[
  {
    "Target": "testdata/fixtures/oraclelinux-7-slim.tar.gz (oracle 7.6)",
    "Type": "oracle",
    "Vulnerabilities": [
      {
        "VulnerabilityID": "CVE-2018-16842",
        "PkgName": "curl",
        "InstalledVersion": "7.29.0-51.0.1.el7_6.3",
        "FixedVersion": "7.29.0-54.0.1.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-16842",
        "Title": "curl: Heap-based buffer over-read in the curl tool warning formatting",
        "Description": "Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.",
        "Severity": "CRITICAL",
        "CweIDs": [
          "CWE-125"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "V2Score": 6.4,
            "V3Score": 9.1
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L",
            "V3Score": 3.6
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-16842.html",
          "http://linux.oracle.com/errata/ELSA-2019-2181.html",
          "http://www.securitytracker.com/id/1042014",
          "https://access.redhat.com/errata/RHSA-2019:2181",
          "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16842",
          "https://curl.haxx.se/docs/CVE-2018-16842.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16842",
          "https://github.com/curl/curl/commit/d530e92f59ae9bb2d47066c3c460b25d2ffeb211",
          "https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html",
          "https://security.gentoo.org/glsa/201903-03",
          "https://usn.ubuntu.com/3805-1/",
          "https://usn.ubuntu.com/3805-2/",
          "https://usn.ubuntu.com/usn/usn-3805-1",
          "https://usn.ubuntu.com/usn/usn-3805-2",
          "https://www.debian.org/security/2018/dsa-4331"
        ],
        "PublishedDate": "2018-10-31T19:29:00Z",
        "LastModifiedDate": "2019-08-06T17:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-16402",
        "PkgName": "elfutils-libelf",
        "InstalledVersion": "0.172-2.el7",
        "FixedVersion": "0.176-2.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-16402",
        "Title": "elfutils: Double-free due to double decompression of sections in crafted ELF causes crash",
        "Description": "libelf/elf_end.c in elfutils 0.173 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact because it tries to decompress twice.",
        "Severity": "CRITICAL",
        "CweIDs": [
          "CWE-415"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V2Score": 7.5,
            "V3Score": 9.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 4.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-16402.html",
          "http://linux.oracle.com/errata/ELSA-2019-2197.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16402",
          "https://sourceware.org/bugzilla/show_bug.cgi?id=23528",
          "https://usn.ubuntu.com/4012-1/",
          "https://usn.ubuntu.com/usn/usn-4012-1"
        ],
        "PublishedDate": "2018-09-03T19:29:00Z",
        "LastModifiedDate": "2019-06-10T17:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-16062",
        "PkgName": "elfutils-libelf",
        "InstalledVersion": "0.172-2.el7",
        "FixedVersion": "0.176-2.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-16062",
        "Title": "elfutils: Heap-based buffer over-read in libdw/dwarf_getaranges.c:dwarf_getaranges() via crafted file",
        "Description": "dwarf_getaranges in dwarf_getaranges.c in libdw in elfutils before 2018-08-18 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-125"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "V2Score": 4.3,
            "V3Score": 5.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 3.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-16062.html",
          "http://linux.oracle.com/errata/ELSA-2019-2197.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html",
          "https://access.redhat.com/errata/RHSA-2019:2197",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16062",
          "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
          "https://sourceware.org/bugzilla/show_bug.cgi?id=23541",
          "https://sourceware.org/git/?p=elfutils.git;a=commit;h=29e31978ba51c1051743a503ee325b5ebc03d7e9",
          "https://usn.ubuntu.com/4012-1/",
          "https://usn.ubuntu.com/usn/usn-4012-1"
        ],
        "PublishedDate": "2018-08-29T03:29:00Z",
        "LastModifiedDate": "2019-10-03T00:03:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-16403",
        "PkgName": "elfutils-libelf",
        "InstalledVersion": "0.172-2.el7",
        "FixedVersion": "0.176-2.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-16403",
        "Title": "elfutils: Heap-based buffer over-read in libdw/dwarf_getabbrev.c and libwd/dwarf_hasattr.c causes crash",
        "Description": "libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c and dwarf_hasattr in dwarf_hasattr.c, leading to a heap-based buffer over-read and an application crash.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-125"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "V2Score": 4.3,
            "V3Score": 5.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 3.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-16403.html",
          "http://linux.oracle.com/errata/ELSA-2019-2197.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html",
          "https://access.redhat.com/errata/RHSA-2019:2197",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16403",
          "https://sourceware.org/bugzilla/show_bug.cgi?id=23529",
          "https://sourceware.org/git/?p=elfutils.git;a=commit;h=6983e59b727458a6c64d9659c85f08218bc4fcda",
          "https://usn.ubuntu.com/4012-1/",
          "https://usn.ubuntu.com/usn/usn-4012-1"
        ],
        "PublishedDate": "2018-09-03T19:29:00Z",
        "LastModifiedDate": "2019-10-03T00:03:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-18310",
        "PkgName": "elfutils-libelf",
        "InstalledVersion": "0.172-2.el7",
        "FixedVersion": "0.176-2.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-18310",
        "Title": "elfutils: invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl",
        "Description": "An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by consider_notes.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-119"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "V2Score": 4.3,
            "V3Score": 5.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 3.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-18310.html",
          "http://linux.oracle.com/errata/ELSA-2019-2197.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18310",
          "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
          "https://sourceware.org/bugzilla/show_bug.cgi?id=23752",
          "https://sourceware.org/ml/elfutils-devel/2018-q4/msg00022.html",
          "https://usn.ubuntu.com/4012-1/",
          "https://usn.ubuntu.com/usn/usn-4012-1"
        ],
        "PublishedDate": "2018-10-15T02:29:00Z",
        "LastModifiedDate": "2019-06-10T17:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-18520",
        "PkgName": "elfutils-libelf",
        "InstalledVersion": "0.172-2.el7",
        "FixedVersion": "0.176-2.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-18520",
        "Title": "elfutils: eu-size cannot handle recursive ar files",
        "Description": "An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-119"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "V2Score": 4.3,
            "V3Score": 6.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 3.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-18520.html",
          "http://linux.oracle.com/errata/ELSA-2019-2197.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18520",
          "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
          "https://sourceware.org/bugzilla/show_bug.cgi?id=23787",
          "https://sourceware.org/ml/elfutils-devel/2018-q4/msg00057.html",
          "https://usn.ubuntu.com/4012-1/",
          "https://usn.ubuntu.com/usn/usn-4012-1"
        ],
        "PublishedDate": "2018-10-19T17:29:00Z",
        "LastModifiedDate": "2019-06-10T17:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-18521",
        "PkgName": "elfutils-libelf",
        "InstalledVersion": "0.172-2.el7",
        "FixedVersion": "0.176-2.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-18521",
        "Title": "elfutils: Divide-by-zero in arlib_add_symbols function in arlib.c",
        "Description": "Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by eu-ranlib, because a zero sh_entsize is mishandled.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-369"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "V2Score": 4.3,
            "V3Score": 5.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 3.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-18521.html",
          "http://linux.oracle.com/errata/ELSA-2019-2197.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18521",
          "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
          "https://sourceware.org/bugzilla/show_bug.cgi?id=23786",
          "https://sourceware.org/ml/elfutils-devel/2018-q4/msg00055.html",
          "https://usn.ubuntu.com/4012-1/",
          "https://usn.ubuntu.com/usn/usn-4012-1"
        ],
        "PublishedDate": "2018-10-19T17:29:00Z",
        "LastModifiedDate": "2019-06-10T17:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-7149",
        "PkgName": "elfutils-libelf",
        "InstalledVersion": "0.172-2.el7",
        "FixedVersion": "0.176-2.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-7149",
        "Title": "elfutils: heap-based buffer over-read in read_srclines in dwarf_getsrclines.c in libdw",
        "Description": "A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by eu-nm.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-125"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "V2Score": 4.3,
            "V3Score": 6.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 3.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-7149.html",
          "http://linux.oracle.com/errata/ELSA-2019-3575.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7149",
          "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
          "https://sourceware.org/bugzilla/show_bug.cgi?id=24102",
          "https://sourceware.org/ml/elfutils-devel/2019-q1/msg00068.html",
          "https://usn.ubuntu.com/4012-1/",
          "https://usn.ubuntu.com/usn/usn-4012-1"
        ],
        "PublishedDate": "2019-01-29T00:29:00Z",
        "LastModifiedDate": "2019-06-10T17:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-7150",
        "PkgName": "elfutils-libelf",
        "InstalledVersion": "0.172-2.el7",
        "FixedVersion": "0.176-2.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-7150",
        "Title": "elfutils: segmentation fault in elf64_xlatetom in libelf/elf32_xlatetom.c",
        "Description": "An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-125"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "V2Score": 4.3,
            "V3Score": 5.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 3.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-7150.html",
          "http://linux.oracle.com/errata/ELSA-2019-3575.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7150",
          "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
          "https://sourceware.org/bugzilla/show_bug.cgi?id=24103",
          "https://sourceware.org/ml/elfutils-devel/2019-q1/msg00070.html",
          "https://usn.ubuntu.com/4012-1/",
          "https://usn.ubuntu.com/usn/usn-4012-1"
        ],
        "PublishedDate": "2019-01-29T00:29:00Z",
        "LastModifiedDate": "2019-06-10T17:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-7664",
        "PkgName": "elfutils-libelf",
        "InstalledVersion": "0.172-2.el7",
        "FixedVersion": "0.176-2.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-7664",
        "Title": "elfutils: out of bound write in elf_cvt_note in libelf/note_xlate.h",
        "Description": "In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service (program crash).",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-119"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "V2Score": 4.3,
            "V3Score": 5.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 3.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-7664.html",
          "http://linux.oracle.com/errata/ELSA-2019-3575.html",
          "https://access.redhat.com/errata/RHSA-2019:2197",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7664",
          "https://sourceware.org/bugzilla/show_bug.cgi?id=24084"
        ],
        "PublishedDate": "2019-02-09T16:29:00Z",
        "LastModifiedDate": "2019-08-06T17:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-7665",
        "PkgName": "elfutils-libelf",
        "InstalledVersion": "0.172-2.el7",
        "FixedVersion": "0.176-2.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-7665",
        "Title": "elfutils: heap-based buffer over-read in function elf32_xlatetom in elf32_xlatetom.c",
        "Description": "In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-119"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "V2Score": 4.3,
            "V3Score": 5.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 3.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-7665.html",
          "http://linux.oracle.com/errata/ELSA-2019-3575.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7665",
          "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
          "https://sourceware.org/bugzilla/show_bug.cgi?id=24089",
          "https://sourceware.org/ml/elfutils-devel/2019-q1/msg00049.html",
          "https://usn.ubuntu.com/4012-1/",
          "https://usn.ubuntu.com/usn/usn-4012-1"
        ],
        "PublishedDate": "2019-02-09T16:29:00Z",
        "LastModifiedDate": "2019-06-10T17:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2016-10739",
        "PkgName": "glibc",
        "InstalledVersion": "2.17-260.0.17.el7_6.6",
        "FixedVersion": "2.17-292.0.1.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2016-10739",
        "Title": "glibc: getaddrinfo should reject IP addresses with trailing characters",
        "Description": "In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-20"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "V2Score": 4.6,
            "V3Score": 5.3
          },
          "redhat": {
            "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
            "V2Score": 4.6
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2016-10739.html",
          "http://linux.oracle.com/errata/ELSA-2019-3513.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00082.html",
          "http://www.securityfocus.com/bid/106672",
          "https://access.redhat.com/errata/RHSA-2019:2118",
          "https://bugzilla.redhat.com/show_bug.cgi?id=1347549",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10739",
          "https://sourceware.org/bugzilla/show_bug.cgi?id=20018"
        ],
        "PublishedDate": "2019-01-21T19:29:00Z",
        "LastModifiedDate": "2019-08-06T17:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2016-10739",
        "PkgName": "glibc-common",
        "InstalledVersion": "2.17-260.0.17.el7_6.6",
        "FixedVersion": "2.17-292.0.1.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2016-10739",
        "Title": "glibc: getaddrinfo should reject IP addresses with trailing characters",
        "Description": "In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-20"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "V2Score": 4.6,
            "V3Score": 5.3
          },
          "redhat": {
            "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
            "V2Score": 4.6
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2016-10739.html",
          "http://linux.oracle.com/errata/ELSA-2019-3513.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00082.html",
          "http://www.securityfocus.com/bid/106672",
          "https://access.redhat.com/errata/RHSA-2019:2118",
          "https://bugzilla.redhat.com/show_bug.cgi?id=1347549",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10739",
          "https://sourceware.org/bugzilla/show_bug.cgi?id=20018"
        ],
        "PublishedDate": "2019-01-21T19:29:00Z",
        "LastModifiedDate": "2019-08-06T17:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-16842",
        "PkgName": "libcurl",
        "InstalledVersion": "7.29.0-51.0.1.el7_6.3",
        "FixedVersion": "7.29.0-54.0.1.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-16842",
        "Title": "curl: Heap-based buffer over-read in the curl tool warning formatting",
        "Description": "Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.",
        "Severity": "CRITICAL",
        "CweIDs": [
          "CWE-125"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "V2Score": 6.4,
            "V3Score": 9.1
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L",
            "V3Score": 3.6
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-16842.html",
          "http://linux.oracle.com/errata/ELSA-2019-2181.html",
          "http://www.securitytracker.com/id/1042014",
          "https://access.redhat.com/errata/RHSA-2019:2181",
          "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16842",
          "https://curl.haxx.se/docs/CVE-2018-16842.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16842",
          "https://github.com/curl/curl/commit/d530e92f59ae9bb2d47066c3c460b25d2ffeb211",
          "https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html",
          "https://security.gentoo.org/glsa/201903-03",
          "https://usn.ubuntu.com/3805-1/",
          "https://usn.ubuntu.com/3805-2/",
          "https://usn.ubuntu.com/usn/usn-3805-1",
          "https://usn.ubuntu.com/usn/usn-3805-2",
          "https://www.debian.org/security/2018/dsa-4331"
        ],
        "PublishedDate": "2018-10-31T19:29:00Z",
        "LastModifiedDate": "2019-08-06T17:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-3858",
        "PkgName": "libssh2",
        "InstalledVersion": "1.4.3-12.0.1.el7_6.3",
        "FixedVersion": "1.8.0-3.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-3858",
        "Title": "libssh2: Zero-byte allocation with a specially crafted SFTP packed leading to an out-of-bounds read",
        "Description": "An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.",
        "Severity": "CRITICAL",
        "CweIDs": [
          "CWE-125"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "V2Score": 6.4,
            "V3Score": 9.1
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "V3Score": 5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-3858.html",
          "http://linux.oracle.com/errata/ELSA-2019-2136.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html",
          "http://packetstormsecurity.com/files/152136/Slackware-Security-Advisory-libssh2-Updates.html",
          "http://www.openwall.com/lists/oss-security/2019/03/18/3",
          "http://www.securityfocus.com/bid/107485",
          "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3858",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3858",
          "https://github.com/libssh2/libssh2/pull/316",
          "https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XCWEA5ZCLKRDUK62QVVYMFWLWKOPX3LO/",
          "https://seclists.org/bugtraq/2019/Apr/25",
          "https://seclists.org/bugtraq/2019/Mar/25",
          "https://security.netapp.com/advisory/ntap-20190327-0005/",
          "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-767",
          "https://www.debian.org/security/2019/dsa-4431",
          "https://www.libssh2.org/CVE-2019-3858.html"
        ],
        "PublishedDate": "2019-03-21T21:29:00Z",
        "LastModifiedDate": "2019-04-15T12:31:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-3861",
        "PkgName": "libssh2",
        "InstalledVersion": "1.4.3-12.0.1.el7_6.3",
        "FixedVersion": "1.8.0-3.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-3861",
        "Title": "libssh2: Out-of-bounds reads with specially crafted SSH packets",
        "Description": "An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.",
        "Severity": "CRITICAL",
        "CweIDs": [
          "CWE-125"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "V2Score": 6.4,
            "V3Score": 9.1
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "V3Score": 5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-3861.html",
          "http://linux.oracle.com/errata/ELSA-2019-2136.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html",
          "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3861",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3861",
          "https://github.com/libssh2/libssh2/pull/316",
          "https://libssh2.org/CVE-2019-3861.html",
          "https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/",
          "https://seclists.org/bugtraq/2019/Apr/25",
          "https://security.netapp.com/advisory/ntap-20190327-0005/",
          "https://www.debian.org/security/2019/dsa-4431",
          "https://www.libssh2.org/CVE-2019-3861.html"
        ],
        "PublishedDate": "2019-03-25T19:29:00Z",
        "LastModifiedDate": "2019-04-15T12:31:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-0495",
        "PkgName": "nspr",
        "InstalledVersion": "4.19.0-1.el7_5",
        "FixedVersion": "4.21.0-1.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-0495",
        "Title": "ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries",
        "Description": "Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-200"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "V2Score": 1.9,
            "V3Score": 4.7
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V3Score": 5.1
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-0495.html",
          "http://linux.oracle.com/errata/ELSA-2019-2237.html",
          "http://www.securitytracker.com/id/1041144",
          "http://www.securitytracker.com/id/1041147",
          "https://access.redhat.com/errata/RHSA-2018:3221",
          "https://access.redhat.com/errata/RHSA-2018:3505",
          "https://access.redhat.com/errata/RHSA-2019:1296",
          "https://access.redhat.com/errata/RHSA-2019:1297",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0495",
          "https://dev.gnupg.org/T4011",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.38_release_notes",
          "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=9010d1576e278a4274ad3f4aa15776c28f6ba965",
          "https://lists.debian.org/debian-lts-announce/2018/06/msg00013.html",
          "https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000426.html",
          "https://usn.ubuntu.com/3689-1/",
          "https://usn.ubuntu.com/3689-2/",
          "https://usn.ubuntu.com/3692-1/",
          "https://usn.ubuntu.com/3692-2/",
          "https://usn.ubuntu.com/3850-1/",
          "https://usn.ubuntu.com/3850-2/",
          "https://usn.ubuntu.com/usn/usn-3689-1",
          "https://usn.ubuntu.com/usn/usn-3689-2",
          "https://usn.ubuntu.com/usn/usn-3692-1",
          "https://usn.ubuntu.com/usn/usn-3692-2",
          "https://usn.ubuntu.com/usn/usn-3850-1",
          "https://usn.ubuntu.com/usn/usn-3850-2",
          "https://www.debian.org/security/2018/dsa-4231",
          "https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/",
          "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
        ],
        "PublishedDate": "2018-06-13T23:29:00Z",
        "LastModifiedDate": "2019-05-30T18:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-12404",
        "PkgName": "nspr",
        "InstalledVersion": "4.19.0-1.el7_5",
        "FixedVersion": "4.21.0-1.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-12404",
        "Title": "nss: Cache side-channel variant of the Bleichenbacher attack",
        "Description": "A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-310"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V2Score": 4.3,
            "V3Score": 5.9
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V3Score": 5.9
          }
        },
        "References": [
          "http://cat.eyalro.net/",
          "http://linux.oracle.com/cve/CVE-2018-12404.html",
          "http://linux.oracle.com/errata/ELSA-2019-2237.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00021.html",
          "http://www.securityfocus.com/bid/107260",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2018-12404",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12404",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.36.6_release_notes",
          "https://usn.ubuntu.com/usn/usn-3850-1",
          "https://usn.ubuntu.com/usn/usn-3850-2"
        ],
        "PublishedDate": "2019-05-02T17:29:00Z",
        "LastModifiedDate": "2019-07-20T12:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-11729",
        "PkgName": "nss",
        "InstalledVersion": "3.36.0-7.1.el7_6",
        "FixedVersion": "3.44.0-7.el7_7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-11729",
        "Title": "nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault",
        "Description": "Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR \u003c 60.8, Firefox \u003c 68, and Thunderbird \u003c 60.8.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-20"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 5,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-11729.html",
          "http://linux.oracle.com/errata/ELSA-2019-4190.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html",
          "https://access.redhat.com/errata/RHSA-2019:1951",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=1515342",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11729",
          "https://usn.ubuntu.com/usn/usn-4054-1",
          "https://usn.ubuntu.com/usn/usn-4060-1",
          "https://usn.ubuntu.com/usn/usn-4060-2",
          "https://usn.ubuntu.com/usn/usn-4064-1",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11729",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11729",
          "https://www.mozilla.org/security/advisories/mfsa2019-21/",
          "https://www.mozilla.org/security/advisories/mfsa2019-22/",
          "https://www.mozilla.org/security/advisories/mfsa2019-23/"
        ],
        "PublishedDate": "2019-07-23T14:15:00Z",
        "LastModifiedDate": "2019-07-29T16:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-0495",
        "PkgName": "nss",
        "InstalledVersion": "3.36.0-7.1.el7_6",
        "FixedVersion": "3.44.0-4.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-0495",
        "Title": "ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries",
        "Description": "Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-200"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "V2Score": 1.9,
            "V3Score": 4.7
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V3Score": 5.1
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-0495.html",
          "http://linux.oracle.com/errata/ELSA-2019-2237.html",
          "http://www.securitytracker.com/id/1041144",
          "http://www.securitytracker.com/id/1041147",
          "https://access.redhat.com/errata/RHSA-2018:3221",
          "https://access.redhat.com/errata/RHSA-2018:3505",
          "https://access.redhat.com/errata/RHSA-2019:1296",
          "https://access.redhat.com/errata/RHSA-2019:1297",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0495",
          "https://dev.gnupg.org/T4011",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.38_release_notes",
          "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=9010d1576e278a4274ad3f4aa15776c28f6ba965",
          "https://lists.debian.org/debian-lts-announce/2018/06/msg00013.html",
          "https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000426.html",
          "https://usn.ubuntu.com/3689-1/",
          "https://usn.ubuntu.com/3689-2/",
          "https://usn.ubuntu.com/3692-1/",
          "https://usn.ubuntu.com/3692-2/",
          "https://usn.ubuntu.com/3850-1/",
          "https://usn.ubuntu.com/3850-2/",
          "https://usn.ubuntu.com/usn/usn-3689-1",
          "https://usn.ubuntu.com/usn/usn-3689-2",
          "https://usn.ubuntu.com/usn/usn-3692-1",
          "https://usn.ubuntu.com/usn/usn-3692-2",
          "https://usn.ubuntu.com/usn/usn-3850-1",
          "https://usn.ubuntu.com/usn/usn-3850-2",
          "https://www.debian.org/security/2018/dsa-4231",
          "https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/",
          "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
        ],
        "PublishedDate": "2018-06-13T23:29:00Z",
        "LastModifiedDate": "2019-05-30T18:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-12404",
        "PkgName": "nss",
        "InstalledVersion": "3.36.0-7.1.el7_6",
        "FixedVersion": "3.44.0-4.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-12404",
        "Title": "nss: Cache side-channel variant of the Bleichenbacher attack",
        "Description": "A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-310"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V2Score": 4.3,
            "V3Score": 5.9
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V3Score": 5.9
          }
        },
        "References": [
          "http://cat.eyalro.net/",
          "http://linux.oracle.com/cve/CVE-2018-12404.html",
          "http://linux.oracle.com/errata/ELSA-2019-2237.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00021.html",
          "http://www.securityfocus.com/bid/107260",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2018-12404",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12404",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.36.6_release_notes",
          "https://usn.ubuntu.com/usn/usn-3850-1",
          "https://usn.ubuntu.com/usn/usn-3850-2"
        ],
        "PublishedDate": "2019-05-02T17:29:00Z",
        "LastModifiedDate": "2019-07-20T12:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-11745",
        "PkgName": "nss",
        "InstalledVersion": "3.36.0-7.1.el7_6",
        "FixedVersion": "3.44.0-7.el7_7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-11745",
        "Title": "nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate",
        "Description": "When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 68.3, Firefox ESR \u003c 68.3, and Firefox \u003c 71.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-787"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "V2Score": 6.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V3Score": 8.1
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-11745.html",
          "http://linux.oracle.com/errata/ELSA-2019-4190.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=1586176",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11745",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.3_release_notes",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47.1_release_notes",
          "https://usn.ubuntu.com/4241-1/",
          "https://usn.ubuntu.com/usn/usn-4203-1",
          "https://usn.ubuntu.com/usn/usn-4203-2",
          "https://usn.ubuntu.com/usn/usn-4216-1",
          "https://usn.ubuntu.com/usn/usn-4216-2",
          "https://usn.ubuntu.com/usn/usn-4241-1",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-38/#CVE-2019-11745",
          "https://www.mozilla.org/security/advisories/mfsa2019-36/",
          "https://www.mozilla.org/security/advisories/mfsa2019-37/",
          "https://www.mozilla.org/security/advisories/mfsa2019-38/"
        ],
        "PublishedDate": "2020-01-08T20:15:00Z",
        "LastModifiedDate": "2020-01-16T19:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-11729",
        "PkgName": "nss-softokn",
        "InstalledVersion": "3.36.0-5.0.1.el7_5",
        "FixedVersion": "3.44.0-8.0.1.el7_7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-11729",
        "Title": "nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault",
        "Description": "Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR \u003c 60.8, Firefox \u003c 68, and Thunderbird \u003c 60.8.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-20"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 5,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-11729.html",
          "http://linux.oracle.com/errata/ELSA-2019-4190.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html",
          "https://access.redhat.com/errata/RHSA-2019:1951",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=1515342",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11729",
          "https://usn.ubuntu.com/usn/usn-4054-1",
          "https://usn.ubuntu.com/usn/usn-4060-1",
          "https://usn.ubuntu.com/usn/usn-4060-2",
          "https://usn.ubuntu.com/usn/usn-4064-1",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11729",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11729",
          "https://www.mozilla.org/security/advisories/mfsa2019-21/",
          "https://www.mozilla.org/security/advisories/mfsa2019-22/",
          "https://www.mozilla.org/security/advisories/mfsa2019-23/"
        ],
        "PublishedDate": "2019-07-23T14:15:00Z",
        "LastModifiedDate": "2019-07-29T16:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-0495",
        "PkgName": "nss-softokn",
        "InstalledVersion": "3.36.0-5.0.1.el7_5",
        "FixedVersion": "3.44.0-5.0.1.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-0495",
        "Title": "ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries",
        "Description": "Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-200"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "V2Score": 1.9,
            "V3Score": 4.7
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V3Score": 5.1
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-0495.html",
          "http://linux.oracle.com/errata/ELSA-2019-2237.html",
          "http://www.securitytracker.com/id/1041144",
          "http://www.securitytracker.com/id/1041147",
          "https://access.redhat.com/errata/RHSA-2018:3221",
          "https://access.redhat.com/errata/RHSA-2018:3505",
          "https://access.redhat.com/errata/RHSA-2019:1296",
          "https://access.redhat.com/errata/RHSA-2019:1297",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0495",
          "https://dev.gnupg.org/T4011",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.38_release_notes",
          "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=9010d1576e278a4274ad3f4aa15776c28f6ba965",
          "https://lists.debian.org/debian-lts-announce/2018/06/msg00013.html",
          "https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000426.html",
          "https://usn.ubuntu.com/3689-1/",
          "https://usn.ubuntu.com/3689-2/",
          "https://usn.ubuntu.com/3692-1/",
          "https://usn.ubuntu.com/3692-2/",
          "https://usn.ubuntu.com/3850-1/",
          "https://usn.ubuntu.com/3850-2/",
          "https://usn.ubuntu.com/usn/usn-3689-1",
          "https://usn.ubuntu.com/usn/usn-3689-2",
          "https://usn.ubuntu.com/usn/usn-3692-1",
          "https://usn.ubuntu.com/usn/usn-3692-2",
          "https://usn.ubuntu.com/usn/usn-3850-1",
          "https://usn.ubuntu.com/usn/usn-3850-2",
          "https://www.debian.org/security/2018/dsa-4231",
          "https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/",
          "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
        ],
        "PublishedDate": "2018-06-13T23:29:00Z",
        "LastModifiedDate": "2019-05-30T18:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-12404",
        "PkgName": "nss-softokn",
        "InstalledVersion": "3.36.0-5.0.1.el7_5",
        "FixedVersion": "3.44.0-5.0.1.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-12404",
        "Title": "nss: Cache side-channel variant of the Bleichenbacher attack",
        "Description": "A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-310"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V2Score": 4.3,
            "V3Score": 5.9
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V3Score": 5.9
          }
        },
        "References": [
          "http://cat.eyalro.net/",
          "http://linux.oracle.com/cve/CVE-2018-12404.html",
          "http://linux.oracle.com/errata/ELSA-2019-2237.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00021.html",
          "http://www.securityfocus.com/bid/107260",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2018-12404",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12404",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.36.6_release_notes",
          "https://usn.ubuntu.com/usn/usn-3850-1",
          "https://usn.ubuntu.com/usn/usn-3850-2"
        ],
        "PublishedDate": "2019-05-02T17:29:00Z",
        "LastModifiedDate": "2019-07-20T12:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-11745",
        "PkgName": "nss-softokn",
        "InstalledVersion": "3.36.0-5.0.1.el7_5",
        "FixedVersion": "3.44.0-8.0.1.el7_7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-11745",
        "Title": "nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate",
        "Description": "When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 68.3, Firefox ESR \u003c 68.3, and Firefox \u003c 71.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-787"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "V2Score": 6.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V3Score": 8.1
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-11745.html",
          "http://linux.oracle.com/errata/ELSA-2019-4190.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=1586176",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11745",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.3_release_notes",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47.1_release_notes",
          "https://usn.ubuntu.com/4241-1/",
          "https://usn.ubuntu.com/usn/usn-4203-1",
          "https://usn.ubuntu.com/usn/usn-4203-2",
          "https://usn.ubuntu.com/usn/usn-4216-1",
          "https://usn.ubuntu.com/usn/usn-4216-2",
          "https://usn.ubuntu.com/usn/usn-4241-1",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-38/#CVE-2019-11745",
          "https://www.mozilla.org/security/advisories/mfsa2019-36/",
          "https://www.mozilla.org/security/advisories/mfsa2019-37/",
          "https://www.mozilla.org/security/advisories/mfsa2019-38/"
        ],
        "PublishedDate": "2020-01-08T20:15:00Z",
        "LastModifiedDate": "2020-01-16T19:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-11729",
        "PkgName": "nss-softokn-freebl",
        "InstalledVersion": "3.36.0-5.0.1.el7_5",
        "FixedVersion": "3.44.0-8.0.1.el7_7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-11729",
        "Title": "nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault",
        "Description": "Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR \u003c 60.8, Firefox \u003c 68, and Thunderbird \u003c 60.8.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-20"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 5,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-11729.html",
          "http://linux.oracle.com/errata/ELSA-2019-4190.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html",
          "https://access.redhat.com/errata/RHSA-2019:1951",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=1515342",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11729",
          "https://usn.ubuntu.com/usn/usn-4054-1",
          "https://usn.ubuntu.com/usn/usn-4060-1",
          "https://usn.ubuntu.com/usn/usn-4060-2",
          "https://usn.ubuntu.com/usn/usn-4064-1",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11729",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11729",
          "https://www.mozilla.org/security/advisories/mfsa2019-21/",
          "https://www.mozilla.org/security/advisories/mfsa2019-22/",
          "https://www.mozilla.org/security/advisories/mfsa2019-23/"
        ],
        "PublishedDate": "2019-07-23T14:15:00Z",
        "LastModifiedDate": "2019-07-29T16:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-0495",
        "PkgName": "nss-softokn-freebl",
        "InstalledVersion": "3.36.0-5.0.1.el7_5",
        "FixedVersion": "3.44.0-5.0.1.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-0495",
        "Title": "ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries",
        "Description": "Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-200"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "V2Score": 1.9,
            "V3Score": 4.7
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V3Score": 5.1
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-0495.html",
          "http://linux.oracle.com/errata/ELSA-2019-2237.html",
          "http://www.securitytracker.com/id/1041144",
          "http://www.securitytracker.com/id/1041147",
          "https://access.redhat.com/errata/RHSA-2018:3221",
          "https://access.redhat.com/errata/RHSA-2018:3505",
          "https://access.redhat.com/errata/RHSA-2019:1296",
          "https://access.redhat.com/errata/RHSA-2019:1297",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0495",
          "https://dev.gnupg.org/T4011",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.38_release_notes",
          "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=9010d1576e278a4274ad3f4aa15776c28f6ba965",
          "https://lists.debian.org/debian-lts-announce/2018/06/msg00013.html",
          "https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000426.html",
          "https://usn.ubuntu.com/3689-1/",
          "https://usn.ubuntu.com/3689-2/",
          "https://usn.ubuntu.com/3692-1/",
          "https://usn.ubuntu.com/3692-2/",
          "https://usn.ubuntu.com/3850-1/",
          "https://usn.ubuntu.com/3850-2/",
          "https://usn.ubuntu.com/usn/usn-3689-1",
          "https://usn.ubuntu.com/usn/usn-3689-2",
          "https://usn.ubuntu.com/usn/usn-3692-1",
          "https://usn.ubuntu.com/usn/usn-3692-2",
          "https://usn.ubuntu.com/usn/usn-3850-1",
          "https://usn.ubuntu.com/usn/usn-3850-2",
          "https://www.debian.org/security/2018/dsa-4231",
          "https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/",
          "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
        ],
        "PublishedDate": "2018-06-13T23:29:00Z",
        "LastModifiedDate": "2019-05-30T18:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-12404",
        "PkgName": "nss-softokn-freebl",
        "InstalledVersion": "3.36.0-5.0.1.el7_5",
        "FixedVersion": "3.44.0-5.0.1.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-12404",
        "Title": "nss: Cache side-channel variant of the Bleichenbacher attack",
        "Description": "A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-310"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V2Score": 4.3,
            "V3Score": 5.9
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V3Score": 5.9
          }
        },
        "References": [
          "http://cat.eyalro.net/",
          "http://linux.oracle.com/cve/CVE-2018-12404.html",
          "http://linux.oracle.com/errata/ELSA-2019-2237.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00021.html",
          "http://www.securityfocus.com/bid/107260",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2018-12404",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12404",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.36.6_release_notes",
          "https://usn.ubuntu.com/usn/usn-3850-1",
          "https://usn.ubuntu.com/usn/usn-3850-2"
        ],
        "PublishedDate": "2019-05-02T17:29:00Z",
        "LastModifiedDate": "2019-07-20T12:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-11745",
        "PkgName": "nss-softokn-freebl",
        "InstalledVersion": "3.36.0-5.0.1.el7_5",
        "FixedVersion": "3.44.0-8.0.1.el7_7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-11745",
        "Title": "nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate",
        "Description": "When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 68.3, Firefox ESR \u003c 68.3, and Firefox \u003c 71.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-787"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "V2Score": 6.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V3Score": 8.1
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-11745.html",
          "http://linux.oracle.com/errata/ELSA-2019-4190.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=1586176",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11745",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.3_release_notes",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47.1_release_notes",
          "https://usn.ubuntu.com/4241-1/",
          "https://usn.ubuntu.com/usn/usn-4203-1",
          "https://usn.ubuntu.com/usn/usn-4203-2",
          "https://usn.ubuntu.com/usn/usn-4216-1",
          "https://usn.ubuntu.com/usn/usn-4216-2",
          "https://usn.ubuntu.com/usn/usn-4241-1",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-38/#CVE-2019-11745",
          "https://www.mozilla.org/security/advisories/mfsa2019-36/",
          "https://www.mozilla.org/security/advisories/mfsa2019-37/",
          "https://www.mozilla.org/security/advisories/mfsa2019-38/"
        ],
        "PublishedDate": "2020-01-08T20:15:00Z",
        "LastModifiedDate": "2020-01-16T19:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-11729",
        "PkgName": "nss-sysinit",
        "InstalledVersion": "3.36.0-7.1.el7_6",
        "FixedVersion": "3.44.0-7.el7_7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-11729",
        "Title": "nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault",
        "Description": "Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR \u003c 60.8, Firefox \u003c 68, and Thunderbird \u003c 60.8.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-20"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 5,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-11729.html",
          "http://linux.oracle.com/errata/ELSA-2019-4190.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html",
          "https://access.redhat.com/errata/RHSA-2019:1951",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=1515342",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11729",
          "https://usn.ubuntu.com/usn/usn-4054-1",
          "https://usn.ubuntu.com/usn/usn-4060-1",
          "https://usn.ubuntu.com/usn/usn-4060-2",
          "https://usn.ubuntu.com/usn/usn-4064-1",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11729",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11729",
          "https://www.mozilla.org/security/advisories/mfsa2019-21/",
          "https://www.mozilla.org/security/advisories/mfsa2019-22/",
          "https://www.mozilla.org/security/advisories/mfsa2019-23/"
        ],
        "PublishedDate": "2019-07-23T14:15:00Z",
        "LastModifiedDate": "2019-07-29T16:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-0495",
        "PkgName": "nss-sysinit",
        "InstalledVersion": "3.36.0-7.1.el7_6",
        "FixedVersion": "3.44.0-4.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-0495",
        "Title": "ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries",
        "Description": "Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-200"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "V2Score": 1.9,
            "V3Score": 4.7
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V3Score": 5.1
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-0495.html",
          "http://linux.oracle.com/errata/ELSA-2019-2237.html",
          "http://www.securitytracker.com/id/1041144",
          "http://www.securitytracker.com/id/1041147",
          "https://access.redhat.com/errata/RHSA-2018:3221",
          "https://access.redhat.com/errata/RHSA-2018:3505",
          "https://access.redhat.com/errata/RHSA-2019:1296",
          "https://access.redhat.com/errata/RHSA-2019:1297",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0495",
          "https://dev.gnupg.org/T4011",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.38_release_notes",
          "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=9010d1576e278a4274ad3f4aa15776c28f6ba965",
          "https://lists.debian.org/debian-lts-announce/2018/06/msg00013.html",
          "https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000426.html",
          "https://usn.ubuntu.com/3689-1/",
          "https://usn.ubuntu.com/3689-2/",
          "https://usn.ubuntu.com/3692-1/",
          "https://usn.ubuntu.com/3692-2/",
          "https://usn.ubuntu.com/3850-1/",
          "https://usn.ubuntu.com/3850-2/",
          "https://usn.ubuntu.com/usn/usn-3689-1",
          "https://usn.ubuntu.com/usn/usn-3689-2",
          "https://usn.ubuntu.com/usn/usn-3692-1",
          "https://usn.ubuntu.com/usn/usn-3692-2",
          "https://usn.ubuntu.com/usn/usn-3850-1",
          "https://usn.ubuntu.com/usn/usn-3850-2",
          "https://www.debian.org/security/2018/dsa-4231",
          "https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/",
          "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
        ],
        "PublishedDate": "2018-06-13T23:29:00Z",
        "LastModifiedDate": "2019-05-30T18:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-12404",
        "PkgName": "nss-sysinit",
        "InstalledVersion": "3.36.0-7.1.el7_6",
        "FixedVersion": "3.44.0-4.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-12404",
        "Title": "nss: Cache side-channel variant of the Bleichenbacher attack",
        "Description": "A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-310"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V2Score": 4.3,
            "V3Score": 5.9
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V3Score": 5.9
          }
        },
        "References": [
          "http://cat.eyalro.net/",
          "http://linux.oracle.com/cve/CVE-2018-12404.html",
          "http://linux.oracle.com/errata/ELSA-2019-2237.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00021.html",
          "http://www.securityfocus.com/bid/107260",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2018-12404",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12404",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.36.6_release_notes",
          "https://usn.ubuntu.com/usn/usn-3850-1",
          "https://usn.ubuntu.com/usn/usn-3850-2"
        ],
        "PublishedDate": "2019-05-02T17:29:00Z",
        "LastModifiedDate": "2019-07-20T12:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-11745",
        "PkgName": "nss-sysinit",
        "InstalledVersion": "3.36.0-7.1.el7_6",
        "FixedVersion": "3.44.0-7.el7_7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-11745",
        "Title": "nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate",
        "Description": "When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 68.3, Firefox ESR \u003c 68.3, and Firefox \u003c 71.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-787"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "V2Score": 6.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V3Score": 8.1
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-11745.html",
          "http://linux.oracle.com/errata/ELSA-2019-4190.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=1586176",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11745",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.3_release_notes",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47.1_release_notes",
          "https://usn.ubuntu.com/4241-1/",
          "https://usn.ubuntu.com/usn/usn-4203-1",
          "https://usn.ubuntu.com/usn/usn-4203-2",
          "https://usn.ubuntu.com/usn/usn-4216-1",
          "https://usn.ubuntu.com/usn/usn-4216-2",
          "https://usn.ubuntu.com/usn/usn-4241-1",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-38/#CVE-2019-11745",
          "https://www.mozilla.org/security/advisories/mfsa2019-36/",
          "https://www.mozilla.org/security/advisories/mfsa2019-37/",
          "https://www.mozilla.org/security/advisories/mfsa2019-38/"
        ],
        "PublishedDate": "2020-01-08T20:15:00Z",
        "LastModifiedDate": "2020-01-16T19:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-11729",
        "PkgName": "nss-tools",
        "InstalledVersion": "3.36.0-7.1.el7_6",
        "FixedVersion": "3.44.0-7.el7_7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-11729",
        "Title": "nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault",
        "Description": "Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR \u003c 60.8, Firefox \u003c 68, and Thunderbird \u003c 60.8.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-20"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 5,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-11729.html",
          "http://linux.oracle.com/errata/ELSA-2019-4190.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html",
          "https://access.redhat.com/errata/RHSA-2019:1951",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=1515342",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11729",
          "https://usn.ubuntu.com/usn/usn-4054-1",
          "https://usn.ubuntu.com/usn/usn-4060-1",
          "https://usn.ubuntu.com/usn/usn-4060-2",
          "https://usn.ubuntu.com/usn/usn-4064-1",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11729",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11729",
          "https://www.mozilla.org/security/advisories/mfsa2019-21/",
          "https://www.mozilla.org/security/advisories/mfsa2019-22/",
          "https://www.mozilla.org/security/advisories/mfsa2019-23/"
        ],
        "PublishedDate": "2019-07-23T14:15:00Z",
        "LastModifiedDate": "2019-07-29T16:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-0495",
        "PkgName": "nss-tools",
        "InstalledVersion": "3.36.0-7.1.el7_6",
        "FixedVersion": "3.44.0-4.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-0495",
        "Title": "ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries",
        "Description": "Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-200"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "V2Score": 1.9,
            "V3Score": 4.7
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V3Score": 5.1
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-0495.html",
          "http://linux.oracle.com/errata/ELSA-2019-2237.html",
          "http://www.securitytracker.com/id/1041144",
          "http://www.securitytracker.com/id/1041147",
          "https://access.redhat.com/errata/RHSA-2018:3221",
          "https://access.redhat.com/errata/RHSA-2018:3505",
          "https://access.redhat.com/errata/RHSA-2019:1296",
          "https://access.redhat.com/errata/RHSA-2019:1297",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0495",
          "https://dev.gnupg.org/T4011",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.38_release_notes",
          "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=9010d1576e278a4274ad3f4aa15776c28f6ba965",
          "https://lists.debian.org/debian-lts-announce/2018/06/msg00013.html",
          "https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000426.html",
          "https://usn.ubuntu.com/3689-1/",
          "https://usn.ubuntu.com/3689-2/",
          "https://usn.ubuntu.com/3692-1/",
          "https://usn.ubuntu.com/3692-2/",
          "https://usn.ubuntu.com/3850-1/",
          "https://usn.ubuntu.com/3850-2/",
          "https://usn.ubuntu.com/usn/usn-3689-1",
          "https://usn.ubuntu.com/usn/usn-3689-2",
          "https://usn.ubuntu.com/usn/usn-3692-1",
          "https://usn.ubuntu.com/usn/usn-3692-2",
          "https://usn.ubuntu.com/usn/usn-3850-1",
          "https://usn.ubuntu.com/usn/usn-3850-2",
          "https://www.debian.org/security/2018/dsa-4231",
          "https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/",
          "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
        ],
        "PublishedDate": "2018-06-13T23:29:00Z",
        "LastModifiedDate": "2019-05-30T18:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-12404",
        "PkgName": "nss-tools",
        "InstalledVersion": "3.36.0-7.1.el7_6",
        "FixedVersion": "3.44.0-4.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-12404",
        "Title": "nss: Cache side-channel variant of the Bleichenbacher attack",
        "Description": "A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-310"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V2Score": 4.3,
            "V3Score": 5.9
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V3Score": 5.9
          }
        },
        "References": [
          "http://cat.eyalro.net/",
          "http://linux.oracle.com/cve/CVE-2018-12404.html",
          "http://linux.oracle.com/errata/ELSA-2019-2237.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00021.html",
          "http://www.securityfocus.com/bid/107260",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2018-12404",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12404",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.36.6_release_notes",
          "https://usn.ubuntu.com/usn/usn-3850-1",
          "https://usn.ubuntu.com/usn/usn-3850-2"
        ],
        "PublishedDate": "2019-05-02T17:29:00Z",
        "LastModifiedDate": "2019-07-20T12:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-11745",
        "PkgName": "nss-tools",
        "InstalledVersion": "3.36.0-7.1.el7_6",
        "FixedVersion": "3.44.0-7.el7_7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-11745",
        "Title": "nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate",
        "Description": "When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 68.3, Firefox ESR \u003c 68.3, and Firefox \u003c 71.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-787"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "V2Score": 6.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V3Score": 8.1
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-11745.html",
          "http://linux.oracle.com/errata/ELSA-2019-4190.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=1586176",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11745",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.3_release_notes",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47.1_release_notes",
          "https://usn.ubuntu.com/4241-1/",
          "https://usn.ubuntu.com/usn/usn-4203-1",
          "https://usn.ubuntu.com/usn/usn-4203-2",
          "https://usn.ubuntu.com/usn/usn-4216-1",
          "https://usn.ubuntu.com/usn/usn-4216-2",
          "https://usn.ubuntu.com/usn/usn-4241-1",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-38/#CVE-2019-11745",
          "https://www.mozilla.org/security/advisories/mfsa2019-36/",
          "https://www.mozilla.org/security/advisories/mfsa2019-37/",
          "https://www.mozilla.org/security/advisories/mfsa2019-38/"
        ],
        "PublishedDate": "2020-01-08T20:15:00Z",
        "LastModifiedDate": "2020-01-16T19:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-11729",
        "PkgName": "nss-util",
        "InstalledVersion": "3.36.0-1.1.el7_6",
        "FixedVersion": "3.44.0-4.el7_7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-11729",
        "Title": "nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault",
        "Description": "Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR \u003c 60.8, Firefox \u003c 68, and Thunderbird \u003c 60.8.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-20"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 5,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-11729.html",
          "http://linux.oracle.com/errata/ELSA-2019-4190.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html",
          "https://access.redhat.com/errata/RHSA-2019:1951",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=1515342",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11729",
          "https://usn.ubuntu.com/usn/usn-4054-1",
          "https://usn.ubuntu.com/usn/usn-4060-1",
          "https://usn.ubuntu.com/usn/usn-4060-2",
          "https://usn.ubuntu.com/usn/usn-4064-1",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11729",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11729",
          "https://www.mozilla.org/security/advisories/mfsa2019-21/",
          "https://www.mozilla.org/security/advisories/mfsa2019-22/",
          "https://www.mozilla.org/security/advisories/mfsa2019-23/"
        ],
        "PublishedDate": "2019-07-23T14:15:00Z",
        "LastModifiedDate": "2019-07-29T16:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-0495",
        "PkgName": "nss-util",
        "InstalledVersion": "3.36.0-1.1.el7_6",
        "FixedVersion": "3.44.0-3.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-0495",
        "Title": "ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries",
        "Description": "Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-200"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "V2Score": 1.9,
            "V3Score": 4.7
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V3Score": 5.1
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-0495.html",
          "http://linux.oracle.com/errata/ELSA-2019-2237.html",
          "http://www.securitytracker.com/id/1041144",
          "http://www.securitytracker.com/id/1041147",
          "https://access.redhat.com/errata/RHSA-2018:3221",
          "https://access.redhat.com/errata/RHSA-2018:3505",
          "https://access.redhat.com/errata/RHSA-2019:1296",
          "https://access.redhat.com/errata/RHSA-2019:1297",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0495",
          "https://dev.gnupg.org/T4011",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.38_release_notes",
          "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=9010d1576e278a4274ad3f4aa15776c28f6ba965",
          "https://lists.debian.org/debian-lts-announce/2018/06/msg00013.html",
          "https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000426.html",
          "https://usn.ubuntu.com/3689-1/",
          "https://usn.ubuntu.com/3689-2/",
          "https://usn.ubuntu.com/3692-1/",
          "https://usn.ubuntu.com/3692-2/",
          "https://usn.ubuntu.com/3850-1/",
          "https://usn.ubuntu.com/3850-2/",
          "https://usn.ubuntu.com/usn/usn-3689-1",
          "https://usn.ubuntu.com/usn/usn-3689-2",
          "https://usn.ubuntu.com/usn/usn-3692-1",
          "https://usn.ubuntu.com/usn/usn-3692-2",
          "https://usn.ubuntu.com/usn/usn-3850-1",
          "https://usn.ubuntu.com/usn/usn-3850-2",
          "https://www.debian.org/security/2018/dsa-4231",
          "https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/",
          "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
        ],
        "PublishedDate": "2018-06-13T23:29:00Z",
        "LastModifiedDate": "2019-05-30T18:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-12404",
        "PkgName": "nss-util",
        "InstalledVersion": "3.36.0-1.1.el7_6",
        "FixedVersion": "3.44.0-3.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-12404",
        "Title": "nss: Cache side-channel variant of the Bleichenbacher attack",
        "Description": "A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-310"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V2Score": 4.3,
            "V3Score": 5.9
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V3Score": 5.9
          }
        },
        "References": [
          "http://cat.eyalro.net/",
          "http://linux.oracle.com/cve/CVE-2018-12404.html",
          "http://linux.oracle.com/errata/ELSA-2019-2237.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00021.html",
          "http://www.securityfocus.com/bid/107260",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2018-12404",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12404",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.36.6_release_notes",
          "https://usn.ubuntu.com/usn/usn-3850-1",
          "https://usn.ubuntu.com/usn/usn-3850-2"
        ],
        "PublishedDate": "2019-05-02T17:29:00Z",
        "LastModifiedDate": "2019-07-20T12:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-11745",
        "PkgName": "nss-util",
        "InstalledVersion": "3.36.0-1.1.el7_6",
        "FixedVersion": "3.44.0-4.el7_7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-11745",
        "Title": "nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate",
        "Description": "When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 68.3, Firefox ESR \u003c 68.3, and Firefox \u003c 71.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-787"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "V2Score": 6.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V3Score": 8.1
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-11745.html",
          "http://linux.oracle.com/errata/ELSA-2019-4190.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=1586176",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11745",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.3_release_notes",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47.1_release_notes",
          "https://usn.ubuntu.com/4241-1/",
          "https://usn.ubuntu.com/usn/usn-4203-1",
          "https://usn.ubuntu.com/usn/usn-4203-2",
          "https://usn.ubuntu.com/usn/usn-4216-1",
          "https://usn.ubuntu.com/usn/usn-4216-2",
          "https://usn.ubuntu.com/usn/usn-4241-1",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-38/#CVE-2019-11745",
          "https://www.mozilla.org/security/advisories/mfsa2019-36/",
          "https://www.mozilla.org/security/advisories/mfsa2019-37/",
          "https://www.mozilla.org/security/advisories/mfsa2019-38/"
        ],
        "PublishedDate": "2020-01-08T20:15:00Z",
        "LastModifiedDate": "2020-01-16T19:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-0734",
        "PkgName": "openssl-libs",
        "InstalledVersion": "1:1.0.2k-16.0.1.el7_6.1",
        "FixedVersion": "1:1.0.2k-19.0.1.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-0734",
        "Title": "openssl: timing side channel attack in the DSA signature algorithm",
        "Description": "The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-320"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V2Score": 4.3,
            "V3Score": 5.9
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V3Score": 5.1
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-0734.html",
          "http://linux.oracle.com/errata/ELSA-2019-3700.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html",
          "http://www.securityfocus.com/bid/105758",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0734",
          "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=43e6a58d4991a451daf4891ff05a48735df871ac",
          "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8abfe72e8c1de1b95f50aa0d9134803b4d00070f",
          "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ef11e19d1365eea2b1851e6f540a0bf365d303e7",
          "https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/",
          "https://security.netapp.com/advisory/ntap-20181105-0002/",
          "https://security.netapp.com/advisory/ntap-20190118-0002/",
          "https://security.netapp.com/advisory/ntap-20190423-0002/",
          "https://usn.ubuntu.com/3840-1/",
          "https://usn.ubuntu.com/usn/usn-3840-1",
          "https://www.debian.org/security/2018/dsa-4348",
          "https://www.debian.org/security/2018/dsa-4355",
          "https://www.openssl.org/news/secadv/20181030.txt",
          "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
          "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html",
          "https://www.tenable.com/security/tns-2018-16",
          "https://www.tenable.com/security/tns-2018-17"
        ],
        "PublishedDate": "2018-10-30T12:29:00Z",
        "LastModifiedDate": "2019-06-11T22:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-1559",
        "PkgName": "openssl-libs",
        "InstalledVersion": "1:1.0.2k-16.0.1.el7_6.1",
        "FixedVersion": "1:1.0.2k-19.0.1.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1559",
        "Title": "openssl: 0-byte record padding oracle",
        "Description": "If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-200"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V2Score": 4.3,
            "V3Score": 5.9
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "V3Score": 6.8
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-1559.html",
          "http://linux.oracle.com/errata/ELSA-2019-2471.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00019.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00047.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00049.html",
          "http://www.securityfocus.com/bid/107174",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1559",
          "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e9bbefbf0f24c57645e7ad6a5a71ae649d18ac8e",
          "https://github.com/RUB-NDS/TLS-Padding-Oracles",
          "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10282",
          "https://lists.debian.org/debian-lts-announce/2019/03/msg00003.html",
          "https://security.gentoo.org/glsa/201903-10",
          "https://security.netapp.com/advisory/ntap-20190301-0001/",
          "https://security.netapp.com/advisory/ntap-20190301-0002/",
          "https://security.netapp.com/advisory/ntap-20190423-0002/",
          "https://support.f5.com/csp/article/K18549143",
          "https://usn.ubuntu.com/3899-1/",
          "https://usn.ubuntu.com/usn/usn-3899-1",
          "https://www.debian.org/security/2019/dsa-4400",
          "https://www.openssl.org/news/secadv/20190226.txt",
          "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
          "https://www.tenable.com/security/tns-2019-02",
          "https://www.tenable.com/security/tns-2019-03"
        ],
        "PublishedDate": "2019-02-27T23:29:00Z",
        "LastModifiedDate": "2019-05-22T00:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-9948",
        "PkgName": "python",
        "InstalledVersion": "2.7.5-80.0.1.el7_6",
        "FixedVersion": "2.7.5-86.0.1.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-9948",
        "Title": "python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms",
        "Description": "urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.",
        "Severity": "CRITICAL",
        "CweIDs": [
          "CWE-254"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "V2Score": 6.4,
            "V3Score": 9.1
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "V3Score": 7.4
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-9948.html",
          "http://linux.oracle.com/errata/ELSA-2019-3520.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html",
          "http://www.securityfocus.com/bid/107549",
          "https://bugs.python.org/issue35907",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9948",
          "https://github.com/python/cpython/pull/11842",
          "https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html",
          "https://security.netapp.com/advisory/ntap-20190404-0004/",
          "https://usn.ubuntu.com/usn/usn-4127-1",
          "https://usn.ubuntu.com/usn/usn-4127-2"
        ],
        "PublishedDate": "2019-03-23T18:29:00Z",
        "LastModifiedDate": "2019-06-19T02:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-14647",
        "PkgName": "python",
        "InstalledVersion": "2.7.5-80.0.1.el7_6",
        "FixedVersion": "2.7.5-86.0.1.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-14647",
        "Title": "python: Missing salt initialization in _elementtree.c module",
        "Description": "Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. Python 3.8, 3.7, 3.6, 3.5, 3.4, 2.7 are believed to be vulnerable.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-909"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 5,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "V3Score": 5.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-14647.html",
          "http://linux.oracle.com/errata/ELSA-2019-2030.html",
          "http://www.securityfocus.com/bid/105396",
          "http://www.securitytracker.com/id/1041740",
          "https://access.redhat.com/errata/RHSA-2019:1260",
          "https://access.redhat.com/errata/RHSA-2019:2030",
          "https://bugs.python.org/issue34623",
          "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14647",
          "https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html",
          "https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/",
          "https://usn.ubuntu.com/3817-1/",
          "https://usn.ubuntu.com/3817-2/",
          "https://usn.ubuntu.com/usn/usn-3817-1",
          "https://usn.ubuntu.com/usn/usn-3817-2",
          "https://www.debian.org/security/2018/dsa-4306",
          "https://www.debian.org/security/2018/dsa-4307"
        ],
        "PublishedDate": "2018-09-25T00:29:00Z",
        "LastModifiedDate": "2019-10-03T00:03:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-20852",
        "PkgName": "python",
        "InstalledVersion": "2.7.5-80.0.1.el7_6",
        "FixedVersion": "2.7.5-86.0.3.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-20852",
        "Title": "python: Cookie domain check returns incorrect results",
        "Description": "http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-20"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "V2Score": 5,
            "V3Score": 5.3
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "V3Score": 5.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-20852.html",
          "http://linux.oracle.com/errata/ELSA-2019-4884.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00071.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00074.html",
          "https://bugs.python.org/issue35121",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20852",
          "https://lists.debian.org/debian-lts-announce/2019/08/msg00022.html",
          "https://python-security.readthedocs.io/vuln/cookie-domain-check.html",
          "https://usn.ubuntu.com/usn/usn-4127-1",
          "https://usn.ubuntu.com/usn/usn-4127-2"
        ],
        "PublishedDate": "2019-07-13T21:15:00Z",
        "LastModifiedDate": "2019-08-17T21:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-5010",
        "PkgName": "python",
        "InstalledVersion": "2.7.5-80.0.1.el7_6",
        "FixedVersion": "2.7.5-86.0.1.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-5010",
        "Title": "python: NULL pointer dereference using a specially crafted X509 certificate",
        "Description": "An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-476"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V2Score": 5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-5010.html",
          "http://linux.oracle.com/errata/ELSA-2019-3520.html",
          "https://access.redhat.com/errata/RHSA-2019:3520",
          "https://access.redhat.com/errata/RHSA-2019:3725",
          "https://blog.talosintelligence.com/2019/01/vulnerability-spotlight-pythonorg.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5010",
          "https://github.com/python/cpython/pull/11569",
          "https://python-security.readthedocs.io/vuln/ssl-crl-dps-dos.html",
          "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0758",
          "https://usn.ubuntu.com/usn/usn-4127-1",
          "https://usn.ubuntu.com/usn/usn-4127-2"
        ],
        "PublishedDate": "2019-10-31T21:15:00Z",
        "LastModifiedDate": "2019-11-06T01:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-9740",
        "PkgName": "python",
        "InstalledVersion": "2.7.5-80.0.1.el7_6",
        "FixedVersion": "2.7.5-86.0.1.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-9740",
        "Title": "python: CRLF injection via the query part of the url passed to urlopen()",
        "Description": "An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-93"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "V2Score": 4.3,
            "V3Score": 6.1
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "V3Score": 6.5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-9740.html",
          "http://linux.oracle.com/errata/ELSA-2019-3520.html",
          "http://www.securityfocus.com/bid/107466",
          "https://access.redhat.com/errata/RHSA-2019:1260",
          "https://bugs.python.org/issue36276",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9740",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/",
          "https://python-security.readthedocs.io/vuln/http-header-injection2.html",
          "https://usn.ubuntu.com/usn/usn-4127-1",
          "https://usn.ubuntu.com/usn/usn-4127-2"
        ],
        "PublishedDate": "2019-03-13T03:29:00Z",
        "LastModifiedDate": "2019-05-28T18:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-9947",
        "PkgName": "python",
        "InstalledVersion": "2.7.5-80.0.1.el7_6",
        "FixedVersion": "2.7.5-86.0.1.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-9947",
        "Title": "python: CRLF injection via the path part of the url passed to urlopen()",
        "Description": "An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-93"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "V2Score": 4.3,
            "V3Score": 6.1
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "V3Score": 6.5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-9947.html",
          "http://linux.oracle.com/errata/ELSA-2019-3520.html",
          "https://access.redhat.com/errata/RHSA-2019:1260",
          "https://bugs.python.org/issue35906",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9947",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/",
          "https://python-security.readthedocs.io/vuln/http-header-injection2.html",
          "https://security.netapp.com/advisory/ntap-20190404-0004/",
          "https://usn.ubuntu.com/usn/usn-4127-1",
          "https://usn.ubuntu.com/usn/usn-4127-2"
        ],
        "PublishedDate": "2019-03-23T18:29:00Z",
        "LastModifiedDate": "2019-05-28T19:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-9948",
        "PkgName": "python-libs",
        "InstalledVersion": "2.7.5-80.0.1.el7_6",
        "FixedVersion": "2.7.5-86.0.1.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-9948",
        "Title": "python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms",
        "Description": "urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.",
        "Severity": "CRITICAL",
        "CweIDs": [
          "CWE-254"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "V2Score": 6.4,
            "V3Score": 9.1
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "V3Score": 7.4
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-9948.html",
          "http://linux.oracle.com/errata/ELSA-2019-3520.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html",
          "http://www.securityfocus.com/bid/107549",
          "https://bugs.python.org/issue35907",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9948",
          "https://github.com/python/cpython/pull/11842",
          "https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html",
          "https://security.netapp.com/advisory/ntap-20190404-0004/",
          "https://usn.ubuntu.com/usn/usn-4127-1",
          "https://usn.ubuntu.com/usn/usn-4127-2"
        ],
        "PublishedDate": "2019-03-23T18:29:00Z",
        "LastModifiedDate": "2019-06-19T02:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-14647",
        "PkgName": "python-libs",
        "InstalledVersion": "2.7.5-80.0.1.el7_6",
        "FixedVersion": "2.7.5-86.0.1.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-14647",
        "Title": "python: Missing salt initialization in _elementtree.c module",
        "Description": "Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. Python 3.8, 3.7, 3.6, 3.5, 3.4, 2.7 are believed to be vulnerable.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-909"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 5,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "V3Score": 5.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-14647.html",
          "http://linux.oracle.com/errata/ELSA-2019-2030.html",
          "http://www.securityfocus.com/bid/105396",
          "http://www.securitytracker.com/id/1041740",
          "https://access.redhat.com/errata/RHSA-2019:1260",
          "https://access.redhat.com/errata/RHSA-2019:2030",
          "https://bugs.python.org/issue34623",
          "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14647",
          "https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html",
          "https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/",
          "https://usn.ubuntu.com/3817-1/",
          "https://usn.ubuntu.com/3817-2/",
          "https://usn.ubuntu.com/usn/usn-3817-1",
          "https://usn.ubuntu.com/usn/usn-3817-2",
          "https://www.debian.org/security/2018/dsa-4306",
          "https://www.debian.org/security/2018/dsa-4307"
        ],
        "PublishedDate": "2018-09-25T00:29:00Z",
        "LastModifiedDate": "2019-10-03T00:03:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-20852",
        "PkgName": "python-libs",
        "InstalledVersion": "2.7.5-80.0.1.el7_6",
        "FixedVersion": "2.7.5-86.0.3.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-20852",
        "Title": "python: Cookie domain check returns incorrect results",
        "Description": "http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-20"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "V2Score": 5,
            "V3Score": 5.3
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "V3Score": 5.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-20852.html",
          "http://linux.oracle.com/errata/ELSA-2019-4884.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00071.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00074.html",
          "https://bugs.python.org/issue35121",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20852",
          "https://lists.debian.org/debian-lts-announce/2019/08/msg00022.html",
          "https://python-security.readthedocs.io/vuln/cookie-domain-check.html",
          "https://usn.ubuntu.com/usn/usn-4127-1",
          "https://usn.ubuntu.com/usn/usn-4127-2"
        ],
        "PublishedDate": "2019-07-13T21:15:00Z",
        "LastModifiedDate": "2019-08-17T21:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-5010",
        "PkgName": "python-libs",
        "InstalledVersion": "2.7.5-80.0.1.el7_6",
        "FixedVersion": "2.7.5-86.0.1.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-5010",
        "Title": "python: NULL pointer dereference using a specially crafted X509 certificate",
        "Description": "An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-476"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V2Score": 5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-5010.html",
          "http://linux.oracle.com/errata/ELSA-2019-3520.html",
          "https://access.redhat.com/errata/RHSA-2019:3520",
          "https://access.redhat.com/errata/RHSA-2019:3725",
          "https://blog.talosintelligence.com/2019/01/vulnerability-spotlight-pythonorg.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5010",
          "https://github.com/python/cpython/pull/11569",
          "https://python-security.readthedocs.io/vuln/ssl-crl-dps-dos.html",
          "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0758",
          "https://usn.ubuntu.com/usn/usn-4127-1",
          "https://usn.ubuntu.com/usn/usn-4127-2"
        ],
        "PublishedDate": "2019-10-31T21:15:00Z",
        "LastModifiedDate": "2019-11-06T01:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-9740",
        "PkgName": "python-libs",
        "InstalledVersion": "2.7.5-80.0.1.el7_6",
        "FixedVersion": "2.7.5-86.0.1.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-9740",
        "Title": "python: CRLF injection via the query part of the url passed to urlopen()",
        "Description": "An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-93"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "V2Score": 4.3,
            "V3Score": 6.1
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "V3Score": 6.5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-9740.html",
          "http://linux.oracle.com/errata/ELSA-2019-3520.html",
          "http://www.securityfocus.com/bid/107466",
          "https://access.redhat.com/errata/RHSA-2019:1260",
          "https://bugs.python.org/issue36276",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9740",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/",
          "https://python-security.readthedocs.io/vuln/http-header-injection2.html",
          "https://usn.ubuntu.com/usn/usn-4127-1",
          "https://usn.ubuntu.com/usn/usn-4127-2"
        ],
        "PublishedDate": "2019-03-13T03:29:00Z",
        "LastModifiedDate": "2019-05-28T18:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-9947",
        "PkgName": "python-libs",
        "InstalledVersion": "2.7.5-80.0.1.el7_6",
        "FixedVersion": "2.7.5-86.0.1.el7",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-9947",
        "Title": "python: CRLF injection via the path part of the url passed to urlopen()",
        "Description": "An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-93"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "V2Score": 4.3,
            "V3Score": 6.1
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "V3Score": 6.5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-9947.html",
          "http://linux.oracle.com/errata/ELSA-2019-3520.html",
          "https://access.redhat.com/errata/RHSA-2019:1260",
          "https://bugs.python.org/issue35906",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9947",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/",
          "https://python-security.readthedocs.io/vuln/http-header-injection2.html",
          "https://security.netapp.com/advisory/ntap-20190404-0004/",
          "https://usn.ubuntu.com/usn/usn-4127-1",
          "https://usn.ubuntu.com/usn/usn-4127-2"
        ],
        "PublishedDate": "2019-03-23T18:29:00Z",
        "LastModifiedDate": "2019-05-28T19:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-13734",
        "PkgName": "sqlite",
        "InstalledVersion": "3.7.17-8.el7",
        "FixedVersion": "3.7.17-8.el7_7.1",
        "Layer": {
          "DiffID": "sha256:4fee40bcfecff11f540de853f7f0dc71efbab8c14ea599452b617e215562e3e2"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-13734",
        "Title": "sqlite: fts3: improve shadow table corruption detection",
        "Description": "Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-787"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "V2Score": 6.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "V3Score": 8.8
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-13734.html",
          "http://linux.oracle.com/errata/ELSA-2020-0273.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html",
          "https://access.redhat.com/errata/RHSA-2019:4238",
          "https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html",
          "https://crbug.com/1025466",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13734",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2Z5M4FPUMDNX2LDPHJKN5ZV5GIS2AKNU/"
        ],
        "PublishedDate": "2019-12-10T22:15:00Z",
        "LastModifiedDate": "2019-12-16T12:15:00Z"
      }
    ]
  }
]