@mitre/hdf-fixtures 3.6.0 → 3.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (11) hide show
  1. package/LICENSE.md +55 -0
  2. package/README.md +4 -3
  3. package/dist/index.d.ts +11 -8
  4. package/dist/index.d.ts.map +1 -1
  5. package/dist/index.js +4 -2
  6. package/dist/index.js.map +1 -1
  7. package/package.json +11 -11
  8. package/results/duplicate-baselines.json +4673 -0
  9. package/results/merge-grype.json +1888 -0
  10. package/results/merge-zap.json +2932 -0
  11. package/inspec/three-layer-rhel7.json +0 -47551
package/results/merge-grype.json ADDED
@@ -0,0 +1,1888 @@
1
+ {
2
+ "baselines": [
3
+ {
4
+ "requirements": [
5
+ {
6
+ "affectedPackages": [
7
+ {
8
+ "cpe": "cpe:2.3:a:binutils:binutils:2.38-4ubuntu2.6:*:*:*:*:*:*:*",
9
+ "ecosystem": "deb",
10
+ "name": "binutils",
11
+ "purl": "pkg:deb/ubuntu/binutils@2.38-4ubuntu2.6?arch=amd64\u0026distro=ubuntu-22.04",
12
+ "version": "2.38-4ubuntu2.6"
13
+ }
14
+ ],
15
+ "descriptions": [
16
+ {
17
+ "data": "libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.",
18
+ "label": "default"
19
+ },
20
+ {
21
+ "data": "vulnerability is not-fixed",
22
+ "label": "fix"
23
+ },
24
+ {
25
+ "data": "{\"related\":[{\"id\":\"CVE-2022-27943\",\"dataSource\":\"https://nvd.nist.gov/vuln/detail/CVE-2022-27943\",\"cvss\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"2.0\",\"vector\":\"AV:N/AC:M/Au:N/C:N/I:N/A:P\",\"metrics\":{\"baseScore\":4.3,\"exploitabilityScore\":8.6,\"impactScore\":2.9},\"vendorMetadata\":{}},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"3.1\",\"vector\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\",\"metrics\":{\"baseScore\":5.5,\"exploitabilityScore\":1.8,\"impactScore\":3.6},\"vendorMetadata\":{}}]}]}",
26
+ "label": "check"
27
+ }
28
+ ],
29
+ "results": [
30
+ {
31
+ "codeDesc": "Package: binutils@2.38-4ubuntu2.6 | Type: deb | Location: /usr/share/doc/binutils/copyright | Match Type: exact-direct-match",
32
+ "message": "Severity: Low vulnerability is not-fixed",
33
+ "startTime": "2024-08-29T17:31:15.474Z",
34
+ "status": "failed"
35
+ }
36
+ ],
37
+ "id": "Grype/CVE-2022-27943",
38
+ "impact": 0.3,
39
+ "tags": {
40
+ "cci": [
41
+ "CCI-001643",
42
+ "CCI-003173"
43
+ ],
44
+ "nist": [
45
+ "SA-11",
46
+ "RA-5"
47
+ ]
48
+ },
49
+ "code": "{\n \"vulnerability\": {\n \"id\": \"CVE-2022-27943\",\n \"dataSource\": \"https://ubuntu.com/security/CVE-2022-27943\",\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"severity\": \"Low\",\n \"urls\": [\n \"https://ubuntu.com/security/CVE-2022-27943\"\n ],\n \"cvss\": [],\n \"fix\": {\n \"versions\": [],\n \"state\": \"not-fixed\"\n },\n \"advisories\": []\n },\n \"relatedVulnerabilities\": [\n {\n \"id\": \"CVE-2022-27943\",\n \"dataSource\": \"https://nvd.nist.gov/vuln/detail/CVE-2022-27943\",\n \"namespace\": \"nvd:cpe\",\n \"severity\": \"Medium\",\n \"urls\": [\n \"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039\",\n \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/\",\n \"https://sourceware.org/bugzilla/show_bug.cgi?id=28995\"\n ],\n \"description\": \"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.\",\n \"cvss\": [\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"2.0\",\n \"vector\": \"AV:N/AC:M/Au:N/C:N/I:N/A:P\",\n \"metrics\": {\n \"baseScore\": 4.3,\n \"exploitabilityScore\": 8.6,\n \"impactScore\": 2.9\n },\n \"vendorMetadata\": {}\n },\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"3.1\",\n \"vector\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\",\n \"metrics\": {\n \"baseScore\": 5.5,\n \"exploitabilityScore\": 1.8,\n \"impactScore\": 3.6\n },\n \"vendorMetadata\": {}\n }\n ]\n }\n ],\n \"matchDetails\": [\n {\n \"type\": \"exact-direct-match\",\n \"matcher\": \"dpkg-matcher\",\n \"searchedBy\": {\n \"distro\": {\n \"type\": \"ubuntu\",\n \"version\": \"22.04\"\n },\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"package\": {\n \"name\": \"binutils\",\n \"version\": \"2.38-4ubuntu2.6\"\n }\n },\n \"found\": {\n \"versionConstraint\": \"none (deb)\",\n \"vulnerabilityID\": \"CVE-2022-27943\"\n }\n }\n ],\n \"artifact\": {\n \"id\": \"2baa616d4a39d455\",\n \"name\": \"binutils\",\n \"version\": \"2.38-4ubuntu2.6\",\n \"type\": \"deb\",\n \"locations\": [\n {\n \"path\": \"/usr/share/doc/binutils/copyright\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/info/binutils.md5sums\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/status\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n }\n ],\n \"language\": \"\",\n \"licenses\": [\n \"GFDL\",\n \"GPL\",\n \"LGPL\"\n ],\n \"cpes\": [\n \"cpe:2.3:a:binutils:binutils:2.38-4ubuntu2.6:*:*:*:*:*:*:*\"\n ],\n \"purl\": \"pkg:deb/ubuntu/binutils@2.38-4ubuntu2.6?arch=amd64\u0026distro=ubuntu-22.04\",\n \"upstreams\": []\n }\n}",
50
+ "refs": [
51
+ {
52
+ "url": "https://ubuntu.com/security/CVE-2022-27943"
53
+ },
54
+ {
55
+ "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039"
56
+ },
57
+ {
58
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/"
59
+ },
60
+ {
61
+ "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995"
62
+ }
63
+ ],
64
+ "title": "Grype found a vulnerability to CVE-2022-27943 in tensorflow/tensorflow:latest",
65
+ "verificationMethod": "automated"
66
+ },
67
+ {
68
+ "affectedPackages": [
69
+ {
70
+ "cpe": "cpe:2.3:a:binutils:binutils:2.38-4ubuntu2.6:*:*:*:*:*:*:*",
71
+ "ecosystem": "deb",
72
+ "name": "binutils",
73
+ "purl": "pkg:deb/ubuntu/binutils@2.38-4ubuntu2.6?arch=amd64\u0026distro=ubuntu-22.04",
74
+ "version": "2.38-4ubuntu2.6"
75
+ }
76
+ ],
77
+ "descriptions": [
78
+ {
79
+ "data": "GNU binutils gold gold v1.11-v1.16 (GNU binutils v2.21-v2.31.1) is affected by: Improper Input Validation, Signed/Unsigned Comparison, Out-of-bounds Read. The impact is: Denial of service. The component is: gold/fileread.cc:497, elfcpp/elfcpp_file.h:644. The attack vector is: An ELF file with an invalid e_shoff header field must be opened.",
80
+ "label": "default"
81
+ },
82
+ {
83
+ "data": "vulnerability is not-fixed",
84
+ "label": "fix"
85
+ },
86
+ {
87
+ "data": "{\"related\":[{\"id\":\"CVE-2019-1010204\",\"dataSource\":\"https://nvd.nist.gov/vuln/detail/CVE-2019-1010204\",\"cvss\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"2.0\",\"vector\":\"AV:N/AC:M/Au:N/C:N/I:N/A:P\",\"metrics\":{\"baseScore\":4.3,\"exploitabilityScore\":8.6,\"impactScore\":2.9},\"vendorMetadata\":{}},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"3.1\",\"vector\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\",\"metrics\":{\"baseScore\":5.5,\"exploitabilityScore\":1.8,\"impactScore\":3.6},\"vendorMetadata\":{}}]}]}",
88
+ "label": "check"
89
+ }
90
+ ],
91
+ "results": [
92
+ {
93
+ "codeDesc": "Package: binutils@2.38-4ubuntu2.6 | Type: deb | Location: /usr/share/doc/binutils/copyright | Match Type: exact-direct-match",
94
+ "message": "Severity: Low vulnerability is not-fixed",
95
+ "startTime": "2024-08-29T17:31:15.474Z",
96
+ "status": "failed"
97
+ }
98
+ ],
99
+ "id": "Grype/CVE-2019-1010204",
100
+ "impact": 0.3,
101
+ "tags": {
102
+ "cci": [
103
+ "CCI-001643",
104
+ "CCI-003173"
105
+ ],
106
+ "nist": [
107
+ "SA-11",
108
+ "RA-5"
109
+ ]
110
+ },
111
+ "code": "{\n \"vulnerability\": {\n \"id\": \"CVE-2019-1010204\",\n \"dataSource\": \"https://ubuntu.com/security/CVE-2019-1010204\",\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"severity\": \"Low\",\n \"urls\": [\n \"https://ubuntu.com/security/CVE-2019-1010204\"\n ],\n \"cvss\": [],\n \"fix\": {\n \"versions\": [],\n \"state\": \"not-fixed\"\n },\n \"advisories\": []\n },\n \"relatedVulnerabilities\": [\n {\n \"id\": \"CVE-2019-1010204\",\n \"dataSource\": \"https://nvd.nist.gov/vuln/detail/CVE-2019-1010204\",\n \"namespace\": \"nvd:cpe\",\n \"severity\": \"Medium\",\n \"urls\": [\n \"https://security.netapp.com/advisory/ntap-20190822-0001/\",\n \"https://sourceware.org/bugzilla/show_bug.cgi?id=23765\",\n \"https://support.f5.com/csp/article/K05032915?utm_source=f5support\u0026amp%3Butm_medium=RSS\"\n ],\n \"description\": \"GNU binutils gold gold v1.11-v1.16 (GNU binutils v2.21-v2.31.1) is affected by: Improper Input Validation, Signed/Unsigned Comparison, Out-of-bounds Read. The impact is: Denial of service. The component is: gold/fileread.cc:497, elfcpp/elfcpp_file.h:644. The attack vector is: An ELF file with an invalid e_shoff header field must be opened.\",\n \"cvss\": [\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"2.0\",\n \"vector\": \"AV:N/AC:M/Au:N/C:N/I:N/A:P\",\n \"metrics\": {\n \"baseScore\": 4.3,\n \"exploitabilityScore\": 8.6,\n \"impactScore\": 2.9\n },\n \"vendorMetadata\": {}\n },\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"3.1\",\n \"vector\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\",\n \"metrics\": {\n \"baseScore\": 5.5,\n \"exploitabilityScore\": 1.8,\n \"impactScore\": 3.6\n },\n \"vendorMetadata\": {}\n }\n ]\n }\n ],\n \"matchDetails\": [\n {\n \"type\": \"exact-direct-match\",\n \"matcher\": \"dpkg-matcher\",\n \"searchedBy\": {\n \"distro\": {\n \"type\": \"ubuntu\",\n \"version\": \"22.04\"\n },\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"package\": {\n \"name\": \"binutils\",\n \"version\": \"2.38-4ubuntu2.6\"\n }\n },\n \"found\": {\n \"versionConstraint\": \"none (deb)\",\n \"vulnerabilityID\": \"CVE-2019-1010204\"\n }\n }\n ],\n \"artifact\": {\n \"id\": \"2baa616d4a39d455\",\n \"name\": \"binutils\",\n \"version\": \"2.38-4ubuntu2.6\",\n \"type\": \"deb\",\n \"locations\": [\n {\n \"path\": \"/usr/share/doc/binutils/copyright\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/info/binutils.md5sums\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/status\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n }\n ],\n \"language\": \"\",\n \"licenses\": [\n \"GFDL\",\n \"GPL\",\n \"LGPL\"\n ],\n \"cpes\": [\n \"cpe:2.3:a:binutils:binutils:2.38-4ubuntu2.6:*:*:*:*:*:*:*\"\n ],\n \"purl\": \"pkg:deb/ubuntu/binutils@2.38-4ubuntu2.6?arch=amd64\u0026distro=ubuntu-22.04\",\n \"upstreams\": []\n }\n}",
112
+ "refs": [
113
+ {
114
+ "url": "https://ubuntu.com/security/CVE-2019-1010204"
115
+ },
116
+ {
117
+ "url": "https://security.netapp.com/advisory/ntap-20190822-0001/"
118
+ },
119
+ {
120
+ "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=23765"
121
+ },
122
+ {
123
+ "url": "https://support.f5.com/csp/article/K05032915?utm_source=f5support\u0026amp%3Butm_medium=RSS"
124
+ }
125
+ ],
126
+ "title": "Grype found a vulnerability to CVE-2019-1010204 in tensorflow/tensorflow:latest",
127
+ "verificationMethod": "automated"
128
+ },
129
+ {
130
+ "affectedPackages": [
131
+ {
132
+ "cpe": "cpe:2.3:a:binutils:binutils:2.38-4ubuntu2.6:*:*:*:*:*:*:*",
133
+ "ecosystem": "deb",
134
+ "name": "binutils",
135
+ "purl": "pkg:deb/ubuntu/binutils@2.38-4ubuntu2.6?arch=amd64\u0026distro=ubuntu-22.04",
136
+ "version": "2.38-4ubuntu2.6"
137
+ }
138
+ ],
139
+ "descriptions": [
140
+ {
141
+ "data": "GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.",
142
+ "label": "default"
143
+ },
144
+ {
145
+ "data": "vulnerability is not-fixed",
146
+ "label": "fix"
147
+ },
148
+ {
149
+ "data": "{\"related\":[{\"id\":\"CVE-2022-48064\",\"dataSource\":\"https://nvd.nist.gov/vuln/detail/CVE-2022-48064\",\"cvss\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"3.1\",\"vector\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\",\"metrics\":{\"baseScore\":5.5,\"exploitabilityScore\":1.8,\"impactScore\":3.6},\"vendorMetadata\":{}}]}]}",
150
+ "label": "check"
151
+ }
152
+ ],
153
+ "results": [
154
+ {
155
+ "codeDesc": "Package: binutils@2.38-4ubuntu2.6 | Type: deb | Location: /usr/share/doc/binutils/copyright | Match Type: exact-direct-match",
156
+ "message": "Manual review required because a Grype rating severity is set to `negligible` or `unknown`. Severity: Negligible vulnerability is not-fixed",
157
+ "startTime": "2024-08-29T17:31:15.474Z",
158
+ "status": "failed"
159
+ }
160
+ ],
161
+ "id": "Grype/CVE-2022-48064",
162
+ "impact": 0,
163
+ "tags": {
164
+ "cci": [
165
+ "CCI-001643",
166
+ "CCI-003173"
167
+ ],
168
+ "nist": [
169
+ "SA-11",
170
+ "RA-5"
171
+ ]
172
+ },
173
+ "code": "{\n \"vulnerability\": {\n \"id\": \"CVE-2022-48064\",\n \"dataSource\": \"https://ubuntu.com/security/CVE-2022-48064\",\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"severity\": \"Negligible\",\n \"urls\": [\n \"https://ubuntu.com/security/CVE-2022-48064\"\n ],\n \"cvss\": [],\n \"fix\": {\n \"versions\": [],\n \"state\": \"not-fixed\"\n },\n \"advisories\": []\n },\n \"relatedVulnerabilities\": [\n {\n \"id\": \"CVE-2022-48064\",\n \"dataSource\": \"https://nvd.nist.gov/vuln/detail/CVE-2022-48064\",\n \"namespace\": \"nvd:cpe\",\n \"severity\": \"Medium\",\n \"urls\": [\n \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3XKYUAIORNQ32IZUOZFURECZKEXOHX7Z/\",\n \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KGSKF4GH7425S6XFDQMWTJGD5U47BAZN/\",\n \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NSUNHSOWWLLNGHRM5TUBNCJHEYHPDX2M/\",\n \"https://security.netapp.com/advisory/ntap-20231006-0008/\",\n \"https://sourceware.org/bugzilla/show_bug.cgi?id=29922\",\n \"https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=8f2c64de86bc3d7556121fe296dd679000283931\"\n ],\n \"description\": \"GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.\",\n \"cvss\": [\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"3.1\",\n \"vector\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\",\n \"metrics\": {\n \"baseScore\": 5.5,\n \"exploitabilityScore\": 1.8,\n \"impactScore\": 3.6\n },\n \"vendorMetadata\": {}\n }\n ]\n }\n ],\n \"matchDetails\": [\n {\n \"type\": \"exact-direct-match\",\n \"matcher\": \"dpkg-matcher\",\n \"searchedBy\": {\n \"distro\": {\n \"type\": \"ubuntu\",\n \"version\": \"22.04\"\n },\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"package\": {\n \"name\": \"binutils\",\n \"version\": \"2.38-4ubuntu2.6\"\n }\n },\n \"found\": {\n \"versionConstraint\": \"none (deb)\",\n \"vulnerabilityID\": \"CVE-2022-48064\"\n }\n }\n ],\n \"artifact\": {\n \"id\": \"2baa616d4a39d455\",\n \"name\": \"binutils\",\n \"version\": \"2.38-4ubuntu2.6\",\n \"type\": \"deb\",\n \"locations\": [\n {\n \"path\": \"/usr/share/doc/binutils/copyright\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/info/binutils.md5sums\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/status\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n }\n ],\n \"language\": \"\",\n \"licenses\": [\n \"GFDL\",\n \"GPL\",\n \"LGPL\"\n ],\n \"cpes\": [\n \"cpe:2.3:a:binutils:binutils:2.38-4ubuntu2.6:*:*:*:*:*:*:*\"\n ],\n \"purl\": \"pkg:deb/ubuntu/binutils@2.38-4ubuntu2.6?arch=amd64\u0026distro=ubuntu-22.04\",\n \"upstreams\": []\n }\n}",
174
+ "refs": [
175
+ {
176
+ "url": "https://ubuntu.com/security/CVE-2022-48064"
177
+ },
178
+ {
179
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3XKYUAIORNQ32IZUOZFURECZKEXOHX7Z/"
180
+ },
181
+ {
182
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KGSKF4GH7425S6XFDQMWTJGD5U47BAZN/"
183
+ },
184
+ {
185
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NSUNHSOWWLLNGHRM5TUBNCJHEYHPDX2M/"
186
+ },
187
+ {
188
+ "url": "https://security.netapp.com/advisory/ntap-20231006-0008/"
189
+ },
190
+ {
191
+ "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=29922"
192
+ },
193
+ {
194
+ "url": "https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=8f2c64de86bc3d7556121fe296dd679000283931"
195
+ }
196
+ ],
197
+ "title": "Grype found a vulnerability to CVE-2022-48064 in tensorflow/tensorflow:latest",
198
+ "verificationMethod": "automated"
199
+ },
200
+ {
201
+ "affectedPackages": [
202
+ {
203
+ "cpe": "cpe:2.3:a:binutils:binutils:2.38-4ubuntu2.6:*:*:*:*:*:*:*",
204
+ "ecosystem": "deb",
205
+ "name": "binutils",
206
+ "purl": "pkg:deb/ubuntu/binutils@2.38-4ubuntu2.6?arch=amd64\u0026distro=ubuntu-22.04",
207
+ "version": "2.38-4ubuntu2.6"
208
+ }
209
+ ],
210
+ "descriptions": [
211
+ {
212
+ "data": "The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated by cxxfilt, a related issue to CVE-2018-12698.",
213
+ "label": "default"
214
+ },
215
+ {
216
+ "data": "vulnerability is not-fixed",
217
+ "label": "fix"
218
+ },
219
+ {
220
+ "data": "{\"related\":[{\"id\":\"CVE-2018-20657\",\"dataSource\":\"https://nvd.nist.gov/vuln/detail/CVE-2018-20657\",\"cvss\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"2.0\",\"vector\":\"AV:N/AC:L/Au:N/C:N/I:N/A:P\",\"metrics\":{\"baseScore\":5,\"exploitabilityScore\":10,\"impactScore\":2.9},\"vendorMetadata\":{}},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"3.0\",\"vector\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"metrics\":{\"baseScore\":7.5,\"exploitabilityScore\":3.9,\"impactScore\":3.6},\"vendorMetadata\":{}}]}]}",
221
+ "label": "check"
222
+ }
223
+ ],
224
+ "results": [
225
+ {
226
+ "codeDesc": "Package: binutils@2.38-4ubuntu2.6 | Type: deb | Location: /usr/share/doc/binutils/copyright | Match Type: exact-direct-match",
227
+ "message": "Manual review required because a Grype rating severity is set to `negligible` or `unknown`. Severity: Negligible vulnerability is not-fixed",
228
+ "startTime": "2024-08-29T17:31:15.474Z",
229
+ "status": "failed"
230
+ }
231
+ ],
232
+ "id": "Grype/CVE-2018-20657",
233
+ "impact": 0,
234
+ "tags": {
235
+ "cci": [
236
+ "CCI-001643",
237
+ "CCI-003173"
238
+ ],
239
+ "nist": [
240
+ "SA-11",
241
+ "RA-5"
242
+ ]
243
+ },
244
+ "code": "{\n \"vulnerability\": {\n \"id\": \"CVE-2018-20657\",\n \"dataSource\": \"https://ubuntu.com/security/CVE-2018-20657\",\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"severity\": \"Negligible\",\n \"urls\": [\n \"https://ubuntu.com/security/CVE-2018-20657\"\n ],\n \"cvss\": [],\n \"fix\": {\n \"versions\": [],\n \"state\": \"not-fixed\"\n },\n \"advisories\": []\n },\n \"relatedVulnerabilities\": [\n {\n \"id\": \"CVE-2018-20657\",\n \"dataSource\": \"https://nvd.nist.gov/vuln/detail/CVE-2018-20657\",\n \"namespace\": \"nvd:cpe\",\n \"severity\": \"High\",\n \"urls\": [\n \"http://www.securityfocus.com/bid/106444\",\n \"https://access.redhat.com/errata/RHSA-2019:3352\",\n \"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88539\",\n \"https://support.f5.com/csp/article/K62602089\"\n ],\n \"description\": \"The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated by cxxfilt, a related issue to CVE-2018-12698.\",\n \"cvss\": [\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"2.0\",\n \"vector\": \"AV:N/AC:L/Au:N/C:N/I:N/A:P\",\n \"metrics\": {\n \"baseScore\": 5,\n \"exploitabilityScore\": 10,\n \"impactScore\": 2.9\n },\n \"vendorMetadata\": {}\n },\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"3.0\",\n \"vector\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\n \"metrics\": {\n \"baseScore\": 7.5,\n \"exploitabilityScore\": 3.9,\n \"impactScore\": 3.6\n },\n \"vendorMetadata\": {}\n }\n ]\n }\n ],\n \"matchDetails\": [\n {\n \"type\": \"exact-direct-match\",\n \"matcher\": \"dpkg-matcher\",\n \"searchedBy\": {\n \"distro\": {\n \"type\": \"ubuntu\",\n \"version\": \"22.04\"\n },\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"package\": {\n \"name\": \"binutils\",\n \"version\": \"2.38-4ubuntu2.6\"\n }\n },\n \"found\": {\n \"versionConstraint\": \"none (deb)\",\n \"vulnerabilityID\": \"CVE-2018-20657\"\n }\n }\n ],\n \"artifact\": {\n \"id\": \"2baa616d4a39d455\",\n \"name\": \"binutils\",\n \"version\": \"2.38-4ubuntu2.6\",\n \"type\": \"deb\",\n \"locations\": [\n {\n \"path\": \"/usr/share/doc/binutils/copyright\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/info/binutils.md5sums\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/status\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n }\n ],\n \"language\": \"\",\n \"licenses\": [\n \"GFDL\",\n \"GPL\",\n \"LGPL\"\n ],\n \"cpes\": [\n \"cpe:2.3:a:binutils:binutils:2.38-4ubuntu2.6:*:*:*:*:*:*:*\"\n ],\n \"purl\": \"pkg:deb/ubuntu/binutils@2.38-4ubuntu2.6?arch=amd64\u0026distro=ubuntu-22.04\",\n \"upstreams\": []\n }\n}",
245
+ "refs": [
246
+ {
247
+ "url": "https://ubuntu.com/security/CVE-2018-20657"
248
+ },
249
+ {
250
+ "url": "http://www.securityfocus.com/bid/106444"
251
+ },
252
+ {
253
+ "url": "https://access.redhat.com/errata/RHSA-2019:3352"
254
+ },
255
+ {
256
+ "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88539"
257
+ },
258
+ {
259
+ "url": "https://support.f5.com/csp/article/K62602089"
260
+ }
261
+ ],
262
+ "title": "Grype found a vulnerability to CVE-2018-20657 in tensorflow/tensorflow:latest",
263
+ "verificationMethod": "automated"
264
+ },
265
+ {
266
+ "affectedPackages": [
267
+ {
268
+ "cpe": "cpe:2.3:a:cpp:cpp:4:11.2.0-1ubuntu1:*:*:*:*:*:*:*",
269
+ "ecosystem": "deb",
270
+ "name": "cpp",
271
+ "purl": "pkg:deb/ubuntu/cpp@4:11.2.0-1ubuntu1?arch=amd64\u0026upstream=gcc-defaults%401.193ubuntu1\u0026distro=ubuntu-22.04",
272
+ "version": "4:11.2.0-1ubuntu1"
273
+ }
274
+ ],
275
+ "descriptions": [
276
+ {
277
+ "data": "\n\n**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.\n\n\n\n\n\n",
278
+ "label": "default"
279
+ },
280
+ {
281
+ "data": "vulnerability is not-fixed",
282
+ "label": "fix"
283
+ },
284
+ {
285
+ "data": "{\"related\":[{\"id\":\"CVE-2023-4039\",\"dataSource\":\"https://nvd.nist.gov/vuln/detail/CVE-2023-4039\",\"cvss\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"3.1\",\"vector\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"metrics\":{\"baseScore\":4.8,\"exploitabilityScore\":2.2,\"impactScore\":2.5},\"vendorMetadata\":{}},{\"source\":\"arm-security@arm.com\",\"type\":\"Secondary\",\"version\":\"3.1\",\"vector\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"metrics\":{\"baseScore\":4.8,\"exploitabilityScore\":2.2,\"impactScore\":2.5},\"vendorMetadata\":{}}]}]}",
286
+ "label": "check"
287
+ }
288
+ ],
289
+ "results": [
290
+ {
291
+ "codeDesc": "Package: cpp@4:11.2.0-1ubuntu1 | Type: deb | Location: /usr/share/doc/cpp/copyright | Match Type: exact-indirect-match",
292
+ "message": "Severity: Medium vulnerability is not-fixed",
293
+ "startTime": "2024-08-29T17:31:15.474Z",
294
+ "status": "failed"
295
+ }
296
+ ],
297
+ "id": "Grype/CVE-2023-4039",
298
+ "impact": 0.5,
299
+ "tags": {
300
+ "cci": [
301
+ "CCI-001643",
302
+ "CCI-003173"
303
+ ],
304
+ "nist": [
305
+ "SA-11",
306
+ "RA-5"
307
+ ]
308
+ },
309
+ "code": "{\n \"vulnerability\": {\n \"id\": \"CVE-2023-4039\",\n \"dataSource\": \"https://ubuntu.com/security/CVE-2023-4039\",\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"severity\": \"Medium\",\n \"urls\": [\n \"https://ubuntu.com/security/CVE-2023-4039\"\n ],\n \"cvss\": [],\n \"fix\": {\n \"versions\": [],\n \"state\": \"not-fixed\"\n },\n \"advisories\": []\n },\n \"relatedVulnerabilities\": [\n {\n \"id\": \"CVE-2023-4039\",\n \"dataSource\": \"https://nvd.nist.gov/vuln/detail/CVE-2023-4039\",\n \"namespace\": \"nvd:cpe\",\n \"severity\": \"Medium\",\n \"urls\": [\n \"https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64\",\n \"https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf\"\n ],\n \"description\": \"\\n\\n**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains \\nthat target AArch64 allows an attacker to exploit an existing buffer \\noverflow in dynamically-sized local variables in your application \\nwithout this being detected. This stack-protector failure only applies \\nto C99-style dynamically-sized local variables or those created using \\nalloca(). The stack-protector operates as intended for statically-sized \\nlocal variables.\\n\\nThe default behavior when the stack-protector \\ndetects an overflow is to terminate your application, resulting in \\ncontrolled loss of availability. An attacker who can exploit a buffer \\noverflow without triggering the stack-protector might be able to change \\nprogram flow control to cause an uncontrolled loss of availability or to\\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.\\n\\n\\n\\n\\n\\n\",\n \"cvss\": [\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"3.1\",\n \"vector\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\",\n \"metrics\": {\n \"baseScore\": 4.8,\n \"exploitabilityScore\": 2.2,\n \"impactScore\": 2.5\n },\n \"vendorMetadata\": {}\n },\n {\n \"source\": \"arm-security@arm.com\",\n \"type\": \"Secondary\",\n \"version\": \"3.1\",\n \"vector\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\",\n \"metrics\": {\n \"baseScore\": 4.8,\n \"exploitabilityScore\": 2.2,\n \"impactScore\": 2.5\n },\n \"vendorMetadata\": {}\n }\n ]\n }\n ],\n \"matchDetails\": [\n {\n \"type\": \"exact-indirect-match\",\n \"matcher\": \"dpkg-matcher\",\n \"searchedBy\": {\n \"distro\": {\n \"type\": \"ubuntu\",\n \"version\": \"22.04\"\n },\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"package\": {\n \"name\": \"gcc-defaults\",\n \"version\": \"1.193ubuntu1\"\n }\n },\n \"found\": {\n \"versionConstraint\": \"none (deb)\",\n \"vulnerabilityID\": \"CVE-2023-4039\"\n }\n }\n ],\n \"artifact\": {\n \"id\": \"c933f77f391da70f\",\n \"name\": \"cpp\",\n \"version\": \"4:11.2.0-1ubuntu1\",\n \"type\": \"deb\",\n \"locations\": [\n {\n \"path\": \"/usr/share/doc/cpp/copyright\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/info/cpp.md5sums\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/status\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n }\n ],\n \"language\": \"\",\n \"licenses\": [\n \"GPL-2\"\n ],\n \"cpes\": [\n \"cpe:2.3:a:cpp:cpp:4:11.2.0-1ubuntu1:*:*:*:*:*:*:*\"\n ],\n \"purl\": \"pkg:deb/ubuntu/cpp@4:11.2.0-1ubuntu1?arch=amd64\u0026upstream=gcc-defaults%401.193ubuntu1\u0026distro=ubuntu-22.04\",\n \"upstreams\": [\n {\n \"name\": \"gcc-defaults\",\n \"version\": \"1.193ubuntu1\"\n }\n ]\n }\n}",
310
+ "refs": [
311
+ {
312
+ "url": "https://ubuntu.com/security/CVE-2023-4039"
313
+ },
314
+ {
315
+ "url": "https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64"
316
+ },
317
+ {
318
+ "url": "https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf"
319
+ }
320
+ ],
321
+ "title": "Grype found a vulnerability to CVE-2023-4039 in tensorflow/tensorflow:latest",
322
+ "verificationMethod": "automated"
323
+ },
324
+ {
325
+ "affectedPackages": [
326
+ {
327
+ "cpe": "cpe:2.3:a:cpp:cpp:4:11.2.0-1ubuntu1:*:*:*:*:*:*:*",
328
+ "ecosystem": "deb",
329
+ "name": "cpp",
330
+ "purl": "pkg:deb/ubuntu/cpp@4:11.2.0-1ubuntu1?arch=amd64\u0026upstream=gcc-defaults%401.193ubuntu1\u0026distro=ubuntu-22.04",
331
+ "version": "4:11.2.0-1ubuntu1"
332
+ }
333
+ ],
334
+ "descriptions": [
335
+ {
336
+ "data": "Arm Armv8-A core implementations utilizing speculative execution past unconditional changes in control flow may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka \"straight-line speculation.\"",
337
+ "label": "default"
338
+ },
339
+ {
340
+ "data": "vulnerability is not-fixed",
341
+ "label": "fix"
342
+ },
343
+ {
344
+ "data": "{\"related\":[{\"id\":\"CVE-2020-13844\",\"dataSource\":\"https://nvd.nist.gov/vuln/detail/CVE-2020-13844\",\"cvss\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"2.0\",\"vector\":\"AV:L/AC:L/Au:N/C:P/I:N/A:N\",\"metrics\":{\"baseScore\":2.1,\"exploitabilityScore\":3.9,\"impactScore\":2.9},\"vendorMetadata\":{}},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"3.1\",\"vector\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"metrics\":{\"baseScore\":5.5,\"exploitabilityScore\":1.8,\"impactScore\":3.6},\"vendorMetadata\":{}}]}]}",
345
+ "label": "check"
346
+ }
347
+ ],
348
+ "results": [
349
+ {
350
+ "codeDesc": "Package: cpp@4:11.2.0-1ubuntu1 | Type: deb | Location: /usr/share/doc/cpp/copyright | Match Type: exact-indirect-match",
351
+ "message": "Severity: Medium vulnerability is not-fixed",
352
+ "startTime": "2024-08-29T17:31:15.474Z",
353
+ "status": "failed"
354
+ }
355
+ ],
356
+ "id": "Grype/CVE-2020-13844",
357
+ "impact": 0.5,
358
+ "tags": {
359
+ "cci": [
360
+ "CCI-001643",
361
+ "CCI-003173"
362
+ ],
363
+ "nist": [
364
+ "SA-11",
365
+ "RA-5"
366
+ ]
367
+ },
368
+ "code": "{\n \"vulnerability\": {\n \"id\": \"CVE-2020-13844\",\n \"dataSource\": \"https://ubuntu.com/security/CVE-2020-13844\",\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"severity\": \"Medium\",\n \"urls\": [\n \"https://ubuntu.com/security/CVE-2020-13844\"\n ],\n \"cvss\": [],\n \"fix\": {\n \"versions\": [],\n \"state\": \"not-fixed\"\n },\n \"advisories\": []\n },\n \"relatedVulnerabilities\": [\n {\n \"id\": \"CVE-2020-13844\",\n \"dataSource\": \"https://nvd.nist.gov/vuln/detail/CVE-2020-13844\",\n \"namespace\": \"nvd:cpe\",\n \"severity\": \"Medium\",\n \"urls\": [\n \"http://lists.llvm.org/pipermail/llvm-dev/2020-June/142109.html\",\n \"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00039.html\",\n \"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00040.html\",\n \"https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability\",\n \"https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/downloads/straight-line-speculation\",\n \"https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/frequently-asked-questions\",\n \"https://gcc.gnu.org/pipermail/gcc-patches/2020-June/547520.html\"\n ],\n \"description\": \"Arm Armv8-A core implementations utilizing speculative execution past unconditional changes in control flow may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka \\\"straight-line speculation.\\\"\",\n \"cvss\": [\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"2.0\",\n \"vector\": \"AV:L/AC:L/Au:N/C:P/I:N/A:N\",\n \"metrics\": {\n \"baseScore\": 2.1,\n \"exploitabilityScore\": 3.9,\n \"impactScore\": 2.9\n },\n \"vendorMetadata\": {}\n },\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"3.1\",\n \"vector\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\n \"metrics\": {\n \"baseScore\": 5.5,\n \"exploitabilityScore\": 1.8,\n \"impactScore\": 3.6\n },\n \"vendorMetadata\": {}\n }\n ]\n }\n ],\n \"matchDetails\": [\n {\n \"type\": \"exact-indirect-match\",\n \"matcher\": \"dpkg-matcher\",\n \"searchedBy\": {\n \"distro\": {\n \"type\": \"ubuntu\",\n \"version\": \"22.04\"\n },\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"package\": {\n \"name\": \"gcc-defaults\",\n \"version\": \"1.193ubuntu1\"\n }\n },\n \"found\": {\n \"versionConstraint\": \"none (deb)\",\n \"vulnerabilityID\": \"CVE-2020-13844\"\n }\n }\n ],\n \"artifact\": {\n \"id\": \"c933f77f391da70f\",\n \"name\": \"cpp\",\n \"version\": \"4:11.2.0-1ubuntu1\",\n \"type\": \"deb\",\n \"locations\": [\n {\n \"path\": \"/usr/share/doc/cpp/copyright\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/info/cpp.md5sums\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/status\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n }\n ],\n \"language\": \"\",\n \"licenses\": [\n \"GPL-2\"\n ],\n \"cpes\": [\n \"cpe:2.3:a:cpp:cpp:4:11.2.0-1ubuntu1:*:*:*:*:*:*:*\"\n ],\n \"purl\": \"pkg:deb/ubuntu/cpp@4:11.2.0-1ubuntu1?arch=amd64\u0026upstream=gcc-defaults%401.193ubuntu1\u0026distro=ubuntu-22.04\",\n \"upstreams\": [\n {\n \"name\": \"gcc-defaults\",\n \"version\": \"1.193ubuntu1\"\n }\n ]\n }\n}",
369
+ "refs": [
370
+ {
371
+ "url": "https://ubuntu.com/security/CVE-2020-13844"
372
+ },
373
+ {
374
+ "url": "http://lists.llvm.org/pipermail/llvm-dev/2020-June/142109.html"
375
+ },
376
+ {
377
+ "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00039.html"
378
+ },
379
+ {
380
+ "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00040.html"
381
+ },
382
+ {
383
+ "url": "https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability"
384
+ },
385
+ {
386
+ "url": "https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/downloads/straight-line-speculation"
387
+ },
388
+ {
389
+ "url": "https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/frequently-asked-questions"
390
+ },
391
+ {
392
+ "url": "https://gcc.gnu.org/pipermail/gcc-patches/2020-June/547520.html"
393
+ }
394
+ ],
395
+ "title": "Grype found a vulnerability to CVE-2020-13844 in tensorflow/tensorflow:latest",
396
+ "verificationMethod": "automated"
397
+ },
398
+ {
399
+ "affectedPackages": [
400
+ {
401
+ "cpe": "cpe:2.3:a:curl:curl:7.81.0-1ubuntu1.16:*:*:*:*:*:*:*",
402
+ "ecosystem": "deb",
403
+ "fixedInVersion": "7.81.0-1ubuntu1.17",
404
+ "name": "curl",
405
+ "purl": "pkg:deb/ubuntu/curl@7.81.0-1ubuntu1.16?arch=amd64\u0026distro=ubuntu-22.04",
406
+ "version": "7.81.0-1ubuntu1.16"
407
+ }
408
+ ],
409
+ "descriptions": [
410
+ {
411
+ "data": "libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.",
412
+ "label": "default"
413
+ },
414
+ {
415
+ "data": "vulnerability is fixed for versions 7.81.0-1ubuntu1.17",
416
+ "label": "fix"
417
+ },
418
+ {
419
+ "data": "{\"related\":[{\"id\":\"CVE-2024-7264\",\"dataSource\":\"https://nvd.nist.gov/vuln/detail/CVE-2024-7264\",\"cvss\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"3.1\",\"vector\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\",\"metrics\":{\"baseScore\":6.5,\"exploitabilityScore\":2.8,\"impactScore\":3.6},\"vendorMetadata\":{}}]}]}",
420
+ "label": "check"
421
+ }
422
+ ],
423
+ "results": [
424
+ {
425
+ "codeDesc": "Package: curl@7.81.0-1ubuntu1.16 | Type: deb | Location: /usr/share/doc/curl/copyright | Match Type: exact-direct-match",
426
+ "message": "Severity: Medium vulnerability is fixed for versions 7.81.0-1ubuntu1.17",
427
+ "startTime": "2024-08-29T17:31:15.474Z",
428
+ "status": "failed"
429
+ }
430
+ ],
431
+ "id": "Grype/CVE-2024-7264",
432
+ "impact": 0.5,
433
+ "tags": {
434
+ "cci": [
435
+ "CCI-001643",
436
+ "CCI-003173"
437
+ ],
438
+ "nist": [
439
+ "SA-11",
440
+ "RA-5"
441
+ ]
442
+ },
443
+ "code": "{\n \"vulnerability\": {\n \"id\": \"CVE-2024-7264\",\n \"dataSource\": \"https://ubuntu.com/security/CVE-2024-7264\",\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"severity\": \"Medium\",\n \"urls\": [\n \"https://ubuntu.com/security/CVE-2024-7264\"\n ],\n \"cvss\": [],\n \"fix\": {\n \"versions\": [\n \"7.81.0-1ubuntu1.17\"\n ],\n \"state\": \"fixed\"\n },\n \"advisories\": []\n },\n \"relatedVulnerabilities\": [\n {\n \"id\": \"CVE-2024-7264\",\n \"dataSource\": \"https://nvd.nist.gov/vuln/detail/CVE-2024-7264\",\n \"namespace\": \"nvd:cpe\",\n \"severity\": \"Medium\",\n \"urls\": [\n \"http://www.openwall.com/lists/oss-security/2024/07/31/1\",\n \"https://curl.se/docs/CVE-2024-7264.html\",\n \"https://curl.se/docs/CVE-2024-7264.json\",\n \"https://hackerone.com/reports/2629968\"\n ],\n \"description\": \"libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\\nparser might end up using -1 for the length of the *time fraction*, leading to\\na `strlen()` getting performed on a pointer to a heap buffer area that is not\\n(purposely) null terminated.\\n\\nThis flaw most likely leads to a crash, but can also lead to heap contents\\ngetting returned to the application when\\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.\",\n \"cvss\": [\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"3.1\",\n \"vector\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\",\n \"metrics\": {\n \"baseScore\": 6.5,\n \"exploitabilityScore\": 2.8,\n \"impactScore\": 3.6\n },\n \"vendorMetadata\": {}\n }\n ]\n }\n ],\n \"matchDetails\": [\n {\n \"type\": \"exact-direct-match\",\n \"matcher\": \"dpkg-matcher\",\n \"searchedBy\": {\n \"distro\": {\n \"type\": \"ubuntu\",\n \"version\": \"22.04\"\n },\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"package\": {\n \"name\": \"curl\",\n \"version\": \"7.81.0-1ubuntu1.16\"\n }\n },\n \"found\": {\n \"versionConstraint\": \"\u003c 7.81.0-1ubuntu1.17 (deb)\",\n \"vulnerabilityID\": \"CVE-2024-7264\"\n }\n }\n ],\n \"artifact\": {\n \"id\": \"324465965a47402a\",\n \"name\": \"curl\",\n \"version\": \"7.81.0-1ubuntu1.16\",\n \"type\": \"deb\",\n \"locations\": [\n {\n \"path\": \"/usr/share/doc/curl/copyright\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/info/curl.md5sums\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/status\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n }\n ],\n \"language\": \"\",\n \"licenses\": [\n \"BSD-3-Clause\",\n \"BSD-4-Clause\",\n \"ISC\",\n \"curl\",\n \"other\",\n \"public-domain\"\n ],\n \"cpes\": [\n \"cpe:2.3:a:curl:curl:7.81.0-1ubuntu1.16:*:*:*:*:*:*:*\"\n ],\n \"purl\": \"pkg:deb/ubuntu/curl@7.81.0-1ubuntu1.16?arch=amd64\u0026distro=ubuntu-22.04\",\n \"upstreams\": []\n }\n}",
444
+ "refs": [
445
+ {
446
+ "url": "https://ubuntu.com/security/CVE-2024-7264"
447
+ },
448
+ {
449
+ "url": "http://www.openwall.com/lists/oss-security/2024/07/31/1"
450
+ },
451
+ {
452
+ "url": "https://curl.se/docs/CVE-2024-7264.html"
453
+ },
454
+ {
455
+ "url": "https://curl.se/docs/CVE-2024-7264.json"
456
+ },
457
+ {
458
+ "url": "https://hackerone.com/reports/2629968"
459
+ }
460
+ ],
461
+ "title": "Grype found a vulnerability to CVE-2024-7264 in tensorflow/tensorflow:latest",
462
+ "verificationMethod": "automated"
463
+ },
464
+ {
465
+ "affectedPackages": [
466
+ {
467
+ "cpe": "cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.81.0-1ubuntu1.16:*:*:*:*:*:*:*",
468
+ "ecosystem": "deb",
469
+ "fixedInVersion": "7.81.0-1ubuntu1.17",
470
+ "name": "libcurl3-gnutls",
471
+ "purl": "pkg:deb/ubuntu/libcurl3-gnutls@7.81.0-1ubuntu1.16?arch=amd64\u0026upstream=curl\u0026distro=ubuntu-22.04",
472
+ "version": "7.81.0-1ubuntu1.16"
473
+ }
474
+ ],
475
+ "descriptions": [
476
+ {
477
+ "data": "libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.",
478
+ "label": "default"
479
+ },
480
+ {
481
+ "data": "vulnerability is fixed for versions 7.81.0-1ubuntu1.17",
482
+ "label": "fix"
483
+ },
484
+ {
485
+ "data": "{\"related\":[{\"id\":\"CVE-2024-7264\",\"dataSource\":\"https://nvd.nist.gov/vuln/detail/CVE-2024-7264\",\"cvss\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"3.1\",\"vector\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\",\"metrics\":{\"baseScore\":6.5,\"exploitabilityScore\":2.8,\"impactScore\":3.6},\"vendorMetadata\":{}}]}]}",
486
+ "label": "check"
487
+ }
488
+ ],
489
+ "results": [
490
+ {
491
+ "codeDesc": "Package: libcurl3-gnutls@7.81.0-1ubuntu1.16 | Type: deb | Location: /usr/share/doc/libcurl3-gnutls/copyright | Match Type: exact-indirect-match",
492
+ "message": "Severity: Medium vulnerability is fixed for versions 7.81.0-1ubuntu1.17",
493
+ "startTime": "2024-08-29T17:31:15.474Z",
494
+ "status": "failed"
495
+ }
496
+ ],
497
+ "id": "Grype/CVE-2024-7264",
498
+ "impact": 0.5,
499
+ "tags": {
500
+ "cci": [
501
+ "CCI-001643",
502
+ "CCI-003173"
503
+ ],
504
+ "nist": [
505
+ "SA-11",
506
+ "RA-5"
507
+ ]
508
+ },
509
+ "code": "{\n \"vulnerability\": {\n \"id\": \"CVE-2024-7264\",\n \"dataSource\": \"https://ubuntu.com/security/CVE-2024-7264\",\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"severity\": \"Medium\",\n \"urls\": [\n \"https://ubuntu.com/security/CVE-2024-7264\"\n ],\n \"cvss\": [],\n \"fix\": {\n \"versions\": [\n \"7.81.0-1ubuntu1.17\"\n ],\n \"state\": \"fixed\"\n },\n \"advisories\": []\n },\n \"relatedVulnerabilities\": [\n {\n \"id\": \"CVE-2024-7264\",\n \"dataSource\": \"https://nvd.nist.gov/vuln/detail/CVE-2024-7264\",\n \"namespace\": \"nvd:cpe\",\n \"severity\": \"Medium\",\n \"urls\": [\n \"http://www.openwall.com/lists/oss-security/2024/07/31/1\",\n \"https://curl.se/docs/CVE-2024-7264.html\",\n \"https://curl.se/docs/CVE-2024-7264.json\",\n \"https://hackerone.com/reports/2629968\"\n ],\n \"description\": \"libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\\nparser might end up using -1 for the length of the *time fraction*, leading to\\na `strlen()` getting performed on a pointer to a heap buffer area that is not\\n(purposely) null terminated.\\n\\nThis flaw most likely leads to a crash, but can also lead to heap contents\\ngetting returned to the application when\\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.\",\n \"cvss\": [\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"3.1\",\n \"vector\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\",\n \"metrics\": {\n \"baseScore\": 6.5,\n \"exploitabilityScore\": 2.8,\n \"impactScore\": 3.6\n },\n \"vendorMetadata\": {}\n }\n ]\n }\n ],\n \"matchDetails\": [\n {\n \"type\": \"exact-indirect-match\",\n \"matcher\": \"dpkg-matcher\",\n \"searchedBy\": {\n \"distro\": {\n \"type\": \"ubuntu\",\n \"version\": \"22.04\"\n },\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"package\": {\n \"name\": \"curl\",\n \"version\": \"7.81.0-1ubuntu1.16\"\n }\n },\n \"found\": {\n \"versionConstraint\": \"\u003c 7.81.0-1ubuntu1.17 (deb)\",\n \"vulnerabilityID\": \"CVE-2024-7264\"\n }\n }\n ],\n \"artifact\": {\n \"id\": \"b4d74f55020f24c9\",\n \"name\": \"libcurl3-gnutls\",\n \"version\": \"7.81.0-1ubuntu1.16\",\n \"type\": \"deb\",\n \"locations\": [\n {\n \"path\": \"/usr/share/doc/libcurl3-gnutls/copyright\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/status\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n }\n ],\n \"language\": \"\",\n \"licenses\": [\n \"BSD-3-Clause\",\n \"BSD-4-Clause\",\n \"ISC\",\n \"curl\",\n \"other\",\n \"public-domain\"\n ],\n \"cpes\": [\n \"cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.81.0-1ubuntu1.16:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.81.0-1ubuntu1.16:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.81.0-1ubuntu1.16:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.81.0-1ubuntu1.16:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:libcurl3:libcurl3-gnutls:7.81.0-1ubuntu1.16:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:libcurl3:libcurl3_gnutls:7.81.0-1ubuntu1.16:*:*:*:*:*:*:*\"\n ],\n \"purl\": \"pkg:deb/ubuntu/libcurl3-gnutls@7.81.0-1ubuntu1.16?arch=amd64\u0026upstream=curl\u0026distro=ubuntu-22.04\",\n \"upstreams\": [\n {\n \"name\": \"curl\"\n }\n ]\n }\n}",
510
+ "refs": [
511
+ {
512
+ "url": "https://ubuntu.com/security/CVE-2024-7264"
513
+ },
514
+ {
515
+ "url": "http://www.openwall.com/lists/oss-security/2024/07/31/1"
516
+ },
517
+ {
518
+ "url": "https://curl.se/docs/CVE-2024-7264.html"
519
+ },
520
+ {
521
+ "url": "https://curl.se/docs/CVE-2024-7264.json"
522
+ },
523
+ {
524
+ "url": "https://hackerone.com/reports/2629968"
525
+ }
526
+ ],
527
+ "title": "Grype found a vulnerability to CVE-2024-7264 in tensorflow/tensorflow:latest",
528
+ "verificationMethod": "automated"
529
+ },
530
+ {
531
+ "affectedPackages": [
532
+ {
533
+ "cpe": "cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1~22.04.4:*:*:*:*:*:*:*",
534
+ "ecosystem": "deb",
535
+ "fixedInVersion": "3.10.12-1~22.04.5",
536
+ "name": "libpython3.10-minimal",
537
+ "purl": "pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.4?arch=amd64\u0026upstream=python3.10\u0026distro=ubuntu-22.04",
538
+ "version": "3.10.12-1~22.04.4"
539
+ }
540
+ ],
541
+ "descriptions": [
542
+ {
543
+ "data": "The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries.\n\nCPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.",
544
+ "label": "default"
545
+ },
546
+ {
547
+ "data": "vulnerability is fixed for versions 3.10.12-1~22.04.5",
548
+ "label": "fix"
549
+ },
550
+ {
551
+ "data": "{}",
552
+ "label": "check"
553
+ }
554
+ ],
555
+ "results": [
556
+ {
557
+ "codeDesc": "Package: libpython3.10-minimal@3.10.12-1~22.04.4 | Type: deb | Location: /usr/share/doc/libpython3.10-minimal/copyright | Match Type: exact-indirect-match",
558
+ "message": "Severity: Low vulnerability is fixed for versions 3.10.12-1~22.04.5",
559
+ "startTime": "2024-08-29T17:31:15.474Z",
560
+ "status": "failed"
561
+ }
562
+ ],
563
+ "id": "Grype/CVE-2024-4032",
564
+ "impact": 0.3,
565
+ "tags": {
566
+ "cci": [
567
+ "CCI-001643",
568
+ "CCI-003173"
569
+ ],
570
+ "nist": [
571
+ "SA-11",
572
+ "RA-5"
573
+ ]
574
+ },
575
+ "code": "{\n \"vulnerability\": {\n \"id\": \"CVE-2024-4032\",\n \"dataSource\": \"https://ubuntu.com/security/CVE-2024-4032\",\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"severity\": \"Low\",\n \"urls\": [\n \"https://ubuntu.com/security/CVE-2024-4032\"\n ],\n \"cvss\": [],\n \"fix\": {\n \"versions\": [\n \"3.10.12-1~22.04.5\"\n ],\n \"state\": \"fixed\"\n },\n \"advisories\": []\n },\n \"relatedVulnerabilities\": [\n {\n \"id\": \"CVE-2024-4032\",\n \"dataSource\": \"https://nvd.nist.gov/vuln/detail/CVE-2024-4032\",\n \"namespace\": \"nvd:cpe\",\n \"severity\": \"Unknown\",\n \"urls\": [\n \"http://www.openwall.com/lists/oss-security/2024/06/17/3\",\n \"https://github.com/python/cpython/commit/22adf29da8d99933ffed8647d3e0726edd16f7f8\",\n \"https://github.com/python/cpython/commit/40d75c2b7f5c67e254d0a025e0f2e2c7ada7f69f\",\n \"https://github.com/python/cpython/commit/895f7e2ac23eff4743143beef0f0c5ac71ea27d3\",\n \"https://github.com/python/cpython/commit/ba431579efdcbaed7a96f2ac4ea0775879a332fb\",\n \"https://github.com/python/cpython/commit/c62c9e518b784fe44432a3f4fc265fb95b651906\",\n \"https://github.com/python/cpython/commit/f86b17ac511e68192ba71f27e752321a3252cee3\",\n \"https://github.com/python/cpython/issues/113171\",\n \"https://github.com/python/cpython/pull/113179\",\n \"https://mail.python.org/archives/list/security-announce@python.org/thread/NRUHDUS2IV2USIZM2CVMSFL6SCKU3RZA/\",\n \"https://security.netapp.com/advisory/ntap-20240726-0004/\",\n \"https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml\",\n \"https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml\"\n ],\n \"description\": \"The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries.\\n\\nCPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.\",\n \"cvss\": []\n }\n ],\n \"matchDetails\": [\n {\n \"type\": \"exact-indirect-match\",\n \"matcher\": \"dpkg-matcher\",\n \"searchedBy\": {\n \"distro\": {\n \"type\": \"ubuntu\",\n \"version\": \"22.04\"\n },\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"package\": {\n \"name\": \"python3.10\",\n \"version\": \"3.10.12-1~22.04.4\"\n }\n },\n \"found\": {\n \"versionConstraint\": \"\u003c 3.10.12-1~22.04.5 (deb)\",\n \"vulnerabilityID\": \"CVE-2024-4032\"\n }\n }\n ],\n \"artifact\": {\n \"id\": \"b091a7d3eecb8cae\",\n \"name\": \"libpython3.10-minimal\",\n \"version\": \"3.10.12-1~22.04.4\",\n \"type\": \"deb\",\n \"locations\": [\n {\n \"path\": \"/usr/share/doc/libpython3.10-minimal/copyright\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/info/libpython3.10-minimal:amd64.conffiles\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/info/libpython3.10-minimal:amd64.md5sums\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/status\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n }\n ],\n \"language\": \"\",\n \"licenses\": [\n \"By\",\n \"GPL-2\",\n \"Permission\",\n \"Redistribution\",\n \"This\"\n ],\n \"cpes\": [\n \"cpe:2.3:a:libpython3.10-minimal:libpython3.10-minimal:3.10.12-1~22.04.4:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:libpython3.10-minimal:libpython3.10_minimal:3.10.12-1~22.04.4:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:libpython3.10_minimal:libpython3.10-minimal:3.10.12-1~22.04.4:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:libpython3.10_minimal:libpython3.10_minimal:3.10.12-1~22.04.4:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:libpython3.10:libpython3.10-minimal:3.10.12-1~22.04.4:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:libpython3.10:libpython3.10_minimal:3.10.12-1~22.04.4:*:*:*:*:*:*:*\"\n ],\n \"purl\": \"pkg:deb/ubuntu/libpython3.10-minimal@3.10.12-1~22.04.4?arch=amd64\u0026upstream=python3.10\u0026distro=ubuntu-22.04\",\n \"upstreams\": [\n {\n \"name\": \"python3.10\"\n }\n ]\n }\n}",
576
+ "refs": [
577
+ {
578
+ "url": "https://ubuntu.com/security/CVE-2024-4032"
579
+ },
580
+ {
581
+ "url": "http://www.openwall.com/lists/oss-security/2024/06/17/3"
582
+ },
583
+ {
584
+ "url": "https://github.com/python/cpython/commit/22adf29da8d99933ffed8647d3e0726edd16f7f8"
585
+ },
586
+ {
587
+ "url": "https://github.com/python/cpython/commit/40d75c2b7f5c67e254d0a025e0f2e2c7ada7f69f"
588
+ },
589
+ {
590
+ "url": "https://github.com/python/cpython/commit/895f7e2ac23eff4743143beef0f0c5ac71ea27d3"
591
+ },
592
+ {
593
+ "url": "https://github.com/python/cpython/commit/ba431579efdcbaed7a96f2ac4ea0775879a332fb"
594
+ },
595
+ {
596
+ "url": "https://github.com/python/cpython/commit/c62c9e518b784fe44432a3f4fc265fb95b651906"
597
+ },
598
+ {
599
+ "url": "https://github.com/python/cpython/commit/f86b17ac511e68192ba71f27e752321a3252cee3"
600
+ },
601
+ {
602
+ "url": "https://github.com/python/cpython/issues/113171"
603
+ },
604
+ {
605
+ "url": "https://github.com/python/cpython/pull/113179"
606
+ },
607
+ {
608
+ "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/NRUHDUS2IV2USIZM2CVMSFL6SCKU3RZA/"
609
+ },
610
+ {
611
+ "url": "https://security.netapp.com/advisory/ntap-20240726-0004/"
612
+ },
613
+ {
614
+ "url": "https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml"
615
+ },
616
+ {
617
+ "url": "https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml"
618
+ }
619
+ ],
620
+ "title": "Grype found a vulnerability to CVE-2024-4032 in tensorflow/tensorflow:latest",
621
+ "verificationMethod": "automated"
622
+ },
623
+ {
624
+ "affectedPackages": [
625
+ {
626
+ "cpe": "cpe:2.3:a:libpython3.10-stdlib:libpython3.10-stdlib:3.10.12-1~22.04.4:*:*:*:*:*:*:*",
627
+ "ecosystem": "deb",
628
+ "fixedInVersion": "3.10.12-1~22.04.5",
629
+ "name": "libpython3.10-stdlib",
630
+ "purl": "pkg:deb/ubuntu/libpython3.10-stdlib@3.10.12-1~22.04.4?arch=amd64\u0026upstream=python3.10\u0026distro=ubuntu-22.04",
631
+ "version": "3.10.12-1~22.04.4"
632
+ }
633
+ ],
634
+ "descriptions": [
635
+ {
636
+ "data": "The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries.\n\nCPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.",
637
+ "label": "default"
638
+ },
639
+ {
640
+ "data": "vulnerability is fixed for versions 3.10.12-1~22.04.5",
641
+ "label": "fix"
642
+ },
643
+ {
644
+ "data": "{}",
645
+ "label": "check"
646
+ }
647
+ ],
648
+ "results": [
649
+ {
650
+ "codeDesc": "Package: libpython3.10-stdlib@3.10.12-1~22.04.4 | Type: deb | Location: /usr/share/doc/libpython3.10-minimal/copyright | Match Type: exact-indirect-match",
651
+ "message": "Severity: Low vulnerability is fixed for versions 3.10.12-1~22.04.5",
652
+ "startTime": "2024-08-29T17:31:15.474Z",
653
+ "status": "failed"
654
+ }
655
+ ],
656
+ "id": "Grype/CVE-2024-4032",
657
+ "impact": 0.3,
658
+ "tags": {
659
+ "cci": [
660
+ "CCI-001643",
661
+ "CCI-003173"
662
+ ],
663
+ "nist": [
664
+ "SA-11",
665
+ "RA-5"
666
+ ]
667
+ },
668
+ "code": "{\n \"vulnerability\": {\n \"id\": \"CVE-2024-4032\",\n \"dataSource\": \"https://ubuntu.com/security/CVE-2024-4032\",\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"severity\": \"Low\",\n \"urls\": [\n \"https://ubuntu.com/security/CVE-2024-4032\"\n ],\n \"cvss\": [],\n \"fix\": {\n \"versions\": [\n \"3.10.12-1~22.04.5\"\n ],\n \"state\": \"fixed\"\n },\n \"advisories\": []\n },\n \"relatedVulnerabilities\": [\n {\n \"id\": \"CVE-2024-4032\",\n \"dataSource\": \"https://nvd.nist.gov/vuln/detail/CVE-2024-4032\",\n \"namespace\": \"nvd:cpe\",\n \"severity\": \"Unknown\",\n \"urls\": [\n \"http://www.openwall.com/lists/oss-security/2024/06/17/3\",\n \"https://github.com/python/cpython/commit/22adf29da8d99933ffed8647d3e0726edd16f7f8\",\n \"https://github.com/python/cpython/commit/40d75c2b7f5c67e254d0a025e0f2e2c7ada7f69f\",\n \"https://github.com/python/cpython/commit/895f7e2ac23eff4743143beef0f0c5ac71ea27d3\",\n \"https://github.com/python/cpython/commit/ba431579efdcbaed7a96f2ac4ea0775879a332fb\",\n \"https://github.com/python/cpython/commit/c62c9e518b784fe44432a3f4fc265fb95b651906\",\n \"https://github.com/python/cpython/commit/f86b17ac511e68192ba71f27e752321a3252cee3\",\n \"https://github.com/python/cpython/issues/113171\",\n \"https://github.com/python/cpython/pull/113179\",\n \"https://mail.python.org/archives/list/security-announce@python.org/thread/NRUHDUS2IV2USIZM2CVMSFL6SCKU3RZA/\",\n \"https://security.netapp.com/advisory/ntap-20240726-0004/\",\n \"https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml\",\n \"https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml\"\n ],\n \"description\": \"The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries.\\n\\nCPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.\",\n \"cvss\": []\n }\n ],\n \"matchDetails\": [\n {\n \"type\": \"exact-indirect-match\",\n \"matcher\": \"dpkg-matcher\",\n \"searchedBy\": {\n \"distro\": {\n \"type\": \"ubuntu\",\n \"version\": \"22.04\"\n },\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"package\": {\n \"name\": \"python3.10\",\n \"version\": \"3.10.12-1~22.04.4\"\n }\n },\n \"found\": {\n \"versionConstraint\": \"\u003c 3.10.12-1~22.04.5 (deb)\",\n \"vulnerabilityID\": \"CVE-2024-4032\"\n }\n }\n ],\n \"artifact\": {\n \"id\": \"7c865f57958d3c18\",\n \"name\": \"libpython3.10-stdlib\",\n \"version\": \"3.10.12-1~22.04.4\",\n \"type\": \"deb\",\n \"locations\": [\n {\n \"path\": \"/usr/share/doc/libpython3.10-minimal/copyright\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/info/libpython3.10-stdlib:amd64.md5sums\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/status\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n }\n ],\n \"language\": \"\",\n \"licenses\": [\n \"By\",\n \"GPL-2\",\n \"Permission\",\n \"Redistribution\",\n \"This\"\n ],\n \"cpes\": [\n \"cpe:2.3:a:libpython3.10-stdlib:libpython3.10-stdlib:3.10.12-1~22.04.4:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:libpython3.10-stdlib:libpython3.10_stdlib:3.10.12-1~22.04.4:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:libpython3.10_stdlib:libpython3.10-stdlib:3.10.12-1~22.04.4:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:libpython3.10_stdlib:libpython3.10_stdlib:3.10.12-1~22.04.4:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:libpython3.10:libpython3.10-stdlib:3.10.12-1~22.04.4:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:libpython3.10:libpython3.10_stdlib:3.10.12-1~22.04.4:*:*:*:*:*:*:*\"\n ],\n \"purl\": \"pkg:deb/ubuntu/libpython3.10-stdlib@3.10.12-1~22.04.4?arch=amd64\u0026upstream=python3.10\u0026distro=ubuntu-22.04\",\n \"upstreams\": [\n {\n \"name\": \"python3.10\"\n }\n ]\n }\n}",
669
+ "refs": [
670
+ {
671
+ "url": "https://ubuntu.com/security/CVE-2024-4032"
672
+ },
673
+ {
674
+ "url": "http://www.openwall.com/lists/oss-security/2024/06/17/3"
675
+ },
676
+ {
677
+ "url": "https://github.com/python/cpython/commit/22adf29da8d99933ffed8647d3e0726edd16f7f8"
678
+ },
679
+ {
680
+ "url": "https://github.com/python/cpython/commit/40d75c2b7f5c67e254d0a025e0f2e2c7ada7f69f"
681
+ },
682
+ {
683
+ "url": "https://github.com/python/cpython/commit/895f7e2ac23eff4743143beef0f0c5ac71ea27d3"
684
+ },
685
+ {
686
+ "url": "https://github.com/python/cpython/commit/ba431579efdcbaed7a96f2ac4ea0775879a332fb"
687
+ },
688
+ {
689
+ "url": "https://github.com/python/cpython/commit/c62c9e518b784fe44432a3f4fc265fb95b651906"
690
+ },
691
+ {
692
+ "url": "https://github.com/python/cpython/commit/f86b17ac511e68192ba71f27e752321a3252cee3"
693
+ },
694
+ {
695
+ "url": "https://github.com/python/cpython/issues/113171"
696
+ },
697
+ {
698
+ "url": "https://github.com/python/cpython/pull/113179"
699
+ },
700
+ {
701
+ "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/NRUHDUS2IV2USIZM2CVMSFL6SCKU3RZA/"
702
+ },
703
+ {
704
+ "url": "https://security.netapp.com/advisory/ntap-20240726-0004/"
705
+ },
706
+ {
707
+ "url": "https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml"
708
+ },
709
+ {
710
+ "url": "https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml"
711
+ }
712
+ ],
713
+ "title": "Grype found a vulnerability to CVE-2024-4032 in tensorflow/tensorflow:latest",
714
+ "verificationMethod": "automated"
715
+ },
716
+ {
717
+ "affectedPackages": [
718
+ {
719
+ "cpe": "cpe:2.3:a:libpython3.11:libpython3.11:3.11.0~rc1-1~22.04:*:*:*:*:*:*:*",
720
+ "ecosystem": "deb",
721
+ "name": "libpython3.11",
722
+ "purl": "pkg:deb/ubuntu/libpython3.11@3.11.0~rc1-1~22.04?arch=amd64\u0026upstream=python3.11\u0026distro=ubuntu-22.04",
723
+ "version": "3.11.0~rc1-1~22.04"
724
+ }
725
+ ],
726
+ "descriptions": [
727
+ {
728
+ "data": "Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing library, when used with the forkserver start method on Linux, allows pickles to be deserialized from any user in the same machine local network namespace, which in many system configurations means any user on the same machine. Pickles can execute arbitrary code. Thus, this allows for local user privilege escalation to the user that any forkserver process is running as. Setting multiprocessing.util.abstract_sockets_supported to False is a workaround. The forkserver start method for multiprocessing is not the default start method. This issue is Linux specific because only Linux supports abstract namespace sockets. CPython before 3.9 does not make use of Linux abstract namespace sockets by default. Support for users manually specifying an abstract namespace socket was added as a bugfix in 3.7.8 and 3.8.3, but users would need to make specific uncommon API calls in order to do that in CPython before 3.9.",
729
+ "label": "default"
730
+ },
731
+ {
732
+ "data": "vulnerability is not-fixed",
733
+ "label": "fix"
734
+ },
735
+ {
736
+ "data": "{\"related\":[{\"id\":\"CVE-2022-42919\",\"dataSource\":\"https://nvd.nist.gov/vuln/detail/CVE-2022-42919\",\"cvss\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"3.1\",\"vector\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"metrics\":{\"baseScore\":7.8,\"exploitabilityScore\":1.8,\"impactScore\":5.9},\"vendorMetadata\":{}}]}]}",
737
+ "label": "check"
738
+ }
739
+ ],
740
+ "results": [
741
+ {
742
+ "codeDesc": "Package: libpython3.11@3.11.0~rc1-1~22.04 | Type: deb | Location: /usr/share/doc/libpython3.11-minimal/copyright | Match Type: exact-indirect-match",
743
+ "message": "Severity: High vulnerability is not-fixed",
744
+ "startTime": "2024-08-29T17:31:15.474Z",
745
+ "status": "failed"
746
+ }
747
+ ],
748
+ "id": "Grype/CVE-2022-42919",
749
+ "impact": 0.7,
750
+ "tags": {
751
+ "cci": [
752
+ "CCI-001643",
753
+ "CCI-003173"
754
+ ],
755
+ "nist": [
756
+ "SA-11",
757
+ "RA-5"
758
+ ]
759
+ },
760
+ "code": "{\n \"vulnerability\": {\n \"id\": \"CVE-2022-42919\",\n \"dataSource\": \"https://ubuntu.com/security/CVE-2022-42919\",\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"severity\": \"High\",\n \"urls\": [\n \"https://ubuntu.com/security/CVE-2022-42919\"\n ],\n \"cvss\": [],\n \"fix\": {\n \"versions\": [],\n \"state\": \"not-fixed\"\n },\n \"advisories\": []\n },\n \"relatedVulnerabilities\": [\n {\n \"id\": \"CVE-2022-42919\",\n \"dataSource\": \"https://nvd.nist.gov/vuln/detail/CVE-2022-42919\",\n \"namespace\": \"nvd:cpe\",\n \"severity\": \"High\",\n \"urls\": [\n \"https://github.com/python/cpython/compare/v3.10.8...v3.10.9\",\n \"https://github.com/python/cpython/compare/v3.9.15...v3.9.16\",\n \"https://github.com/python/cpython/issues/97514\",\n \"https://github.com/python/cpython/issues/97514#issuecomment-1310277840\",\n \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKGCQPIVHEAIJ77R3RSNSQWYBUDVWDKU/\",\n \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2LHWWEI5OBQ6RELULMVU6KMDYG4WZXH/\",\n \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PI5DYIED6U26BGX5IRZWNCP6TY4M2ZGZ/\",\n \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QLUGZSEAO3MBWGKCUSMKQIRYJZKJCIOB/\",\n \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R6KGIRHSENZ4QAB234Z36HVIDTRJ3MFI/\",\n \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDK3ZZBRYFO47ET3N4BNTKVXN47U6ICY/\",\n \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCRKBB5Y5EWTJUNC7LK665WO64DDXSTN/\",\n \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XX6LLAXGZVZ327REY6MDZRMMP47LJ53P/\",\n \"https://security.gentoo.org/glsa/202305-02\",\n \"https://security.netapp.com/advisory/ntap-20221209-0006/\"\n ],\n \"description\": \"Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing library, when used with the forkserver start method on Linux, allows pickles to be deserialized from any user in the same machine local network namespace, which in many system configurations means any user on the same machine. Pickles can execute arbitrary code. Thus, this allows for local user privilege escalation to the user that any forkserver process is running as. Setting multiprocessing.util.abstract_sockets_supported to False is a workaround. The forkserver start method for multiprocessing is not the default start method. This issue is Linux specific because only Linux supports abstract namespace sockets. CPython before 3.9 does not make use of Linux abstract namespace sockets by default. Support for users manually specifying an abstract namespace socket was added as a bugfix in 3.7.8 and 3.8.3, but users would need to make specific uncommon API calls in order to do that in CPython before 3.9.\",\n \"cvss\": [\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"3.1\",\n \"vector\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\n \"metrics\": {\n \"baseScore\": 7.8,\n \"exploitabilityScore\": 1.8,\n \"impactScore\": 5.9\n },\n \"vendorMetadata\": {}\n }\n ]\n }\n ],\n \"matchDetails\": [\n {\n \"type\": \"exact-indirect-match\",\n \"matcher\": \"dpkg-matcher\",\n \"searchedBy\": {\n \"distro\": {\n \"type\": \"ubuntu\",\n \"version\": \"22.04\"\n },\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"package\": {\n \"name\": \"python3.11\",\n \"version\": \"3.11.0~rc1-1~22.04\"\n }\n },\n \"found\": {\n \"versionConstraint\": \"none (deb)\",\n \"vulnerabilityID\": \"CVE-2022-42919\"\n }\n }\n ],\n \"artifact\": {\n \"id\": \"6804eab1d6c15334\",\n \"name\": \"libpython3.11\",\n \"version\": \"3.11.0~rc1-1~22.04\",\n \"type\": \"deb\",\n \"locations\": [\n {\n \"path\": \"/usr/share/doc/libpython3.11-minimal/copyright\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n },\n {\n \"path\": \"/var/lib/dpkg/info/libpython3.11:amd64.md5sums\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n },\n {\n \"path\": \"/var/lib/dpkg/status\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n }\n ],\n \"language\": \"\",\n \"licenses\": [\n \"By\",\n \"GPL-2\",\n \"Permission\",\n \"Redistribution\",\n \"This\"\n ],\n \"cpes\": [\n \"cpe:2.3:a:libpython3.11:libpython3.11:3.11.0~rc1-1~22.04:*:*:*:*:*:*:*\"\n ],\n \"purl\": \"pkg:deb/ubuntu/libpython3.11@3.11.0~rc1-1~22.04?arch=amd64\u0026upstream=python3.11\u0026distro=ubuntu-22.04\",\n \"upstreams\": [\n {\n \"name\": \"python3.11\"\n }\n ]\n }\n}",
761
+ "refs": [
762
+ {
763
+ "url": "https://ubuntu.com/security/CVE-2022-42919"
764
+ },
765
+ {
766
+ "url": "https://github.com/python/cpython/compare/v3.10.8...v3.10.9"
767
+ },
768
+ {
769
+ "url": "https://github.com/python/cpython/compare/v3.9.15...v3.9.16"
770
+ },
771
+ {
772
+ "url": "https://github.com/python/cpython/issues/97514"
773
+ },
774
+ {
775
+ "url": "https://github.com/python/cpython/issues/97514#issuecomment-1310277840"
776
+ },
777
+ {
778
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKGCQPIVHEAIJ77R3RSNSQWYBUDVWDKU/"
779
+ },
780
+ {
781
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2LHWWEI5OBQ6RELULMVU6KMDYG4WZXH/"
782
+ },
783
+ {
784
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PI5DYIED6U26BGX5IRZWNCP6TY4M2ZGZ/"
785
+ },
786
+ {
787
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QLUGZSEAO3MBWGKCUSMKQIRYJZKJCIOB/"
788
+ },
789
+ {
790
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R6KGIRHSENZ4QAB234Z36HVIDTRJ3MFI/"
791
+ },
792
+ {
793
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDK3ZZBRYFO47ET3N4BNTKVXN47U6ICY/"
794
+ },
795
+ {
796
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCRKBB5Y5EWTJUNC7LK665WO64DDXSTN/"
797
+ },
798
+ {
799
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XX6LLAXGZVZ327REY6MDZRMMP47LJ53P/"
800
+ },
801
+ {
802
+ "url": "https://security.gentoo.org/glsa/202305-02"
803
+ },
804
+ {
805
+ "url": "https://security.netapp.com/advisory/ntap-20221209-0006/"
806
+ }
807
+ ],
808
+ "title": "Grype found a vulnerability to CVE-2022-42919 in tensorflow/tensorflow:latest",
809
+ "verificationMethod": "automated"
810
+ },
811
+ {
812
+ "affectedPackages": [
813
+ {
814
+ "cpe": "cpe:2.3:a:libpython3.11-dev:libpython3.11-dev:3.11.0~rc1-1~22.04:*:*:*:*:*:*:*",
815
+ "ecosystem": "deb",
816
+ "name": "libpython3.11-dev",
817
+ "purl": "pkg:deb/ubuntu/libpython3.11-dev@3.11.0~rc1-1~22.04?arch=amd64\u0026upstream=python3.11\u0026distro=ubuntu-22.04",
818
+ "version": "3.11.0~rc1-1~22.04"
819
+ }
820
+ ],
821
+ "descriptions": [
822
+ {
823
+ "data": "Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing library, when used with the forkserver start method on Linux, allows pickles to be deserialized from any user in the same machine local network namespace, which in many system configurations means any user on the same machine. Pickles can execute arbitrary code. Thus, this allows for local user privilege escalation to the user that any forkserver process is running as. Setting multiprocessing.util.abstract_sockets_supported to False is a workaround. The forkserver start method for multiprocessing is not the default start method. This issue is Linux specific because only Linux supports abstract namespace sockets. CPython before 3.9 does not make use of Linux abstract namespace sockets by default. Support for users manually specifying an abstract namespace socket was added as a bugfix in 3.7.8 and 3.8.3, but users would need to make specific uncommon API calls in order to do that in CPython before 3.9.",
824
+ "label": "default"
825
+ },
826
+ {
827
+ "data": "vulnerability is not-fixed",
828
+ "label": "fix"
829
+ },
830
+ {
831
+ "data": "{\"related\":[{\"id\":\"CVE-2022-42919\",\"dataSource\":\"https://nvd.nist.gov/vuln/detail/CVE-2022-42919\",\"cvss\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"3.1\",\"vector\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"metrics\":{\"baseScore\":7.8,\"exploitabilityScore\":1.8,\"impactScore\":5.9},\"vendorMetadata\":{}}]}]}",
832
+ "label": "check"
833
+ }
834
+ ],
835
+ "results": [
836
+ {
837
+ "codeDesc": "Package: libpython3.11-dev@3.11.0~rc1-1~22.04 | Type: deb | Location: /usr/share/doc/libpython3.11-minimal/copyright | Match Type: exact-indirect-match",
838
+ "message": "Severity: High vulnerability is not-fixed",
839
+ "startTime": "2024-08-29T17:31:15.474Z",
840
+ "status": "failed"
841
+ }
842
+ ],
843
+ "id": "Grype/CVE-2022-42919",
844
+ "impact": 0.7,
845
+ "tags": {
846
+ "cci": [
847
+ "CCI-001643",
848
+ "CCI-003173"
849
+ ],
850
+ "nist": [
851
+ "SA-11",
852
+ "RA-5"
853
+ ]
854
+ },
855
+ "code": "{\n \"vulnerability\": {\n \"id\": \"CVE-2022-42919\",\n \"dataSource\": \"https://ubuntu.com/security/CVE-2022-42919\",\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"severity\": \"High\",\n \"urls\": [\n \"https://ubuntu.com/security/CVE-2022-42919\"\n ],\n \"cvss\": [],\n \"fix\": {\n \"versions\": [],\n \"state\": \"not-fixed\"\n },\n \"advisories\": []\n },\n \"relatedVulnerabilities\": [\n {\n \"id\": \"CVE-2022-42919\",\n \"dataSource\": \"https://nvd.nist.gov/vuln/detail/CVE-2022-42919\",\n \"namespace\": \"nvd:cpe\",\n \"severity\": \"High\",\n \"urls\": [\n \"https://github.com/python/cpython/compare/v3.10.8...v3.10.9\",\n \"https://github.com/python/cpython/compare/v3.9.15...v3.9.16\",\n \"https://github.com/python/cpython/issues/97514\",\n \"https://github.com/python/cpython/issues/97514#issuecomment-1310277840\",\n \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKGCQPIVHEAIJ77R3RSNSQWYBUDVWDKU/\",\n \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2LHWWEI5OBQ6RELULMVU6KMDYG4WZXH/\",\n \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PI5DYIED6U26BGX5IRZWNCP6TY4M2ZGZ/\",\n \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QLUGZSEAO3MBWGKCUSMKQIRYJZKJCIOB/\",\n \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R6KGIRHSENZ4QAB234Z36HVIDTRJ3MFI/\",\n \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDK3ZZBRYFO47ET3N4BNTKVXN47U6ICY/\",\n \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCRKBB5Y5EWTJUNC7LK665WO64DDXSTN/\",\n \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XX6LLAXGZVZ327REY6MDZRMMP47LJ53P/\",\n \"https://security.gentoo.org/glsa/202305-02\",\n \"https://security.netapp.com/advisory/ntap-20221209-0006/\"\n ],\n \"description\": \"Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing library, when used with the forkserver start method on Linux, allows pickles to be deserialized from any user in the same machine local network namespace, which in many system configurations means any user on the same machine. Pickles can execute arbitrary code. Thus, this allows for local user privilege escalation to the user that any forkserver process is running as. Setting multiprocessing.util.abstract_sockets_supported to False is a workaround. The forkserver start method for multiprocessing is not the default start method. This issue is Linux specific because only Linux supports abstract namespace sockets. CPython before 3.9 does not make use of Linux abstract namespace sockets by default. Support for users manually specifying an abstract namespace socket was added as a bugfix in 3.7.8 and 3.8.3, but users would need to make specific uncommon API calls in order to do that in CPython before 3.9.\",\n \"cvss\": [\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"3.1\",\n \"vector\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\n \"metrics\": {\n \"baseScore\": 7.8,\n \"exploitabilityScore\": 1.8,\n \"impactScore\": 5.9\n },\n \"vendorMetadata\": {}\n }\n ]\n }\n ],\n \"matchDetails\": [\n {\n \"type\": \"exact-indirect-match\",\n \"matcher\": \"dpkg-matcher\",\n \"searchedBy\": {\n \"distro\": {\n \"type\": \"ubuntu\",\n \"version\": \"22.04\"\n },\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"package\": {\n \"name\": \"python3.11\",\n \"version\": \"3.11.0~rc1-1~22.04\"\n }\n },\n \"found\": {\n \"versionConstraint\": \"none (deb)\",\n \"vulnerabilityID\": \"CVE-2022-42919\"\n }\n }\n ],\n \"artifact\": {\n \"id\": \"f22d42b9e8547354\",\n \"name\": \"libpython3.11-dev\",\n \"version\": \"3.11.0~rc1-1~22.04\",\n \"type\": \"deb\",\n \"locations\": [\n {\n \"path\": \"/usr/share/doc/libpython3.11-minimal/copyright\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n },\n {\n \"path\": \"/var/lib/dpkg/info/libpython3.11-dev:amd64.md5sums\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n },\n {\n \"path\": \"/var/lib/dpkg/status\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n }\n ],\n \"language\": \"\",\n \"licenses\": [\n \"By\",\n \"GPL-2\",\n \"Permission\",\n \"Redistribution\",\n \"This\"\n ],\n \"cpes\": [\n \"cpe:2.3:a:libpython3.11-dev:libpython3.11-dev:3.11.0~rc1-1~22.04:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:libpython3.11-dev:libpython3.11_dev:3.11.0~rc1-1~22.04:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:libpython3.11_dev:libpython3.11-dev:3.11.0~rc1-1~22.04:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:libpython3.11_dev:libpython3.11_dev:3.11.0~rc1-1~22.04:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:libpython3.11:libpython3.11-dev:3.11.0~rc1-1~22.04:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:libpython3.11:libpython3.11_dev:3.11.0~rc1-1~22.04:*:*:*:*:*:*:*\"\n ],\n \"purl\": \"pkg:deb/ubuntu/libpython3.11-dev@3.11.0~rc1-1~22.04?arch=amd64\u0026upstream=python3.11\u0026distro=ubuntu-22.04\",\n \"upstreams\": [\n {\n \"name\": \"python3.11\"\n }\n ]\n }\n}",
856
+ "refs": [
857
+ {
858
+ "url": "https://ubuntu.com/security/CVE-2022-42919"
859
+ },
860
+ {
861
+ "url": "https://github.com/python/cpython/compare/v3.10.8...v3.10.9"
862
+ },
863
+ {
864
+ "url": "https://github.com/python/cpython/compare/v3.9.15...v3.9.16"
865
+ },
866
+ {
867
+ "url": "https://github.com/python/cpython/issues/97514"
868
+ },
869
+ {
870
+ "url": "https://github.com/python/cpython/issues/97514#issuecomment-1310277840"
871
+ },
872
+ {
873
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKGCQPIVHEAIJ77R3RSNSQWYBUDVWDKU/"
874
+ },
875
+ {
876
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2LHWWEI5OBQ6RELULMVU6KMDYG4WZXH/"
877
+ },
878
+ {
879
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PI5DYIED6U26BGX5IRZWNCP6TY4M2ZGZ/"
880
+ },
881
+ {
882
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QLUGZSEAO3MBWGKCUSMKQIRYJZKJCIOB/"
883
+ },
884
+ {
885
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R6KGIRHSENZ4QAB234Z36HVIDTRJ3MFI/"
886
+ },
887
+ {
888
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDK3ZZBRYFO47ET3N4BNTKVXN47U6ICY/"
889
+ },
890
+ {
891
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCRKBB5Y5EWTJUNC7LK665WO64DDXSTN/"
892
+ },
893
+ {
894
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XX6LLAXGZVZ327REY6MDZRMMP47LJ53P/"
895
+ },
896
+ {
897
+ "url": "https://security.gentoo.org/glsa/202305-02"
898
+ },
899
+ {
900
+ "url": "https://security.netapp.com/advisory/ntap-20221209-0006/"
901
+ }
902
+ ],
903
+ "title": "Grype found a vulnerability to CVE-2022-42919 in tensorflow/tensorflow:latest",
904
+ "verificationMethod": "automated"
905
+ },
906
+ {
907
+ "affectedPackages": [
908
+ {
909
+ "cpe": "cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*",
910
+ "ecosystem": "deb",
911
+ "name": "linux-libc-dev",
912
+ "purl": "pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04",
913
+ "version": "5.15.0-113.123"
914
+ }
915
+ ],
916
+ "descriptions": [
917
+ {
918
+ "data": "block/scsi_ioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during authorization of SCSI commands, which allows local users to bypass intended access restrictions via an SG_IO ioctl call that leverages overlapping opcodes.",
919
+ "label": "default"
920
+ },
921
+ {
922
+ "data": "vulnerability is not-fixed",
923
+ "label": "fix"
924
+ },
925
+ {
926
+ "data": "{\"related\":[{\"id\":\"CVE-2012-4542\",\"dataSource\":\"https://nvd.nist.gov/vuln/detail/CVE-2012-4542\",\"cvss\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"2.0\",\"vector\":\"AV:L/AC:L/Au:N/C:P/I:P/A:P\",\"metrics\":{\"baseScore\":4.6,\"exploitabilityScore\":3.9,\"impactScore\":6.4},\"vendorMetadata\":{}}]}]}",
927
+ "label": "check"
928
+ }
929
+ ],
930
+ "results": [
931
+ {
932
+ "codeDesc": "Package: linux-libc-dev@5.15.0-113.123 | Type: deb | Location: /usr/share/doc/linux-libc-dev/copyright | Match Type: exact-indirect-match",
933
+ "message": "This vulnerability was ignored by configured rules. Severity: Low vulnerability is not-fixed",
934
+ "startTime": "2024-08-29T17:31:15.474Z",
935
+ "status": "notReviewed"
936
+ }
937
+ ],
938
+ "id": "Grype-Ignored-Match/CVE-2012-4542",
939
+ "impact": 0.3,
940
+ "tags": {
941
+ "cci": [
942
+ "CCI-001643",
943
+ "CCI-003173"
944
+ ],
945
+ "nist": [
946
+ "SA-11",
947
+ "RA-5"
948
+ ]
949
+ },
950
+ "code": "{\n \"vulnerability\": {\n \"id\": \"CVE-2012-4542\",\n \"dataSource\": \"https://ubuntu.com/security/CVE-2012-4542\",\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"severity\": \"Low\",\n \"urls\": [\n \"https://ubuntu.com/security/CVE-2012-4542\"\n ],\n \"cvss\": [],\n \"fix\": {\n \"versions\": [],\n \"state\": \"not-fixed\"\n },\n \"advisories\": []\n },\n \"relatedVulnerabilities\": [\n {\n \"id\": \"CVE-2012-4542\",\n \"dataSource\": \"https://nvd.nist.gov/vuln/detail/CVE-2012-4542\",\n \"namespace\": \"nvd:cpe\",\n \"severity\": \"Medium\",\n \"urls\": [\n \"http://marc.info/?l=linux-kernel\u0026m=135903967015813\u0026w=2\",\n \"http://marc.info/?l=linux-kernel\u0026m=135904012416042\u0026w=2\",\n \"http://rhn.redhat.com/errata/RHSA-2013-0496.html\",\n \"http://rhn.redhat.com/errata/RHSA-2013-0579.html\",\n \"http://rhn.redhat.com/errata/RHSA-2013-0882.html\",\n \"http://rhn.redhat.com/errata/RHSA-2013-0928.html\",\n \"https://bugzilla.redhat.com/show_bug.cgi?id=875360\",\n \"https://oss.oracle.com/git/?p=redpatch.git%3Ba=commit%3Bh=76a274e17114abf1a77de6b651424648ce9e10c8\"\n ],\n \"description\": \"block/scsi_ioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during authorization of SCSI commands, which allows local users to bypass intended access restrictions via an SG_IO ioctl call that leverages overlapping opcodes.\",\n \"cvss\": [\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"2.0\",\n \"vector\": \"AV:L/AC:L/Au:N/C:P/I:P/A:P\",\n \"metrics\": {\n \"baseScore\": 4.6,\n \"exploitabilityScore\": 3.9,\n \"impactScore\": 6.4\n },\n \"vendorMetadata\": {}\n }\n ]\n }\n ],\n \"matchDetails\": [\n {\n \"type\": \"exact-indirect-match\",\n \"matcher\": \"dpkg-matcher\",\n \"searchedBy\": {\n \"distro\": {\n \"type\": \"ubuntu\",\n \"version\": \"22.04\"\n },\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"package\": {\n \"name\": \"linux\",\n \"version\": \"5.15.0-113.123\"\n }\n },\n \"found\": {\n \"versionConstraint\": \"none (deb)\",\n \"vulnerabilityID\": \"CVE-2012-4542\"\n }\n }\n ],\n \"artifact\": {\n \"id\": \"ae4822e3cd5a96ea\",\n \"name\": \"linux-libc-dev\",\n \"version\": \"5.15.0-113.123\",\n \"type\": \"deb\",\n \"locations\": [\n {\n \"path\": \"/usr/share/doc/linux-libc-dev/copyright\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/info/linux-libc-dev:amd64.md5sums\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/status\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n }\n ],\n \"language\": \"\",\n \"licenses\": [\n \"GPL-2\"\n ],\n \"cpes\": [\n \"cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc-dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\"\n ],\n \"purl\": \"pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04\",\n \"upstreams\": [\n {\n \"name\": \"linux\"\n }\n ]\n },\n \"appliedIgnoreRules\": [\n {\n \"package\": {\n \"name\": \"linux-libc-dev\",\n \"type\": \"deb\",\n \"upstream-name\": \"linux\"\n },\n \"match-type\": \"exact-indirect-match\"\n }\n ]\n}",
951
+ "refs": [
952
+ {
953
+ "url": "https://ubuntu.com/security/CVE-2012-4542"
954
+ },
955
+ {
956
+ "url": "http://marc.info/?l=linux-kernel\u0026m=135903967015813\u0026w=2"
957
+ },
958
+ {
959
+ "url": "http://marc.info/?l=linux-kernel\u0026m=135904012416042\u0026w=2"
960
+ },
961
+ {
962
+ "url": "http://rhn.redhat.com/errata/RHSA-2013-0496.html"
963
+ },
964
+ {
965
+ "url": "http://rhn.redhat.com/errata/RHSA-2013-0579.html"
966
+ },
967
+ {
968
+ "url": "http://rhn.redhat.com/errata/RHSA-2013-0882.html"
969
+ },
970
+ {
971
+ "url": "http://rhn.redhat.com/errata/RHSA-2013-0928.html"
972
+ },
973
+ {
974
+ "url": "https://bugzilla.redhat.com/show_bug.cgi?id=875360"
975
+ },
976
+ {
977
+ "url": "https://oss.oracle.com/git/?p=redpatch.git%3Ba=commit%3Bh=76a274e17114abf1a77de6b651424648ce9e10c8"
978
+ }
979
+ ],
980
+ "title": "Grype found a vulnerability to CVE-2012-4542 in tensorflow/tensorflow:latest",
981
+ "verificationMethod": "automated"
982
+ },
983
+ {
984
+ "affectedPackages": [
985
+ {
986
+ "cpe": "cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*",
987
+ "ecosystem": "deb",
988
+ "name": "linux-libc-dev",
989
+ "purl": "pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04",
990
+ "version": "5.15.0-113.123"
991
+ }
992
+ ],
993
+ "descriptions": [
994
+ {
995
+ "data": "The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated by JavaScript code that creates many CANVAS elements for rendering by Chrome or Firefox.",
996
+ "label": "default"
997
+ },
998
+ {
999
+ "data": "vulnerability is not-fixed",
1000
+ "label": "fix"
1001
+ },
1002
+ {
1003
+ "data": "{\"related\":[{\"id\":\"CVE-2013-7445\",\"dataSource\":\"https://nvd.nist.gov/vuln/detail/CVE-2013-7445\",\"cvss\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"2.0\",\"vector\":\"AV:N/AC:L/Au:N/C:N/I:N/A:C\",\"metrics\":{\"baseScore\":7.8,\"exploitabilityScore\":10,\"impactScore\":6.9},\"vendorMetadata\":{}}]}]}",
1004
+ "label": "check"
1005
+ }
1006
+ ],
1007
+ "results": [
1008
+ {
1009
+ "codeDesc": "Package: linux-libc-dev@5.15.0-113.123 | Type: deb | Location: /usr/share/doc/linux-libc-dev/copyright | Match Type: exact-indirect-match",
1010
+ "message": "This vulnerability was ignored by configured rules. Severity: Medium vulnerability is not-fixed",
1011
+ "startTime": "2024-08-29T17:31:15.474Z",
1012
+ "status": "notReviewed"
1013
+ }
1014
+ ],
1015
+ "id": "Grype-Ignored-Match/CVE-2013-7445",
1016
+ "impact": 0.5,
1017
+ "tags": {
1018
+ "cci": [
1019
+ "CCI-001643",
1020
+ "CCI-003173"
1021
+ ],
1022
+ "nist": [
1023
+ "SA-11",
1024
+ "RA-5"
1025
+ ]
1026
+ },
1027
+ "code": "{\n \"vulnerability\": {\n \"id\": \"CVE-2013-7445\",\n \"dataSource\": \"https://ubuntu.com/security/CVE-2013-7445\",\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"severity\": \"Medium\",\n \"urls\": [\n \"https://ubuntu.com/security/CVE-2013-7445\"\n ],\n \"cvss\": [],\n \"fix\": {\n \"versions\": [],\n \"state\": \"not-fixed\"\n },\n \"advisories\": []\n },\n \"relatedVulnerabilities\": [\n {\n \"id\": \"CVE-2013-7445\",\n \"dataSource\": \"https://nvd.nist.gov/vuln/detail/CVE-2013-7445\",\n \"namespace\": \"nvd:cpe\",\n \"severity\": \"High\",\n \"urls\": [\n \"https://bugzilla.kernel.org/show_bug.cgi?id=60533\"\n ],\n \"description\": \"The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated by JavaScript code that creates many CANVAS elements for rendering by Chrome or Firefox.\",\n \"cvss\": [\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"2.0\",\n \"vector\": \"AV:N/AC:L/Au:N/C:N/I:N/A:C\",\n \"metrics\": {\n \"baseScore\": 7.8,\n \"exploitabilityScore\": 10,\n \"impactScore\": 6.9\n },\n \"vendorMetadata\": {}\n }\n ]\n }\n ],\n \"matchDetails\": [\n {\n \"type\": \"exact-indirect-match\",\n \"matcher\": \"dpkg-matcher\",\n \"searchedBy\": {\n \"distro\": {\n \"type\": \"ubuntu\",\n \"version\": \"22.04\"\n },\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"package\": {\n \"name\": \"linux\",\n \"version\": \"5.15.0-113.123\"\n }\n },\n \"found\": {\n \"versionConstraint\": \"none (deb)\",\n \"vulnerabilityID\": \"CVE-2013-7445\"\n }\n }\n ],\n \"artifact\": {\n \"id\": \"ae4822e3cd5a96ea\",\n \"name\": \"linux-libc-dev\",\n \"version\": \"5.15.0-113.123\",\n \"type\": \"deb\",\n \"locations\": [\n {\n \"path\": \"/usr/share/doc/linux-libc-dev/copyright\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/info/linux-libc-dev:amd64.md5sums\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/status\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n }\n ],\n \"language\": \"\",\n \"licenses\": [\n \"GPL-2\"\n ],\n \"cpes\": [\n \"cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc-dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\"\n ],\n \"purl\": \"pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04\",\n \"upstreams\": [\n {\n \"name\": \"linux\"\n }\n ]\n },\n \"appliedIgnoreRules\": [\n {\n \"package\": {\n \"name\": \"linux-libc-dev\",\n \"type\": \"deb\",\n \"upstream-name\": \"linux\"\n },\n \"match-type\": \"exact-indirect-match\"\n }\n ]\n}",
1028
+ "refs": [
1029
+ {
1030
+ "url": "https://ubuntu.com/security/CVE-2013-7445"
1031
+ },
1032
+ {
1033
+ "url": "https://bugzilla.kernel.org/show_bug.cgi?id=60533"
1034
+ }
1035
+ ],
1036
+ "title": "Grype found a vulnerability to CVE-2013-7445 in tensorflow/tensorflow:latest",
1037
+ "verificationMethod": "automated"
1038
+ },
1039
+ {
1040
+ "affectedPackages": [
1041
+ {
1042
+ "cpe": "cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*",
1043
+ "ecosystem": "deb",
1044
+ "name": "linux-libc-dev",
1045
+ "purl": "pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04",
1046
+ "version": "5.15.0-113.123"
1047
+ }
1048
+ ],
1049
+ "descriptions": [
1050
+ {
1051
+ "data": "Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory by not enabling memory and I/O decoding control bits. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0777.",
1052
+ "label": "default"
1053
+ },
1054
+ {
1055
+ "data": "vulnerability is not-fixed",
1056
+ "label": "fix"
1057
+ },
1058
+ {
1059
+ "data": "{\"related\":[{\"id\":\"CVE-2015-8553\",\"dataSource\":\"https://nvd.nist.gov/vuln/detail/CVE-2015-8553\",\"cvss\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"2.0\",\"vector\":\"AV:L/AC:L/Au:N/C:P/I:N/A:N\",\"metrics\":{\"baseScore\":2.1,\"exploitabilityScore\":3.9,\"impactScore\":2.9},\"vendorMetadata\":{}},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"3.0\",\"vector\":\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\",\"metrics\":{\"baseScore\":6.5,\"exploitabilityScore\":2,\"impactScore\":4},\"vendorMetadata\":{}}]}]}",
1060
+ "label": "check"
1061
+ }
1062
+ ],
1063
+ "results": [
1064
+ {
1065
+ "codeDesc": "Package: linux-libc-dev@5.15.0-113.123 | Type: deb | Location: /usr/share/doc/linux-libc-dev/copyright | Match Type: exact-indirect-match",
1066
+ "message": "This vulnerability was ignored by configured rules. Severity: Medium vulnerability is not-fixed",
1067
+ "startTime": "2024-08-29T17:31:15.474Z",
1068
+ "status": "notReviewed"
1069
+ }
1070
+ ],
1071
+ "id": "Grype-Ignored-Match/CVE-2015-8553",
1072
+ "impact": 0.5,
1073
+ "tags": {
1074
+ "cci": [
1075
+ "CCI-001643",
1076
+ "CCI-003173"
1077
+ ],
1078
+ "nist": [
1079
+ "SA-11",
1080
+ "RA-5"
1081
+ ]
1082
+ },
1083
+ "code": "{\n \"vulnerability\": {\n \"id\": \"CVE-2015-8553\",\n \"dataSource\": \"https://ubuntu.com/security/CVE-2015-8553\",\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"severity\": \"Medium\",\n \"urls\": [\n \"https://ubuntu.com/security/CVE-2015-8553\"\n ],\n \"cvss\": [],\n \"fix\": {\n \"versions\": [],\n \"state\": \"not-fixed\"\n },\n \"advisories\": []\n },\n \"relatedVulnerabilities\": [\n {\n \"id\": \"CVE-2015-8553\",\n \"dataSource\": \"https://nvd.nist.gov/vuln/detail/CVE-2015-8553\",\n \"namespace\": \"nvd:cpe\",\n \"severity\": \"Medium\",\n \"urls\": [\n \"http://xenbits.xen.org/xsa/advisory-120.html\",\n \"https://seclists.org/bugtraq/2019/Aug/18\",\n \"https://www.debian.org/security/2019/dsa-4497\"\n ],\n \"description\": \"Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory by not enabling memory and I/O decoding control bits. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0777.\",\n \"cvss\": [\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"2.0\",\n \"vector\": \"AV:L/AC:L/Au:N/C:P/I:N/A:N\",\n \"metrics\": {\n \"baseScore\": 2.1,\n \"exploitabilityScore\": 3.9,\n \"impactScore\": 2.9\n },\n \"vendorMetadata\": {}\n },\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"3.0\",\n \"vector\": \"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\",\n \"metrics\": {\n \"baseScore\": 6.5,\n \"exploitabilityScore\": 2,\n \"impactScore\": 4\n },\n \"vendorMetadata\": {}\n }\n ]\n }\n ],\n \"matchDetails\": [\n {\n \"type\": \"exact-indirect-match\",\n \"matcher\": \"dpkg-matcher\",\n \"searchedBy\": {\n \"distro\": {\n \"type\": \"ubuntu\",\n \"version\": \"22.04\"\n },\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"package\": {\n \"name\": \"linux\",\n \"version\": \"5.15.0-113.123\"\n }\n },\n \"found\": {\n \"versionConstraint\": \"none (deb)\",\n \"vulnerabilityID\": \"CVE-2015-8553\"\n }\n }\n ],\n \"artifact\": {\n \"id\": \"ae4822e3cd5a96ea\",\n \"name\": \"linux-libc-dev\",\n \"version\": \"5.15.0-113.123\",\n \"type\": \"deb\",\n \"locations\": [\n {\n \"path\": \"/usr/share/doc/linux-libc-dev/copyright\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/info/linux-libc-dev:amd64.md5sums\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/status\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n }\n ],\n \"language\": \"\",\n \"licenses\": [\n \"GPL-2\"\n ],\n \"cpes\": [\n \"cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc-dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\"\n ],\n \"purl\": \"pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04\",\n \"upstreams\": [\n {\n \"name\": \"linux\"\n }\n ]\n },\n \"appliedIgnoreRules\": [\n {\n \"package\": {\n \"name\": \"linux-libc-dev\",\n \"type\": \"deb\",\n \"upstream-name\": \"linux\"\n },\n \"match-type\": \"exact-indirect-match\"\n }\n ]\n}",
1084
+ "refs": [
1085
+ {
1086
+ "url": "https://ubuntu.com/security/CVE-2015-8553"
1087
+ },
1088
+ {
1089
+ "url": "http://xenbits.xen.org/xsa/advisory-120.html"
1090
+ },
1091
+ {
1092
+ "url": "https://seclists.org/bugtraq/2019/Aug/18"
1093
+ },
1094
+ {
1095
+ "url": "https://www.debian.org/security/2019/dsa-4497"
1096
+ }
1097
+ ],
1098
+ "title": "Grype found a vulnerability to CVE-2015-8553 in tensorflow/tensorflow:latest",
1099
+ "verificationMethod": "automated"
1100
+ },
1101
+ {
1102
+ "affectedPackages": [
1103
+ {
1104
+ "cpe": "cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*",
1105
+ "ecosystem": "deb",
1106
+ "name": "linux-libc-dev",
1107
+ "purl": "pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04",
1108
+ "version": "5.15.0-113.123"
1109
+ }
1110
+ ],
1111
+ "descriptions": [
1112
+ {
1113
+ "data": "An information disclosure vulnerability in the kernel USB gadget driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-31614969.",
1114
+ "label": "default"
1115
+ },
1116
+ {
1117
+ "data": "vulnerability is not-fixed",
1118
+ "label": "fix"
1119
+ },
1120
+ {
1121
+ "data": "{\"related\":[{\"id\":\"CVE-2017-0537\",\"dataSource\":\"https://nvd.nist.gov/vuln/detail/CVE-2017-0537\",\"cvss\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"2.0\",\"vector\":\"AV:N/AC:H/Au:N/C:P/I:N/A:N\",\"metrics\":{\"baseScore\":2.6,\"exploitabilityScore\":4.9,\"impactScore\":2.9},\"vendorMetadata\":{}},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"3.0\",\"vector\":\"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N\",\"metrics\":{\"baseScore\":4.7,\"exploitabilityScore\":1,\"impactScore\":3.6},\"vendorMetadata\":{}}]}]}",
1122
+ "label": "check"
1123
+ }
1124
+ ],
1125
+ "results": [
1126
+ {
1127
+ "codeDesc": "Package: linux-libc-dev@5.15.0-113.123 | Type: deb | Location: /usr/share/doc/linux-libc-dev/copyright | Match Type: exact-indirect-match",
1128
+ "message": "This vulnerability was ignored by configured rules. Severity: Low vulnerability is not-fixed",
1129
+ "startTime": "2024-08-29T17:31:15.474Z",
1130
+ "status": "notReviewed"
1131
+ }
1132
+ ],
1133
+ "id": "Grype-Ignored-Match/CVE-2017-0537",
1134
+ "impact": 0.3,
1135
+ "tags": {
1136
+ "cci": [
1137
+ "CCI-001643",
1138
+ "CCI-003173"
1139
+ ],
1140
+ "nist": [
1141
+ "SA-11",
1142
+ "RA-5"
1143
+ ]
1144
+ },
1145
+ "code": "{\n \"vulnerability\": {\n \"id\": \"CVE-2017-0537\",\n \"dataSource\": \"https://ubuntu.com/security/CVE-2017-0537\",\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"severity\": \"Low\",\n \"urls\": [\n \"https://ubuntu.com/security/CVE-2017-0537\"\n ],\n \"cvss\": [],\n \"fix\": {\n \"versions\": [],\n \"state\": \"not-fixed\"\n },\n \"advisories\": []\n },\n \"relatedVulnerabilities\": [\n {\n \"id\": \"CVE-2017-0537\",\n \"dataSource\": \"https://nvd.nist.gov/vuln/detail/CVE-2017-0537\",\n \"namespace\": \"nvd:cpe\",\n \"severity\": \"Medium\",\n \"urls\": [\n \"http://www.securityfocus.com/bid/96831\",\n \"http://www.securitytracker.com/id/1037968\",\n \"https://source.android.com/security/bulletin/2017-03-01\",\n \"https://source.android.com/security/bulletin/2017-03-01.html\"\n ],\n \"description\": \"An information disclosure vulnerability in the kernel USB gadget driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-31614969.\",\n \"cvss\": [\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"2.0\",\n \"vector\": \"AV:N/AC:H/Au:N/C:P/I:N/A:N\",\n \"metrics\": {\n \"baseScore\": 2.6,\n \"exploitabilityScore\": 4.9,\n \"impactScore\": 2.9\n },\n \"vendorMetadata\": {}\n },\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"3.0\",\n \"vector\": \"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N\",\n \"metrics\": {\n \"baseScore\": 4.7,\n \"exploitabilityScore\": 1,\n \"impactScore\": 3.6\n },\n \"vendorMetadata\": {}\n }\n ]\n }\n ],\n \"matchDetails\": [\n {\n \"type\": \"exact-indirect-match\",\n \"matcher\": \"dpkg-matcher\",\n \"searchedBy\": {\n \"distro\": {\n \"type\": \"ubuntu\",\n \"version\": \"22.04\"\n },\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"package\": {\n \"name\": \"linux\",\n \"version\": \"5.15.0-113.123\"\n }\n },\n \"found\": {\n \"versionConstraint\": \"none (deb)\",\n \"vulnerabilityID\": \"CVE-2017-0537\"\n }\n }\n ],\n \"artifact\": {\n \"id\": \"ae4822e3cd5a96ea\",\n \"name\": \"linux-libc-dev\",\n \"version\": \"5.15.0-113.123\",\n \"type\": \"deb\",\n \"locations\": [\n {\n \"path\": \"/usr/share/doc/linux-libc-dev/copyright\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/info/linux-libc-dev:amd64.md5sums\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/status\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n }\n ],\n \"language\": \"\",\n \"licenses\": [\n \"GPL-2\"\n ],\n \"cpes\": [\n \"cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc-dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\"\n ],\n \"purl\": \"pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04\",\n \"upstreams\": [\n {\n \"name\": \"linux\"\n }\n ]\n },\n \"appliedIgnoreRules\": [\n {\n \"package\": {\n \"name\": \"linux-libc-dev\",\n \"type\": \"deb\",\n \"upstream-name\": \"linux\"\n },\n \"match-type\": \"exact-indirect-match\"\n }\n ]\n}",
1146
+ "refs": [
1147
+ {
1148
+ "url": "https://ubuntu.com/security/CVE-2017-0537"
1149
+ },
1150
+ {
1151
+ "url": "http://www.securityfocus.com/bid/96831"
1152
+ },
1153
+ {
1154
+ "url": "http://www.securitytracker.com/id/1037968"
1155
+ },
1156
+ {
1157
+ "url": "https://source.android.com/security/bulletin/2017-03-01"
1158
+ },
1159
+ {
1160
+ "url": "https://source.android.com/security/bulletin/2017-03-01.html"
1161
+ }
1162
+ ],
1163
+ "title": "Grype found a vulnerability to CVE-2017-0537 in tensorflow/tensorflow:latest",
1164
+ "verificationMethod": "automated"
1165
+ },
1166
+ {
1167
+ "affectedPackages": [
1168
+ {
1169
+ "cpe": "cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*",
1170
+ "ecosystem": "deb",
1171
+ "name": "linux-libc-dev",
1172
+ "purl": "pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04",
1173
+ "version": "5.15.0-113.123"
1174
+ }
1175
+ ],
1176
+ "descriptions": [
1177
+ {
1178
+ "data": "An elevation of privilege vulnerability in the kernel file system. Product: Android. Versions: Android kernel. Android ID A-31269937.",
1179
+ "label": "default"
1180
+ },
1181
+ {
1182
+ "data": "vulnerability is not-fixed",
1183
+ "label": "fix"
1184
+ },
1185
+ {
1186
+ "data": "{\"related\":[{\"id\":\"CVE-2017-13165\",\"dataSource\":\"https://nvd.nist.gov/vuln/detail/CVE-2017-13165\",\"cvss\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"2.0\",\"vector\":\"AV:L/AC:L/Au:N/C:P/I:P/A:P\",\"metrics\":{\"baseScore\":4.6,\"exploitabilityScore\":3.9,\"impactScore\":6.4},\"vendorMetadata\":{}},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"3.0\",\"vector\":\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"metrics\":{\"baseScore\":7.8,\"exploitabilityScore\":1.8,\"impactScore\":5.9},\"vendorMetadata\":{}}]}]}",
1187
+ "label": "check"
1188
+ }
1189
+ ],
1190
+ "results": [
1191
+ {
1192
+ "codeDesc": "Package: linux-libc-dev@5.15.0-113.123 | Type: deb | Location: /usr/share/doc/linux-libc-dev/copyright | Match Type: exact-indirect-match",
1193
+ "message": "This vulnerability was ignored by configured rules. Severity: Negligible vulnerability is not-fixed",
1194
+ "startTime": "2024-08-29T17:31:15.474Z",
1195
+ "status": "notReviewed"
1196
+ }
1197
+ ],
1198
+ "id": "Grype-Ignored-Match/CVE-2017-13165",
1199
+ "impact": 0,
1200
+ "tags": {
1201
+ "cci": [
1202
+ "CCI-001643",
1203
+ "CCI-003173"
1204
+ ],
1205
+ "nist": [
1206
+ "SA-11",
1207
+ "RA-5"
1208
+ ]
1209
+ },
1210
+ "code": "{\n \"vulnerability\": {\n \"id\": \"CVE-2017-13165\",\n \"dataSource\": \"https://ubuntu.com/security/CVE-2017-13165\",\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"severity\": \"Negligible\",\n \"urls\": [\n \"https://ubuntu.com/security/CVE-2017-13165\"\n ],\n \"cvss\": [],\n \"fix\": {\n \"versions\": [],\n \"state\": \"not-fixed\"\n },\n \"advisories\": []\n },\n \"relatedVulnerabilities\": [\n {\n \"id\": \"CVE-2017-13165\",\n \"dataSource\": \"https://nvd.nist.gov/vuln/detail/CVE-2017-13165\",\n \"namespace\": \"nvd:cpe\",\n \"severity\": \"High\",\n \"urls\": [\n \"https://source.android.com/security/bulletin/pixel/2017-12-01\"\n ],\n \"description\": \"An elevation of privilege vulnerability in the kernel file system. Product: Android. Versions: Android kernel. Android ID A-31269937.\",\n \"cvss\": [\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"2.0\",\n \"vector\": \"AV:L/AC:L/Au:N/C:P/I:P/A:P\",\n \"metrics\": {\n \"baseScore\": 4.6,\n \"exploitabilityScore\": 3.9,\n \"impactScore\": 6.4\n },\n \"vendorMetadata\": {}\n },\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"3.0\",\n \"vector\": \"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\n \"metrics\": {\n \"baseScore\": 7.8,\n \"exploitabilityScore\": 1.8,\n \"impactScore\": 5.9\n },\n \"vendorMetadata\": {}\n }\n ]\n }\n ],\n \"matchDetails\": [\n {\n \"type\": \"exact-indirect-match\",\n \"matcher\": \"dpkg-matcher\",\n \"searchedBy\": {\n \"distro\": {\n \"type\": \"ubuntu\",\n \"version\": \"22.04\"\n },\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"package\": {\n \"name\": \"linux\",\n \"version\": \"5.15.0-113.123\"\n }\n },\n \"found\": {\n \"versionConstraint\": \"none (deb)\",\n \"vulnerabilityID\": \"CVE-2017-13165\"\n }\n }\n ],\n \"artifact\": {\n \"id\": \"ae4822e3cd5a96ea\",\n \"name\": \"linux-libc-dev\",\n \"version\": \"5.15.0-113.123\",\n \"type\": \"deb\",\n \"locations\": [\n {\n \"path\": \"/usr/share/doc/linux-libc-dev/copyright\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/info/linux-libc-dev:amd64.md5sums\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/status\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n }\n ],\n \"language\": \"\",\n \"licenses\": [\n \"GPL-2\"\n ],\n \"cpes\": [\n \"cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc-dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\"\n ],\n \"purl\": \"pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04\",\n \"upstreams\": [\n {\n \"name\": \"linux\"\n }\n ]\n },\n \"appliedIgnoreRules\": [\n {\n \"package\": {\n \"name\": \"linux-libc-dev\",\n \"type\": \"deb\",\n \"upstream-name\": \"linux\"\n },\n \"match-type\": \"exact-indirect-match\"\n }\n ]\n}",
1211
+ "refs": [
1212
+ {
1213
+ "url": "https://ubuntu.com/security/CVE-2017-13165"
1214
+ },
1215
+ {
1216
+ "url": "https://source.android.com/security/bulletin/pixel/2017-12-01"
1217
+ }
1218
+ ],
1219
+ "title": "Grype found a vulnerability to CVE-2017-13165 in tensorflow/tensorflow:latest",
1220
+ "verificationMethod": "automated"
1221
+ },
1222
+ {
1223
+ "affectedPackages": [
1224
+ {
1225
+ "cpe": "cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*",
1226
+ "ecosystem": "deb",
1227
+ "name": "linux-libc-dev",
1228
+ "purl": "pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04",
1229
+ "version": "5.15.0-113.123"
1230
+ }
1231
+ ],
1232
+ "descriptions": [
1233
+ {
1234
+ "data": "The acpi_ds_create_operands() function in drivers/acpi/acpica/dsutils.c in the Linux kernel through 4.12.9 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table.",
1235
+ "label": "default"
1236
+ },
1237
+ {
1238
+ "data": "vulnerability is not-fixed",
1239
+ "label": "fix"
1240
+ },
1241
+ {
1242
+ "data": "{\"related\":[{\"id\":\"CVE-2017-13693\",\"dataSource\":\"https://nvd.nist.gov/vuln/detail/CVE-2017-13693\",\"cvss\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"2.0\",\"vector\":\"AV:L/AC:L/Au:N/C:C/I:N/A:N\",\"metrics\":{\"baseScore\":4.9,\"exploitabilityScore\":3.9,\"impactScore\":6.9},\"vendorMetadata\":{}},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"3.0\",\"vector\":\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"metrics\":{\"baseScore\":5.5,\"exploitabilityScore\":1.8,\"impactScore\":3.6},\"vendorMetadata\":{}}]}]}",
1243
+ "label": "check"
1244
+ }
1245
+ ],
1246
+ "results": [
1247
+ {
1248
+ "codeDesc": "Package: linux-libc-dev@5.15.0-113.123 | Type: deb | Location: /usr/share/doc/linux-libc-dev/copyright | Match Type: exact-indirect-match",
1249
+ "message": "This vulnerability was ignored by configured rules. Severity: Negligible vulnerability is not-fixed",
1250
+ "startTime": "2024-08-29T17:31:15.474Z",
1251
+ "status": "notReviewed"
1252
+ }
1253
+ ],
1254
+ "id": "Grype-Ignored-Match/CVE-2017-13693",
1255
+ "impact": 0,
1256
+ "tags": {
1257
+ "cci": [
1258
+ "CCI-001643",
1259
+ "CCI-003173"
1260
+ ],
1261
+ "nist": [
1262
+ "SA-11",
1263
+ "RA-5"
1264
+ ]
1265
+ },
1266
+ "code": "{\n \"vulnerability\": {\n \"id\": \"CVE-2017-13693\",\n \"dataSource\": \"https://ubuntu.com/security/CVE-2017-13693\",\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"severity\": \"Negligible\",\n \"urls\": [\n \"https://ubuntu.com/security/CVE-2017-13693\"\n ],\n \"cvss\": [],\n \"fix\": {\n \"versions\": [],\n \"state\": \"not-fixed\"\n },\n \"advisories\": []\n },\n \"relatedVulnerabilities\": [\n {\n \"id\": \"CVE-2017-13693\",\n \"dataSource\": \"https://nvd.nist.gov/vuln/detail/CVE-2017-13693\",\n \"namespace\": \"nvd:cpe\",\n \"severity\": \"Medium\",\n \"urls\": [\n \"http://www.securityfocus.com/bid/100502\",\n \"https://github.com/acpica/acpica/pull/295/commits/987a3b5cf7175916e2a4b6ea5b8e70f830dfe732\",\n \"https://patchwork.kernel.org/patch/9919053/\"\n ],\n \"description\": \"The acpi_ds_create_operands() function in drivers/acpi/acpica/dsutils.c in the Linux kernel through 4.12.9 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table.\",\n \"cvss\": [\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"2.0\",\n \"vector\": \"AV:L/AC:L/Au:N/C:C/I:N/A:N\",\n \"metrics\": {\n \"baseScore\": 4.9,\n \"exploitabilityScore\": 3.9,\n \"impactScore\": 6.9\n },\n \"vendorMetadata\": {}\n },\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"3.0\",\n \"vector\": \"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\n \"metrics\": {\n \"baseScore\": 5.5,\n \"exploitabilityScore\": 1.8,\n \"impactScore\": 3.6\n },\n \"vendorMetadata\": {}\n }\n ]\n }\n ],\n \"matchDetails\": [\n {\n \"type\": \"exact-indirect-match\",\n \"matcher\": \"dpkg-matcher\",\n \"searchedBy\": {\n \"distro\": {\n \"type\": \"ubuntu\",\n \"version\": \"22.04\"\n },\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"package\": {\n \"name\": \"linux\",\n \"version\": \"5.15.0-113.123\"\n }\n },\n \"found\": {\n \"versionConstraint\": \"none (deb)\",\n \"vulnerabilityID\": \"CVE-2017-13693\"\n }\n }\n ],\n \"artifact\": {\n \"id\": \"ae4822e3cd5a96ea\",\n \"name\": \"linux-libc-dev\",\n \"version\": \"5.15.0-113.123\",\n \"type\": \"deb\",\n \"locations\": [\n {\n \"path\": \"/usr/share/doc/linux-libc-dev/copyright\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/info/linux-libc-dev:amd64.md5sums\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/status\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n }\n ],\n \"language\": \"\",\n \"licenses\": [\n \"GPL-2\"\n ],\n \"cpes\": [\n \"cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc-dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\"\n ],\n \"purl\": \"pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04\",\n \"upstreams\": [\n {\n \"name\": \"linux\"\n }\n ]\n },\n \"appliedIgnoreRules\": [\n {\n \"package\": {\n \"name\": \"linux-libc-dev\",\n \"type\": \"deb\",\n \"upstream-name\": \"linux\"\n },\n \"match-type\": \"exact-indirect-match\"\n }\n ]\n}",
1267
+ "refs": [
1268
+ {
1269
+ "url": "https://ubuntu.com/security/CVE-2017-13693"
1270
+ },
1271
+ {
1272
+ "url": "http://www.securityfocus.com/bid/100502"
1273
+ },
1274
+ {
1275
+ "url": "https://github.com/acpica/acpica/pull/295/commits/987a3b5cf7175916e2a4b6ea5b8e70f830dfe732"
1276
+ },
1277
+ {
1278
+ "url": "https://patchwork.kernel.org/patch/9919053/"
1279
+ }
1280
+ ],
1281
+ "title": "Grype found a vulnerability to CVE-2017-13693 in tensorflow/tensorflow:latest",
1282
+ "verificationMethod": "automated"
1283
+ },
1284
+ {
1285
+ "affectedPackages": [
1286
+ {
1287
+ "cpe": "cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*",
1288
+ "ecosystem": "deb",
1289
+ "fixedInVersion": "5.15.0-116.126",
1290
+ "name": "linux-libc-dev",
1291
+ "purl": "pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04",
1292
+ "version": "5.15.0-113.123"
1293
+ }
1294
+ ],
1295
+ "descriptions": [
1296
+ {
1297
+ "data": "A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).",
1298
+ "label": "default"
1299
+ },
1300
+ {
1301
+ "data": "vulnerability is fixed for versions 5.15.0-116.126",
1302
+ "label": "fix"
1303
+ },
1304
+ {
1305
+ "data": "{\"related\":[{\"id\":\"CVE-2022-38096\",\"dataSource\":\"https://nvd.nist.gov/vuln/detail/CVE-2022-38096\",\"cvss\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"3.1\",\"vector\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"metrics\":{\"baseScore\":5.5,\"exploitabilityScore\":1.8,\"impactScore\":3.6},\"vendorMetadata\":{}},{\"source\":\"security@openanolis.org\",\"type\":\"Secondary\",\"version\":\"3.1\",\"vector\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H\",\"metrics\":{\"baseScore\":6.3,\"exploitabilityScore\":2.1,\"impactScore\":4.2},\"vendorMetadata\":{}}]}]}",
1306
+ "label": "check"
1307
+ }
1308
+ ],
1309
+ "results": [
1310
+ {
1311
+ "codeDesc": "Package: linux-libc-dev@5.15.0-113.123 | Type: deb | Location: /usr/share/doc/linux-libc-dev/copyright | Match Type: exact-indirect-match",
1312
+ "message": "This vulnerability was ignored by configured rules. Severity: Medium vulnerability is fixed for versions 5.15.0-116.126",
1313
+ "startTime": "2024-08-29T17:31:15.474Z",
1314
+ "status": "notReviewed"
1315
+ }
1316
+ ],
1317
+ "id": "Grype-Ignored-Match/CVE-2022-38096",
1318
+ "impact": 0.5,
1319
+ "tags": {
1320
+ "cci": [
1321
+ "CCI-001643",
1322
+ "CCI-003173"
1323
+ ],
1324
+ "nist": [
1325
+ "SA-11",
1326
+ "RA-5"
1327
+ ]
1328
+ },
1329
+ "code": "{\n \"vulnerability\": {\n \"id\": \"CVE-2022-38096\",\n \"dataSource\": \"https://ubuntu.com/security/CVE-2022-38096\",\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"severity\": \"Medium\",\n \"urls\": [\n \"https://ubuntu.com/security/CVE-2022-38096\"\n ],\n \"cvss\": [],\n \"fix\": {\n \"versions\": [\n \"5.15.0-116.126\"\n ],\n \"state\": \"fixed\"\n },\n \"advisories\": []\n },\n \"relatedVulnerabilities\": [\n {\n \"id\": \"CVE-2022-38096\",\n \"dataSource\": \"https://nvd.nist.gov/vuln/detail/CVE-2022-38096\",\n \"namespace\": \"nvd:cpe\",\n \"severity\": \"Medium\",\n \"urls\": [\n \"https://bugzilla.openanolis.cn/show_bug.cgi?id=2073\",\n \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\"\n ],\n \"description\": \"A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).\",\n \"cvss\": [\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"3.1\",\n \"vector\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\n \"metrics\": {\n \"baseScore\": 5.5,\n \"exploitabilityScore\": 1.8,\n \"impactScore\": 3.6\n },\n \"vendorMetadata\": {}\n },\n {\n \"source\": \"security@openanolis.org\",\n \"type\": \"Secondary\",\n \"version\": \"3.1\",\n \"vector\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H\",\n \"metrics\": {\n \"baseScore\": 6.3,\n \"exploitabilityScore\": 2.1,\n \"impactScore\": 4.2\n },\n \"vendorMetadata\": {}\n }\n ]\n }\n ],\n \"matchDetails\": [\n {\n \"type\": \"exact-indirect-match\",\n \"matcher\": \"dpkg-matcher\",\n \"searchedBy\": {\n \"distro\": {\n \"type\": \"ubuntu\",\n \"version\": \"22.04\"\n },\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"package\": {\n \"name\": \"linux\",\n \"version\": \"5.15.0-113.123\"\n }\n },\n \"found\": {\n \"versionConstraint\": \"\u003c 5.15.0-116.126 (deb)\",\n \"vulnerabilityID\": \"CVE-2022-38096\"\n }\n }\n ],\n \"artifact\": {\n \"id\": \"ae4822e3cd5a96ea\",\n \"name\": \"linux-libc-dev\",\n \"version\": \"5.15.0-113.123\",\n \"type\": \"deb\",\n \"locations\": [\n {\n \"path\": \"/usr/share/doc/linux-libc-dev/copyright\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/info/linux-libc-dev:amd64.md5sums\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/status\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n }\n ],\n \"language\": \"\",\n \"licenses\": [\n \"GPL-2\"\n ],\n \"cpes\": [\n \"cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc-dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\"\n ],\n \"purl\": \"pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04\",\n \"upstreams\": [\n {\n \"name\": \"linux\"\n }\n ]\n },\n \"appliedIgnoreRules\": [\n {\n \"package\": {\n \"name\": \"linux-libc-dev\",\n \"type\": \"deb\",\n \"upstream-name\": \"linux\"\n },\n \"match-type\": \"exact-indirect-match\"\n }\n ]\n}",
1330
+ "refs": [
1331
+ {
1332
+ "url": "https://ubuntu.com/security/CVE-2022-38096"
1333
+ },
1334
+ {
1335
+ "url": "https://bugzilla.openanolis.cn/show_bug.cgi?id=2073"
1336
+ },
1337
+ {
1338
+ "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
1339
+ }
1340
+ ],
1341
+ "title": "Grype found a vulnerability to CVE-2022-38096 in tensorflow/tensorflow:latest",
1342
+ "verificationMethod": "automated"
1343
+ },
1344
+ {
1345
+ "affectedPackages": [
1346
+ {
1347
+ "cpe": "cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*",
1348
+ "ecosystem": "deb",
1349
+ "name": "linux-libc-dev",
1350
+ "purl": "pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04",
1351
+ "version": "5.15.0-113.123"
1352
+ }
1353
+ ],
1354
+ "descriptions": [
1355
+ {
1356
+ "data": "\n\n\nA side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled address, potentially leading to information disclosure.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n",
1357
+ "label": "default"
1358
+ },
1359
+ {
1360
+ "data": "vulnerability is not-fixed",
1361
+ "label": "fix"
1362
+ },
1363
+ {
1364
+ "data": "{\"related\":[{\"id\":\"CVE-2023-20569\",\"dataSource\":\"https://nvd.nist.gov/vuln/detail/CVE-2023-20569\",\"cvss\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"3.1\",\"vector\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"metrics\":{\"baseScore\":4.7,\"exploitabilityScore\":1,\"impactScore\":3.6},\"vendorMetadata\":{}}]}]}",
1365
+ "label": "check"
1366
+ }
1367
+ ],
1368
+ "results": [
1369
+ {
1370
+ "codeDesc": "Package: linux-libc-dev@5.15.0-113.123 | Type: deb | Location: /usr/share/doc/linux-libc-dev/copyright | Match Type: exact-indirect-match",
1371
+ "message": "This vulnerability was ignored by configured rules. Severity: High vulnerability is not-fixed",
1372
+ "startTime": "2024-08-29T17:31:15.474Z",
1373
+ "status": "notReviewed"
1374
+ }
1375
+ ],
1376
+ "id": "Grype-Ignored-Match/CVE-2023-20569",
1377
+ "impact": 0.7,
1378
+ "tags": {
1379
+ "cci": [
1380
+ "CCI-001643",
1381
+ "CCI-003173"
1382
+ ],
1383
+ "nist": [
1384
+ "SA-11",
1385
+ "RA-5"
1386
+ ]
1387
+ },
1388
+ "code": "{\n \"vulnerability\": {\n \"id\": \"CVE-2023-20569\",\n \"dataSource\": \"https://ubuntu.com/security/CVE-2023-20569\",\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"severity\": \"High\",\n \"urls\": [\n \"https://ubuntu.com/security/CVE-2023-20569\"\n ],\n \"cvss\": [],\n \"fix\": {\n \"versions\": [],\n \"state\": \"not-fixed\"\n },\n \"advisories\": []\n },\n \"relatedVulnerabilities\": [\n {\n \"id\": \"CVE-2023-20569\",\n \"dataSource\": \"https://nvd.nist.gov/vuln/detail/CVE-2023-20569\",\n \"namespace\": \"nvd:cpe\",\n \"severity\": \"Medium\",\n \"urls\": [\n \"http://www.openwall.com/lists/oss-security/2023/08/08/4\",\n \"http://xenbits.xen.org/xsa/advisory-434.html\",\n \"https://comsec.ethz.ch/research/microarch/inception/\",\n \"https://lists.debian.org/debian-lts-announce/2023/08/msg00013.html\",\n \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HKKYIK2EASDNUV4I7EFJKNBVO3KCKGRR/\",\n \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L4E4TZNMLYL2KETY23IPA43QXFAVJ46V/\",\n \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKK3IA63LSKM4EC3TN4UM6DDEIOWEQIG/\",\n \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7WO5JM74YJSYAE5RBV4DC6A4YLEKWLF/\",\n \"https://security.netapp.com/advisory/ntap-20240605-0006/\",\n \"https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7005\",\n \"https://www.debian.org/security/2023/dsa-5475\"\n ],\n \"description\": \"\\n\\n\\nA side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled address, potentially leading to information disclosure.\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\",\n \"cvss\": [\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"3.1\",\n \"vector\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N\",\n \"metrics\": {\n \"baseScore\": 4.7,\n \"exploitabilityScore\": 1,\n \"impactScore\": 3.6\n },\n \"vendorMetadata\": {}\n }\n ]\n }\n ],\n \"matchDetails\": [\n {\n \"type\": \"exact-indirect-match\",\n \"matcher\": \"dpkg-matcher\",\n \"searchedBy\": {\n \"distro\": {\n \"type\": \"ubuntu\",\n \"version\": \"22.04\"\n },\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"package\": {\n \"name\": \"linux\",\n \"version\": \"5.15.0-113.123\"\n }\n },\n \"found\": {\n \"versionConstraint\": \"none (deb)\",\n \"vulnerabilityID\": \"CVE-2023-20569\"\n }\n }\n ],\n \"artifact\": {\n \"id\": \"ae4822e3cd5a96ea\",\n \"name\": \"linux-libc-dev\",\n \"version\": \"5.15.0-113.123\",\n \"type\": \"deb\",\n \"locations\": [\n {\n \"path\": \"/usr/share/doc/linux-libc-dev/copyright\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/info/linux-libc-dev:amd64.md5sums\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/status\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n }\n ],\n \"language\": \"\",\n \"licenses\": [\n \"GPL-2\"\n ],\n \"cpes\": [\n \"cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc-dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\"\n ],\n \"purl\": \"pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04\",\n \"upstreams\": [\n {\n \"name\": \"linux\"\n }\n ]\n },\n \"appliedIgnoreRules\": [\n {\n \"package\": {\n \"name\": \"linux-libc-dev\",\n \"type\": \"deb\",\n \"upstream-name\": \"linux\"\n },\n \"match-type\": \"exact-indirect-match\"\n }\n ]\n}",
1389
+ "refs": [
1390
+ {
1391
+ "url": "https://ubuntu.com/security/CVE-2023-20569"
1392
+ },
1393
+ {
1394
+ "url": "http://www.openwall.com/lists/oss-security/2023/08/08/4"
1395
+ },
1396
+ {
1397
+ "url": "http://xenbits.xen.org/xsa/advisory-434.html"
1398
+ },
1399
+ {
1400
+ "url": "https://comsec.ethz.ch/research/microarch/inception/"
1401
+ },
1402
+ {
1403
+ "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00013.html"
1404
+ },
1405
+ {
1406
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HKKYIK2EASDNUV4I7EFJKNBVO3KCKGRR/"
1407
+ },
1408
+ {
1409
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L4E4TZNMLYL2KETY23IPA43QXFAVJ46V/"
1410
+ },
1411
+ {
1412
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKK3IA63LSKM4EC3TN4UM6DDEIOWEQIG/"
1413
+ },
1414
+ {
1415
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7WO5JM74YJSYAE5RBV4DC6A4YLEKWLF/"
1416
+ },
1417
+ {
1418
+ "url": "https://security.netapp.com/advisory/ntap-20240605-0006/"
1419
+ },
1420
+ {
1421
+ "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-7005"
1422
+ },
1423
+ {
1424
+ "url": "https://www.debian.org/security/2023/dsa-5475"
1425
+ }
1426
+ ],
1427
+ "title": "Grype found a vulnerability to CVE-2023-20569 in tensorflow/tensorflow:latest",
1428
+ "verificationMethod": "automated"
1429
+ },
1430
+ {
1431
+ "affectedPackages": [
1432
+ {
1433
+ "cpe": "cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*",
1434
+ "ecosystem": "deb",
1435
+ "fixedInVersion": "5.15.0-116.126",
1436
+ "name": "linux-libc-dev",
1437
+ "purl": "pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04",
1438
+ "version": "5.15.0-113.123"
1439
+ }
1440
+ ],
1441
+ "descriptions": [
1442
+ {
1443
+ "data": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO\n\nThe SC16IS7XX IC supports a burst mode to access the FIFOs where the\ninitial register address is sent ($00), followed by all the FIFO data\nwithout having to resend the register address each time. In this mode, the\nIC doesn't increment the register address for each R/W byte.\n\nThe regmap_raw_read() and regmap_raw_write() are functions which can\nperform IO over multiple registers. They are currently used to read/write\nfrom/to the FIFO, and although they operate correctly in this burst mode on\nthe SPI bus, they would corrupt the regmap cache if it was not disabled\nmanually. The reason is that when the R/W size is more than 1 byte, these\nfunctions assume that the register address is incremented and handle the\ncache accordingly.\n\nConvert FIFO R/W functions to use the regmap _noinc_ versions in order to\nremove the manual cache control which was a workaround when using the\n_raw_ versions. FIFO registers are properly declared as volatile so\ncache will not be used/updated for FIFO accesses.",
1444
+ "label": "default"
1445
+ },
1446
+ {
1447
+ "data": "vulnerability is fixed for versions 5.15.0-116.126",
1448
+ "label": "fix"
1449
+ },
1450
+ {
1451
+ "data": "{}",
1452
+ "label": "check"
1453
+ }
1454
+ ],
1455
+ "results": [
1456
+ {
1457
+ "codeDesc": "Package: linux-libc-dev@5.15.0-113.123 | Type: deb | Location: /usr/share/doc/linux-libc-dev/copyright | Match Type: exact-indirect-match",
1458
+ "message": "This vulnerability was ignored by configured rules. Severity: Medium vulnerability is fixed for versions 5.15.0-116.126",
1459
+ "startTime": "2024-08-29T17:31:15.474Z",
1460
+ "status": "notReviewed"
1461
+ }
1462
+ ],
1463
+ "id": "Grype-Ignored-Match/CVE-2023-52488",
1464
+ "impact": 0.5,
1465
+ "tags": {
1466
+ "cci": [
1467
+ "CCI-001643",
1468
+ "CCI-003173"
1469
+ ],
1470
+ "nist": [
1471
+ "SA-11",
1472
+ "RA-5"
1473
+ ]
1474
+ },
1475
+ "code": "{\n \"vulnerability\": {\n \"id\": \"CVE-2023-52488\",\n \"dataSource\": \"https://ubuntu.com/security/CVE-2023-52488\",\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"severity\": \"Medium\",\n \"urls\": [\n \"https://ubuntu.com/security/CVE-2023-52488\"\n ],\n \"cvss\": [],\n \"fix\": {\n \"versions\": [\n \"5.15.0-116.126\"\n ],\n \"state\": \"fixed\"\n },\n \"advisories\": []\n },\n \"relatedVulnerabilities\": [\n {\n \"id\": \"CVE-2023-52488\",\n \"dataSource\": \"https://nvd.nist.gov/vuln/detail/CVE-2023-52488\",\n \"namespace\": \"nvd:cpe\",\n \"severity\": \"Unknown\",\n \"urls\": [\n \"https://git.kernel.org/stable/c/084c24e788d9cf29c55564de368bf5284f2bb5db\",\n \"https://git.kernel.org/stable/c/416b10d2817c94db86829fb92ad43ce7d002c573\",\n \"https://git.kernel.org/stable/c/4e37416e4ee1b1bc17364a68973e0c63be89e611\",\n \"https://git.kernel.org/stable/c/aa7cb4787698add9367b19f7afc667662c9bdb23\",\n \"https://git.kernel.org/stable/c/dbf4ab821804df071c8b566d9813083125e6d97b\",\n \"https://git.kernel.org/stable/c/e635f652696ef6f1230621cfd89c350cb5ec6169\",\n \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\"\n ],\n \"description\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nserial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO\\n\\nThe SC16IS7XX IC supports a burst mode to access the FIFOs where the\\ninitial register address is sent ($00), followed by all the FIFO data\\nwithout having to resend the register address each time. In this mode, the\\nIC doesn't increment the register address for each R/W byte.\\n\\nThe regmap_raw_read() and regmap_raw_write() are functions which can\\nperform IO over multiple registers. They are currently used to read/write\\nfrom/to the FIFO, and although they operate correctly in this burst mode on\\nthe SPI bus, they would corrupt the regmap cache if it was not disabled\\nmanually. The reason is that when the R/W size is more than 1 byte, these\\nfunctions assume that the register address is incremented and handle the\\ncache accordingly.\\n\\nConvert FIFO R/W functions to use the regmap _noinc_ versions in order to\\nremove the manual cache control which was a workaround when using the\\n_raw_ versions. FIFO registers are properly declared as volatile so\\ncache will not be used/updated for FIFO accesses.\",\n \"cvss\": []\n }\n ],\n \"matchDetails\": [\n {\n \"type\": \"exact-indirect-match\",\n \"matcher\": \"dpkg-matcher\",\n \"searchedBy\": {\n \"distro\": {\n \"type\": \"ubuntu\",\n \"version\": \"22.04\"\n },\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"package\": {\n \"name\": \"linux\",\n \"version\": \"5.15.0-113.123\"\n }\n },\n \"found\": {\n \"versionConstraint\": \"\u003c 5.15.0-116.126 (deb)\",\n \"vulnerabilityID\": \"CVE-2023-52488\"\n }\n }\n ],\n \"artifact\": {\n \"id\": \"ae4822e3cd5a96ea\",\n \"name\": \"linux-libc-dev\",\n \"version\": \"5.15.0-113.123\",\n \"type\": \"deb\",\n \"locations\": [\n {\n \"path\": \"/usr/share/doc/linux-libc-dev/copyright\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/info/linux-libc-dev:amd64.md5sums\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/status\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n }\n ],\n \"language\": \"\",\n \"licenses\": [\n \"GPL-2\"\n ],\n \"cpes\": [\n \"cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc-dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\"\n ],\n \"purl\": \"pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04\",\n \"upstreams\": [\n {\n \"name\": \"linux\"\n }\n ]\n },\n \"appliedIgnoreRules\": [\n {\n \"package\": {\n \"name\": \"linux-libc-dev\",\n \"type\": \"deb\",\n \"upstream-name\": \"linux\"\n },\n \"match-type\": \"exact-indirect-match\"\n }\n ]\n}",
1476
+ "refs": [
1477
+ {
1478
+ "url": "https://ubuntu.com/security/CVE-2023-52488"
1479
+ },
1480
+ {
1481
+ "url": "https://git.kernel.org/stable/c/084c24e788d9cf29c55564de368bf5284f2bb5db"
1482
+ },
1483
+ {
1484
+ "url": "https://git.kernel.org/stable/c/416b10d2817c94db86829fb92ad43ce7d002c573"
1485
+ },
1486
+ {
1487
+ "url": "https://git.kernel.org/stable/c/4e37416e4ee1b1bc17364a68973e0c63be89e611"
1488
+ },
1489
+ {
1490
+ "url": "https://git.kernel.org/stable/c/aa7cb4787698add9367b19f7afc667662c9bdb23"
1491
+ },
1492
+ {
1493
+ "url": "https://git.kernel.org/stable/c/dbf4ab821804df071c8b566d9813083125e6d97b"
1494
+ },
1495
+ {
1496
+ "url": "https://git.kernel.org/stable/c/e635f652696ef6f1230621cfd89c350cb5ec6169"
1497
+ },
1498
+ {
1499
+ "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
1500
+ }
1501
+ ],
1502
+ "title": "Grype found a vulnerability to CVE-2023-52488 in tensorflow/tensorflow:latest",
1503
+ "verificationMethod": "automated"
1504
+ },
1505
+ {
1506
+ "affectedPackages": [
1507
+ {
1508
+ "cpe": "cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*",
1509
+ "ecosystem": "deb",
1510
+ "fixedInVersion": "5.15.0-116.126",
1511
+ "name": "linux-libc-dev",
1512
+ "purl": "pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04",
1513
+ "version": "5.15.0-113.123"
1514
+ }
1515
+ ],
1516
+ "descriptions": [
1517
+ {
1518
+ "data": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc\n\nAny unprivileged user can attach N_GSM0710 ldisc, but it requires\nCAP_NET_ADMIN to create a GSM network anyway.\n\nRequire initial namespace CAP_NET_ADMIN to do that.",
1519
+ "label": "default"
1520
+ },
1521
+ {
1522
+ "data": "vulnerability is fixed for versions 5.15.0-116.126",
1523
+ "label": "fix"
1524
+ },
1525
+ {
1526
+ "data": "{}",
1527
+ "label": "check"
1528
+ }
1529
+ ],
1530
+ "results": [
1531
+ {
1532
+ "codeDesc": "Package: linux-libc-dev@5.15.0-113.123 | Type: deb | Location: /usr/share/doc/linux-libc-dev/copyright | Match Type: exact-indirect-match",
1533
+ "message": "This vulnerability was ignored by configured rules. Severity: High vulnerability is fixed for versions 5.15.0-116.126",
1534
+ "startTime": "2024-08-29T17:31:15.474Z",
1535
+ "status": "notReviewed"
1536
+ }
1537
+ ],
1538
+ "id": "Grype-Ignored-Match/CVE-2023-52880",
1539
+ "impact": 0.7,
1540
+ "tags": {
1541
+ "cci": [
1542
+ "CCI-001643",
1543
+ "CCI-003173"
1544
+ ],
1545
+ "nist": [
1546
+ "SA-11",
1547
+ "RA-5"
1548
+ ]
1549
+ },
1550
+ "code": "{\n \"vulnerability\": {\n \"id\": \"CVE-2023-52880\",\n \"dataSource\": \"https://ubuntu.com/security/CVE-2023-52880\",\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"severity\": \"High\",\n \"urls\": [\n \"https://ubuntu.com/security/CVE-2023-52880\"\n ],\n \"cvss\": [],\n \"fix\": {\n \"versions\": [\n \"5.15.0-116.126\"\n ],\n \"state\": \"fixed\"\n },\n \"advisories\": []\n },\n \"relatedVulnerabilities\": [\n {\n \"id\": \"CVE-2023-52880\",\n \"dataSource\": \"https://nvd.nist.gov/vuln/detail/CVE-2023-52880\",\n \"namespace\": \"nvd:cpe\",\n \"severity\": \"Unknown\",\n \"urls\": [\n \"https://git.kernel.org/stable/c/2b85977977cbd120591b23c2450e90a5806a7167\",\n \"https://git.kernel.org/stable/c/2d154a54c58f9c8375bfbea9f7e51ba3bfb2e43a\",\n \"https://git.kernel.org/stable/c/67c37756898a5a6b2941a13ae7260c89b54e0d88\",\n \"https://git.kernel.org/stable/c/7a529c9023a197ab3bf09bb95df32a3813f7ba58\",\n \"https://git.kernel.org/stable/c/7d303dee473ba3529d75b63491e9963342107bed\",\n \"https://git.kernel.org/stable/c/ada28eb4b9561aab93942f3224a2e41d76fe57fa\",\n \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\n \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\"\n ],\n \"description\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc\\n\\nAny unprivileged user can attach N_GSM0710 ldisc, but it requires\\nCAP_NET_ADMIN to create a GSM network anyway.\\n\\nRequire initial namespace CAP_NET_ADMIN to do that.\",\n \"cvss\": []\n }\n ],\n \"matchDetails\": [\n {\n \"type\": \"exact-indirect-match\",\n \"matcher\": \"dpkg-matcher\",\n \"searchedBy\": {\n \"distro\": {\n \"type\": \"ubuntu\",\n \"version\": \"22.04\"\n },\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"package\": {\n \"name\": \"linux\",\n \"version\": \"5.15.0-113.123\"\n }\n },\n \"found\": {\n \"versionConstraint\": \"\u003c 5.15.0-116.126 (deb)\",\n \"vulnerabilityID\": \"CVE-2023-52880\"\n }\n }\n ],\n \"artifact\": {\n \"id\": \"ae4822e3cd5a96ea\",\n \"name\": \"linux-libc-dev\",\n \"version\": \"5.15.0-113.123\",\n \"type\": \"deb\",\n \"locations\": [\n {\n \"path\": \"/usr/share/doc/linux-libc-dev/copyright\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/info/linux-libc-dev:amd64.md5sums\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/status\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n }\n ],\n \"language\": \"\",\n \"licenses\": [\n \"GPL-2\"\n ],\n \"cpes\": [\n \"cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc-dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\"\n ],\n \"purl\": \"pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04\",\n \"upstreams\": [\n {\n \"name\": \"linux\"\n }\n ]\n },\n \"appliedIgnoreRules\": [\n {\n \"package\": {\n \"name\": \"linux-libc-dev\",\n \"type\": \"deb\",\n \"upstream-name\": \"linux\"\n },\n \"match-type\": \"exact-indirect-match\"\n }\n ]\n}",
1551
+ "refs": [
1552
+ {
1553
+ "url": "https://ubuntu.com/security/CVE-2023-52880"
1554
+ },
1555
+ {
1556
+ "url": "https://git.kernel.org/stable/c/2b85977977cbd120591b23c2450e90a5806a7167"
1557
+ },
1558
+ {
1559
+ "url": "https://git.kernel.org/stable/c/2d154a54c58f9c8375bfbea9f7e51ba3bfb2e43a"
1560
+ },
1561
+ {
1562
+ "url": "https://git.kernel.org/stable/c/67c37756898a5a6b2941a13ae7260c89b54e0d88"
1563
+ },
1564
+ {
1565
+ "url": "https://git.kernel.org/stable/c/7a529c9023a197ab3bf09bb95df32a3813f7ba58"
1566
+ },
1567
+ {
1568
+ "url": "https://git.kernel.org/stable/c/7d303dee473ba3529d75b63491e9963342107bed"
1569
+ },
1570
+ {
1571
+ "url": "https://git.kernel.org/stable/c/ada28eb4b9561aab93942f3224a2e41d76fe57fa"
1572
+ },
1573
+ {
1574
+ "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
1575
+ },
1576
+ {
1577
+ "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
1578
+ }
1579
+ ],
1580
+ "title": "Grype found a vulnerability to CVE-2023-52880 in tensorflow/tensorflow:latest",
1581
+ "verificationMethod": "automated"
1582
+ },
1583
+ {
1584
+ "affectedPackages": [
1585
+ {
1586
+ "cpe": "cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*",
1587
+ "ecosystem": "deb",
1588
+ "fixedInVersion": "5.15.0-116.126",
1589
+ "name": "linux-libc-dev",
1590
+ "purl": "pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04",
1591
+ "version": "5.15.0-113.123"
1592
+ }
1593
+ ],
1594
+ "descriptions": [
1595
+ {
1596
+ "data": "Integer Overflow or Wraparound vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (md, raid, raid5 modules) allows Forced Integer Overflow.",
1597
+ "label": "default"
1598
+ },
1599
+ {
1600
+ "data": "vulnerability is fixed for versions 5.15.0-116.126",
1601
+ "label": "fix"
1602
+ },
1603
+ {
1604
+ "data": "{\"related\":[{\"id\":\"CVE-2024-23307\",\"dataSource\":\"https://nvd.nist.gov/vuln/detail/CVE-2024-23307\",\"cvss\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"3.1\",\"vector\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"metrics\":{\"baseScore\":7.8,\"exploitabilityScore\":1.8,\"impactScore\":5.9},\"vendorMetadata\":{}},{\"source\":\"security@openanolis.org\",\"type\":\"Secondary\",\"version\":\"3.1\",\"vector\":\"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H\",\"metrics\":{\"baseScore\":4.4,\"exploitabilityScore\":0.7,\"impactScore\":3.6},\"vendorMetadata\":{}}]}]}",
1605
+ "label": "check"
1606
+ }
1607
+ ],
1608
+ "results": [
1609
+ {
1610
+ "codeDesc": "Package: linux-libc-dev@5.15.0-113.123 | Type: deb | Location: /usr/share/doc/linux-libc-dev/copyright | Match Type: exact-indirect-match",
1611
+ "message": "This vulnerability was ignored by configured rules. Severity: Low vulnerability is fixed for versions 5.15.0-116.126",
1612
+ "startTime": "2024-08-29T17:31:15.474Z",
1613
+ "status": "notReviewed"
1614
+ }
1615
+ ],
1616
+ "id": "Grype-Ignored-Match/CVE-2024-23307",
1617
+ "impact": 0.3,
1618
+ "tags": {
1619
+ "cci": [
1620
+ "CCI-001643",
1621
+ "CCI-003173"
1622
+ ],
1623
+ "nist": [
1624
+ "SA-11",
1625
+ "RA-5"
1626
+ ]
1627
+ },
1628
+ "code": "{\n \"vulnerability\": {\n \"id\": \"CVE-2024-23307\",\n \"dataSource\": \"https://ubuntu.com/security/CVE-2024-23307\",\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"severity\": \"Low\",\n \"urls\": [\n \"https://ubuntu.com/security/CVE-2024-23307\"\n ],\n \"cvss\": [],\n \"fix\": {\n \"versions\": [\n \"5.15.0-116.126\"\n ],\n \"state\": \"fixed\"\n },\n \"advisories\": []\n },\n \"relatedVulnerabilities\": [\n {\n \"id\": \"CVE-2024-23307\",\n \"dataSource\": \"https://nvd.nist.gov/vuln/detail/CVE-2024-23307\",\n \"namespace\": \"nvd:cpe\",\n \"severity\": \"High\",\n \"urls\": [\n \"https://bugzilla.openanolis.cn/show_bug.cgi?id=7975\"\n ],\n \"description\": \"Integer Overflow or Wraparound vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (md, raid, raid5 modules) allows Forced Integer Overflow.\",\n \"cvss\": [\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"3.1\",\n \"vector\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\n \"metrics\": {\n \"baseScore\": 7.8,\n \"exploitabilityScore\": 1.8,\n \"impactScore\": 5.9\n },\n \"vendorMetadata\": {}\n },\n {\n \"source\": \"security@openanolis.org\",\n \"type\": \"Secondary\",\n \"version\": \"3.1\",\n \"vector\": \"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H\",\n \"metrics\": {\n \"baseScore\": 4.4,\n \"exploitabilityScore\": 0.7,\n \"impactScore\": 3.6\n },\n \"vendorMetadata\": {}\n }\n ]\n }\n ],\n \"matchDetails\": [\n {\n \"type\": \"exact-indirect-match\",\n \"matcher\": \"dpkg-matcher\",\n \"searchedBy\": {\n \"distro\": {\n \"type\": \"ubuntu\",\n \"version\": \"22.04\"\n },\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"package\": {\n \"name\": \"linux\",\n \"version\": \"5.15.0-113.123\"\n }\n },\n \"found\": {\n \"versionConstraint\": \"\u003c 5.15.0-116.126 (deb)\",\n \"vulnerabilityID\": \"CVE-2024-23307\"\n }\n }\n ],\n \"artifact\": {\n \"id\": \"ae4822e3cd5a96ea\",\n \"name\": \"linux-libc-dev\",\n \"version\": \"5.15.0-113.123\",\n \"type\": \"deb\",\n \"locations\": [\n {\n \"path\": \"/usr/share/doc/linux-libc-dev/copyright\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/info/linux-libc-dev:amd64.md5sums\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/status\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n }\n ],\n \"language\": \"\",\n \"licenses\": [\n \"GPL-2\"\n ],\n \"cpes\": [\n \"cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc-dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\"\n ],\n \"purl\": \"pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04\",\n \"upstreams\": [\n {\n \"name\": \"linux\"\n }\n ]\n },\n \"appliedIgnoreRules\": [\n {\n \"package\": {\n \"name\": \"linux-libc-dev\",\n \"type\": \"deb\",\n \"upstream-name\": \"linux\"\n },\n \"match-type\": \"exact-indirect-match\"\n }\n ]\n}",
1629
+ "refs": [
1630
+ {
1631
+ "url": "https://ubuntu.com/security/CVE-2024-23307"
1632
+ },
1633
+ {
1634
+ "url": "https://bugzilla.openanolis.cn/show_bug.cgi?id=7975"
1635
+ }
1636
+ ],
1637
+ "title": "Grype found a vulnerability to CVE-2024-23307 in tensorflow/tensorflow:latest",
1638
+ "verificationMethod": "automated"
1639
+ },
1640
+ {
1641
+ "affectedPackages": [
1642
+ {
1643
+ "cpe": "cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*",
1644
+ "ecosystem": "deb",
1645
+ "fixedInVersion": "5.15.0-116.126",
1646
+ "name": "linux-libc-dev",
1647
+ "purl": "pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04",
1648
+ "version": "5.15.0-113.123"
1649
+ }
1650
+ ],
1651
+ "descriptions": [
1652
+ {
1653
+ "data": "A race condition was found in the Linux kernel's net/bluetooth device driver in conn_info_{min,max}_age_set() function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service.\n\n\n\n\n",
1654
+ "label": "default"
1655
+ },
1656
+ {
1657
+ "data": "vulnerability is fixed for versions 5.15.0-116.126",
1658
+ "label": "fix"
1659
+ },
1660
+ {
1661
+ "data": "{\"related\":[{\"id\":\"CVE-2024-24857\",\"dataSource\":\"https://nvd.nist.gov/vuln/detail/CVE-2024-24857\",\"cvss\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"version\":\"3.1\",\"vector\":\"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H\",\"metrics\":{\"baseScore\":6.8,\"exploitabilityScore\":1.6,\"impactScore\":5.2},\"vendorMetadata\":{}},{\"source\":\"security@openanolis.org\",\"type\":\"Secondary\",\"version\":\"3.1\",\"vector\":\"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:L\",\"metrics\":{\"baseScore\":4.6,\"exploitabilityScore\":0.4,\"impactScore\":4.2},\"vendorMetadata\":{}}]}]}",
1662
+ "label": "check"
1663
+ }
1664
+ ],
1665
+ "results": [
1666
+ {
1667
+ "codeDesc": "Package: linux-libc-dev@5.15.0-113.123 | Type: deb | Location: /usr/share/doc/linux-libc-dev/copyright | Match Type: exact-indirect-match",
1668
+ "message": "This vulnerability was ignored by configured rules. Severity: Low vulnerability is fixed for versions 5.15.0-116.126",
1669
+ "startTime": "2024-08-29T17:31:15.474Z",
1670
+ "status": "notReviewed"
1671
+ }
1672
+ ],
1673
+ "id": "Grype-Ignored-Match/CVE-2024-24857",
1674
+ "impact": 0.3,
1675
+ "tags": {
1676
+ "cci": [
1677
+ "CCI-001643",
1678
+ "CCI-003173"
1679
+ ],
1680
+ "nist": [
1681
+ "SA-11",
1682
+ "RA-5"
1683
+ ]
1684
+ },
1685
+ "code": "{\n \"vulnerability\": {\n \"id\": \"CVE-2024-24857\",\n \"dataSource\": \"https://ubuntu.com/security/CVE-2024-24857\",\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"severity\": \"Low\",\n \"urls\": [\n \"https://ubuntu.com/security/CVE-2024-24857\"\n ],\n \"cvss\": [],\n \"fix\": {\n \"versions\": [\n \"5.15.0-116.126\"\n ],\n \"state\": \"fixed\"\n },\n \"advisories\": []\n },\n \"relatedVulnerabilities\": [\n {\n \"id\": \"CVE-2024-24857\",\n \"dataSource\": \"https://nvd.nist.gov/vuln/detail/CVE-2024-24857\",\n \"namespace\": \"nvd:cpe\",\n \"severity\": \"Medium\",\n \"urls\": [\n \"https://bugzilla.openanolis.cn/show_bug.cgi?id=8155\",\n \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\n \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\"\n ],\n \"description\": \"A race condition was found in the Linux kernel's net/bluetooth device driver in conn_info_{min,max}_age_set() function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service.\\n\\n\\n\\n\\n\",\n \"cvss\": [\n {\n \"source\": \"nvd@nist.gov\",\n \"type\": \"Primary\",\n \"version\": \"3.1\",\n \"vector\": \"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H\",\n \"metrics\": {\n \"baseScore\": 6.8,\n \"exploitabilityScore\": 1.6,\n \"impactScore\": 5.2\n },\n \"vendorMetadata\": {}\n },\n {\n \"source\": \"security@openanolis.org\",\n \"type\": \"Secondary\",\n \"version\": \"3.1\",\n \"vector\": \"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:L\",\n \"metrics\": {\n \"baseScore\": 4.6,\n \"exploitabilityScore\": 0.4,\n \"impactScore\": 4.2\n },\n \"vendorMetadata\": {}\n }\n ]\n }\n ],\n \"matchDetails\": [\n {\n \"type\": \"exact-indirect-match\",\n \"matcher\": \"dpkg-matcher\",\n \"searchedBy\": {\n \"distro\": {\n \"type\": \"ubuntu\",\n \"version\": \"22.04\"\n },\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"package\": {\n \"name\": \"linux\",\n \"version\": \"5.15.0-113.123\"\n }\n },\n \"found\": {\n \"versionConstraint\": \"\u003c 5.15.0-116.126 (deb)\",\n \"vulnerabilityID\": \"CVE-2024-24857\"\n }\n }\n ],\n \"artifact\": {\n \"id\": \"ae4822e3cd5a96ea\",\n \"name\": \"linux-libc-dev\",\n \"version\": \"5.15.0-113.123\",\n \"type\": \"deb\",\n \"locations\": [\n {\n \"path\": \"/usr/share/doc/linux-libc-dev/copyright\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/info/linux-libc-dev:amd64.md5sums\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/status\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n }\n ],\n \"language\": \"\",\n \"licenses\": [\n \"GPL-2\"\n ],\n \"cpes\": [\n \"cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc-dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\"\n ],\n \"purl\": \"pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04\",\n \"upstreams\": [\n {\n \"name\": \"linux\"\n }\n ]\n },\n \"appliedIgnoreRules\": [\n {\n \"package\": {\n \"name\": \"linux-libc-dev\",\n \"type\": \"deb\",\n \"upstream-name\": \"linux\"\n },\n \"match-type\": \"exact-indirect-match\"\n }\n ]\n}",
1686
+ "refs": [
1687
+ {
1688
+ "url": "https://ubuntu.com/security/CVE-2024-24857"
1689
+ },
1690
+ {
1691
+ "url": "https://bugzilla.openanolis.cn/show_bug.cgi?id=8155"
1692
+ },
1693
+ {
1694
+ "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
1695
+ },
1696
+ {
1697
+ "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
1698
+ }
1699
+ ],
1700
+ "title": "Grype found a vulnerability to CVE-2024-24857 in tensorflow/tensorflow:latest",
1701
+ "verificationMethod": "automated"
1702
+ },
1703
+ {
1704
+ "affectedPackages": [
1705
+ {
1706
+ "cpe": "cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*",
1707
+ "ecosystem": "deb",
1708
+ "fixedInVersion": "5.15.0-116.126",
1709
+ "name": "linux-libc-dev",
1710
+ "purl": "pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04",
1711
+ "version": "5.15.0-113.123"
1712
+ }
1713
+ ],
1714
+ "descriptions": [
1715
+ {
1716
+ "data": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: disallow anonymous set with timeout flag\n\nAnonymous sets are never used with timeout from userspace, reject this.\nException to this rule is NFT_SET_EVAL to ensure legacy meters still work.",
1717
+ "label": "default"
1718
+ },
1719
+ {
1720
+ "data": "vulnerability is fixed for versions 5.15.0-116.126",
1721
+ "label": "fix"
1722
+ },
1723
+ {
1724
+ "data": "{}",
1725
+ "label": "check"
1726
+ }
1727
+ ],
1728
+ "results": [
1729
+ {
1730
+ "codeDesc": "Package: linux-libc-dev@5.15.0-113.123 | Type: deb | Location: /usr/share/doc/linux-libc-dev/copyright | Match Type: exact-indirect-match",
1731
+ "message": "This vulnerability was ignored by configured rules. Severity: High vulnerability is fixed for versions 5.15.0-116.126",
1732
+ "startTime": "2024-08-29T17:31:15.474Z",
1733
+ "status": "notReviewed"
1734
+ }
1735
+ ],
1736
+ "id": "Grype-Ignored-Match/CVE-2024-26642",
1737
+ "impact": 0.7,
1738
+ "tags": {
1739
+ "cci": [
1740
+ "CCI-001643",
1741
+ "CCI-003173"
1742
+ ],
1743
+ "nist": [
1744
+ "SA-11",
1745
+ "RA-5"
1746
+ ]
1747
+ },
1748
+ "code": "{\n \"vulnerability\": {\n \"id\": \"CVE-2024-26642\",\n \"dataSource\": \"https://ubuntu.com/security/CVE-2024-26642\",\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"severity\": \"High\",\n \"urls\": [\n \"https://ubuntu.com/security/CVE-2024-26642\"\n ],\n \"cvss\": [],\n \"fix\": {\n \"versions\": [\n \"5.15.0-116.126\"\n ],\n \"state\": \"fixed\"\n },\n \"advisories\": []\n },\n \"relatedVulnerabilities\": [\n {\n \"id\": \"CVE-2024-26642\",\n \"dataSource\": \"https://nvd.nist.gov/vuln/detail/CVE-2024-26642\",\n \"namespace\": \"nvd:cpe\",\n \"severity\": \"Unknown\",\n \"urls\": [\n \"https://git.kernel.org/stable/c/16603605b667b70da974bea8216c93e7db043bf1\",\n \"https://git.kernel.org/stable/c/72c1efe3f247a581667b7d368fff3bd9a03cd57a\",\n \"https://git.kernel.org/stable/c/7cdc1be24cc1bcd56a3e89ac4aef20e31ad09199\",\n \"https://git.kernel.org/stable/c/8e07c16695583a66e81f67ce4c46e94dece47ba7\",\n \"https://git.kernel.org/stable/c/c0c2176d1814b92ea4c8e7eb7c9cd94cd99c1b12\",\n \"https://git.kernel.org/stable/c/e4988d8415bd0294d6f9f4a1e7095f8b50a97ca9\",\n \"https://git.kernel.org/stable/c/e9a0d3f376eb356d54ffce36e7cc37514cbfbd6f\",\n \"https://git.kernel.org/stable/c/fe40ffbca19dc70d7c6b1e3c77b9ccb404c57351\",\n \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\n \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\"\n ],\n \"description\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nf_tables: disallow anonymous set with timeout flag\\n\\nAnonymous sets are never used with timeout from userspace, reject this.\\nException to this rule is NFT_SET_EVAL to ensure legacy meters still work.\",\n \"cvss\": []\n }\n ],\n \"matchDetails\": [\n {\n \"type\": \"exact-indirect-match\",\n \"matcher\": \"dpkg-matcher\",\n \"searchedBy\": {\n \"distro\": {\n \"type\": \"ubuntu\",\n \"version\": \"22.04\"\n },\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"package\": {\n \"name\": \"linux\",\n \"version\": \"5.15.0-113.123\"\n }\n },\n \"found\": {\n \"versionConstraint\": \"\u003c 5.15.0-116.126 (deb)\",\n \"vulnerabilityID\": \"CVE-2024-26642\"\n }\n }\n ],\n \"artifact\": {\n \"id\": \"ae4822e3cd5a96ea\",\n \"name\": \"linux-libc-dev\",\n \"version\": \"5.15.0-113.123\",\n \"type\": \"deb\",\n \"locations\": [\n {\n \"path\": \"/usr/share/doc/linux-libc-dev/copyright\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/info/linux-libc-dev:amd64.md5sums\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/status\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n }\n ],\n \"language\": \"\",\n \"licenses\": [\n \"GPL-2\"\n ],\n \"cpes\": [\n \"cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc-dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\"\n ],\n \"purl\": \"pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04\",\n \"upstreams\": [\n {\n \"name\": \"linux\"\n }\n ]\n },\n \"appliedIgnoreRules\": [\n {\n \"package\": {\n \"name\": \"linux-libc-dev\",\n \"type\": \"deb\",\n \"upstream-name\": \"linux\"\n },\n \"match-type\": \"exact-indirect-match\"\n }\n ]\n}",
1749
+ "refs": [
1750
+ {
1751
+ "url": "https://ubuntu.com/security/CVE-2024-26642"
1752
+ },
1753
+ {
1754
+ "url": "https://git.kernel.org/stable/c/16603605b667b70da974bea8216c93e7db043bf1"
1755
+ },
1756
+ {
1757
+ "url": "https://git.kernel.org/stable/c/72c1efe3f247a581667b7d368fff3bd9a03cd57a"
1758
+ },
1759
+ {
1760
+ "url": "https://git.kernel.org/stable/c/7cdc1be24cc1bcd56a3e89ac4aef20e31ad09199"
1761
+ },
1762
+ {
1763
+ "url": "https://git.kernel.org/stable/c/8e07c16695583a66e81f67ce4c46e94dece47ba7"
1764
+ },
1765
+ {
1766
+ "url": "https://git.kernel.org/stable/c/c0c2176d1814b92ea4c8e7eb7c9cd94cd99c1b12"
1767
+ },
1768
+ {
1769
+ "url": "https://git.kernel.org/stable/c/e4988d8415bd0294d6f9f4a1e7095f8b50a97ca9"
1770
+ },
1771
+ {
1772
+ "url": "https://git.kernel.org/stable/c/e9a0d3f376eb356d54ffce36e7cc37514cbfbd6f"
1773
+ },
1774
+ {
1775
+ "url": "https://git.kernel.org/stable/c/fe40ffbca19dc70d7c6b1e3c77b9ccb404c57351"
1776
+ },
1777
+ {
1778
+ "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
1779
+ },
1780
+ {
1781
+ "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
1782
+ }
1783
+ ],
1784
+ "title": "Grype found a vulnerability to CVE-2024-26642 in tensorflow/tensorflow:latest",
1785
+ "verificationMethod": "automated"
1786
+ },
1787
+ {
1788
+ "affectedPackages": [
1789
+ {
1790
+ "cpe": "cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*",
1791
+ "ecosystem": "deb",
1792
+ "name": "linux-libc-dev",
1793
+ "purl": "pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04",
1794
+ "version": "5.15.0-113.123"
1795
+ }
1796
+ ],
1797
+ "descriptions": [
1798
+ {
1799
+ "data": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix use-after-free on failed backlog decryption\n\nWhen the decrypt request goes to the backlog and crypto_aead_decrypt\nreturns -EBUSY, tls_do_decryption will wait until all async\ndecryptions have completed. If one of them fails, tls_do_decryption\nwill return -EBADMSG and tls_decrypt_sg jumps to the error path,\nreleasing all the pages. But the pages have been passed to the async\ncallback, and have already been released by tls_decrypt_done.\n\nThe only true async case is when crypto_aead_decrypt returns\n -EINPROGRESS. With -EBUSY, we already waited so we can tell\ntls_sw_recvmsg that the data is available for immediate copy, but we\nneed to notify tls_decrypt_sg (via the new -\u003easync_done flag) that the\nmemory has already been released.",
1800
+ "label": "default"
1801
+ },
1802
+ {
1803
+ "data": "vulnerability is not-fixed",
1804
+ "label": "fix"
1805
+ },
1806
+ {
1807
+ "data": "{}",
1808
+ "label": "check"
1809
+ }
1810
+ ],
1811
+ "results": [
1812
+ {
1813
+ "codeDesc": "Package: linux-libc-dev@5.15.0-113.123 | Type: deb | Location: /usr/share/doc/linux-libc-dev/copyright | Match Type: exact-indirect-match",
1814
+ "message": "This vulnerability was ignored by configured rules. Severity: High vulnerability is not-fixed",
1815
+ "startTime": "2024-08-29T17:31:15.474Z",
1816
+ "status": "notReviewed"
1817
+ }
1818
+ ],
1819
+ "id": "Grype-Ignored-Match/CVE-2024-26800",
1820
+ "impact": 0.7,
1821
+ "tags": {
1822
+ "cci": [
1823
+ "CCI-001643",
1824
+ "CCI-003173"
1825
+ ],
1826
+ "nist": [
1827
+ "SA-11",
1828
+ "RA-5"
1829
+ ]
1830
+ },
1831
+ "code": "{\n \"vulnerability\": {\n \"id\": \"CVE-2024-26800\",\n \"dataSource\": \"https://ubuntu.com/security/CVE-2024-26800\",\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"severity\": \"High\",\n \"urls\": [\n \"https://ubuntu.com/security/CVE-2024-26800\"\n ],\n \"cvss\": [],\n \"fix\": {\n \"versions\": [],\n \"state\": \"not-fixed\"\n },\n \"advisories\": []\n },\n \"relatedVulnerabilities\": [\n {\n \"id\": \"CVE-2024-26800\",\n \"dataSource\": \"https://nvd.nist.gov/vuln/detail/CVE-2024-26800\",\n \"namespace\": \"nvd:cpe\",\n \"severity\": \"Unknown\",\n \"urls\": [\n \"https://git.kernel.org/stable/c/13114dc5543069f7b97991e3b79937b6da05f5b0\",\n \"https://git.kernel.org/stable/c/1ac9fb84bc7ecd4bc6428118301d9d864d2a58d1\",\n \"https://git.kernel.org/stable/c/81be85353b0f5a7b660635634b655329b429eefe\",\n \"https://git.kernel.org/stable/c/f2b85a4cc763841843de693bbd7308fe9a2c4c89\"\n ],\n \"description\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntls: fix use-after-free on failed backlog decryption\\n\\nWhen the decrypt request goes to the backlog and crypto_aead_decrypt\\nreturns -EBUSY, tls_do_decryption will wait until all async\\ndecryptions have completed. If one of them fails, tls_do_decryption\\nwill return -EBADMSG and tls_decrypt_sg jumps to the error path,\\nreleasing all the pages. But the pages have been passed to the async\\ncallback, and have already been released by tls_decrypt_done.\\n\\nThe only true async case is when crypto_aead_decrypt returns\\n -EINPROGRESS. With -EBUSY, we already waited so we can tell\\ntls_sw_recvmsg that the data is available for immediate copy, but we\\nneed to notify tls_decrypt_sg (via the new -\u003easync_done flag) that the\\nmemory has already been released.\",\n \"cvss\": []\n }\n ],\n \"matchDetails\": [\n {\n \"type\": \"exact-indirect-match\",\n \"matcher\": \"dpkg-matcher\",\n \"searchedBy\": {\n \"distro\": {\n \"type\": \"ubuntu\",\n \"version\": \"22.04\"\n },\n \"namespace\": \"ubuntu:distro:ubuntu:22.04\",\n \"package\": {\n \"name\": \"linux\",\n \"version\": \"5.15.0-113.123\"\n }\n },\n \"found\": {\n \"versionConstraint\": \"none (deb)\",\n \"vulnerabilityID\": \"CVE-2024-26800\"\n }\n }\n ],\n \"artifact\": {\n \"id\": \"ae4822e3cd5a96ea\",\n \"name\": \"linux-libc-dev\",\n \"version\": \"5.15.0-113.123\",\n \"type\": \"deb\",\n \"locations\": [\n {\n \"path\": \"/usr/share/doc/linux-libc-dev/copyright\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/info/linux-libc-dev:amd64.md5sums\",\n \"layerID\": \"sha256:0bbf3e64c8b076609ce0a0b49a39e3392992b82dea57fba51f0aa1304e821869\"\n },\n {\n \"path\": \"/var/lib/dpkg/status\",\n \"layerID\": \"sha256:8b4c7a90e5edb88774351f3fd5c661a3fa0f8fedcf68f696981d3a5fdae85d86\"\n }\n ],\n \"language\": \"\",\n \"licenses\": [\n \"GPL-2\"\n ],\n \"cpes\": [\n \"cpe:2.3:a:linux-libc-dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc-dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc_dev:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux-libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux_libc:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux-libc-dev:5.15.0-113.123:*:*:*:*:*:*:*\",\n \"cpe:2.3:a:linux:linux_libc_dev:5.15.0-113.123:*:*:*:*:*:*:*\"\n ],\n \"purl\": \"pkg:deb/ubuntu/linux-libc-dev@5.15.0-113.123?arch=amd64\u0026upstream=linux\u0026distro=ubuntu-22.04\",\n \"upstreams\": [\n {\n \"name\": \"linux\"\n }\n ]\n },\n \"appliedIgnoreRules\": [\n {\n \"package\": {\n \"name\": \"linux-libc-dev\",\n \"type\": \"deb\",\n \"upstream-name\": \"linux\"\n },\n \"match-type\": \"exact-indirect-match\"\n }\n ]\n}",
1832
+ "refs": [
1833
+ {
1834
+ "url": "https://ubuntu.com/security/CVE-2024-26800"
1835
+ },
1836
+ {
1837
+ "url": "https://git.kernel.org/stable/c/13114dc5543069f7b97991e3b79937b6da05f5b0"
1838
+ },
1839
+ {
1840
+ "url": "https://git.kernel.org/stable/c/1ac9fb84bc7ecd4bc6428118301d9d864d2a58d1"
1841
+ },
1842
+ {
1843
+ "url": "https://git.kernel.org/stable/c/81be85353b0f5a7b660635634b655329b429eefe"
1844
+ },
1845
+ {
1846
+ "url": "https://git.kernel.org/stable/c/f2b85a4cc763841843de693bbd7308fe9a2c4c89"
1847
+ }
1848
+ ],
1849
+ "title": "Grype found a vulnerability to CVE-2024-26800 in tensorflow/tensorflow:latest",
1850
+ "verificationMethod": "automated"
1851
+ }
1852
+ ],
1853
+ "resultsChecksum": {
1854
+ "algorithm": "sha256",
1855
+ "value": "ae4a677ddcec4b864c977200962c96c30903acb2e92870cd6abc3fb5cfaacda2"
1856
+ },
1857
+ "name": "tensorflow/tensorflow:latest"
1858
+ }
1859
+ ],
1860
+ "components": [
1861
+ {
1862
+ "integrity": [
1863
+ {
1864
+ "algorithm": "sha256",
1865
+ "value": "5ec32574bc7f466b5b8f7343e300e1368574a1a89a54735d332cf0f7b78aedf7"
1866
+ }
1867
+ ],
1868
+ "labels": {
1869
+ "architecture": "amd64"
1870
+ },
1871
+ "name": "tensorflow/tensorflow@sha256:821b11952acfa67764c1f433a0629747ee49e30a69291811a2dcbef77b67cf33",
1872
+ "type": "containerImage",
1873
+ "osName": "ubuntu",
1874
+ "osVersion": "22.04",
1875
+ "imageId": "sha256:8f6e945a1a52d428908c6b70f2741376279500f92c5381afbac9a790aa18c5b9",
1876
+ "image": "tensorflow/tensorflow@sha256:821b11952acfa67764c1f433a0629747ee49e30a69291811a2dcbef77b67cf33"
1877
+ }
1878
+ ],
1879
+ "generator": {
1880
+ "name": "grype-to-hdf",
1881
+ "version": "1.0.0"
1882
+ },
1883
+ "timestamp": "2024-08-29T17:31:15.474Z",
1884
+ "tool": {
1885
+ "name": "Grype",
1886
+ "version": "0.79.3"
1887
+ }
1888
+ }