43285","https://bugzilla.redhat.com/show_bug.cgi?id=2036020","https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://python-security.readthedocs.io/vuln/ftplib-pasv.html","https://security-tracker.debian.org/tracker/CVE-2021-4189","https://security.netapp.com/advisory/ntap-20221104-0004/","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-4189","description":"A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible."}]},{"artifact":{"id":"ecf5e89e65014edb","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.64.0-4:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/debian/libcurl4@7.64.0-4?arch=amd64&distro=debian-10.1&upstream=curl","type":"deb","version":"7.64.0-4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.64.0-4+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-22947","versionConstraint":"< 7.64.0-4+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"curl","version":"7.64.0-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-22947","fix":{"state":"fixed","versions":["7.64.0-4+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.64.0-4+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-22947","cwe":"CWE-310","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2021-22947","cwe":"CWE-345","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-22947","date":"2026-10-08","epss":0.03009,"percentile":0.87008}],"risk":1.6399050000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-22947","description":"When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server."},"relatedVulnerabilities":[{"id":"CVE-2021-22947","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-22947","cwe":"CWE-310","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2021-22947","cwe":"CWE-345","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-22947","date":"2026-10-08","epss":0.03009,"percentile":0.87008}],"urls":["http://seclists.org/fulldisclosure/2022/Mar/29","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://hackerone.com/reports/1334763","https://lists.debian.org/debian-lts-announce/2021/09/msg00022.html","https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20211029-0003/","https://support.apple.com/kb/HT213183","https://www.debian.org/security/2022/dsa-5197","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-22947","description":"When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server."}]},{"artifact":{"id":"272d36f5a7420670","cpes":["cpe:2.3:a:dirmngr:dirmngr:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*"],"name":"dirmngr","purl":"pkg:deb/debian/dirmngr@2.2.12-1%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=gnupg2","type":"deb","version":"2.2.12-1+deb10u1","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/dirmngr/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/dirmngr/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dirmngr.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/dirmngr.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dirmngr.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/dirmngr.list"},{"path":"/var/lib/dpkg/info/dirmngr.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/dirmngr.postinst"},{"path":"/var/lib/dpkg/info/dirmngr.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/dirmngr.postrm"},{"path":"/var/lib/dpkg/info/dirmngr.preinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/dirmngr.preinst"},{"path":"/var/lib/dpkg/info/dirmngr.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/dirmngr.prerm"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.12-1+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-34903","versionConstraint":"< 2.2.12-1+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"gnupg2","version":"2.2.12-1+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-34903","fix":{"state":"fixed","versions":["2.2.12-1+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.12-1+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-34903","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-34903","date":"2026-10-08","epss":0.02844,"percentile":0.8627}],"risk":1.6353,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5174-1","link":"https://security-tracker.debian.org/tracker/DSA-5174-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-34903","description":"GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."},"relatedVulnerabilities":[{"id":"CVE-2022-34903","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-34903","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-34903","date":"2026-10-08","epss":0.02844,"percentile":0.8627}],"urls":["http://www.openwall.com/lists/oss-security/2022/07/02/1","https://bugs.debian.org/1014157","https://dev.gnupg.org/T6027","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRLWJQ76A4UKHI3Q36BKSJKS4LFLQO33/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPTAR76EIZY7NQFENSOZO7U473257OVZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VN63GBTMRWO36Y7BKA2WQHROAKCXKCBL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU64FUVG2PRZBSHFOQRSP7KDVEIZ23OS/","https://security.netapp.com/advisory/ntap-20220826-0005/","https://www.debian.org/security/2022/dsa-5174","https://www.openwall.com/lists/oss-security/2022/06/30/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-34903","description":"GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."}]},{"artifact":{"id":"1f21ee65e81b37d7","cpes":["cpe:2.3:a:gnupg:gnupg:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*"],"name":"gnupg","purl":"pkg:deb/debian/gnupg@2.2.12-1%2Bdeb10u1?arch=all&distro=debian-10.1&upstream=gnupg2","type":"deb","version":"2.2.12-1+deb10u1","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gnupg/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/gnupg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/gnupg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/gnupg.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.12-1+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-34903","versionConstraint":"< 2.2.12-1+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"gnupg2","version":"2.2.12-1+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-34903","fix":{"state":"fixed","versions":["2.2.12-1+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.12-1+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-34903","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-34903","date":"2026-10-08","epss":0.02844,"percentile":0.8627}],"risk":1.6353,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5174-1","link":"https://security-tracker.debian.org/tracker/DSA-5174-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-34903","description":"GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."},"relatedVulnerabilities":[{"id":"CVE-2022-34903","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-34903","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-34903","date":"2026-10-08","epss":0.02844,"percentile":0.8627}],"urls":["http://www.openwall.com/lists/oss-security/2022/07/02/1","https://bugs.debian.org/1014157","https://dev.gnupg.org/T6027","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRLWJQ76A4UKHI3Q36BKSJKS4LFLQO33/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPTAR76EIZY7NQFENSOZO7U473257OVZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VN63GBTMRWO36Y7BKA2WQHROAKCXKCBL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU64FUVG2PRZBSHFOQRSP7KDVEIZ23OS/","https://security.netapp.com/advisory/ntap-20220826-0005/","https://www.debian.org/security/2022/dsa-5174","https://www.openwall.com/lists/oss-security/2022/06/30/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-34903","description":"GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."}]},{"artifact":{"id":"fb01d0c6b5385db2","cpes":["cpe:2.3:a:gnupg-l10n:gnupg-l10n:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gnupg-l10n:gnupg_l10n:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gnupg_l10n:gnupg-l10n:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gnupg_l10n:gnupg_l10n:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gnupg:gnupg-l10n:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gnupg:gnupg_l10n:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*"],"name":"gnupg-l10n","purl":"pkg:deb/debian/gnupg-l10n@2.2.12-1%2Bdeb10u1?arch=all&distro=debian-10.1&upstream=gnupg2","type":"deb","version":"2.2.12-1+deb10u1","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gnupg-l10n/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/gnupg-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg-l10n.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/gnupg-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg-l10n.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/gnupg-l10n.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.12-1+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-34903","versionConstraint":"< 2.2.12-1+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"gnupg2","version":"2.2.12-1+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-34903","fix":{"state":"fixed","versions":["2.2.12-1+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.12-1+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-34903","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-34903","date":"2026-10-08","epss":0.02844,"percentile":0.8627}],"risk":1.6353,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5174-1","link":"https://security-tracker.debian.org/tracker/DSA-5174-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-34903","description":"GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."},"relatedVulnerabilities":[{"id":"CVE-2022-34903","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-34903","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-34903","date":"2026-10-08","epss":0.02844,"percentile":0.8627}],"urls":["http://www.openwall.com/lists/oss-security/2022/07/02/1","https://bugs.debian.org/1014157","https://dev.gnupg.org/T6027","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRLWJQ76A4UKHI3Q36BKSJKS4LFLQO33/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPTAR76EIZY7NQFENSOZO7U473257OVZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VN63GBTMRWO36Y7BKA2WQHROAKCXKCBL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU64FUVG2PRZBSHFOQRSP7KDVEIZ23OS/","https://security.netapp.com/advisory/ntap-20220826-0005/","https://www.debian.org/security/2022/dsa-5174","https://www.openwall.com/lists/oss-security/2022/06/30/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-34903","description":"GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."}]},{"artifact":{"id":"9ea995935f462047","cpes":["cpe:2.3:a:gnupg-utils:gnupg-utils:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gnupg-utils:gnupg_utils:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gnupg_utils:gnupg-utils:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gnupg_utils:gnupg_utils:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gnupg:gnupg-utils:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gnupg:gnupg_utils:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*"],"name":"gnupg-utils","purl":"pkg:deb/debian/gnupg-utils@2.2.12-1%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=gnupg2","type":"deb","version":"2.2.12-1+deb10u1","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gnupg-utils/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/gnupg-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg-utils.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/gnupg-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg-utils.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/gnupg-utils.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.12-1+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-34903","versionConstraint":"< 2.2.12-1+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"gnupg2","version":"2.2.12-1+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-34903","fix":{"state":"fixed","versions":["2.2.12-1+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.12-1+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-34903","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-34903","date":"2026-10-08","epss":0.02844,"percentile":0.8627}],"risk":1.6353,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5174-1","link":"https://security-tracker.debian.org/tracker/DSA-5174-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-34903","description":"GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."},"relatedVulnerabilities":[{"id":"CVE-2022-34903","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-34903","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-34903","date":"2026-10-08","epss":0.02844,"percentile":0.8627}],"urls":["http://www.openwall.com/lists/oss-security/2022/07/02/1","https://bugs.debian.org/1014157","https://dev.gnupg.org/T6027","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRLWJQ76A4UKHI3Q36BKSJKS4LFLQO33/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPTAR76EIZY7NQFENSOZO7U473257OVZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VN63GBTMRWO36Y7BKA2WQHROAKCXKCBL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU64FUVG2PRZBSHFOQRSP7KDVEIZ23OS/","https://security.netapp.com/advisory/ntap-20220826-0005/","https://www.debian.org/security/2022/dsa-5174","https://www.openwall.com/lists/oss-security/2022/06/30/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-34903","description":"GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."}]},{"artifact":{"id":"c7299385107b0e57","cpes":["cpe:2.3:a:gpg:gpg:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*"],"name":"gpg","purl":"pkg:deb/debian/gpg@2.2.12-1%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=gnupg2","type":"deb","version":"2.2.12-1+deb10u1","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpg/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/gpg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/gpg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/gpg.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.12-1+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-34903","versionConstraint":"< 2.2.12-1+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"gnupg2","version":"2.2.12-1+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-34903","fix":{"state":"fixed","versions":["2.2.12-1+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.12-1+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-34903","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-34903","date":"2026-10-08","epss":0.02844,"percentile":0.8627}],"risk":1.6353,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5174-1","link":"https://security-tracker.debian.org/tracker/DSA-5174-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-34903","description":"GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."},"relatedVulnerabilities":[{"id":"CVE-2022-34903","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-34903","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-34903","date":"2026-10-08","epss":0.02844,"percentile":0.8627}],"urls":["http://www.openwall.com/lists/oss-security/2022/07/02/1","https://bugs.debian.org/1014157","https://dev.gnupg.org/T6027","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRLWJQ76A4UKHI3Q36BKSJKS4LFLQO33/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPTAR76EIZY7NQFENSOZO7U473257OVZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VN63GBTMRWO36Y7BKA2WQHROAKCXKCBL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU64FUVG2PRZBSHFOQRSP7KDVEIZ23OS/","https://security.netapp.com/advisory/ntap-20220826-0005/","https://www.debian.org/security/2022/dsa-5174","https://www.openwall.com/lists/oss-security/2022/06/30/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-34903","description":"GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."}]},{"artifact":{"id":"94744d6829341a3d","cpes":["cpe:2.3:a:gpg-agent:gpg-agent:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gpg-agent:gpg_agent:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gpg_agent:gpg-agent:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gpg_agent:gpg_agent:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg-agent:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg_agent:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*"],"name":"gpg-agent","purl":"pkg:deb/debian/gpg-agent@2.2.12-1%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=gnupg2","type":"deb","version":"2.2.12-1+deb10u1","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpg-agent/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/gpg-agent/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-agent.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/gpg-agent.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-agent.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/gpg-agent.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-agent.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/gpg-agent.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.12-1+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-34903","versionConstraint":"< 2.2.12-1+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"gnupg2","version":"2.2.12-1+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-34903","fix":{"state":"fixed","versions":["2.2.12-1+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.12-1+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-34903","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-34903","date":"2026-10-08","epss":0.02844,"percentile":0.8627}],"risk":1.6353,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5174-1","link":"https://security-tracker.debian.org/tracker/DSA-5174-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-34903","description":"GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."},"relatedVulnerabilities":[{"id":"CVE-2022-34903","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-34903","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-34903","date":"2026-10-08","epss":0.02844,"percentile":0.8627}],"urls":["http://www.openwall.com/lists/oss-security/2022/07/02/1","https://bugs.debian.org/1014157","https://dev.gnupg.org/T6027","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRLWJQ76A4UKHI3Q36BKSJKS4LFLQO33/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPTAR76EIZY7NQFENSOZO7U473257OVZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VN63GBTMRWO36Y7BKA2WQHROAKCXKCBL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU64FUVG2PRZBSHFOQRSP7KDVEIZ23OS/","https://security.netapp.com/advisory/ntap-20220826-0005/","https://www.debian.org/security/2022/dsa-5174","https://www.openwall.com/lists/oss-security/2022/06/30/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-34903","description":"GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."}]},{"artifact":{"id":"e4da94fb5d1be992","cpes":["cpe:2.3:a:gpg-wks-client:gpg-wks-client:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gpg-wks-client:gpg_wks_client:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks_client:gpg-wks-client:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks_client:gpg_wks_client:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gpg-wks:gpg-wks-client:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gpg-wks:gpg_wks_client:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks:gpg-wks-client:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks:gpg_wks_client:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg-wks-client:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg_wks_client:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*"],"name":"gpg-wks-client","purl":"pkg:deb/debian/gpg-wks-client@2.2.12-1%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=gnupg2","type":"deb","version":"2.2.12-1+deb10u1","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpg-wks-client/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/gpg-wks-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-wks-client.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/gpg-wks-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-wks-client.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/gpg-wks-client.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.12-1+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-34903","versionConstraint":"< 2.2.12-1+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"gnupg2","version":"2.2.12-1+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-34903","fix":{"state":"fixed","versions":["2.2.12-1+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.12-1+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-34903","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-34903","date":"2026-10-08","epss":0.02844,"percentile":0.8627}],"risk":1.6353,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5174-1","link":"https://security-tracker.debian.org/tracker/DSA-5174-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-34903","description":"GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."},"relatedVulnerabilities":[{"id":"CVE-2022-34903","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-34903","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-34903","date":"2026-10-08","epss":0.02844,"percentile":0.8627}],"urls":["http://www.openwall.com/lists/oss-security/2022/07/02/1","https://bugs.debian.org/1014157","https://dev.gnupg.org/T6027","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRLWJQ76A4UKHI3Q36BKSJKS4LFLQO33/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPTAR76EIZY7NQFENSOZO7U473257OVZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VN63GBTMRWO36Y7BKA2WQHROAKCXKCBL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU64FUVG2PRZBSHFOQRSP7KDVEIZ23OS/","https://security.netapp.com/advisory/ntap-20220826-0005/","https://www.debian.org/security/2022/dsa-5174","https://www.openwall.com/lists/oss-security/2022/06/30/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-34903","description":"GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."}]},{"artifact":{"id":"d0ca72773927413e","cpes":["cpe:2.3:a:gpg-wks-server:gpg-wks-server:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gpg-wks-server:gpg_wks_server:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks_server:gpg-wks-server:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks_server:gpg_wks_server:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gpg-wks:gpg-wks-server:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gpg-wks:gpg_wks_server:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks:gpg-wks-server:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks:gpg_wks_server:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg-wks-server:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg_wks_server:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*"],"name":"gpg-wks-server","purl":"pkg:deb/debian/gpg-wks-server@2.2.12-1%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=gnupg2","type":"deb","version":"2.2.12-1+deb10u1","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpg-wks-server/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/gpg-wks-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-wks-server.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/gpg-wks-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-wks-server.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/gpg-wks-server.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.12-1+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-34903","versionConstraint":"< 2.2.12-1+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"gnupg2","version":"2.2.12-1+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-34903","fix":{"state":"fixed","versions":["2.2.12-1+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.12-1+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-34903","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-34903","date":"2026-10-08","epss":0.02844,"percentile":0.8627}],"risk":1.6353,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5174-1","link":"https://security-tracker.debian.org/tracker/DSA-5174-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-34903","description":"GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."},"relatedVulnerabilities":[{"id":"CVE-2022-34903","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-34903","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-34903","date":"2026-10-08","epss":0.02844,"percentile":0.8627}],"urls":["http://www.openwall.com/lists/oss-security/2022/07/02/1","https://bugs.debian.org/1014157","https://dev.gnupg.org/T6027","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRLWJQ76A4UKHI3Q36BKSJKS4LFLQO33/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPTAR76EIZY7NQFENSOZO7U473257OVZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VN63GBTMRWO36Y7BKA2WQHROAKCXKCBL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU64FUVG2PRZBSHFOQRSP7KDVEIZ23OS/","https://security.netapp.com/advisory/ntap-20220826-0005/","https://www.debian.org/security/2022/dsa-5174","https://www.openwall.com/lists/oss-security/2022/06/30/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-34903","description":"GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."}]},{"artifact":{"id":"a5cf017354093899","cpes":["cpe:2.3:a:gpgconf:gpgconf:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*"],"name":"gpgconf","purl":"pkg:deb/debian/gpgconf@2.2.12-1%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=gnupg2","type":"deb","version":"2.2.12-1+deb10u1","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgconf/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/gpgconf/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgconf.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/gpgconf.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgconf.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/gpgconf.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.12-1+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-34903","versionConstraint":"< 2.2.12-1+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"gnupg2","version":"2.2.12-1+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-34903","fix":{"state":"fixed","versions":["2.2.12-1+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.12-1+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-34903","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-34903","date":"2026-10-08","epss":0.02844,"percentile":0.8627}],"risk":1.6353,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5174-1","link":"https://security-tracker.debian.org/tracker/DSA-5174-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-34903","description":"GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."},"relatedVulnerabilities":[{"id":"CVE-2022-34903","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-34903","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-34903","date":"2026-10-08","epss":0.02844,"percentile":0.8627}],"urls":["http://www.openwall.com/lists/oss-security/2022/07/02/1","https://bugs.debian.org/1014157","https://dev.gnupg.org/T6027","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRLWJQ76A4UKHI3Q36BKSJKS4LFLQO33/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPTAR76EIZY7NQFENSOZO7U473257OVZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VN63GBTMRWO36Y7BKA2WQHROAKCXKCBL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU64FUVG2PRZBSHFOQRSP7KDVEIZ23OS/","https://security.netapp.com/advisory/ntap-20220826-0005/","https://www.debian.org/security/2022/dsa-5174","https://www.openwall.com/lists/oss-security/2022/06/30/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-34903","description":"GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."}]},{"artifact":{"id":"615a19c533612dc3","cpes":["cpe:2.3:a:gpgsm:gpgsm:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*"],"name":"gpgsm","purl":"pkg:deb/debian/gpgsm@2.2.12-1%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=gnupg2","type":"deb","version":"2.2.12-1+deb10u1","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgsm/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/gpgsm/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgsm.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/gpgsm.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgsm.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/gpgsm.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.12-1+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-34903","versionConstraint":"< 2.2.12-1+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"gnupg2","version":"2.2.12-1+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-34903","fix":{"state":"fixed","versions":["2.2.12-1+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.12-1+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-34903","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-34903","date":"2026-10-08","epss":0.02844,"percentile":0.8627}],"risk":1.6353,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5174-1","link":"https://security-tracker.debian.org/tracker/DSA-5174-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-34903","description":"GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."},"relatedVulnerabilities":[{"id":"CVE-2022-34903","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-34903","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-34903","date":"2026-10-08","epss":0.02844,"percentile":0.8627}],"urls":["http://www.openwall.com/lists/oss-security/2022/07/02/1","https://bugs.debian.org/1014157","https://dev.gnupg.org/T6027","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRLWJQ76A4UKHI3Q36BKSJKS4LFLQO33/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPTAR76EIZY7NQFENSOZO7U473257OVZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VN63GBTMRWO36Y7BKA2WQHROAKCXKCBL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU64FUVG2PRZBSHFOQRSP7KDVEIZ23OS/","https://security.netapp.com/advisory/ntap-20220826-0005/","https://www.debian.org/security/2022/dsa-5174","https://www.openwall.com/lists/oss-security/2022/06/30/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-34903","description":"GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."}]},{"artifact":{"id":"7f936fc60378589a","cpes":["cpe:2.3:a:gpgv:gpgv:2.2.12-1\\+deb10u1:*:*:*:*:*:*:*"],"name":"gpgv","purl":"pkg:deb/debian/gpgv@2.2.12-1%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=gnupg2","type":"deb","version":"2.2.12-1+deb10u1","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgv/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/gpgv/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/gpgv.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.list","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/gpgv.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.12-1+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-34903","versionConstraint":"< 2.2.12-1+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"gnupg2","version":"2.2.12-1+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-34903","fix":{"state":"fixed","versions":["2.2.12-1+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.12-1+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-34903","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-34903","date":"2026-10-08","epss":0.02844,"percentile":0.8627}],"risk":1.6353,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-5174-1","link":"https://security-tracker.debian.org/tracker/DSA-5174-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-34903","description":"GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."},"relatedVulnerabilities":[{"id":"CVE-2022-34903","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-34903","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-34903","date":"2026-10-08","epss":0.02844,"percentile":0.8627}],"urls":["http://www.openwall.com/lists/oss-security/2022/07/02/1","https://bugs.debian.org/1014157","https://dev.gnupg.org/T6027","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRLWJQ76A4UKHI3Q36BKSJKS4LFLQO33/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPTAR76EIZY7NQFENSOZO7U473257OVZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VN63GBTMRWO36Y7BKA2WQHROAKCXKCBL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU64FUVG2PRZBSHFOQRSP7KDVEIZ23OS/","https://security.netapp.com/advisory/ntap-20220826-0005/","https://www.debian.org/security/2022/dsa-5174","https://www.openwall.com/lists/oss-security/2022/06/30/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-34903","description":"GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."}]},{"artifact":{"id":"ecf5e89e65014edb","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.64.0-4:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/debian/libcurl4@7.64.0-4?arch=amd64&distro=debian-10.1&upstream=curl","type":"deb","version":"7.64.0-4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.64.0-4+deb10u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-27533","versionConstraint":"< 7.64.0-4+deb10u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"curl","version":"7.64.0-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-27533","fix":{"state":"fixed","versions":["7.64.0-4+deb10u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.64.0-4+deb10u6"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27533","cwe":"CWE-75","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2023-27533","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-27533","date":"2026-10-08","epss":0.01993,"percentile":0.80048}],"risk":1.6242950000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-27533","description":"A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system."},"relatedVulnerabilities":[{"id":"CVE-2023-27533","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27533","cwe":"CWE-75","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2023-27533","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-27533","date":"2026-10-08","epss":0.01993,"percentile":0.80048}],"urls":["https://hackerone.com/reports/1891474","https://lists.debian.org/debian-lts-announce/2023/04/msg00025.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/","https://security.gentoo.org/glsa/202310-12","https://security.netapp.com/advisory/ntap-20230420-0011/","https://advisory.splunk.com/advisories/SVD-2023-0809","https://curl.se/docs/CVE-2023-27533.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-27533","description":"A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system."}]},{"artifact":{"id":"78e377730903892e","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.17-3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.17-3?arch=amd64&distro=debian-10.1&upstream=krb5","type":"deb","version":"1.17-3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.17-3+deb10u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-36054","versionConstraint":"< 1.17-3+deb10u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"krb5","version":"1.17-3"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-36054","fix":{"state":"fixed","versions":["1.17-3+deb10u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.17-3+deb10u6"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-36054","cwe":"CWE-824","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-36054","date":"2026-10-08","epss":0.02814,"percentile":0.86119}],"risk":1.6180499999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-36054","description":"lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count."},"relatedVulnerabilities":[{"id":"CVE-2023-36054","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-36054","cwe":"CWE-824","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-36054","date":"2026-10-08","epss":0.02814,"percentile":0.86119}],"urls":["https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd","https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final","https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final","https://lists.debian.org/debian-lts-announce/2023/10/msg00031.html","https://security.netapp.com/advisory/ntap-20230908-0004/","https://web.mit.edu/kerberos/www/advisories/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-36054","description":"lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count."}]},{"artifact":{"id":"8934c1cbf61306d1","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.17-3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.17-3?arch=amd64&distro=debian-10.1&upstream=krb5","type":"deb","version":"1.17-3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.17-3+deb10u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-36054","versionConstraint":"< 1.17-3+deb10u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"krb5","version":"1.17-3"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-36054","fix":{"state":"fixed","versions":["1.17-3+deb10u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.17-3+deb10u6"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-36054","cwe":"CWE-824","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-36054","date":"2026-10-08","epss":0.02814,"percentile":0.86119}],"risk":1.6180499999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-36054","description":"lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count."},"relatedVulnerabilities":[{"id":"CVE-2023-36054","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-36054","cwe":"CWE-824","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-36054","date":"2026-10-08","epss":0.02814,"percentile":0.86119}],"urls":["https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd","https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final","https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final","https://lists.debian.org/debian-lts-announce/2023/10/msg00031.html","https://security.netapp.com/advisory/ntap-20230908-0004/","https://web.mit.edu/kerberos/www/advisories/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-36054","description":"lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count."}]},{"artifact":{"id":"de70c2aa7611f8ea","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.17-3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.17-3?arch=amd64&distro=debian-10.1&upstream=krb5","type":"deb","version":"1.17-3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.17-3+deb10u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-36054","versionConstraint":"< 1.17-3+deb10u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"krb5","version":"1.17-3"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-36054","fix":{"state":"fixed","versions":["1.17-3+deb10u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.17-3+deb10u6"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-36054","cwe":"CWE-824","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-36054","date":"2026-10-08","epss":0.02814,"percentile":0.86119}],"risk":1.6180499999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-36054","description":"lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count."},"relatedVulnerabilities":[{"id":"CVE-2023-36054","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-36054","cwe":"CWE-824","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-36054","date":"2026-10-08","epss":0.02814,"percentile":0.86119}],"urls":["https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd","https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final","https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final","https://lists.debian.org/debian-lts-announce/2023/10/msg00031.html","https://security.netapp.com/advisory/ntap-20230908-0004/","https://web.mit.edu/kerberos/www/advisories/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-36054","description":"lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count."}]},{"artifact":{"id":"481759f67535d39d","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.17-3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.17-3?arch=amd64&distro=debian-10.1&upstream=krb5","type":"deb","version":"1.17-3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.17-3+deb10u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-36054","versionConstraint":"< 1.17-3+deb10u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"krb5","version":"1.17-3"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-36054","fix":{"state":"fixed","versions":["1.17-3+deb10u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.17-3+deb10u6"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-36054","cwe":"CWE-824","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-36054","date":"2026-10-08","epss":0.02814,"percentile":0.86119}],"risk":1.6180499999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-36054","description":"lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count."},"relatedVulnerabilities":[{"id":"CVE-2023-36054","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-36054","cwe":"CWE-824","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-36054","date":"2026-10-08","epss":0.02814,"percentile":0.86119}],"urls":["https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd","https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final","https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final","https://lists.debian.org/debian-lts-announce/2023/10/msg00031.html","https://security.netapp.com/advisory/ntap-20230908-0004/","https://web.mit.edu/kerberos/www/advisories/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-36054","description":"lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.13.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0224","versionConstraint":"<1.13.13||>=1.14.0-0,<1.14.5 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0224","fix":{"state":"fixed","versions":["1.13.13","1.14.5"],"available":[{"date":"2020-07-14","kind":"release","version":"1.13.13"},{"date":"2020-07-14","kind":"release","version":"1.14.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-15586","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-15586","date":"2026-10-08","epss":0.02883,"percentile":0.86448}],"risk":1.5712350000000004,"urls":["https://go.googlesource.com/go/+/fa98f46741f818913a8c11b877520a548715131f","https://go.dev/issue/34902","https://groups.google.com/g/golang-announce/c/XZNfaiwgt2w"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/242598","description":"HTTP servers where the Handler concurrently reads the request body and writes a response can encounter a data race and crash. The httputil.ReverseProxy Handler is affected."},"relatedVulnerabilities":[{"id":"CVE-2020-15586","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-15586","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-15586","date":"2026-10-08","epss":0.02883,"percentile":0.86448}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00077.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00082.html","http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html","https://groups.google.com/forum/#%21topic/golang-announce/XZNfaiwgt2w","https://groups.google.com/forum/#%21topic/golang-announce/f2c5bqrGH_g","https://lists.debian.org/debian-lts-announce/2020/11/msg00037.html","https://lists.debian.org/debian-lts-announce/2020/11/msg00038.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OCR6LAKCVKL55KJQPPBBWVQGOP7RL2RW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WIRVUHD7TJIT7JJ33FKHIVTHPYABYPHR/","https://security.netapp.com/advisory/ntap-20200731-0005/","https://www.cloudfoundry.org/blog/cve-2020-15586/","https://www.debian.org/security/2021/dsa-4848","https://www.oracle.com/security-alerts/cpuApr2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-15586","description":"Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.13.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0224","versionConstraint":"<1.13.13||>=1.14.0-0,<1.14.5 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0224","fix":{"state":"fixed","versions":["1.13.13","1.14.5"],"available":[{"date":"2020-07-14","kind":"release","version":"1.13.13"},{"date":"2020-07-14","kind":"release","version":"1.14.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-15586","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-15586","date":"2026-10-08","epss":0.02883,"percentile":0.86448}],"risk":1.5712350000000004,"urls":["https://go.googlesource.com/go/+/fa98f46741f818913a8c11b877520a548715131f","https://go.dev/issue/34902","https://groups.google.com/g/golang-announce/c/XZNfaiwgt2w"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/242598","description":"HTTP servers where the Handler concurrently reads the request body and writes a response can encounter a data race and crash. The httputil.ReverseProxy Handler is affected."},"relatedVulnerabilities":[{"id":"CVE-2020-15586","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-15586","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-15586","date":"2026-10-08","epss":0.02883,"percentile":0.86448}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00077.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00082.html","http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html","https://groups.google.com/forum/#%21topic/golang-announce/XZNfaiwgt2w","https://groups.google.com/forum/#%21topic/golang-announce/f2c5bqrGH_g","https://lists.debian.org/debian-lts-announce/2020/11/msg00037.html","https://lists.debian.org/debian-lts-announce/2020/11/msg00038.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OCR6LAKCVKL55KJQPPBBWVQGOP7RL2RW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WIRVUHD7TJIT7JJ33FKHIVTHPYABYPHR/","https://security.netapp.com/advisory/ntap-20200731-0005/","https://www.cloudfoundry.org/blog/cve-2020-15586/","https://www.debian.org/security/2021/dsa-4848","https://www.oracle.com/security-alerts/cpuApr2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-15586","description":"Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time."}]},{"artifact":{"id":"bca20a7b0a858bf3","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/debian/libssl1.1@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1&upstream=openssl","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1n-0+deb10u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-3817","versionConstraint":"< 1.1.1n-0+deb10u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-3817","fix":{"state":"fixed","versions":["1.1.1n-0+deb10u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1n-0+deb10u6"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-3817","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-3817","cwe":"CWE-834","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-3817","date":"2026-10-08","epss":0.03047,"percentile":0.87153}],"risk":1.569205,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-3817","description":"Issue summary: Checking excessively long DH keys or parameters may be very slow.  Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service.  The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p.  An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack.  The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check().  Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the \"-check\" option.  The OpenSSL SSL/TLS implementation is not affected by this issue.  The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."},"relatedVulnerabilities":[{"id":"CVE-2023-3817","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-3817","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-3817","cwe":"CWE-834","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-3817","date":"2026-10-08","epss":0.03047,"percentile":0.87153}],"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5","https://www.openssl.org/news/secadv/20230731.txt","http://seclists.org/fulldisclosure/2023/Jul/43","http://www.openwall.com/lists/oss-security/2023/07/31/1","http://www.openwall.com/lists/oss-security/2023/09/22/11","http://www.openwall.com/lists/oss-security/2023/09/22/9","http://www.openwall.com/lists/oss-security/2023/11/06/2","https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230818-0014/","https://security.netapp.com/advisory/ntap-20231027-0008/","https://security.netapp.com/advisory/ntap-20240621-0006/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-3817","description":"Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than the modulus p parameter, thus it is\nunnecessary to perform these checks if q is larger than p.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulnerable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the \"-check\" option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."}]},{"artifact":{"id":"d308e84bddad0b0f","cpes":["cpe:2.3:a:openssl:openssl:1.1.1d-0\\+deb10u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.1.1d-0%2Bdeb10u2?arch=amd64&distro=debian-10.1","type":"deb","version":"1.1.1d-0+deb10u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.1n-0+deb10u6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-3817","versionConstraint":"< 1.1.1n-0+deb10u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openssl","version":"1.1.1d-0+deb10u2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-3817","fix":{"state":"fixed","versions":["1.1.1n-0+deb10u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.1n-0+deb10u6"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-3817","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-3817","cwe":"CWE-834","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-3817","date":"2026-10-08","epss":0.03047,"percentile":0.87153}],"risk":1.569205,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-3817","description":"Issue summary: Checking excessively long DH keys or parameters may be very slow.  Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service.  The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p.  An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack.  The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check().  Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the \"-check\" option.  The OpenSSL SSL/TLS implementation is not affected by this issue.  The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."},"relatedVulnerabilities":[{"id":"CVE-2023-3817","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-3817","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-3817","cwe":"CWE-834","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-3817","date":"2026-10-08","epss":0.03047,"percentile":0.87153}],"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5","https://www.openssl.org/news/secadv/20230731.txt","http://seclists.org/fulldisclosure/2023/Jul/43","http://www.openwall.com/lists/oss-security/2023/07/31/1","http://www.openwall.com/lists/oss-security/2023/09/22/11","http://www.openwall.com/lists/oss-security/2023/09/22/9","http://www.openwall.com/lists/oss-security/2023/11/06/2","https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230818-0014/","https://security.netapp.com/advisory/ntap-20231027-0008/","https://security.netapp.com/advisory/ntap-20240621-0006/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-3817","description":"Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than the modulus p parameter, thus it is\nunnecessary to perform these checks if q is larger than p.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulnerable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the \"-check\" option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.17.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0523","versionConstraint":"<1.17.12||>=1.18.0-0,<1.18.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0523","fix":{"state":"fixed","versions":["1.17.12","1.18.4"],"available":[{"date":"2022-07-12","kind":"release","version":"1.17.12"},{"date":"2022-07-12","kind":"release","version":"1.18.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-30633","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-30633","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-30633","date":"2026-10-08","epss":0.02086,"percentile":0.80996}],"risk":1.5645,"urls":["https://go.googlesource.com/go/+/c4c1993fd2a5b26fe45c09592af6d3388a3b2e08","https://go.dev/issue/53611","https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/417061","description":"Unmarshaling an XML document into a Go struct which has a nested field that uses the 'any' field tag can panic due to stack exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2022-30633","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-30633","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-30633","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-30633","date":"2026-10-08","epss":0.02086,"percentile":0.80996}],"urls":["https://go.dev/cl/417061","https://go.dev/issue/53611","https://go.googlesource.com/go/+/c4c1993fd2a5b26fe45c09592af6d3388a3b2e08","https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE","https://pkg.go.dev/vuln/GO-2022-0523"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-30633","description":"Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.17.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0523","versionConstraint":"<1.17.12||>=1.18.0-0,<1.18.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0523","fix":{"state":"fixed","versions":["1.17.12","1.18.4"],"available":[{"date":"2022-07-12","kind":"release","version":"1.17.12"},{"date":"2022-07-12","kind":"release","version":"1.18.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-30633","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-30633","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-30633","date":"2026-10-08","epss":0.02086,"percentile":0.80996}],"risk":1.5645,"urls":["https://go.googlesource.com/go/+/c4c1993fd2a5b26fe45c09592af6d3388a3b2e08","https://go.dev/issue/53611","https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/417061","description":"Unmarshaling an XML document into a Go struct which has a nested field that uses the 'any' field tag can panic due to stack exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2022-30633","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-30633","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-30633","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-30633","date":"2026-10-08","epss":0.02086,"percentile":0.80996}],"urls":["https://go.dev/cl/417061","https://go.dev/issue/53611","https://go.googlesource.com/go/+/c4c1993fd2a5b26fe45c09592af6d3388a3b2e08","https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE","https://pkg.go.dev/vuln/GO-2022-0523"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-30633","description":"Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.17.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0522","versionConstraint":"<1.17.12||>=1.18.0-0,<1.18.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0522","fix":{"state":"fixed","versions":["1.17.12","1.18.4"],"available":[{"date":"2022-07-12","kind":"release","version":"1.17.12"},{"date":"2022-07-12","kind":"release","version":"1.18.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-30632","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-30632","date":"2026-10-08","epss":0.02069,"percentile":0.80835}],"risk":1.55175,"urls":["https://go.googlesource.com/go/+/ac68c6c683409f98250d34ad282b9e1b0c9095ef","https://go.dev/issue/53416","https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/417066","description":"Calling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2022-30632","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-30632","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-30632","date":"2026-10-08","epss":0.02069,"percentile":0.80835}],"urls":["https://go.dev/cl/417066","https://go.dev/issue/53416","https://go.googlesource.com/go/+/ac68c6c683409f98250d34ad282b9e1b0c9095ef","https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE","https://pkg.go.dev/vuln/GO-2022-0522"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-30632","description":"Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.17.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0522","versionConstraint":"<1.17.12||>=1.18.0-0,<1.18.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0522","fix":{"state":"fixed","versions":["1.17.12","1.18.4"],"available":[{"date":"2022-07-12","kind":"release","version":"1.17.12"},{"date":"2022-07-12","kind":"release","version":"1.18.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-30632","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-30632","date":"2026-10-08","epss":0.02069,"percentile":0.80835}],"risk":1.55175,"urls":["https://go.googlesource.com/go/+/ac68c6c683409f98250d34ad282b9e1b0c9095ef","https://go.dev/issue/53416","https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/417066","description":"Calling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2022-30632","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-30632","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-30632","date":"2026-10-08","epss":0.02069,"percentile":0.80835}],"urls":["https://go.dev/cl/417066","https://go.dev/issue/53416","https://go.googlesource.com/go/+/ac68c6c683409f98250d34ad282b9e1b0c9095ef","https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE","https://pkg.go.dev/vuln/GO-2022-0522"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-30632","description":"Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.17.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0527","versionConstraint":"<1.17.12||>=1.18.0-0,<1.18.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0527","fix":{"state":"fixed","versions":["1.17.12","1.18.4"],"available":[{"date":"2022-07-12","kind":"release","version":"1.17.12"},{"date":"2022-07-12","kind":"release","version":"1.18.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-30630","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-30630","date":"2026-10-08","epss":0.02069,"percentile":0.80835}],"risk":1.55175,"urls":["https://go.googlesource.com/go/+/fa2d41d0ca736f3ad6b200b2a4e134364e9acc59","https://go.dev/issue/53415","https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/417065","description":"Calling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2022-30630","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-30630","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-30630","date":"2026-10-08","epss":0.02069,"percentile":0.80835}],"urls":["https://go.dev/cl/417065","https://go.dev/issue/53415","https://go.googlesource.com/go/+/fa2d41d0ca736f3ad6b200b2a4e134364e9acc59","https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE","https://pkg.go.dev/vuln/GO-2022-0527"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-30630","description":"Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.17.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0527","versionConstraint":"<1.17.12||>=1.18.0-0,<1.18.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0527","fix":{"state":"fixed","versions":["1.17.12","1.18.4"],"available":[{"date":"2022-07-12","kind":"release","version":"1.17.12"},{"date":"2022-07-12","kind":"release","version":"1.18.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-30630","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-30630","date":"2026-10-08","epss":0.02069,"percentile":0.80835}],"risk":1.55175,"urls":["https://go.googlesource.com/go/+/fa2d41d0ca736f3ad6b200b2a4e134364e9acc59","https://go.dev/issue/53415","https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/417065","description":"Calling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2022-30630","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-30630","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-30630","date":"2026-10-08","epss":0.02069,"percentile":0.80835}],"urls":["https://go.dev/cl/417065","https://go.dev/issue/53415","https://go.googlesource.com/go/+/fa2d41d0ca736f3ad6b200b2a4e134364e9acc59","https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE","https://pkg.go.dev/vuln/GO-2022-0527"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-30630","description":"Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.17.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0524","versionConstraint":"<1.17.12||>=1.18.0-0,<1.18.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0524","fix":{"state":"fixed","versions":["1.17.12","1.18.4"],"available":[{"date":"2022-07-12","kind":"release","version":"1.17.12"},{"date":"2022-07-12","kind":"release","version":"1.18.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-30631","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-30631","date":"2026-10-08","epss":0.02066,"percentile":0.80798}],"risk":1.5495,"urls":["https://go.googlesource.com/go/+/b2b8872c876201eac2d0707276c6999ff3eb185e","https://go.dev/issue/53168","https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/417067","description":"Calling Reader.Read on an archive containing a large number of concatenated 0-length compressed files can cause a panic due to stack exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2022-30631","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-30631","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-30631","date":"2026-10-08","epss":0.02066,"percentile":0.80798}],"urls":["https://go.dev/cl/417067","https://go.dev/issue/53168","https://go.googlesource.com/go/+/b2b8872c876201eac2d0707276c6999ff3eb185e","https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE","https://pkg.go.dev/vuln/GO-2022-0524"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-30631","description":"Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.17.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0524","versionConstraint":"<1.17.12||>=1.18.0-0,<1.18.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0524","fix":{"state":"fixed","versions":["1.17.12","1.18.4"],"available":[{"date":"2022-07-12","kind":"release","version":"1.17.12"},{"date":"2022-07-12","kind":"release","version":"1.18.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-30631","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-30631","date":"2026-10-08","epss":0.02066,"percentile":0.80798}],"risk":1.5495,"urls":["https://go.googlesource.com/go/+/b2b8872c876201eac2d0707276c6999ff3eb185e","https://go.dev/issue/53168","https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/417067","description":"Calling Reader.Read on an archive containing a large number of concatenated 0-length compressed files can cause a panic due to stack exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2022-30631","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-30631","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-30631","date":"2026-10-08","epss":0.02066,"percentile":0.80798}],"urls":["https://go.dev/cl/417067","https://go.dev/issue/53168","https://go.googlesource.com/go/+/b2b8872c876201eac2d0707276c6999ff3eb185e","https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE","https://pkg.go.dev/vuln/GO-2022-0524"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-30631","description":"Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files."}]},{"artifact":{"id":"176a7c056143b0b3","cpes":["cpe:2.3:a:libksba8:libksba8:1.3.5-2:*:*:*:*:*:*:*"],"name":"libksba8","purl":"pkg:deb/debian/libksba8@1.3.5-2?arch=amd64&distro=debian-10.1&upstream=libksba","type":"deb","version":"1.3.5-2","language":"","licenses":["sha256:c30c530c45d074a643f1aa8cd4773c412b012c32280ebd7a35995e4aa21eeef1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libksba8/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libksba8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libksba8:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libksba8:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libksba"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.3.5-2+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-3515","versionConstraint":"< 1.3.5-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"libksba","version":"1.3.5-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-3515","fix":{"state":"fixed","versions":["1.3.5-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.3.5-2+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3515","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-3515","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3515","date":"2026-10-08","epss":0.01648,"percentile":0.75767}],"risk":1.5491200000000003,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-3515","description":"A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment."},"relatedVulnerabilities":[{"id":"CVE-2022-3515","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3515","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-3515","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3515","date":"2026-10-08","epss":0.01648,"percentile":0.75767}],"urls":["https://access.redhat.com/security/cve/CVE-2022-3515","https://bugzilla.redhat.com/show_bug.cgi?id=2135610","https://dev.gnupg.org/rK4b7d9cd4a018898d7714ce06f3faf2626c14582b","https://security.netapp.com/advisory/ntap-20230706-0008/","https://www.gnupg.org/blog/20221017-pepe-left-the-ksba.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3515","description":"A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.14.14"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0235","versionConstraint":"<1.14.14||>=1.15.0-0,<1.15.7 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0235","fix":{"state":"fixed","versions":["1.14.14","1.15.7"],"available":[{"date":"2021-01-19","kind":"release","version":"1.14.14"},{"date":"2021-01-19","kind":"release","version":"1.15.7"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3114","cwe":"CWE-682","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3114","date":"2026-10-08","epss":0.02666,"percentile":0.85294}],"risk":1.53295,"urls":["https://go.googlesource.com/go/+/d95ca9138026cbe40e0857d76a81a16d03230871","https://go.dev/issue/43786","https://groups.google.com/g/golang-announce/c/mperVMGa98w"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/284779","description":"The P224() Curve implementation can in rare circumstances generate incorrect outputs, including returning invalid points from ScalarMult."},"relatedVulnerabilities":[{"id":"CVE-2021-3114","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3114","cwe":"CWE-682","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3114","date":"2026-10-08","epss":0.02666,"percentile":0.85294}],"urls":["https://github.com/golang/go/commit/d95ca9138026cbe40e0857d76a81a16d03230871","https://groups.google.com/g/golang-announce/c/mperVMGa98w","https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html","https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YWAYJGXWC232SG3UR3TR574E6BP3OSQQ/","https://security.gentoo.org/glsa/202208-02","https://security.netapp.com/advisory/ntap-20210219-0001/","https://www.debian.org/security/2021/dsa-4848"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3114","description":"In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.14.14"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0235","versionConstraint":"<1.14.14||>=1.15.0-0,<1.15.7 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0235","fix":{"state":"fixed","versions":["1.14.14","1.15.7"],"available":[{"date":"2021-01-19","kind":"release","version":"1.14.14"},{"date":"2021-01-19","kind":"release","version":"1.15.7"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3114","cwe":"CWE-682","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3114","date":"2026-10-08","epss":0.02666,"percentile":0.85294}],"risk":1.53295,"urls":["https://go.googlesource.com/go/+/d95ca9138026cbe40e0857d76a81a16d03230871","https://go.dev/issue/43786","https://groups.google.com/g/golang-announce/c/mperVMGa98w"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/284779","description":"The P224() Curve implementation can in rare circumstances generate incorrect outputs, including returning invalid points from ScalarMult."},"relatedVulnerabilities":[{"id":"CVE-2021-3114","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3114","cwe":"CWE-682","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3114","date":"2026-10-08","epss":0.02666,"percentile":0.85294}],"urls":["https://github.com/golang/go/commit/d95ca9138026cbe40e0857d76a81a16d03230871","https://groups.google.com/g/golang-announce/c/mperVMGa98w","https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html","https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YWAYJGXWC232SG3UR3TR574E6BP3OSQQ/","https://security.gentoo.org/glsa/202208-02","https://security.netapp.com/advisory/ntap-20210219-0001/","https://www.debian.org/security/2021/dsa-4848"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3114","description":"In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.17.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0493","versionConstraint":"<1.17.10||>=1.18.0-0,<1.18.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0493","fix":{"state":"fixed","versions":["1.17.10","1.18.2"],"available":[{"date":"2022-05-10","kind":"release","version":"1.17.10"},{"date":"2022-05-10","kind":"release","version":"1.18.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-29526","cwe":"CWE-269","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-29526","date":"2026-10-08","epss":0.02951,"percentile":0.86767}],"risk":1.5197650000000003,"urls":["https://go.dev/issue/52313","https://go.dev/cl/400074","https://groups.google.com/g/golang-announce/c/Y5qrqw_lWdU"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/399539","description":"When called with a non-zero flags parameter, the Faccessat function can incorrectly report that a file is accessible."},"relatedVulnerabilities":[{"id":"CVE-2022-29526","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-29526","cwe":"CWE-269","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-29526","date":"2026-10-08","epss":0.02951,"percentile":0.86767}],"urls":["https://github.com/golang/go/issues/52313","https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/Y5qrqw_lWdU","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q6GE5EQGE4L2KRVGW4T75QVIYAXCLO5X/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/","https://security.gentoo.org/glsa/202208-02","https://security.netapp.com/advisory/ntap-20220729-0001/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-29526","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible."},{"id":"GHSA-p782-xgp4-8hr8","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-29526","cwe":"CWE-269","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-29526","date":"2026-10-08","epss":0.02951,"percentile":0.86767}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-29526","https://github.com/golang/go/issues/52313","https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/Y5qrqw_lWdU","https://security.gentoo.org/glsa/202208-02","https://go.dev/cl/399539","https://go.dev/cl/400074","https://go.dev/issue/52313","https://pkg.go.dev/vuln/GO-2022-0493","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q6GE5EQGE4L2KRVGW4T75QVIYAXCLO5X","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR","https://security.netapp.com/advisory/ntap-20220729-0001"],"severity":"Medium","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-p782-xgp4-8hr8","description":"golang.org/x/sys/unix has Incorrect privilege reporting in syscall"}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.17.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0493","versionConstraint":"<1.17.10||>=1.18.0-0,<1.18.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0493","fix":{"state":"fixed","versions":["1.17.10","1.18.2"],"available":[{"date":"2022-05-10","kind":"release","version":"1.17.10"},{"date":"2022-05-10","kind":"release","version":"1.18.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-29526","cwe":"CWE-269","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-29526","date":"2026-10-08","epss":0.02951,"percentile":0.86767}],"risk":1.5197650000000003,"urls":["https://go.dev/issue/52313","https://go.dev/cl/400074","https://groups.google.com/g/golang-announce/c/Y5qrqw_lWdU"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/399539","description":"When called with a non-zero flags parameter, the Faccessat function can incorrectly report that a file is accessible."},"relatedVulnerabilities":[{"id":"CVE-2022-29526","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-29526","cwe":"CWE-269","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-29526","date":"2026-10-08","epss":0.02951,"percentile":0.86767}],"urls":["https://github.com/golang/go/issues/52313","https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/Y5qrqw_lWdU","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q6GE5EQGE4L2KRVGW4T75QVIYAXCLO5X/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/","https://security.gentoo.org/glsa/202208-02","https://security.netapp.com/advisory/ntap-20220729-0001/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-29526","description":"Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible."},{"id":"GHSA-p782-xgp4-8hr8","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-29526","cwe":"CWE-269","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-29526","date":"2026-10-08","epss":0.02951,"percentile":0.86767}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-29526","https://github.com/golang/go/issues/52313","https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/Y5qrqw_lWdU","https://security.gentoo.org/glsa/202208-02","https://go.dev/cl/399539","https://go.dev/cl/400074","https://go.dev/issue/52313","https://pkg.go.dev/vuln/GO-2022-0493","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q6GE5EQGE4L2KRVGW4T75QVIYAXCLO5X","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR","https://security.netapp.com/advisory/ntap-20220729-0001"],"severity":"Medium","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-p782-xgp4-8hr8","description":"golang.org/x/sys/unix has Incorrect privilege reporting in syscall"}]},{"artifact":{"id":"7c1ebd3787684a51","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.7-4:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/debian/libgnutls30@3.6.7-4?arch=amd64&distro=debian-10.1&upstream=gnutls28","type":"deb","version":"3.6.7-4","language":"","licenses":["sha256:d35f0abecc61a3676965c20cf13a44815b05d9b4a68985fa1809b13c2aff9090"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.7-4+deb10u9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-2509","versionConstraint":"< 3.6.7-4+deb10u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"gnutls28","version":"3.6.7-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-2509","fix":{"state":"fixed","versions":["3.6.7-4+deb10u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.6.7-4+deb10u9"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-2509","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-2509","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-2509","date":"2026-10-08","epss":0.01988,"percentile":0.79996}],"risk":1.4909999999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-2509","description":"A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verify function."},"relatedVulnerabilities":[{"id":"CVE-2022-2509","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-2509","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-2509","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-2509","date":"2026-10-08","epss":0.01988,"percentile":0.79996}],"urls":["https://access.redhat.com/security/cve/CVE-2022-2509","https://lists.debian.org/debian-lts-announce/2022/08/msg00002.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FL27JS3VM74YEQU7PGB62USO3KSBYZX/","https://lists.gnupg.org/pipermail/gnutls-help/2022-July/004746.html","https://www.debian.org/security/2022/dsa-5203"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-2509","description":"A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verify function."}]},{"artifact":{"id":"176a7c056143b0b3","cpes":["cpe:2.3:a:libksba8:libksba8:1.3.5-2:*:*:*:*:*:*:*"],"name":"libksba8","purl":"pkg:deb/debian/libksba8@1.3.5-2?arch=amd64&distro=debian-10.1&upstream=libksba","type":"deb","version":"1.3.5-2","language":"","licenses":["sha256:c30c530c45d074a643f1aa8cd4773c412b012c32280ebd7a35995e4aa21eeef1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libksba8/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libksba8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libksba8:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libksba8:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libksba"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.3.5-2+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-47629","versionConstraint":"< 1.3.5-2+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"libksba","version":"1.3.5-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-47629","fix":{"state":"fixed","versions":["1.3.5-2+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.3.5-2+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-47629","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-47629","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-47629","date":"2026-10-08","epss":0.0158,"percentile":0.74755}],"risk":1.4852000000000003,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-47629","description":"Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser."},"relatedVulnerabilities":[{"id":"CVE-2022-47629","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-47629","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-47629","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-47629","date":"2026-10-08","epss":0.0158,"percentile":0.74755}],"urls":["https://dev.gnupg.org/T6284","https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git%3Ba=commit%3Bh=f61a5ea4e0f6a80fd4b28ef0174bee77793cf070","https://lists.debian.org/debian-lts-announce/2022/12/msg00035.html","https://security.gentoo.org/glsa/202212-07","https://security.netapp.com/advisory/ntap-20230316-0011/","https://www.debian.org/security/2022/dsa-5305"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-47629","description":"Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.19.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2023-1752","versionConstraint":"<1.19.9||>=1.20.0-0,<1.20.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2023-1752","fix":{"state":"fixed","versions":["1.19.9","1.20.4"],"available":[{"date":"2023-05-02","kind":"release","version":"1.19.9"},{"date":"2023-05-02","kind":"release","version":"1.20.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24540","cwe":"CWE-77","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24540","date":"2026-10-08","epss":0.0156,"percentile":0.74484}],"risk":1.4664,"urls":["https://go.dev/cl/491616","https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU"],"severity":"Critical","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/59721","description":"Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set \"\\t\\n\\f\\r\\u0020\\u2028\\u2029\" in JavaScript contexts that also contain actions may not be properly sanitized during execution."},"relatedVulnerabilities":[{"id":"CVE-2023-24540","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24540","cwe":"CWE-77","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24540","date":"2026-10-08","epss":0.0156,"percentile":0.74484}],"urls":["https://go.dev/cl/491616","https://go.dev/issue/59721","https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU","https://pkg.go.dev/vuln/GO-2023-1752","https://security.netapp.com/advisory/ntap-20241115-0008/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24540","description":"Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set \"\\t\\n\\f\\r\\u0020\\u2028\\u2029\" in JavaScript contexts that also contain actions may not be properly sanitized during execution."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.19.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2023-1752","versionConstraint":"<1.19.9||>=1.20.0-0,<1.20.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2023-1752","fix":{"state":"fixed","versions":["1.19.9","1.20.4"],"available":[{"date":"2023-05-02","kind":"release","version":"1.19.9"},{"date":"2023-05-02","kind":"release","version":"1.20.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24540","cwe":"CWE-77","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24540","date":"2026-10-08","epss":0.0156,"percentile":0.74484}],"risk":1.4664,"urls":["https://go.dev/cl/491616","https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU"],"severity":"Critical","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/59721","description":"Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set \"\\t\\n\\f\\r\\u0020\\u2028\\u2029\" in JavaScript contexts that also contain actions may not be properly sanitized during execution."},"relatedVulnerabilities":[{"id":"CVE-2023-24540","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24540","cwe":"CWE-77","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24540","date":"2026-10-08","epss":0.0156,"percentile":0.74484}],"urls":["https://go.dev/cl/491616","https://go.dev/issue/59721","https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU","https://pkg.go.dev/vuln/GO-2023-1752","https://security.netapp.com/advisory/ntap-20241115-0008/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24540","description":"Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set \"\\t\\n\\f\\r\\u0020\\u2028\\u2029\" in JavaScript contexts that also contain actions may not be properly sanitized during execution."}]},{"artifact":{"id":"9fd90e877ecfcb60","cpes":["cpe:2.3:a:libjson-c3:libjson-c3:0.12.1\\+ds-2:*:*:*:*:*:*:*","cpe:2.3:a:libjson-c3:libjson_c3:0.12.1\\+ds-2:*:*:*:*:*:*:*","cpe:2.3:a:libjson_c3:libjson-c3:0.12.1\\+ds-2:*:*:*:*:*:*:*","cpe:2.3:a:libjson_c3:libjson_c3:0.12.1\\+ds-2:*:*:*:*:*:*:*","cpe:2.3:a:libjson:libjson-c3:0.12.1\\+ds-2:*:*:*:*:*:*:*","cpe:2.3:a:libjson:libjson_c3:0.12.1\\+ds-2:*:*:*:*:*:*:*"],"name":"libjson-c3","purl":"pkg:deb/debian/libjson-c3@0.12.1%2Bds-2?arch=amd64&distro=debian-10.1&upstream=json-c","type":"deb","version":"0.12.1+ds-2","language":"","licenses":["Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjson-c3/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libjson-c3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjson-c3:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libjson-c3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"json-c"}]},"matchDetails":[{"fix":{"suggestedVersion":"0.12.1+ds-2+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-12762","versionConstraint":"< 0.12.1+ds-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"json-c","version":"0.12.1+ds-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-12762","fix":{"state":"fixed","versions":["0.12.1+ds-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"0.12.1+ds-2+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12762","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-12762","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-12762","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-12762","date":"2026-10-08","epss":0.01895,"percentile":0.78995}],"risk":1.449675,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4741-1","link":"https://security-tracker.debian.org/tracker/DSA-4741-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-12762","description":"json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend."},"relatedVulnerabilities":[{"id":"CVE-2020-12762","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12762","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-12762","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-12762","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-12762","date":"2026-10-08","epss":0.01895,"percentile":0.78995}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/json-c/json-c/pull/592","https://github.com/rsyslog/libfastjson/issues/161","https://lists.debian.org/debian-lts-announce/2020/05/msg00032.html","https://lists.debian.org/debian-lts-announce/2020/05/msg00034.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00031.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00023.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBR36IXYBHITAZFB5PFBJTED22WO5ONB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CQQRRGBQCAWNCCJ2HN3W5SSCZ4QGMXQI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W226TSCJBEOXDUFVKNWNH7ETG7AR6MCS/","https://security.gentoo.org/glsa/202006-13","https://security.netapp.com/advisory/ntap-20210521-0001/","https://usn.ubuntu.com/4360-1/","https://usn.ubuntu.com/4360-4/","https://www.debian.org/security/2020/dsa-4741","https://lists.debian.org/debian-lts-announce/2025/07/msg00021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-12762","description":"json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend."}]},{"artifact":{"id":"7f19231bca942dc4","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/debian/libldap-2.4-2@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-2953","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-2953","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-2953","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-2953","cwe":"CWE-476","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2023-2953","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-2953","date":"2026-10-08","epss":0.0193,"percentile":0.7939}],"risk":1.4475000000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-2953","description":"A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function."},"relatedVulnerabilities":[{"id":"CVE-2023-2953","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-2953","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-2953","cwe":"CWE-476","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2023-2953","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-2953","date":"2026-10-08","epss":0.0193,"percentile":0.7939}],"urls":["http://seclists.org/fulldisclosure/2023/Jul/47","http://seclists.org/fulldisclosure/2023/Jul/48","http://seclists.org/fulldisclosure/2023/Jul/52","https://access.redhat.com/security/cve/CVE-2023-2953","https://bugs.openldap.org/show_bug.cgi?id=9904","https://security.netapp.com/advisory/ntap-20230703-0005/","https://support.apple.com/kb/HT213843","https://support.apple.com/kb/HT213844","https://support.apple.com/kb/HT213845"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-2953","description":"A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function."}]},{"artifact":{"id":"ed53a6639a2640b0","cpes":["cpe:2.3:a:libldap-common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap-common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap_common:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_common:2.4.47\\+dfsg-3\\+deb10u1:*:*:*:*:*:*:*"],"name":"libldap-common","purl":"pkg:deb/debian/libldap-common@2.4.47%2Bdfsg-3%2Bdeb10u1?arch=all&distro=debian-10.1&upstream=openldap","type":"deb","version":"2.4.47+dfsg-3+deb10u1","language":"","licenses":["sha256:0690f1ee382f98e95b446743db55395641d5e258de65939e9cb1c660d67a43a8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-common/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libldap-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-common.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libldap-common.list"}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-2953","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"openldap","version":"2.4.47+dfsg-3+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-2953","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-2953","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-2953","cwe":"CWE-476","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2023-2953","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-2953","date":"2026-10-08","epss":0.0193,"percentile":0.7939}],"risk":1.4475000000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-2953","description":"A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function."},"relatedVulnerabilities":[{"id":"CVE-2023-2953","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-2953","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-2953","cwe":"CWE-476","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2023-2953","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-2953","date":"2026-10-08","epss":0.0193,"percentile":0.7939}],"urls":["http://seclists.org/fulldisclosure/2023/Jul/47","http://seclists.org/fulldisclosure/2023/Jul/48","http://seclists.org/fulldisclosure/2023/Jul/52","https://access.redhat.com/security/cve/CVE-2023-2953","https://bugs.openldap.org/show_bug.cgi?id=9904","https://security.netapp.com/advisory/ntap-20230703-0005/","https://support.apple.com/kb/HT213843","https://support.apple.com/kb/HT213844","https://support.apple.com/kb/HT213845"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-2953","description":"A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.19.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2023-1704","versionConstraint":"<1.19.8||>=1.20.0-0,<1.20.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2023-1704","fix":{"state":"fixed","versions":["1.19.8","1.20.3"],"available":[{"date":"2023-04-04","kind":"release","version":"1.19.8"},{"date":"2023-04-04","kind":"release","version":"1.20.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24534","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24534","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24534","date":"2026-10-08","epss":0.01888,"percentile":0.78902}],"risk":1.4160000000000001,"urls":["https://go.dev/cl/481994","https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/58975","description":"HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service.\n\nCertain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service.\n\nWith fix, header parsing now correctly allocates only the memory required to hold parsed headers."},"relatedVulnerabilities":[{"id":"CVE-2023-24534","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24534","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24534","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24534","date":"2026-10-08","epss":0.01888,"percentile":0.78902}],"urls":["https://go.dev/cl/481994","https://go.dev/issue/58975","https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8","https://pkg.go.dev/vuln/GO-2023-1704","https://security.gentoo.org/glsa/202311-09","https://security.netapp.com/advisory/ntap-20230526-0007/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24534","description":"HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service. With fix, header parsing now correctly allocates only the memory required to hold parsed headers."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.19.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2023-1704","versionConstraint":"<1.19.8||>=1.20.0-0,<1.20.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2023-1704","fix":{"state":"fixed","versions":["1.19.8","1.20.3"],"available":[{"date":"2023-04-04","kind":"release","version":"1.19.8"},{"date":"2023-04-04","kind":"release","version":"1.20.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24534","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24534","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24534","date":"2026-10-08","epss":0.01888,"percentile":0.78902}],"risk":1.4160000000000001,"urls":["https://go.dev/cl/481994","https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/58975","description":"HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service.\n\nCertain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service.\n\nWith fix, header parsing now correctly allocates only the memory required to hold parsed headers."},"relatedVulnerabilities":[{"id":"CVE-2023-24534","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24534","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24534","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24534","date":"2026-10-08","epss":0.01888,"percentile":0.78902}],"urls":["https://go.dev/cl/481994","https://go.dev/issue/58975","https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8","https://pkg.go.dev/vuln/GO-2023-1704","https://security.gentoo.org/glsa/202311-09","https://security.netapp.com/advisory/ntap-20230526-0007/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24534","description":"HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service. With fix, header parsing now correctly allocates only the memory required to hold parsed headers."}]},{"artifact":{"id":"9c0f03079e497030","cpes":["cpe:2.3:a:libpython3.7-minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-minimal","purl":"pkg:deb/debian/libpython3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-16935","versionConstraint":"< 3.7.3-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-16935","fix":{"state":"fixed","versions":["3.7.3-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-16935","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-16935","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16935","date":"2026-10-08","epss":0.04653,"percentile":0.91501}],"risk":1.3959000000000001,"urls":[],"severity":"Low","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-16935","description":"The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server."},"relatedVulnerabilities":[{"id":"CVE-2019-16935","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16935","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-16935","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16935","date":"2026-10-08","epss":0.04653,"percentile":0.91501}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://bugs.python.org/issue38243","https://github.com/python/cpython/blob/35c0809158be7feae4c4f877a08b93baea2d8291/Lib/xmlrpc/server.py#L897","https://github.com/python/cpython/blob/e007860b8b3609ce0bc62b1780efaa06241520bd/Lib/DocXMLRPCServer.py#L213","https://github.com/python/cpython/pull/16373","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/","https://security.netapp.com/advisory/ntap-20191017-0004/","https://usn.ubuntu.com/4151-1/","https://usn.ubuntu.com/4151-2/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16935","description":"The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server."}]},{"artifact":{"id":"b6d8c37141cd8c0a","cpes":["cpe:2.3:a:libpython3.7-stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-stdlib","purl":"pkg:deb/debian/libpython3.7-stdlib@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-16935","versionConstraint":"< 3.7.3-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-16935","fix":{"state":"fixed","versions":["3.7.3-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-16935","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-16935","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16935","date":"2026-10-08","epss":0.04653,"percentile":0.91501}],"risk":1.3959000000000001,"urls":[],"severity":"Low","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-16935","description":"The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server."},"relatedVulnerabilities":[{"id":"CVE-2019-16935","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16935","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-16935","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16935","date":"2026-10-08","epss":0.04653,"percentile":0.91501}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://bugs.python.org/issue38243","https://github.com/python/cpython/blob/35c0809158be7feae4c4f877a08b93baea2d8291/Lib/xmlrpc/server.py#L897","https://github.com/python/cpython/blob/e007860b8b3609ce0bc62b1780efaa06241520bd/Lib/DocXMLRPCServer.py#L213","https://github.com/python/cpython/pull/16373","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/","https://security.netapp.com/advisory/ntap-20191017-0004/","https://usn.ubuntu.com/4151-1/","https://usn.ubuntu.com/4151-2/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16935","description":"The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server."}]},{"artifact":{"id":"94955c7d71be2bb1","cpes":["cpe:2.3:a:python3.7:python3.7:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7","purl":"pkg:deb/debian/python3.7@3.7.3-2?arch=amd64&distro=debian-10.1","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.list"},{"path":"/var/lib/dpkg/info/python3.7.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.postinst"},{"path":"/var/lib/dpkg/info/python3.7.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-16935","versionConstraint":"< 3.7.3-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-16935","fix":{"state":"fixed","versions":["3.7.3-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-16935","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-16935","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16935","date":"2026-10-08","epss":0.04653,"percentile":0.91501}],"risk":1.3959000000000001,"urls":[],"severity":"Low","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-16935","description":"The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server."},"relatedVulnerabilities":[{"id":"CVE-2019-16935","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16935","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-16935","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16935","date":"2026-10-08","epss":0.04653,"percentile":0.91501}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://bugs.python.org/issue38243","https://github.com/python/cpython/blob/35c0809158be7feae4c4f877a08b93baea2d8291/Lib/xmlrpc/server.py#L897","https://github.com/python/cpython/blob/e007860b8b3609ce0bc62b1780efaa06241520bd/Lib/DocXMLRPCServer.py#L213","https://github.com/python/cpython/pull/16373","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/","https://security.netapp.com/advisory/ntap-20191017-0004/","https://usn.ubuntu.com/4151-1/","https://usn.ubuntu.com/4151-2/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16935","description":"The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server."}]},{"artifact":{"id":"988c8a69c0d8509e","cpes":["cpe:2.3:a:python3.7-minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7-minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7-minimal","purl":"pkg:deb/debian/python3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.list"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.7-minimal.preinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.prerm"}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-16935","versionConstraint":"< 3.7.3-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-16935","fix":{"state":"fixed","versions":["3.7.3-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-16935","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-16935","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16935","date":"2026-10-08","epss":0.04653,"percentile":0.91501}],"risk":1.3959000000000001,"urls":[],"severity":"Low","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-16935","description":"The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server."},"relatedVulnerabilities":[{"id":"CVE-2019-16935","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16935","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-16935","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16935","date":"2026-10-08","epss":0.04653,"percentile":0.91501}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://bugs.python.org/issue38243","https://github.com/python/cpython/blob/35c0809158be7feae4c4f877a08b93baea2d8291/Lib/xmlrpc/server.py#L897","https://github.com/python/cpython/blob/e007860b8b3609ce0bc62b1780efaa06241520bd/Lib/DocXMLRPCServer.py#L213","https://github.com/python/cpython/pull/16373","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/","https://security.netapp.com/advisory/ntap-20191017-0004/","https://usn.ubuntu.com/4151-1/","https://usn.ubuntu.com/4151-2/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16935","description":"The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server."}]},{"artifact":{"id":"ecf5e89e65014edb","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.64.0-4:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/debian/libcurl4@7.64.0-4?arch=amd64&distro=debian-10.1&upstream=curl","type":"deb","version":"7.64.0-4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.64.0-4+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-22898","versionConstraint":"< 7.64.0-4+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"curl","version":"7.64.0-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-22898","fix":{"state":"fixed","versions":["7.64.0-4+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.64.0-4+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-22898","cwe":"CWE-200","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2021-22898","cwe":"CWE-909","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-22898","date":"2026-10-08","epss":0.04507,"percentile":0.91268}],"risk":1.3746349999999998,"urls":[],"severity":"Low","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-22898","description":"curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol."},"relatedVulnerabilities":[{"id":"CVE-2021-22898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:N/A:N","metrics":{"baseScore":2.6,"impactScore":2.9,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-22898","cwe":"CWE-200","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2021-22898","cwe":"CWE-909","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-22898","date":"2026-10-08","epss":0.04507,"percentile":0.91268}],"urls":["http://www.openwall.com/lists/oss-security/2021/07/21/4","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://curl.se/docs/CVE-2021-22898.html","https://github.com/curl/curl/commit/39ce47f219b09c380b81f89fe54ac586c8db6bde","https://hackerone.com/reports/1176461","https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/08/msg00017.html","https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POOC3UV7V6L4CJ5KA2PTWTNUV5Y72T3Q/","https://www.debian.org/security/2022/dsa-5197","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://advisory.splunk.com/advisories/SVD-2023-0809","https://curl.se/docs/CVE-2021-22898.json"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-22898","description":"curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol."}]},{"artifact":{"id":"ecf5e89e65014edb","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.64.0-4:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/debian/libcurl4@7.64.0-4?arch=amd64&distro=debian-10.1&upstream=curl","type":"deb","version":"7.64.0-4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.64.0-4+deb10u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-43552","versionConstraint":"< 7.64.0-4+deb10u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"curl","version":"7.64.0-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-43552","fix":{"state":"fixed","versions":["7.64.0-4+deb10u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.64.0-4+deb10u4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-43552","cwe":"CWE-416","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-43552","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-43552","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-43552","date":"2026-10-08","epss":0.02511,"percentile":0.84298}],"risk":1.3684950000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-43552","description":"A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path."},"relatedVulnerabilities":[{"id":"CVE-2022-43552","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-43552","cwe":"CWE-416","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-43552","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-43552","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-43552","date":"2026-10-08","epss":0.02511,"percentile":0.84298}],"urls":["http://seclists.org/fulldisclosure/2023/Mar/17","https://hackerone.com/reports/1764858","https://security.gentoo.org/glsa/202310-12","https://security.netapp.com/advisory/ntap-20230214-0002/","https://support.apple.com/kb/HT213670"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-43552","description":"A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path."}]},{"artifact":{"id":"d55bfe42f054b394","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.2.6-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.2.6-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=expat","type":"deb","version":"2.2.6-2+deb10u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.2.6-2+deb10u7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-52425","versionConstraint":"< 2.2.6-2+deb10u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"expat","version":"2.2.6-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-52425","fix":{"state":"fixed","versions":["2.2.6-2+deb10u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.2.6-2+deb10u7"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52425","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-52425","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52425","date":"2026-10-08","epss":0.01815,"percentile":0.7802}],"risk":1.36125,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-52425","description":"libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed."},"relatedVulnerabilities":[{"id":"CVE-2023-52425","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52425","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-52425","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-52425","date":"2026-10-08","epss":0.01815,"percentile":0.7802}],"urls":["http://www.openwall.com/lists/oss-security/2024/03/20/5","https://github.com/libexpat/libexpat/pull/789","https://lists.debian.org/debian-lts-announce/2024/04/msg00006.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNUBSGZFEZOBHJFTAD42SAN4ATW2VEMV/","https://security.netapp.com/advisory/ntap-20240614-0003/","https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52425","description":"libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.17.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0526","versionConstraint":"<1.17.12||>=1.18.0-0,<1.18.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0526","fix":{"state":"fixed","versions":["1.17.12","1.18.4"],"available":[{"date":"2022-07-12","kind":"release","version":"1.17.12"},{"date":"2022-07-12","kind":"release","version":"1.18.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-30635","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-30635","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-30635","date":"2026-10-08","epss":0.0181,"percentile":0.77961}],"risk":1.3575,"urls":["https://go.googlesource.com/go/+/6fa37e98ea4382bf881428ee0c150ce591500eb7","https://go.dev/issue/53615","https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/417064","description":"Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2022-30635","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-30635","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-30635","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-30635","date":"2026-10-08","epss":0.0181,"percentile":0.77961}],"urls":["https://go.dev/cl/417064","https://go.dev/issue/53615","https://go.googlesource.com/go/+/6fa37e98ea4382bf881428ee0c150ce591500eb7","https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE","https://pkg.go.dev/vuln/GO-2022-0526"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-30635","description":"Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.17.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-0526","versionConstraint":"<1.17.12||>=1.18.0-0,<1.18.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-0526","fix":{"state":"fixed","versions":["1.17.12","1.18.4"],"available":[{"date":"2022-07-12","kind":"release","version":"1.17.12"},{"date":"2022-07-12","kind":"release","version":"1.18.4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-30635","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-30635","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-30635","date":"2026-10-08","epss":0.0181,"percentile":0.77961}],"risk":1.3575,"urls":["https://go.googlesource.com/go/+/6fa37e98ea4382bf881428ee0c150ce591500eb7","https://go.dev/issue/53615","https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/417064","description":"Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2022-30635","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-30635","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-30635","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-30635","date":"2026-10-08","epss":0.0181,"percentile":0.77961}],"urls":["https://go.dev/cl/417064","https://go.dev/issue/53615","https://go.googlesource.com/go/+/6fa37e98ea4382bf881428ee0c150ce591500eb7","https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE","https://pkg.go.dev/vuln/GO-2022-0526"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-30635","description":"Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures."}]},{"artifact":{"id":"d3f929327cc1f09c","cpes":["cpe:2.3:a:libglib2.0-0:libglib2.0-0:2.58.3-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0-0:libglib2.0_0:2.58.3-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0_0:libglib2.0-0:2.58.3-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0_0:libglib2.0_0:2.58.3-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0:libglib2.0-0:2.58.3-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0:libglib2.0_0:2.58.3-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libglib2.0-0","purl":"pkg:deb/debian/libglib2.0-0@2.58.3-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=glib2.0","type":"deb","version":"2.58.3-2+deb10u1","language":"","licenses":["sha256:ac63a394252c3de7e3afca547269c18fde17b8143b63ab2ddf6ea205339c1271"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libglib2.0-0/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libglib2.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libglib2.0-0:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libglib2.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glib2.0"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.58.3-2+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-28153","versionConstraint":"< 2.58.3-2+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"glib2.0","version":"2.58.3-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-28153","fix":{"state":"fixed","versions":["2.58.3-2+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.58.3-2+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-28153","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-28153","date":"2026-10-08","epss":0.02622,"percentile":0.85019}],"risk":1.35033,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-28153","description":"An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)"},"relatedVulnerabilities":[{"id":"CVE-2021-28153","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-28153","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-28153","date":"2026-10-08","epss":0.02622,"percentile":0.85019}],"urls":["https://gitlab.gnome.org/GNOME/glib/-/issues/2325","https://lists.debian.org/debian-lts-announce/2022/06/msg00006.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RXTD5HCP2K4AAUSWWZTBKQNHRCTAEOF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICUTQPHZNZWX2DZR46QFLQZRHVMHIILJ/","https://security.gentoo.org/glsa/202107-13","https://security.netapp.com/advisory/ntap-20210416-0003/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-28153","description":"An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)"}]},{"artifact":{"id":"9c0f03079e497030","cpes":["cpe:2.3:a:libpython3.7-minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-minimal","purl":"pkg:deb/debian/libpython3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-48560","versionConstraint":"< 3.7.3-2+deb10u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-48560","fix":{"state":"fixed","versions":["3.7.3-2+deb10u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u6"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-48560","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-48560","date":"2026-10-08","epss":0.01771,"percentile":0.77468}],"risk":1.32825,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-48560","description":"A use-after-free exists in Python through 3.9 via heappushpop in heapq."},"relatedVulnerabilities":[{"id":"CVE-2022-48560","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-48560","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-48560","date":"2026-10-08","epss":0.01771,"percentile":0.77468}],"urls":["https://bugs.python.org/issue39421","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZ5OOBWNYWXFTZDMCGHJVGDLDTHLWITJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VO7Y2YZSDK3UYJD2KBGLXRTGNG6T326J/","https://security.netapp.com/advisory/ntap-20230929-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JZ5OOBWNYWXFTZDMCGHJVGDLDTHLWITJ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VO7Y2YZSDK3UYJD2KBGLXRTGNG6T326J/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-48560","description":"A use-after-free exists in Python through 3.9 via heappushpop in heapq."}]},{"artifact":{"id":"b6d8c37141cd8c0a","cpes":["cpe:2.3:a:libpython3.7-stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-stdlib","purl":"pkg:deb/debian/libpython3.7-stdlib@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-48560","versionConstraint":"< 3.7.3-2+deb10u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-48560","fix":{"state":"fixed","versions":["3.7.3-2+deb10u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u6"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-48560","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-48560","date":"2026-10-08","epss":0.01771,"percentile":0.77468}],"risk":1.32825,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-48560","description":"A use-after-free exists in Python through 3.9 via heappushpop in heapq."},"relatedVulnerabilities":[{"id":"CVE-2022-48560","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-48560","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-48560","date":"2026-10-08","epss":0.01771,"percentile":0.77468}],"urls":["https://bugs.python.org/issue39421","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZ5OOBWNYWXFTZDMCGHJVGDLDTHLWITJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VO7Y2YZSDK3UYJD2KBGLXRTGNG6T326J/","https://security.netapp.com/advisory/ntap-20230929-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JZ5OOBWNYWXFTZDMCGHJVGDLDTHLWITJ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VO7Y2YZSDK3UYJD2KBGLXRTGNG6T326J/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-48560","description":"A use-after-free exists in Python through 3.9 via heappushpop in heapq."}]},{"artifact":{"id":"94955c7d71be2bb1","cpes":["cpe:2.3:a:python3.7:python3.7:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7","purl":"pkg:deb/debian/python3.7@3.7.3-2?arch=amd64&distro=debian-10.1","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.list"},{"path":"/var/lib/dpkg/info/python3.7.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.postinst"},{"path":"/var/lib/dpkg/info/python3.7.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-48560","versionConstraint":"< 3.7.3-2+deb10u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-48560","fix":{"state":"fixed","versions":["3.7.3-2+deb10u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u6"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-48560","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-48560","date":"2026-10-08","epss":0.01771,"percentile":0.77468}],"risk":1.32825,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-48560","description":"A use-after-free exists in Python through 3.9 via heappushpop in heapq."},"relatedVulnerabilities":[{"id":"CVE-2022-48560","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-48560","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-48560","date":"2026-10-08","epss":0.01771,"percentile":0.77468}],"urls":["https://bugs.python.org/issue39421","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZ5OOBWNYWXFTZDMCGHJVGDLDTHLWITJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VO7Y2YZSDK3UYJD2KBGLXRTGNG6T326J/","https://security.netapp.com/advisory/ntap-20230929-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JZ5OOBWNYWXFTZDMCGHJVGDLDTHLWITJ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VO7Y2YZSDK3UYJD2KBGLXRTGNG6T326J/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-48560","description":"A use-after-free exists in Python through 3.9 via heappushpop in heapq."}]},{"artifact":{"id":"988c8a69c0d8509e","cpes":["cpe:2.3:a:python3.7-minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7-minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7-minimal","purl":"pkg:deb/debian/python3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.list"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.7-minimal.preinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.prerm"}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.7.3-2+deb10u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-48560","versionConstraint":"< 3.7.3-2+deb10u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-48560","fix":{"state":"fixed","versions":["3.7.3-2+deb10u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.7.3-2+deb10u6"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-48560","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-48560","date":"2026-10-08","epss":0.01771,"percentile":0.77468}],"risk":1.32825,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-48560","description":"A use-after-free exists in Python through 3.9 via heappushpop in heapq."},"relatedVulnerabilities":[{"id":"CVE-2022-48560","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-48560","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-48560","date":"2026-10-08","epss":0.01771,"percentile":0.77468}],"urls":["https://bugs.python.org/issue39421","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZ5OOBWNYWXFTZDMCGHJVGDLDTHLWITJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VO7Y2YZSDK3UYJD2KBGLXRTGNG6T326J/","https://security.netapp.com/advisory/ntap-20230929-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JZ5OOBWNYWXFTZDMCGHJVGDLDTHLWITJ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VO7Y2YZSDK3UYJD2KBGLXRTGNG6T326J/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-48560","description":"A use-after-free exists in Python through 3.9 via heappushpop in heapq."}]},{"artifact":{"id":"72c1823bc1859d07","cpes":["cpe:2.3:a:libhogweed4:libhogweed4:3.4.1-1:*:*:*:*:*:*:*"],"name":"libhogweed4","purl":"pkg:deb/debian/libhogweed4@3.4.1-1?arch=amd64&distro=debian-10.1&upstream=nettle","type":"deb","version":"3.4.1-1","language":"","licenses":["GAP","GPL","GPL-2","GPL-2+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1+","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnettle6/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libhogweed4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libhogweed4:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libhogweed4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nettle"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.1-1+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-20305","versionConstraint":"< 3.4.1-1+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"nettle","version":"3.4.1-1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-20305","fix":{"state":"fixed","versions":["3.4.1-1+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.4.1-1+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-20305","cwe":"CWE-327","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-20305","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-20305","date":"2026-10-08","epss":0.01687,"percentile":0.76329}],"risk":1.31586,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4933-1","link":"https://security-tracker.debian.org/tracker/DSA-4933-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-20305","description":"A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability."},"relatedVulnerabilities":[{"id":"CVE-2021-20305","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-20305","cwe":"CWE-327","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-20305","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-20305","date":"2026-10-08","epss":0.01687,"percentile":0.76329}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1942533","https://lists.debian.org/debian-lts-announce/2021/09/msg00008.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQKWVVMAIDAJ7YAA3VVO32BHLDOH2E63/","https://security.gentoo.org/glsa/202105-31","https://security.netapp.com/advisory/ntap-20211022-0002/","https://www.debian.org/security/2021/dsa-4933"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-20305","description":"A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability."}]},{"artifact":{"id":"ecafc2436bdacd60","cpes":["cpe:2.3:a:libnettle6:libnettle6:3.4.1-1:*:*:*:*:*:*:*"],"name":"libnettle6","purl":"pkg:deb/debian/libnettle6@3.4.1-1?arch=amd64&distro=debian-10.1&upstream=nettle","type":"deb","version":"3.4.1-1","language":"","licenses":["GAP","GPL","GPL-2","GPL-2+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1+","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnettle6/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libnettle6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnettle6:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libnettle6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nettle"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.1-1+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-20305","versionConstraint":"< 3.4.1-1+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"nettle","version":"3.4.1-1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-20305","fix":{"state":"fixed","versions":["3.4.1-1+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.4.1-1+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-20305","cwe":"CWE-327","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-20305","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-20305","date":"2026-10-08","epss":0.01687,"percentile":0.76329}],"risk":1.31586,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4933-1","link":"https://security-tracker.debian.org/tracker/DSA-4933-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-20305","description":"A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability."},"relatedVulnerabilities":[{"id":"CVE-2021-20305","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-20305","cwe":"CWE-327","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-20305","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-20305","date":"2026-10-08","epss":0.01687,"percentile":0.76329}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1942533","https://lists.debian.org/debian-lts-announce/2021/09/msg00008.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQKWVVMAIDAJ7YAA3VVO32BHLDOH2E63/","https://security.gentoo.org/glsa/202105-31","https://security.netapp.com/advisory/ntap-20211022-0002/","https://www.debian.org/security/2021/dsa-4933"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-20305","description":"A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability."}]},{"artifact":{"id":"ecf5e89e65014edb","cpes":["cpe:2.3:a:libcurl4:libcurl4:7.64.0-4:*:*:*:*:*:*:*"],"name":"libcurl4","purl":"pkg:deb/debian/libcurl4@7.64.0-4?arch=amd64&distro=debian-10.1&upstream=curl","type":"deb","version":"7.64.0-4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl","other","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl4/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libcurl4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libcurl4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.64.0-4+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-8284","versionConstraint":"< 7.64.0-4+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"curl","version":"7.64.0-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-8284","fix":{"state":"fixed","versions":["7.64.0-4+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.64.0-4+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8284","cwe":"CWE-200","type":"Secondary","source":"support@hackerone.com"}],"epss":[{"cve":"CVE-2020-8284","date":"2026-10-08","epss":0.03898,"percentile":0.89989}],"risk":1.3058299999999998,"urls":[],"severity":"Low","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4881-1","link":"https://security-tracker.debian.org/tracker/DSA-4881-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-8284","description":"A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions."},"relatedVulnerabilities":[{"id":"CVE-2020-8284","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8284","cwe":"CWE-200","type":"Secondary","source":"support@hackerone.com"}],"epss":[{"cve":"CVE-2020-8284","date":"2026-10-08","epss":0.03898,"percentile":0.89989}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://curl.se/docs/CVE-2020-8284.html","https://hackerone.com/reports/1040166","https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/","https://security.gentoo.org/glsa/202012-14","https://security.netapp.com/advisory/ntap-20210122-0007/","https://support.apple.com/kb/HT212325","https://support.apple.com/kb/HT212326","https://support.apple.com/kb/HT212327","https://www.debian.org/security/2021/dsa-4881","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8284","description":"A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions."}]},{"artifact":{"id":"9c0f03079e497030","cpes":["cpe:2.3:a:libpython3.7-minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_minimal:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-minimal","purl":"pkg:deb/debian/libpython3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-27043","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-27043","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2023-27043","cwe":"CWE-1286","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-27043","date":"2026-10-08","epss":0.02527,"percentile":0.84422}],"risk":1.3014050000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-27043","description":"The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python."},"relatedVulnerabilities":[{"id":"CVE-2023-27043","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2023-27043","cwe":"CWE-1286","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-27043","date":"2026-10-08","epss":0.02527,"percentile":0.84422}],"urls":["http://python.org","https://github.com/python/cpython/issues/102988","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SOX7BCN6YL7B3RFPEEXPIU5CMTEHJOKR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://python-security.readthedocs.io/vuln/email-parseaddr-realname.html","https://security.netapp.com/advisory/ntap-20230601-0003/","http://seclists.org/fulldisclosure/2025/Apr/8","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-577017.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-27043","description":"The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python."}]},{"artifact":{"id":"b6d8c37141cd8c0a","cpes":["cpe:2.3:a:libpython3.7-stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7-stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7_stdlib:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7-stdlib:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.7:libpython3.7_stdlib:3.7.3-2:*:*:*:*:*:*:*"],"name":"libpython3.7-stdlib","purl":"pkg:deb/debian/libpython3.7-stdlib@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libpython3.7-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libpython3.7-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-27043","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-27043","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2023-27043","cwe":"CWE-1286","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-27043","date":"2026-10-08","epss":0.02527,"percentile":0.84422}],"risk":1.3014050000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-27043","description":"The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python."},"relatedVulnerabilities":[{"id":"CVE-2023-27043","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2023-27043","cwe":"CWE-1286","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-27043","date":"2026-10-08","epss":0.02527,"percentile":0.84422}],"urls":["http://python.org","https://github.com/python/cpython/issues/102988","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SOX7BCN6YL7B3RFPEEXPIU5CMTEHJOKR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://python-security.readthedocs.io/vuln/email-parseaddr-realname.html","https://security.netapp.com/advisory/ntap-20230601-0003/","http://seclists.org/fulldisclosure/2025/Apr/8","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-577017.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-27043","description":"The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python."}]},{"artifact":{"id":"94955c7d71be2bb1","cpes":["cpe:2.3:a:python3.7:python3.7:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7","purl":"pkg:deb/debian/python3.7@3.7.3-2?arch=amd64&distro=debian-10.1","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.list"},{"path":"/var/lib/dpkg/info/python3.7.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.postinst"},{"path":"/var/lib/dpkg/info/python3.7.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-27043","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-27043","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2023-27043","cwe":"CWE-1286","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-27043","date":"2026-10-08","epss":0.02527,"percentile":0.84422}],"risk":1.3014050000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-27043","description":"The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python."},"relatedVulnerabilities":[{"id":"CVE-2023-27043","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2023-27043","cwe":"CWE-1286","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-27043","date":"2026-10-08","epss":0.02527,"percentile":0.84422}],"urls":["http://python.org","https://github.com/python/cpython/issues/102988","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SOX7BCN6YL7B3RFPEEXPIU5CMTEHJOKR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://python-security.readthedocs.io/vuln/email-parseaddr-realname.html","https://security.netapp.com/advisory/ntap-20230601-0003/","http://seclists.org/fulldisclosure/2025/Apr/8","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-577017.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-27043","description":"The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python."}]},{"artifact":{"id":"988c8a69c0d8509e","cpes":["cpe:2.3:a:python3.7-minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7-minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7_minimal:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7-minimal:3.7.3-2:*:*:*:*:*:*:*","cpe:2.3:a:python3.7:python3.7_minimal:3.7.3-2:*:*:*:*:*:*:*"],"name":"python3.7-minimal","purl":"pkg:deb/debian/python3.7-minimal@3.7.3-2?arch=amd64&distro=debian-10.1&upstream=python3.7","type":"deb","version":"3.7.3-2","language":"","licenses":["sha256:f1cbf908e1daa8789b389fdcf17811ed36b675d736b39a103591399861350382"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.7-minimal/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/python3.7-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.7-minimal.list","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.list"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.postrm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.7-minimal.preinst","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.7-minimal.prerm","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/python3.7-minimal.prerm"}],"upstreams":[{"name":"python3.7"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-27043","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"python3.7","version":"3.7.3-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-27043","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2023-27043","cwe":"CWE-1286","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-27043","date":"2026-10-08","epss":0.02527,"percentile":0.84422}],"risk":1.3014050000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-27043","description":"The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python."},"relatedVulnerabilities":[{"id":"CVE-2023-27043","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-27043","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2023-27043","cwe":"CWE-1286","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-27043","date":"2026-10-08","epss":0.02527,"percentile":0.84422}],"urls":["http://python.org","https://github.com/python/cpython/issues/102988","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SOX7BCN6YL7B3RFPEEXPIU5CMTEHJOKR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://python-security.readthedocs.io/vuln/email-parseaddr-realname.html","https://security.netapp.com/advisory/ntap-20230601-0003/","http://seclists.org/fulldisclosure/2025/Apr/8","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZAEFSFZDNBNJPNOUTLG5COISGQDLMGV/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/75DTHSTNOFFNAWHXKMDXS7EJWC6W2FUC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ARI7VDSNTQVXRQFM6IK5GSSLEIYV4VZH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BQAKLUJMHFGVBRDPEY57BJGNCE5UUPHW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HXYVPEZUA3465AEFX5JVFVP7KIFZMF3N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6M5I6OQHJABNEYY555HUMMKX3Y4P25Z/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NEUNZSZ3CVSM2QWVYH3N2XGOCDWNYUA3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORLXS5YTKN65E2Q2NWKXMFS5FWQHRNZW/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2MAICLFDDO3QVNHTZ2OCERZQ34R2PIC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2W2BZQIHMCKRI5FNBJERFYMS5PK6TAH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PHVGRKQAGANCSGFI3QMYOCIMS4IFOZA5/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PU6Y2S5CBN5BWCBDAJFTGIBZLK3S2G3J/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDRDDPDN3VFIYXJIYEABY6USX5EU66AG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDDC2VOX7OQC6OHMYTVD4HLFZIV6PYBC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SINP4OVYNB2AGDYI2GS37EMW3H3F7XPZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VZXC32CJ7TWDPJO6GY2XIQRO7JZX5FLP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XWMBD4LNHWEXRI6YVFWJMTJQUL5WOFTS/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YQVY5C5REXWJIORJIL2FIL3ALOEJEF72/","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-577017.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-27043","description":"The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python."}]},{"artifact":{"id":"23379702208ad4ae","cpes":["cpe:2.3:a:libncurses6:libncurses6:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libncurses6","purl":"pkg:deb/debian/libncurses6@6.1%2B20181013-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=ncurses","type":"deb","version":"6.1+20181013-2+deb10u1","language":"","licenses":["sha256:5e8ee902c8906ddb7779fd36dc9979cb08b51fbebf7c0b1a9aeb78af382af590"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo6/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libncurses6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncurses6:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libncurses6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"fix":{"suggestedVersion":"6.1+20181013-2+deb10u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-19189","versionConstraint":"< 6.1+20181013-2+deb10u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"ncurses","version":"6.1+20181013-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-19189","fix":{"state":"fixed","versions":["6.1+20181013-2+deb10u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"6.1+20181013-2+deb10u4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19189","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19189","date":"2026-10-08","epss":0.02234,"percentile":0.82244}],"risk":1.2845499999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-19189","description":"Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command."},"relatedVulnerabilities":[{"id":"CVE-2020-19189","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19189","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19189","date":"2026-10-08","epss":0.02234,"percentile":0.82244}],"urls":["http://seclists.org/fulldisclosure/2023/Dec/10","http://seclists.org/fulldisclosure/2023/Dec/11","http://seclists.org/fulldisclosure/2023/Dec/9","https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc5.md","https://lists.debian.org/debian-lts-announce/2023/09/msg00033.html","https://security.netapp.com/advisory/ntap-20231006-0005/","https://support.apple.com/kb/HT214036","https://support.apple.com/kb/HT214037","https://support.apple.com/kb/HT214038"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-19189","description":"Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command."}]},{"artifact":{"id":"845a07db623ef9dc","cpes":["cpe:2.3:a:libncursesw6:libncursesw6:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libncursesw6","purl":"pkg:deb/debian/libncursesw6@6.1%2B20181013-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=ncurses","type":"deb","version":"6.1+20181013-2+deb10u1","language":"","licenses":["sha256:5e8ee902c8906ddb7779fd36dc9979cb08b51fbebf7c0b1a9aeb78af382af590"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo6/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libncursesw6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncursesw6:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libncursesw6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"fix":{"suggestedVersion":"6.1+20181013-2+deb10u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-19189","versionConstraint":"< 6.1+20181013-2+deb10u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"ncurses","version":"6.1+20181013-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-19189","fix":{"state":"fixed","versions":["6.1+20181013-2+deb10u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"6.1+20181013-2+deb10u4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19189","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19189","date":"2026-10-08","epss":0.02234,"percentile":0.82244}],"risk":1.2845499999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-19189","description":"Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command."},"relatedVulnerabilities":[{"id":"CVE-2020-19189","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19189","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19189","date":"2026-10-08","epss":0.02234,"percentile":0.82244}],"urls":["http://seclists.org/fulldisclosure/2023/Dec/10","http://seclists.org/fulldisclosure/2023/Dec/11","http://seclists.org/fulldisclosure/2023/Dec/9","https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc5.md","https://lists.debian.org/debian-lts-announce/2023/09/msg00033.html","https://security.netapp.com/advisory/ntap-20231006-0005/","https://support.apple.com/kb/HT214036","https://support.apple.com/kb/HT214037","https://support.apple.com/kb/HT214038"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-19189","description":"Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command."}]},{"artifact":{"id":"398b6a96752d6a52","cpes":["cpe:2.3:a:libtinfo6:libtinfo6:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"libtinfo6","purl":"pkg:deb/debian/libtinfo6@6.1%2B20181013-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=ncurses","type":"deb","version":"6.1+20181013-2+deb10u1","language":"","licenses":["sha256:5e8ee902c8906ddb7779fd36dc9979cb08b51fbebf7c0b1a9aeb78af382af590"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo6/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libtinfo6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtinfo6:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libtinfo6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"fix":{"suggestedVersion":"6.1+20181013-2+deb10u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-19189","versionConstraint":"< 6.1+20181013-2+deb10u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"ncurses","version":"6.1+20181013-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-19189","fix":{"state":"fixed","versions":["6.1+20181013-2+deb10u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"6.1+20181013-2+deb10u4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19189","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19189","date":"2026-10-08","epss":0.02234,"percentile":0.82244}],"risk":1.2845499999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-19189","description":"Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command."},"relatedVulnerabilities":[{"id":"CVE-2020-19189","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19189","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19189","date":"2026-10-08","epss":0.02234,"percentile":0.82244}],"urls":["http://seclists.org/fulldisclosure/2023/Dec/10","http://seclists.org/fulldisclosure/2023/Dec/11","http://seclists.org/fulldisclosure/2023/Dec/9","https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc5.md","https://lists.debian.org/debian-lts-announce/2023/09/msg00033.html","https://security.netapp.com/advisory/ntap-20231006-0005/","https://support.apple.com/kb/HT214036","https://support.apple.com/kb/HT214037","https://support.apple.com/kb/HT214038"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-19189","description":"Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command."}]},{"artifact":{"id":"ee327b3210e9495d","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:deb/debian/ncurses-base@6.1%2B20181013-2%2Bdeb10u1?arch=all&distro=debian-10.1&upstream=ncurses","type":"deb","version":"6.1+20181013-2+deb10u1","language":"","licenses":["sha256:5e8ee902c8906ddb7779fd36dc9979cb08b51fbebf7c0b1a9aeb78af382af590"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-base/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/ncurses-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.conffiles","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/ncurses-base.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/ncurses-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.list","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/ncurses-base.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"fix":{"suggestedVersion":"6.1+20181013-2+deb10u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-19189","versionConstraint":"< 6.1+20181013-2+deb10u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"ncurses","version":"6.1+20181013-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-19189","fix":{"state":"fixed","versions":["6.1+20181013-2+deb10u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"6.1+20181013-2+deb10u4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19189","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19189","date":"2026-10-08","epss":0.02234,"percentile":0.82244}],"risk":1.2845499999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-19189","description":"Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command."},"relatedVulnerabilities":[{"id":"CVE-2020-19189","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19189","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19189","date":"2026-10-08","epss":0.02234,"percentile":0.82244}],"urls":["http://seclists.org/fulldisclosure/2023/Dec/10","http://seclists.org/fulldisclosure/2023/Dec/11","http://seclists.org/fulldisclosure/2023/Dec/9","https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc5.md","https://lists.debian.org/debian-lts-announce/2023/09/msg00033.html","https://security.netapp.com/advisory/ntap-20231006-0005/","https://support.apple.com/kb/HT214036","https://support.apple.com/kb/HT214037","https://support.apple.com/kb/HT214038"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-19189","description":"Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command."}]},{"artifact":{"id":"14c95522205f6d31","cpes":["cpe:2.3:a:ncurses-bin:ncurses-bin:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-bin:ncurses_bin:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses-bin:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses_bin:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-bin:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_bin:6.1\\+20181013-2\\+deb10u1:*:*:*:*:*:*:*"],"name":"ncurses-bin","purl":"pkg:deb/debian/ncurses-bin@6.1%2B20181013-2%2Bdeb10u1?arch=amd64&distro=debian-10.1&upstream=ncurses","type":"deb","version":"6.1+20181013-2+deb10u1","language":"","licenses":["sha256:5e8ee902c8906ddb7779fd36dc9979cb08b51fbebf7c0b1a9aeb78af382af590"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-bin/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/ncurses-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/ncurses-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.list","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/ncurses-bin.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"fix":{"suggestedVersion":"6.1+20181013-2+deb10u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-19189","versionConstraint":"< 6.1+20181013-2+deb10u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"ncurses","version":"6.1+20181013-2+deb10u1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-19189","fix":{"state":"fixed","versions":["6.1+20181013-2+deb10u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"6.1+20181013-2+deb10u4"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19189","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19189","date":"2026-10-08","epss":0.02234,"percentile":0.82244}],"risk":1.2845499999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-19189","description":"Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command."},"relatedVulnerabilities":[{"id":"CVE-2020-19189","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-19189","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-19189","date":"2026-10-08","epss":0.02234,"percentile":0.82244}],"urls":["http://seclists.org/fulldisclosure/2023/Dec/10","http://seclists.org/fulldisclosure/2023/Dec/11","http://seclists.org/fulldisclosure/2023/Dec/9","https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc5.md","https://lists.debian.org/debian-lts-announce/2023/09/msg00033.html","https://security.netapp.com/advisory/ntap-20231006-0005/","https://support.apple.com/kb/HT214036","https://support.apple.com/kb/HT214037","https://support.apple.com/kb/HT214038"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-19189","description":"Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.19.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2023-1568","versionConstraint":"<1.19.6||>=1.20.0-0,<1.20.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2023-1568","fix":{"state":"fixed","versions":["1.19.6","1.20.1"],"available":[{"date":"2023-02-14","kind":"release","version":"1.19.6"},{"date":"2023-02-14","kind":"release","version":"1.20.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41722","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41722","date":"2026-10-08","epss":0.01678,"percentile":0.76195}],"risk":1.2585,"urls":["https://go.dev/cl/468123","https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/57274","description":"A path traversal vulnerability exists in filepath.Clean on Windows.\n\nOn Windows, the filepath.Clean function could transform an invalid path such as \"a/../c:/b\" into the valid path \"c:\\b\". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack.\n\nAfter fix, the filepath.Clean function transforms this path into the relative (but still invalid) path \".\\c:\\b\"."},"relatedVulnerabilities":[{"id":"CVE-2022-41722","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41722","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41722","date":"2026-10-08","epss":0.01678,"percentile":0.76195}],"urls":["https://go.dev/cl/468123","https://go.dev/issue/57274","https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E","https://pkg.go.dev/vuln/GO-2023-1568"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41722","description":"A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as \"a/../c:/b\" into the valid path \"c:\\b\". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path \".\\c:\\b\"."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.19.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2023-1568","versionConstraint":"<1.19.6||>=1.20.0-0,<1.20.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2023-1568","fix":{"state":"fixed","versions":["1.19.6","1.20.1"],"available":[{"date":"2023-02-14","kind":"release","version":"1.19.6"},{"date":"2023-02-14","kind":"release","version":"1.20.1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41722","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41722","date":"2026-10-08","epss":0.01678,"percentile":0.76195}],"risk":1.2585,"urls":["https://go.dev/cl/468123","https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/57274","description":"A path traversal vulnerability exists in filepath.Clean on Windows.\n\nOn Windows, the filepath.Clean function could transform an invalid path such as \"a/../c:/b\" into the valid path \"c:\\b\". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack.\n\nAfter fix, the filepath.Clean function transforms this path into the relative (but still invalid) path \".\\c:\\b\"."},"relatedVulnerabilities":[{"id":"CVE-2022-41722","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41722","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41722","date":"2026-10-08","epss":0.01678,"percentile":0.76195}],"urls":["https://go.dev/cl/468123","https://go.dev/issue/57274","https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E","https://pkg.go.dev/vuln/GO-2023-1568"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41722","description":"A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as \"a/../c:/b\" into the valid path \"c:\\b\". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path \".\\c:\\b\"."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.18.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-1037","versionConstraint":"<1.18.7||>=1.19.0-0,<1.19.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-1037","fix":{"state":"fixed","versions":["1.18.7","1.19.2"],"available":[{"date":"2022-10-04","kind":"release","version":"1.18.7"},{"date":"2022-10-04","kind":"release","version":"1.19.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-2879","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-2879","date":"2026-10-08","epss":0.01667,"percentile":0.76048}],"risk":1.2502499999999999,"urls":["https://go.dev/cl/439355","https://groups.google.com/g/golang-announce/c/xtuG5faxtaU"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/54853","description":"Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB."},"relatedVulnerabilities":[{"id":"CVE-2022-2879","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-2879","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-2879","date":"2026-10-08","epss":0.01667,"percentile":0.76048}],"urls":["https://go.dev/cl/439355","https://go.dev/issue/54853","https://groups.google.com/g/golang-announce/c/xtuG5faxtaU","https://pkg.go.dev/vuln/GO-2022-1037","https://security.gentoo.org/glsa/202311-09"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-2879","description":"Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.18.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2022-1037","versionConstraint":"<1.18.7||>=1.19.0-0,<1.19.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2022-1037","fix":{"state":"fixed","versions":["1.18.7","1.19.2"],"available":[{"date":"2022-10-04","kind":"release","version":"1.18.7"},{"date":"2022-10-04","kind":"release","version":"1.19.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-2879","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-2879","date":"2026-10-08","epss":0.01667,"percentile":0.76048}],"risk":1.2502499999999999,"urls":["https://go.dev/cl/439355","https://groups.google.com/g/golang-announce/c/xtuG5faxtaU"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/54853","description":"Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB."},"relatedVulnerabilities":[{"id":"CVE-2022-2879","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-2879","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-2879","date":"2026-10-08","epss":0.01667,"percentile":0.76048}],"urls":["https://go.dev/cl/439355","https://go.dev/issue/54853","https://groups.google.com/g/golang-announce/c/xtuG5faxtaU","https://pkg.go.dev/vuln/GO-2022-1037","https://security.gentoo.org/glsa/202311-09"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-2879","description":"Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB."}]},{"artifact":{"id":"78e377730903892e","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.17-3:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.17-3?arch=amd64&distro=debian-10.1&upstream=krb5","type":"deb","version":"1.17-3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.17-3+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-37750","versionConstraint":"< 1.17-3+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"krb5","version":"1.17-3"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-37750","fix":{"state":"fixed","versions":["1.17-3+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.17-3+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-37750","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-37750","date":"2026-10-08","epss":0.02166,"percentile":0.81699}],"risk":1.24545,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-37750","description":"The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field."},"relatedVulnerabilities":[{"id":"CVE-2021-37750","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-37750","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-37750","date":"2026-10-08","epss":0.02166,"percentile":0.81699}],"urls":["https://github.com/krb5/krb5/commit/d775c95af7606a51bf79547a94fa52ddd1cb7f49","https://github.com/krb5/krb5/releases","https://lists.debian.org/debian-lts-announce/2021/09/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MFCLW7D46E4VCREKKH453T5DA4XOLHU2/","https://security.netapp.com/advisory/ntap-20210923-0002/","https://web.mit.edu/kerberos/advisories/","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.starwindsoftware.com/security/sw-20220817-0004/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-37750","description":"The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field."}]},{"artifact":{"id":"8934c1cbf61306d1","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.17-3:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.17-3?arch=amd64&distro=debian-10.1&upstream=krb5","type":"deb","version":"1.17-3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.17-3+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-37750","versionConstraint":"< 1.17-3+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"krb5","version":"1.17-3"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-37750","fix":{"state":"fixed","versions":["1.17-3+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.17-3+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-37750","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-37750","date":"2026-10-08","epss":0.02166,"percentile":0.81699}],"risk":1.24545,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-37750","description":"The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field."},"relatedVulnerabilities":[{"id":"CVE-2021-37750","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-37750","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-37750","date":"2026-10-08","epss":0.02166,"percentile":0.81699}],"urls":["https://github.com/krb5/krb5/commit/d775c95af7606a51bf79547a94fa52ddd1cb7f49","https://github.com/krb5/krb5/releases","https://lists.debian.org/debian-lts-announce/2021/09/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MFCLW7D46E4VCREKKH453T5DA4XOLHU2/","https://security.netapp.com/advisory/ntap-20210923-0002/","https://web.mit.edu/kerberos/advisories/","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.starwindsoftware.com/security/sw-20220817-0004/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-37750","description":"The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field."}]},{"artifact":{"id":"de70c2aa7611f8ea","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.17-3:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.17-3:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.17-3?arch=amd64&distro=debian-10.1&upstream=krb5","type":"deb","version":"1.17-3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.17-3+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-37750","versionConstraint":"< 1.17-3+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"krb5","version":"1.17-3"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-37750","fix":{"state":"fixed","versions":["1.17-3+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.17-3+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-37750","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-37750","date":"2026-10-08","epss":0.02166,"percentile":0.81699}],"risk":1.24545,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-37750","description":"The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field."},"relatedVulnerabilities":[{"id":"CVE-2021-37750","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-37750","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-37750","date":"2026-10-08","epss":0.02166,"percentile":0.81699}],"urls":["https://github.com/krb5/krb5/commit/d775c95af7606a51bf79547a94fa52ddd1cb7f49","https://github.com/krb5/krb5/releases","https://lists.debian.org/debian-lts-announce/2021/09/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MFCLW7D46E4VCREKKH453T5DA4XOLHU2/","https://security.netapp.com/advisory/ntap-20210923-0002/","https://web.mit.edu/kerberos/advisories/","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.starwindsoftware.com/security/sw-20220817-0004/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-37750","description":"The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field."}]},{"artifact":{"id":"481759f67535d39d","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.17-3:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.17-3?arch=amd64&distro=debian-10.1&upstream=krb5","type":"deb","version":"1.17-3","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.17-3+deb10u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-37750","versionConstraint":"< 1.17-3+deb10u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"krb5","version":"1.17-3"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2021-37750","fix":{"state":"fixed","versions":["1.17-3+deb10u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.17-3+deb10u3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-37750","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-37750","date":"2026-10-08","epss":0.02166,"percentile":0.81699}],"risk":1.24545,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-37750","description":"The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field."},"relatedVulnerabilities":[{"id":"CVE-2021-37750","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-37750","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-37750","date":"2026-10-08","epss":0.02166,"percentile":0.81699}],"urls":["https://github.com/krb5/krb5/commit/d775c95af7606a51bf79547a94fa52ddd1cb7f49","https://github.com/krb5/krb5/releases","https://lists.debian.org/debian-lts-announce/2021/09/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MFCLW7D46E4VCREKKH453T5DA4XOLHU2/","https://security.netapp.com/advisory/ntap-20210923-0002/","https://web.mit.edu/kerberos/advisories/","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.starwindsoftware.com/security/sw-20220817-0004/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-37750","description":"The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field."}]},{"artifact":{"id":"55c72a3cae1cb771","cpes":["cpe:2.3:a:libonig5:libonig5:6.9.1-1:*:*:*:*:*:*:*"],"name":"libonig5","purl":"pkg:deb/debian/libonig5@6.9.1-1?arch=amd64&distro=debian-10.1&upstream=libonig","type":"deb","version":"6.9.1-1","language":"","licenses":["BSD-2-clause","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libonig5/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libonig5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libonig5:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libonig5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libonig"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-19203","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"libonig","version":"6.9.1-1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-19203","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-19203","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19203","date":"2026-10-08","epss":0.04052,"percentile":0.90381}],"risk":1.2156,"urls":[],"severity":"Low","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-19203","description":"An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string. This leads to a heap-based buffer over-read."},"relatedVulnerabilities":[{"id":"CVE-2019-19203","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19203","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19203","date":"2026-10-08","epss":0.04052,"percentile":0.90381}],"urls":["https://github.com/ManhNDd/CVE-2019-19203","https://github.com/kkos/oniguruma/issues/163","https://github.com/kkos/oniguruma/releases/tag/v6.9.4_rc2","https://github.com/tarantula-team/CVE-2019-19203","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NO267PLHGYZSWX3XTRPKYBKD4J3YOU5V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3MBNW6Z4DOXSCNWGBLQ7OA3OGUJ44WL/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19203","description":"An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string. This leads to a heap-based buffer over-read."}]},{"artifact":{"id":"55c72a3cae1cb771","cpes":["cpe:2.3:a:libonig5:libonig5:6.9.1-1:*:*:*:*:*:*:*"],"name":"libonig5","purl":"pkg:deb/debian/libonig5@6.9.1-1?arch=amd64&distro=debian-10.1&upstream=libonig","type":"deb","version":"6.9.1-1","language":"","licenses":["BSD-2-clause","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libonig5/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libonig5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libonig5:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libonig5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libonig"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-13224","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"libonig","version":"6.9.1-1"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2019-13224","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-13224","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-13224","date":"2026-10-08","epss":0.04047,"percentile":0.90367}],"risk":1.2141,"urls":[],"severity":"Low","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-13224","description":"A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust."},"relatedVulnerabilities":[{"id":"CVE-2019-13224","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-13224","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-13224","date":"2026-10-08","epss":0.04047,"percentile":0.90367}],"urls":["https://github.com/kkos/oniguruma/commit/0f7f61ed1b7b697e283e37bd2d731d0bd57adb55","https://lists.debian.org/debian-lts-announce/2019/07/msg00013.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWCPDTZOIUKGMFAD5NAKUB7FPJFAIQN5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SNL26OZSQRVLEO6JRNUVIMZTICXBNEQW/","https://security.gentoo.org/glsa/201911-03","https://support.f5.com/csp/article/K00103182","https://support.f5.com/csp/article/K00103182?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/4088-1/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-13224","description":"A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust."}]},{"artifact":{"id":"7c1ebd3787684a51","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.7-4:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/debian/libgnutls30@3.6.7-4?arch=amd64&distro=debian-10.1&upstream=gnutls28","type":"deb","version":"3.6.7-4","language":"","licenses":["sha256:d35f0abecc61a3676965c20cf13a44815b05d9b4a68985fa1809b13c2aff9090"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.6.7-4+deb10u12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-0553","versionConstraint":"< 3.6.7-4+deb10u12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"gnutls28","version":"3.6.7-4"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2024-0553","fix":{"state":"fixed","versions":["3.6.7-4+deb10u12"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.6.7-4+deb10u12"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0553","cwe":"CWE-203","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-0553","cwe":"CWE-203","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-0553","date":"2026-10-08","epss":0.01614,"percentile":0.75252}],"risk":1.2105000000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-0553","description":"A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981."},"relatedVulnerabilities":[{"id":"CVE-2024-0553","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0553","cwe":"CWE-203","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-0553","cwe":"CWE-203","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-0553","date":"2026-10-08","epss":0.01614,"percentile":0.75252}],"urls":["https://access.redhat.com/errata/RHSA-2024:0533","https://access.redhat.com/errata/RHSA-2024:0627","https://access.redhat.com/errata/RHSA-2024:0796","https://access.redhat.com/errata/RHSA-2024:1082","https://access.redhat.com/errata/RHSA-2024:1108","https://access.redhat.com/errata/RHSA-2024:1383","https://access.redhat.com/errata/RHSA-2024:2094","https://access.redhat.com/security/cve/CVE-2024-0553","https://bugzilla.redhat.com/show_bug.cgi?id=2258412","https://gitlab.com/gnutls/gnutls/-/issues/1522","https://lists.gnupg.org/pipermail/gnutls-help/2024-January/004841.html","http://www.openwall.com/lists/oss-security/2024/01/19/3","https://lists.debian.org/debian-lts-announce/2024/02/msg00010.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ZEIOLORQ7N6WRPFXZSYDL2MC4LP7VFV/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GNXKVR5YNUEBNHAHM5GSYKBZX4W2HMN2/","https://security.netapp.com/advisory/ntap-20240202-0011/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0553","description":"A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981."}]},{"artifact":{"id":"5a00b6e84834b8f7","cpes":["cpe:2.3:a:libperl5.28:libperl5.28:5.28.1-6:*:*:*:*:*:*:*"],"name":"libperl5.28","purl":"pkg:deb/debian/libperl5.28@5.28.1-6?arch=amd64&distro=debian-10.1&upstream=perl","type":"deb","version":"5.28.1-6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.28/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/libperl5.28/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.28:amd64.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/libperl5.28:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-31484","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"perl","version":"5.28.1-6"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-31484","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31484","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31484","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31484","date":"2026-10-08","epss":0.01548,"percentile":0.7429}],"risk":1.20744,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-31484","description":"CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS."},"relatedVulnerabilities":[{"id":"CVE-2023-31484","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31484","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31484","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31484","date":"2026-10-08","epss":0.01548,"percentile":0.7429}],"urls":["http://www.openwall.com/lists/oss-security/2023/04/29/1","http://www.openwall.com/lists/oss-security/2023/05/03/3","http://www.openwall.com/lists/oss-security/2023/05/03/5","http://www.openwall.com/lists/oss-security/2023/05/07/2","https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/","https://github.com/andk/cpanpm/pull/175","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BM6UW55CNFUTNGD5ZRKGUKKKFDJGMFHL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LEGCEOKFJVBJ2QQ6S2H4NAEWTUERC7SB/","https://metacpan.org/dist/CPAN/changes","https://security.netapp.com/advisory/ntap-20240621-0007/","https://www.openwall.com/lists/oss-security/2023/04/18/14","https://lists.debian.org/debian-lts-announce/2024/10/msg00017.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-31484","description":"CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS."}]},{"artifact":{"id":"4a18855ea4ce4a40","cpes":["cpe:2.3:a:perl:perl:5.28.1-6:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.28.1-6?arch=amd64&distro=debian-10.1","type":"deb","version":"5.28.1-6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl.preinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-31484","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"perl","version":"5.28.1-6"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-31484","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31484","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31484","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31484","date":"2026-10-08","epss":0.01548,"percentile":0.7429}],"risk":1.20744,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-31484","description":"CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS."},"relatedVulnerabilities":[{"id":"CVE-2023-31484","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31484","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31484","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31484","date":"2026-10-08","epss":0.01548,"percentile":0.7429}],"urls":["http://www.openwall.com/lists/oss-security/2023/04/29/1","http://www.openwall.com/lists/oss-security/2023/05/03/3","http://www.openwall.com/lists/oss-security/2023/05/03/5","http://www.openwall.com/lists/oss-security/2023/05/07/2","https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/","https://github.com/andk/cpanpm/pull/175","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BM6UW55CNFUTNGD5ZRKGUKKKFDJGMFHL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LEGCEOKFJVBJ2QQ6S2H4NAEWTUERC7SB/","https://metacpan.org/dist/CPAN/changes","https://security.netapp.com/advisory/ntap-20240621-0007/","https://www.openwall.com/lists/oss-security/2023/04/18/14","https://lists.debian.org/debian-lts-announce/2024/10/msg00017.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-31484","description":"CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS."}]},{"artifact":{"id":"62eec6c9883d4a8d","cpes":["cpe:2.3:a:perl-base:perl-base:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.28.1-6:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.28.1-6?arch=amd64&distro=debian-10.1&upstream=perl","type":"deb","version":"5.28.1-6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/perl-base.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-31484","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"perl","version":"5.28.1-6"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-31484","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31484","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31484","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31484","date":"2026-10-08","epss":0.01548,"percentile":0.7429}],"risk":1.20744,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-31484","description":"CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS."},"relatedVulnerabilities":[{"id":"CVE-2023-31484","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31484","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31484","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31484","date":"2026-10-08","epss":0.01548,"percentile":0.7429}],"urls":["http://www.openwall.com/lists/oss-security/2023/04/29/1","http://www.openwall.com/lists/oss-security/2023/05/03/3","http://www.openwall.com/lists/oss-security/2023/05/03/5","http://www.openwall.com/lists/oss-security/2023/05/07/2","https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/","https://github.com/andk/cpanpm/pull/175","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BM6UW55CNFUTNGD5ZRKGUKKKFDJGMFHL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LEGCEOKFJVBJ2QQ6S2H4NAEWTUERC7SB/","https://metacpan.org/dist/CPAN/changes","https://security.netapp.com/advisory/ntap-20240621-0007/","https://www.openwall.com/lists/oss-security/2023/04/18/14","https://lists.debian.org/debian-lts-announce/2024/10/msg00017.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-31484","description":"CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS."}]},{"artifact":{"id":"600f71408b95fb2a","cpes":["cpe:2.3:a:perl-modules-5.28:perl-modules-5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.28:perl_modules_5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.28:perl-modules-5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.28:perl_modules_5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.28:5.28.1-6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.28:5.28.1-6:*:*:*:*:*:*:*"],"name":"perl-modules-5.28","purl":"pkg:deb/debian/perl-modules-5.28@5.28.1-6?arch=all&distro=debian-10.1&upstream=perl","type":"deb","version":"5.28.1-6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.28/copyright","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/share/doc/perl-modules-5.28/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.28.md5sums","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl-modules-5.28.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.28.list","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/info/perl-modules-5.28.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-31484","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"perl","version":"5.28.1-6"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2023-31484","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31484","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31484","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31484","date":"2026-10-08","epss":0.01548,"percentile":0.7429}],"risk":1.20744,"urls":[],"severity":"High","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-31484","description":"CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS."},"relatedVulnerabilities":[{"id":"CVE-2023-31484","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31484","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31484","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31484","date":"2026-10-08","epss":0.01548,"percentile":0.7429}],"urls":["http://www.openwall.com/lists/oss-security/2023/04/29/1","http://www.openwall.com/lists/oss-security/2023/05/03/3","http://www.openwall.com/lists/oss-security/2023/05/03/5","http://www.openwall.com/lists/oss-security/2023/05/07/2","https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/","https://github.com/andk/cpanpm/pull/175","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BM6UW55CNFUTNGD5ZRKGUKKKFDJGMFHL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LEGCEOKFJVBJ2QQ6S2H4NAEWTUERC7SB/","https://metacpan.org/dist/CPAN/changes","https://security.netapp.com/advisory/ntap-20240621-0007/","https://www.openwall.com/lists/oss-security/2023/04/18/14","https://lists.debian.org/debian-lts-announce/2024/10/msg00017.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-31484","description":"CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS."}]},{"artifact":{"id":"940633232797803a","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.27.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.27.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.27.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.27.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.27.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.27.2-3:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.27.2-3?arch=amd64&distro=debian-10.1&upstream=sqlite3","type":"deb","version":"3.27.2-3","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.27.2-3+deb10u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-35527","versionConstraint":"< 3.27.2-3+deb10u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"sqlite3","version":"3.27.2-3"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-35527","fix":{"state":"fixed","versions":["3.27.2-3+deb10u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.27.2-3+deb10u2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35527","cwe":"CWE-119","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2020-35527","cwe":"CWE-119","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-35527","date":"2026-10-08","epss":0.01247,"percentile":0.68418}],"risk":1.17218,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-35527","description":"In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause."},"relatedVulnerabilities":[{"id":"CVE-2020-35527","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35527","cwe":"CWE-119","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2020-35527","cwe":"CWE-119","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-35527","date":"2026-10-08","epss":0.01247,"percentile":0.68418}],"urls":["https://security.netapp.com/advisory/ntap-20221111-0007/","https://www.sqlite.org/src/info/c431b3fd8fd0f6a6"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-35527","description":"In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause."}]},{"artifact":{"id":"de13d9d3b0096104","cpes":["cpe:2.3:a:libp11-kit0:libp11-kit0:0.23.15-2:*:*:*:*:*:*:*","cpe:2.3:a:libp11-kit0:libp11_kit0:0.23.15-2:*:*:*:*:*:*:*","cpe:2.3:a:libp11_kit0:libp11-kit0:0.23.15-2:*:*:*:*:*:*:*","cpe:2.3:a:libp11_kit0:libp11_kit0:0.23.15-2:*:*:*:*:*:*:*","cpe:2.3:a:libp11:libp11-kit0:0.23.15-2:*:*:*:*:*:*:*","cpe:2.3:a:libp11:libp11_kit0:0.23.15-2:*:*:*:*:*:*:*"],"name":"libp11-kit0","purl":"pkg:deb/debian/libp11-kit0@0.23.15-2?arch=amd64&distro=debian-10.1&upstream=p11-kit","type":"deb","version":"0.23.15-2","language":"","licenses":["sha256:7e0942c830cd46f69d01e0806c63b6757bb229b635f0bdd48bcc0e7c32ea4787"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libp11-kit0/copyright","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/usr/share/doc/libp11-kit0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libp11-kit0:amd64.md5sums","layerID":"sha256:b67d19e65ef653823ed62a5835399c610a40e8205c16f839c5cc567954fcf594","accessPath":"/var/lib/dpkg/info/libp11-kit0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"p11-kit"}]},"matchDetails":[{"fix":{"suggestedVersion":"0.23.15-2+deb10u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-29362","versionConstraint":"< 0.23.15-2+deb10u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"p11-kit","version":"0.23.15-2"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2020-29362","fix":{"state":"fixed","versions":["0.23.15-2+deb10u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"0.23.15-2+deb10u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-29362","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-29362","date":"2026-10-08","epss":0.0227,"percentile":0.82523}],"risk":1.1690500000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:10","advisories":[{"id":"DSA-4822-1","link":"https://security-tracker.debian.org/tracker/DSA-4822-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-29362","description":"An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the remote entity supplies a byte array through a serialized PKCS#11 function call, the receiving entity may allow the reading of up to 4 bytes of memory past the heap allocation."},"relatedVulnerabilities":[{"id":"CVE-2020-29362","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-29362","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-29362","date":"2026-10-08","epss":0.0227,"percentile":0.82523}],"urls":["https://github.com/p11-glue/p11-kit/releases","https://github.com/p11-glue/p11-kit/security/advisories/GHSA-5wpq-43j2-6qwc","https://lists.debian.org/debian-lts-announce/2021/01/msg00002.html","https://www.debian.org/security/2021/dsa-4822"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-29362","description":"An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the remote entity supplies a byte array through a serialized PKCS#11 function call, the receiving entity may allow the reading of up to 4 bytes of memory past the heap allocation."}]},{"artifact":{"id":"54d4361207911e8c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.15.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0241","versionConstraint":"<1.15.13||>=1.16.0-0,<1.16.5 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0241","fix":{"state":"fixed","versions":["1.15.13","1.16.5"],"available":[{"date":"2021-06-03","kind":"release","version":"1.15.13"},{"date":"2021-06-03","kind":"release","version":"1.16.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33197","cwe":"CWE-862","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33197","date":"2026-10-08","epss":0.0226,"percentile":0.82448}],"risk":1.1639,"urls":["https://go.googlesource.com/go/+/950fa11c4cb01a145bb07eeb167d90a1846061b3","https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI","https://go.dev/issue/46313"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/321929","description":"ReverseProxy can be made to forward certain hop-by-hop headers, including Connection. If the target of the ReverseProxy is itself a reverse proxy, this lets an attacker drop arbitrary headers, including those set by the ReverseProxy.Director."},"relatedVulnerabilities":[{"id":"CVE-2021-33197","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33197","cwe":"CWE-862","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33197","date":"2026-10-08","epss":0.0226,"percentile":0.82448}],"urls":["https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI","https://security.gentoo.org/glsa/202208-02"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33197","description":"In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers."}]},{"artifact":{"id":"66eff34d35fb9f3c","cpes":["cpe:2.3:a:golang:go:1.13.4:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.13.4","type":"go-module","version":"go1.13.4","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.15.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2021-0241","versionConstraint":"<1.15.13||>=1.16.0-0,<1.16.5 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.13.4"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2021-0241","fix":{"state":"fixed","versions":["1.15.13","1.16.5"],"available":[{"date":"2021-06-03","kind":"release","version":"1.15.13"},{"date":"2021-06-03","kind":"release","version":"1.16.5"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33197","cwe":"CWE-862","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33197","date":"2026-10-08","epss":0.0226,"percentile":0.82448}],"risk":1.1639,"urls":["https://go.googlesource.com/go/+/950fa11c4cb01a145bb07eeb167d90a1846061b3","https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI","https://go.dev/issue/46313"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/321929","description":"ReverseProxy can be made to forward certain hop-by-hop headers, including Connection. If the target of the ReverseProxy is itself a reverse proxy, this lets an attacker drop arbitrary headers, including those set by the ReverseProxy.Director."},"relatedVulnerabilities":[{"id":"CVE-2021-33197","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33197","cwe":"CWE-862","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33197","date":"2026-10-08","epss":0.0226,"percentile":0.82448}],"urls":["https://groups.google.com/g/golang-announce","https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI","https://security.gentoo.org/glsa/202208-02"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33197","description":"In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers."}]},{"artifact":{"id":"261b94c10c1e7dbf","cpes":["cpe:2.3:a:golang:text:v0.3.2:*:*:*:*:*:*:*"],"name":"golang.org/x/text","purl":"pkg:golang/golang.org/x/text@v0.3.2","type":"go-module","version":"v0.3.2","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssl","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssl","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.3.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5rcv-m4m3-hfh7","versionConstraint":"<0.3.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/text","version":"v0.3.2"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-5rcv-m4m3-hfh7","fix":{"state":"fixed","versions":["0.3.3"],"available":[{"date":"2023-08-31","kind":"first-observed","version":"0.3.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-14040","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14040","date":"2026-10-08","epss":0.0184,"percentile":0.78337}],"risk":1.15,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-14040","https://github.com/golang/go/issues/39491","https://github.com/golang/text/commit/23ae387dee1f90d29a23c0e87ee0b46038fbed0e","https://go-review.googlesource.com/c/text/+/238238","https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0","https://groups.google.com/g/golang-announce/c/bXVeAmGOqz0","https://go.dev/cl/238238","https://go.dev/issue/39491","https://go.googlesource.com/text/+/23ae387dee1f90d29a23c0e87ee0b46038fbed0e","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O"],"severity":"Medium","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5rcv-m4m3-hfh7","description":"golang.org/x/text Infinite loop"},"relatedVulnerabilities":[{"id":"CVE-2020-14040","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-14040","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14040","date":"2026-10-08","epss":0.0184,"percentile":0.78337}],"urls":["https://groups.google.com/forum/#%21topic/golang-announce/bXVeAmGOqz0","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-14040","description":"The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String."}]},{"artifact":{"id":"5bddac6b42b303b3","cpes":["cpe:2.3:a:golang:text:v0.3.2:*:*:*:*:*:*:*"],"name":"golang.org/x/text","purl":"pkg:golang/golang.org/x/text@v0.3.2","type":"go-module","version":"v0.3.2","language":"go","licenses":[],"metadata":{"mainModule":"github.com/cloudflare/cfssl","architecture":"x86_64","goCompiledVersion":"go1.13.4"},"locations":[{"path":"/usr/sbin/cfssljson","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/usr/sbin/cfssljson","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.3.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5rcv-m4m3-hfh7","versionConstraint":"<0.3.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/text","version":"v0.3.2"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-5rcv-m4m3-hfh7","fix":{"state":"fixed","versions":["0.3.3"],"available":[{"date":"2023-08-31","kind":"first-observed","version":"0.3.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-14040","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14040","date":"2026-10-08","epss":0.0184,"percentile":0.78337}],"risk":1.15,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-14040","https://github.com/golang/go/issues/39491","https://github.com/golang/text/commit/23ae387dee1f90d29a23c0e87ee0b46038fbed0e","https://go-review.googlesource.com/c/text/+/238238","https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0","https://groups.google.com/g/golang-announce/c/bXVeAmGOqz0","https://go.dev/cl/238238","https://go.dev/issue/39491","https://go.googlesource.com/text/+/23ae387dee1f90d29a23c0e87ee0b46038fbed0e","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O"],"severity":"Medium","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5rcv-m4m3-hfh7","description":"golang.org/x/text Infinite loop"},"relatedVulnerabilities":[{"id":"CVE-2020-14040","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-14040","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14040","date":"2026-10-08","epss":0.0184,"percentile":0.78337}],"urls":["https://groups.google.com/forum/#%21topic/golang-announce/bXVeAmGOqz0","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TACQFZDPA7AUR6TRZBCX2RGRFSDYLI7O/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-14040","description":"The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String."}]},{"artifact":{"id":"940633232797803a","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.27.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.27.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.27.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.27.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.27.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.27.2-3:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.27.2-3?arch=amd64&distro=debian-10.1&upstream=sqlite3","type":"deb","version":"3.27.2-3","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4a858b6f6e3b748526671b0a2a9d803f8b7e0144a9e5ca2c9fa32d0d15739fe5","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:d3d371382e9b21a43c7f1809c6d47496c2ab66562889695795cb8a5276d133f7","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-35737","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"10.1"},"package":{"name":"sqlite3","version":"3.27.2-3"},"namespace":"debian:distro:debian:10"}}],"vulnerability":{"id":"CVE-2022-35737","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-35737","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-35737","date":"2026-10-08","epss":0.22774,"percentile":0.97683}],"risk":1.1387,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:10","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-35737","description":"SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API."},"relatedVulnerabilities":[{"id":"CVE-2022-35737","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-35737","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-35737","date":"2026-10-08","epss":0.22774,"percentile":0.97683}],"urls":["https://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api/","https://kb.cert.org/vuls/id/720344","https://security.gentoo.org/glsa/202210-40","https://security.netapp.com/advisory/ntap-20220915-0009/","https://sqlite.org/releaselog/3_39_2.html","https://www.sqlite.org/cves.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-35737","description":"SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API."}]}],"grade":"F","score":"0.00","as_of":"2026-10-09T19:17:57.873Z","grype_db_version":"2026-10-09T06:32:32.000Z"}