[
  {
    "Target": "testdata/fixtures/oraclelinux-6-slim.tar.gz (oracle 6.10)",
    "Type": "oracle",
    "Vulnerabilities": [
      {
        "VulnerabilityID": "CVE-2019-3862",
        "PkgName": "libssh2",
        "InstalledVersion": "1.4.2-2.el6_7.1",
        "FixedVersion": "1.4.2-2.0.1.el6_7.1",
        "Layer": {
          "DiffID": "sha256:a6f189f69066d36aff8efe2602482d28c02de433aef44ee9087b291df7e8fd08"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-3862",
        "Title": "libssh2: Out-of-bounds memory comparison with specially crafted message channel request",
        "Description": "An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.",
        "Severity": "CRITICAL",
        "CweIDs": [
          "CWE-125"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "V2Score": 6.4,
            "V3Score": 9.1
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "V3Score": 7.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-3862.html",
          "http://linux.oracle.com/errata/ELSA-2019-4693.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html",
          "http://packetstormsecurity.com/files/152136/Slackware-Security-Advisory-libssh2-Updates.html",
          "http://www.openwall.com/lists/oss-security/2019/03/18/3",
          "http://www.securityfocus.com/bid/107485",
          "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3862",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3862",
          "https://github.com/libssh2/libssh2/pull/316",
          "https://libssh2.org/CVE-2019-3862.html",
          "https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XCWEA5ZCLKRDUK62QVVYMFWLWKOPX3LO/",
          "https://seclists.org/bugtraq/2019/Apr/25",
          "https://seclists.org/bugtraq/2019/Mar/25",
          "https://security.netapp.com/advisory/ntap-20190327-0005/",
          "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-767",
          "https://www.debian.org/security/2019/dsa-4431",
          "https://www.libssh2.org/CVE-2019-3862.html"
        ],
        "PublishedDate": "2019-03-21T16:01:00Z",
        "LastModifiedDate": "2019-04-15T12:31:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-3855",
        "PkgName": "libssh2",
        "InstalledVersion": "1.4.2-2.el6_7.1",
        "FixedVersion": "1.4.2-3.0.1.el6_10.1",
        "Layer": {
          "DiffID": "sha256:a6f189f69066d36aff8efe2602482d28c02de433aef44ee9087b291df7e8fd08"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-3855",
        "Title": "libssh2: Integer overflow in transport read resulting in out of bounds write",
        "Description": "An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-190"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "V2Score": 9.3,
            "V3Score": 8.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-3855.html",
          "http://linux.oracle.com/errata/ELSA-2019-1652.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html",
          "http://packetstormsecurity.com/files/152136/Slackware-Security-Advisory-libssh2-Updates.html",
          "http://www.openwall.com/lists/oss-security/2019/03/18/3",
          "http://www.securityfocus.com/bid/107485",
          "https://access.redhat.com/errata/RHSA-2019:0679",
          "https://access.redhat.com/errata/RHSA-2019:1175",
          "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3855",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3855",
          "https://github.com/libssh2/libssh2/pull/315",
          "https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XCWEA5ZCLKRDUK62QVVYMFWLWKOPX3LO/",
          "https://seclists.org/bugtraq/2019/Apr/25",
          "https://seclists.org/bugtraq/2019/Mar/25",
          "https://security.netapp.com/advisory/ntap-20190327-0005/",
          "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-767",
          "https://www.debian.org/security/2019/dsa-4431",
          "https://www.libssh2.org/CVE-2019-3855.html"
        ],
        "PublishedDate": "2019-03-21T21:29:00Z",
        "LastModifiedDate": "2019-05-14T21:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-3856",
        "PkgName": "libssh2",
        "InstalledVersion": "1.4.2-2.el6_7.1",
        "FixedVersion": "1.4.2-3.0.1.el6_10.1",
        "Layer": {
          "DiffID": "sha256:a6f189f69066d36aff8efe2602482d28c02de433aef44ee9087b291df7e8fd08"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-3856",
        "Title": "libssh2: Integer overflow in keyboard interactive handling resulting in out of bounds write",
        "Description": "An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-190"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "V2Score": 6.8,
            "V3Score": 8.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-3856.html",
          "http://linux.oracle.com/errata/ELSA-2019-1652.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html",
          "https://access.redhat.com/errata/RHSA-2019:0679",
          "https://access.redhat.com/errata/RHSA-2019:1175",
          "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3856",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3856",
          "https://github.com/libssh2/libssh2/pull/315",
          "https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/",
          "https://seclists.org/bugtraq/2019/Apr/25",
          "https://security.netapp.com/advisory/ntap-20190327-0005/",
          "https://www.debian.org/security/2019/dsa-4431",
          "https://www.libssh2.org/CVE-2019-3856.html"
        ],
        "PublishedDate": "2019-03-25T19:29:00Z",
        "LastModifiedDate": "2019-05-14T21:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-3857",
        "PkgName": "libssh2",
        "InstalledVersion": "1.4.2-2.el6_7.1",
        "FixedVersion": "1.4.2-3.0.1.el6_10.1",
        "Layer": {
          "DiffID": "sha256:a6f189f69066d36aff8efe2602482d28c02de433aef44ee9087b291df7e8fd08"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-3857",
        "Title": "libssh2: Integer overflow in SSH packet processing channel resulting in out of bounds write",
        "Description": "An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-190"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "V2Score": 6.8,
            "V3Score": 8.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-3857.html",
          "http://linux.oracle.com/errata/ELSA-2019-1652.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html",
          "https://access.redhat.com/errata/RHSA-2019:0679",
          "https://access.redhat.com/errata/RHSA-2019:1175",
          "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3857",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3857",
          "https://github.com/libssh2/libssh2/pull/315",
          "https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/",
          "https://seclists.org/bugtraq/2019/Apr/25",
          "https://security.netapp.com/advisory/ntap-20190327-0005/",
          "https://www.debian.org/security/2019/dsa-4431",
          "https://www.libssh2.org/CVE-2019-3857.html"
        ],
        "PublishedDate": "2019-03-25T19:29:00Z",
        "LastModifiedDate": "2019-05-14T21:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-3863",
        "PkgName": "libssh2",
        "InstalledVersion": "1.4.2-2.el6_7.1",
        "FixedVersion": "1.4.2-3.0.1.el6_10.1",
        "Layer": {
          "DiffID": "sha256:a6f189f69066d36aff8efe2602482d28c02de433aef44ee9087b291df7e8fd08"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-3863",
        "Title": "libssh2: Integer overflow in user authenticate keyboard interactive allows out-of-bounds writes",
        "Description": "A flaw was found in libssh2 before 1.8.1. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used as an index to copy memory causing in an out of bounds memory write error.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-787"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "V2Score": 6.8,
            "V3Score": 8.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-3863.html",
          "http://linux.oracle.com/errata/ELSA-2019-1652.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html",
          "https://access.redhat.com/errata/RHSA-2019:0679",
          "https://access.redhat.com/errata/RHSA-2019:1175",
          "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3863",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3863",
          "https://github.com/libssh2/libssh2/pull/315",
          "https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/",
          "https://seclists.org/bugtraq/2019/Apr/25",
          "https://security.netapp.com/advisory/ntap-20190327-0005/",
          "https://www.debian.org/security/2019/dsa-4431",
          "https://www.libssh2.org/CVE-2019-3863.html"
        ],
        "PublishedDate": "2019-03-25T18:29:00Z",
        "LastModifiedDate": "2019-05-14T21:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-11745",
        "PkgName": "nss-softokn",
        "InstalledVersion": "3.14.3-23.3.0.1.el6_8",
        "FixedVersion": "3.44.0-6.0.1.el6_10",
        "Layer": {
          "DiffID": "sha256:a6f189f69066d36aff8efe2602482d28c02de433aef44ee9087b291df7e8fd08"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-11745",
        "Title": "nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate",
        "Description": "When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 68.3, Firefox ESR \u003c 68.3, and Firefox \u003c 71.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-787"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "V2Score": 6.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V3Score": 8.1
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-11745.html",
          "http://linux.oracle.com/errata/ELSA-2019-4190.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=1586176",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11745",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.3_release_notes",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47.1_release_notes",
          "https://usn.ubuntu.com/4241-1/",
          "https://usn.ubuntu.com/usn/usn-4203-1",
          "https://usn.ubuntu.com/usn/usn-4203-2",
          "https://usn.ubuntu.com/usn/usn-4216-1",
          "https://usn.ubuntu.com/usn/usn-4216-2",
          "https://usn.ubuntu.com/usn/usn-4241-1",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-38/#CVE-2019-11745",
          "https://www.mozilla.org/security/advisories/mfsa2019-36/",
          "https://www.mozilla.org/security/advisories/mfsa2019-37/",
          "https://www.mozilla.org/security/advisories/mfsa2019-38/"
        ],
        "PublishedDate": "2020-01-08T20:15:00Z",
        "LastModifiedDate": "2020-01-16T19:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-11745",
        "PkgName": "nss-softokn-freebl",
        "InstalledVersion": "3.14.3-23.3.0.1.el6_8",
        "FixedVersion": "3.44.0-6.0.1.el6_10",
        "Layer": {
          "DiffID": "sha256:a6f189f69066d36aff8efe2602482d28c02de433aef44ee9087b291df7e8fd08"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-11745",
        "Title": "nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate",
        "Description": "When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 68.3, Firefox ESR \u003c 68.3, and Firefox \u003c 71.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-787"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "V2Score": 6.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V3Score": 8.1
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-11745.html",
          "http://linux.oracle.com/errata/ELSA-2019-4190.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=1586176",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11745",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.3_release_notes",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47.1_release_notes",
          "https://usn.ubuntu.com/4241-1/",
          "https://usn.ubuntu.com/usn/usn-4203-1",
          "https://usn.ubuntu.com/usn/usn-4203-2",
          "https://usn.ubuntu.com/usn/usn-4216-1",
          "https://usn.ubuntu.com/usn/usn-4216-2",
          "https://usn.ubuntu.com/usn/usn-4241-1",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-38/#CVE-2019-11745",
          "https://www.mozilla.org/security/advisories/mfsa2019-36/",
          "https://www.mozilla.org/security/advisories/mfsa2019-37/",
          "https://www.mozilla.org/security/advisories/mfsa2019-38/"
        ],
        "PublishedDate": "2020-01-08T20:15:00Z",
        "LastModifiedDate": "2020-01-16T19:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-1559",
        "PkgName": "openssl",
        "InstalledVersion": "1.0.1e-57.0.6.el6",
        "FixedVersion": "1.0.1e-58.0.1.el6_10",
        "Layer": {
          "DiffID": "sha256:a6f189f69066d36aff8efe2602482d28c02de433aef44ee9087b291df7e8fd08"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1559",
        "Title": "openssl: 0-byte record padding oracle",
        "Description": "If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-200"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V2Score": 4.3,
            "V3Score": 5.9
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "V3Score": 6.8
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-1559.html",
          "http://linux.oracle.com/errata/ELSA-2019-2471.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00019.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00047.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00049.html",
          "http://www.securityfocus.com/bid/107174",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1559",
          "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e9bbefbf0f24c57645e7ad6a5a71ae649d18ac8e",
          "https://github.com/RUB-NDS/TLS-Padding-Oracles",
          "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10282",
          "https://lists.debian.org/debian-lts-announce/2019/03/msg00003.html",
          "https://security.gentoo.org/glsa/201903-10",
          "https://security.netapp.com/advisory/ntap-20190301-0001/",
          "https://security.netapp.com/advisory/ntap-20190301-0002/",
          "https://security.netapp.com/advisory/ntap-20190423-0002/",
          "https://support.f5.com/csp/article/K18549143",
          "https://usn.ubuntu.com/3899-1/",
          "https://usn.ubuntu.com/usn/usn-3899-1",
          "https://www.debian.org/security/2019/dsa-4400",
          "https://www.openssl.org/news/secadv/20190226.txt",
          "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
          "https://www.tenable.com/security/tns-2019-02",
          "https://www.tenable.com/security/tns-2019-03"
        ],
        "PublishedDate": "2019-02-27T23:29:00Z",
        "LastModifiedDate": "2019-05-22T00:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-20852",
        "PkgName": "python",
        "InstalledVersion": "2.6.6-68.0.1.el6_10",
        "FixedVersion": "2.6.6-68.0.2.el6_10",
        "Layer": {
          "DiffID": "sha256:a6f189f69066d36aff8efe2602482d28c02de433aef44ee9087b291df7e8fd08"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-20852",
        "Title": "python: Cookie domain check returns incorrect results",
        "Description": "http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-20"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "V2Score": 5,
            "V3Score": 5.3
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "V3Score": 5.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-20852.html",
          "http://linux.oracle.com/errata/ELSA-2019-4884.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00071.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00074.html",
          "https://bugs.python.org/issue35121",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20852",
          "https://lists.debian.org/debian-lts-announce/2019/08/msg00022.html",
          "https://python-security.readthedocs.io/vuln/cookie-domain-check.html",
          "https://usn.ubuntu.com/usn/usn-4127-1",
          "https://usn.ubuntu.com/usn/usn-4127-2"
        ],
        "PublishedDate": "2019-07-13T21:15:00Z",
        "LastModifiedDate": "2019-08-17T21:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-20852",
        "PkgName": "python-libs",
        "InstalledVersion": "2.6.6-68.0.1.el6_10",
        "FixedVersion": "2.6.6-68.0.2.el6_10",
        "Layer": {
          "DiffID": "sha256:a6f189f69066d36aff8efe2602482d28c02de433aef44ee9087b291df7e8fd08"
        },
        "SeveritySource": "nvd",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-20852",
        "Title": "python: Cookie domain check returns incorrect results",
        "Description": "http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-20"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "V2Score": 5,
            "V3Score": 5.3
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "V3Score": 5.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-20852.html",
          "http://linux.oracle.com/errata/ELSA-2019-4884.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00071.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00074.html",
          "https://bugs.python.org/issue35121",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20852",
          "https://lists.debian.org/debian-lts-announce/2019/08/msg00022.html",
          "https://python-security.readthedocs.io/vuln/cookie-domain-check.html",
          "https://usn.ubuntu.com/usn/usn-4127-1",
          "https://usn.ubuntu.com/usn/usn-4127-2"
        ],
        "PublishedDate": "2019-07-13T21:15:00Z",
        "LastModifiedDate": "2019-08-17T21:15:00Z"
      }
    ]
  }
]