[
  {
    "Target": "testdata/fixtures/photon-20.tar.gz (photon 2.0)",
    "Type": "photon",
    "Vulnerabilities": [
      {
        "VulnerabilityID": "CVE-2019-18276",
        "PkgName": "bash",
        "InstalledVersion": "4.4.12-3.ph2",
        "FixedVersion": "4.4.18-1.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-18276",
        "Title": "bash: when effective UID is not equal to its real UID the saved UID is not dropped",
        "Description": "An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support \"saved UID\" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use \"enable -f\" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.",
        "Severity": "CRITICAL",
        "CweIDs": [
          "CWE-273"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "V2Score": 7.2
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "V3Score": 7.8
          }
        },
        "References": [
          "http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276",
          "https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff",
          "https://www.youtube.com/watch?v=-wGtxJ8opa8"
        ],
        "PublishedDate": "2019-11-28T01:15:00Z",
        "LastModifiedDate": "2020-01-22T14:27:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-5481",
        "PkgName": "curl",
        "InstalledVersion": "7.59.0-7.ph2",
        "FixedVersion": "7.59.0-9.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-5481",
        "Title": "curl: double free due to subsequent call of realloc()",
        "Description": "Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.",
        "Severity": "CRITICAL",
        "CweIDs": [
          "CWE-415"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "V2Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
            "V3Score": 5.7
          }
        },
        "References": [
          "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html",
          "https://curl.haxx.se/docs/CVE-2019-5481.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5481",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/",
          "https://usn.ubuntu.com/usn/usn-4129-1"
        ],
        "PublishedDate": "2019-09-16T19:15:00Z",
        "LastModifiedDate": "2019-09-18T00:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-5482",
        "PkgName": "curl",
        "InstalledVersion": "7.59.0-7.ph2",
        "FixedVersion": "7.59.0-9.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-5482",
        "Title": "curl: heap buffer overflow in function tftp_receive_packet()",
        "Description": "Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.",
        "Severity": "CRITICAL",
        "CweIDs": [
          "CWE-120"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "V2Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "V3Score": 6.3
          }
        },
        "References": [
          "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html",
          "https://curl.haxx.se/docs/CVE-2019-5482.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5482",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/",
          "https://usn.ubuntu.com/usn/usn-4129-1",
          "https://usn.ubuntu.com/usn/usn-4129-2"
        ],
        "PublishedDate": "2019-09-16T19:15:00Z",
        "LastModifiedDate": "2019-09-18T00:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-16890",
        "PkgName": "curl",
        "InstalledVersion": "7.59.0-7.ph2",
        "FixedVersion": "7.59.0-8.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-16890",
        "Title": "curl: NTLM type-2 heap out-of-bounds buffer read",
        "Description": "libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-125"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 5,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 4.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-16890.html",
          "http://linux.oracle.com/errata/ELSA-2019-3701.html",
          "http://www.securityfocus.com/bid/106947",
          "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16890",
          "https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf",
          "https://curl.haxx.se/docs/CVE-2018-16890.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16890",
          "https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f@%3Cdevnull.infra.apache.org%3E",
          "https://security.netapp.com/advisory/ntap-20190315-0001/",
          "https://usn.ubuntu.com/3882-1/",
          "https://usn.ubuntu.com/usn/usn-3882-1",
          "https://www.debian.org/security/2019/dsa-4386",
          "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
          "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
        ],
        "PublishedDate": "2019-02-06T20:29:00Z",
        "LastModifiedDate": "2019-07-23T23:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-5481",
        "PkgName": "curl-libs",
        "InstalledVersion": "7.59.0-7.ph2",
        "FixedVersion": "7.59.0-9.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-5481",
        "Title": "curl: double free due to subsequent call of realloc()",
        "Description": "Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.",
        "Severity": "CRITICAL",
        "CweIDs": [
          "CWE-415"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "V2Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
            "V3Score": 5.7
          }
        },
        "References": [
          "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html",
          "https://curl.haxx.se/docs/CVE-2019-5481.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5481",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/",
          "https://usn.ubuntu.com/usn/usn-4129-1"
        ],
        "PublishedDate": "2019-09-16T19:15:00Z",
        "LastModifiedDate": "2019-09-18T00:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-5482",
        "PkgName": "curl-libs",
        "InstalledVersion": "7.59.0-7.ph2",
        "FixedVersion": "7.59.0-9.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-5482",
        "Title": "curl: heap buffer overflow in function tftp_receive_packet()",
        "Description": "Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.",
        "Severity": "CRITICAL",
        "CweIDs": [
          "CWE-120"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "V2Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "V3Score": 6.3
          }
        },
        "References": [
          "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html",
          "https://curl.haxx.se/docs/CVE-2019-5482.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5482",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/",
          "https://usn.ubuntu.com/usn/usn-4129-1",
          "https://usn.ubuntu.com/usn/usn-4129-2"
        ],
        "PublishedDate": "2019-09-16T19:15:00Z",
        "LastModifiedDate": "2019-09-18T00:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-16890",
        "PkgName": "curl-libs",
        "InstalledVersion": "7.59.0-7.ph2",
        "FixedVersion": "7.59.0-8.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-16890",
        "Title": "curl: NTLM type-2 heap out-of-bounds buffer read",
        "Description": "libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-125"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 5,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 4.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-16890.html",
          "http://linux.oracle.com/errata/ELSA-2019-3701.html",
          "http://www.securityfocus.com/bid/106947",
          "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16890",
          "https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf",
          "https://curl.haxx.se/docs/CVE-2018-16890.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16890",
          "https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f@%3Cdevnull.infra.apache.org%3E",
          "https://security.netapp.com/advisory/ntap-20190315-0001/",
          "https://usn.ubuntu.com/3882-1/",
          "https://usn.ubuntu.com/usn/usn-3882-1",
          "https://www.debian.org/security/2019/dsa-4386",
          "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
          "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
        ],
        "PublishedDate": "2019-02-06T20:29:00Z",
        "LastModifiedDate": "2019-07-23T23:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-5094",
        "PkgName": "e2fsprogs-libs",
        "InstalledVersion": "1.43.4-2.ph2",
        "FixedVersion": "1.43.4-3.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-5094",
        "Title": "e2fsprogs: crafted ext4 partition leads to out-of-bounds write",
        "Description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-787"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
            "V2Score": 4.6
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "V3Score": 6.4
          }
        },
        "References": [
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094",
          "https://lists.debian.org/debian-lts-announce/2019/09/msg00029.html",
          "https://seclists.org/bugtraq/2019/Sep/58",
          "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0887",
          "https://usn.ubuntu.com/4142-2/",
          "https://usn.ubuntu.com/usn/usn-4142-1",
          "https://usn.ubuntu.com/usn/usn-4142-2",
          "https://www.debian.org/security/2019/dsa-4535"
        ],
        "PublishedDate": "2019-09-24T22:15:00Z",
        "LastModifiedDate": "2019-09-28T03:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-5188",
        "PkgName": "e2fsprogs-libs",
        "InstalledVersion": "1.43.4-2.ph2",
        "FixedVersion": "1.43.4-4.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-5188",
        "Title": "e2fsprogs: Out-of-bounds write in  e2fsck/rehash.c",
        "Description": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-787"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
            "V2Score": 4.6
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00004.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5188",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2AKETJ6BREDUHRWQTV35SPGG5C6H7KSI/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DOBCYQKCTTWXBLMUPJ5TX3FY7JNCOKY/",
          "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0973",
          "https://usn.ubuntu.com/4249-1/",
          "https://usn.ubuntu.com/usn/usn-4249-1"
        ],
        "PublishedDate": "2020-01-08T16:15:00Z",
        "LastModifiedDate": "2020-01-28T06:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-20843",
        "PkgName": "expat-libs",
        "InstalledVersion": "2.2.4-1.ph2",
        "FixedVersion": "2.2.4-2.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-20843",
        "Title": "expat: large number of colons in input makes parser consume high amount of resources, leading to DoS",
        "Description": "In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-611"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 7.8,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "V3Score": 5.3
          }
        },
        "References": [
          "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5226",
          "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931031",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20843",
          "https://github.com/libexpat/libexpat/blob/R_2_2_7/expat/Changes",
          "https://github.com/libexpat/libexpat/issues/186",
          "https://github.com/libexpat/libexpat/pull/262",
          "https://github.com/libexpat/libexpat/pull/262/commits/11f8838bf99ea0a6f0b76f9760c43704d00c4ff6",
          "https://lists.debian.org/debian-lts-announce/2019/06/msg00028.html",
          "https://seclists.org/bugtraq/2019/Jun/39",
          "https://security.netapp.com/advisory/ntap-20190703-0001/",
          "https://usn.ubuntu.com/4040-1/",
          "https://usn.ubuntu.com/4040-2/",
          "https://usn.ubuntu.com/usn/usn-4040-1",
          "https://usn.ubuntu.com/usn/usn-4040-2",
          "https://www.debian.org/security/2019/dsa-4472"
        ],
        "PublishedDate": "2019-06-24T17:15:00Z",
        "LastModifiedDate": "2019-06-26T21:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-20387",
        "PkgName": "libsolv",
        "InstalledVersion": "0.6.26-4.ph2",
        "FixedVersion": "0.6.26-5.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-20387",
        "Title": "libsolv: out-of-bounds read in repodata_schema2id in repodata.c",
        "Description": "repodata_schema2id in repodata.c in libsolv before 0.7.6 has a heap-based buffer over-read via a last schema whose length is less than the length of the input schema.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-125"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V2Score": 5
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20387",
          "https://github.com/openSUSE/libsolv/commit/fdb9c9c03508990e4583046b590c30d958f272da",
          "https://github.com/openSUSE/libsolv/commit/fdb9c9c03508990e4583046b590c30d958f272da (0.7.6)",
          "https://github.com/openSUSE/libsolv/compare/0.7.5...0.7.6",
          "https://lists.debian.org/debian-lts-announce/2020/01/msg00034.html"
        ],
        "PublishedDate": "2020-01-21T23:15:00Z",
        "LastModifiedDate": "2020-01-30T21:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-13115",
        "PkgName": "libssh2",
        "InstalledVersion": "1.8.2-1.ph2",
        "FixedVersion": "1.9.0-1.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-13115",
        "Title": "libssh2: integer overflow in kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c leads to out-of-bounds write",
        "Description": "In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-190"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
            "V2Score": 5.8,
            "V3Score": 8.1
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H",
            "V3Score": 6.8
          }
        },
        "References": [
          "https://blog.semmle.com/libssh2-integer-overflow/",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13115",
          "https://github.com/libssh2/libssh2/compare/02ecf17...42d37aa",
          "https://github.com/libssh2/libssh2/pull/350",
          "https://libssh2.org/changes.html",
          "https://lists.debian.org/debian-lts-announce/2019/07/msg00024.html"
        ],
        "PublishedDate": "2019-07-16T18:15:00Z",
        "LastModifiedDate": "2019-07-25T21:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-17498",
        "PkgName": "libssh2",
        "InstalledVersion": "1.8.2-1.ph2",
        "FixedVersion": "1.9.0-2.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-17498",
        "Title": "libssh2: integer overflow in SSH_MSG_DISCONNECT logic in packet.c",
        "Description": "In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-190"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:P",
            "V2Score": 5.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "V3Score": 6.5
          }
        },
        "References": [
          "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00026.html",
          "https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17498",
          "https://github.com/kevinbackhouse/SecurityExploits/tree/8cbdbbe6363510f7d9ceec685373da12e6fc752d/libssh2/out_of_bounds_read_disconnect_CVE-2019-17498",
          "https://github.com/libssh2/libssh2/blob/42d37aa63129a1b2644bf6495198923534322d64/src/packet.c#L480",
          "https://github.com/libssh2/libssh2/pull/402/commits/1c6fa92b77e34d089493fe6d3e2c6c8775858b94",
          "https://lists.debian.org/debian-lts-announce/2019/11/msg00010.html",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TY7EEE34RFKCTXTMBQQWWSLXZWSCXNDB/"
        ],
        "PublishedDate": "2019-10-21T22:15:00Z",
        "LastModifiedDate": "2019-11-07T03:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-17594",
        "PkgName": "ncurses-libs",
        "InstalledVersion": "6.0-14.ph2",
        "FixedVersion": "6.1-1.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-17594",
        "Title": "ncurses: heap-based buffer overflow in the _nc_find_entry function in tinfo/comp_hash.c",
        "Description": "There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-125"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
            "V2Score": 4.6
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "V3Score": 5.3
          }
        },
        "References": [
          "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00059.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00061.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17594",
          "https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00017.html",
          "https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00045.html"
        ],
        "PublishedDate": "2019-10-14T21:15:00Z",
        "LastModifiedDate": "2019-12-26T15:35:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-17595",
        "PkgName": "ncurses-libs",
        "InstalledVersion": "6.0-14.ph2",
        "FixedVersion": "6.1-1.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-17595",
        "Title": "ncurses: heap-based buffer overflow in the fmt_entry function in tinfo/comp_hash.c",
        "Description": "There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-125"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:P",
            "V2Score": 5.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
            "V3Score": 5.4
          }
        },
        "References": [
          "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00059.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00061.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17595",
          "https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00013.html",
          "https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00045.html"
        ],
        "PublishedDate": "2019-10-14T21:15:00Z",
        "LastModifiedDate": "2019-12-23T19:26:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-1547",
        "PkgName": "openssl",
        "InstalledVersion": "1.0.2s-1.ph2",
        "FixedVersion": "1.0.2t-1.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1547",
        "Title": "openssl: side-channel weak encryption vulnerability",
        "Description": "Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-311"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
            "V2Score": 1.9
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "V3Score": 5.5
          }
        },
        "References": [
          "http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html",
          "https://arxiv.org/abs/1909.01785",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1547",
          "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=21c856b75d81eff61aa63b4f036bb64a85bf6d46",
          "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=30c22fa8b1d840036b8e203585738df62a03cec8",
          "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=7c1709c2da5414f5b6133d00a03fc8c5bf996c7a",
          "https://seclists.org/bugtraq/2019/Sep/25",
          "https://security.netapp.com/advisory/ntap-20190919-0002/",
          "https://www.openssl.org/news/secadv/20190910.txt"
        ],
        "PublishedDate": "2019-09-10T17:15:00Z",
        "LastModifiedDate": "2019-09-12T16:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-1563",
        "PkgName": "openssl",
        "InstalledVersion": "1.0.2s-1.ph2",
        "FixedVersion": "1.0.2t-1.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1563",
        "Title": "openssl: information disclosure in PKCS7_dataDecode and CMS_decrypt_set1_pkey",
        "Description": "In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).",
        "Severity": "LOW",
        "CweIDs": [
          "CWE-311"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "V2Score": 4.3
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "V3Score": 3.7
          }
        },
        "References": [
          "http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1563",
          "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=08229ad838c50f644d7e928e2eef147b4308ad64",
          "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=631f94db0065c78181ca9ba5546ebc8bb3884b97",
          "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f",
          "https://seclists.org/bugtraq/2019/Sep/25",
          "https://security.netapp.com/advisory/ntap-20190919-0002/",
          "https://www.openssl.org/news/secadv/20190910.txt"
        ],
        "PublishedDate": "2019-09-10T17:15:00Z",
        "LastModifiedDate": "2019-09-12T11:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-19317",
        "PkgName": "sqlite-libs",
        "InstalledVersion": "3.27.2-3.ph2",
        "FixedVersion": "3.27.2-7.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-19317",
        "Title": "sqlite: omits bits from the colUsed bitmask in the case of a generated column",
        "Description": "lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other impact.",
        "Severity": "CRITICAL",
        "CweIDs": [
          "CWE-20"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "V2Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "https://github.com/sqlite/sqlite/commit/522ebfa7cee96fb325a22ea3a2464a63485886a8",
          "https://github.com/sqlite/sqlite/commit/73bacb7f93eab9f4bd5a65cbc4ae242acf63c9e3",
          "https://security.netapp.com/advisory/ntap-20191223-0001/"
        ],
        "PublishedDate": "2019-12-05T14:15:00Z",
        "LastModifiedDate": "2020-01-07T21:36:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-19603",
        "PkgName": "sqlite-libs",
        "InstalledVersion": "3.27.2-3.ph2",
        "FixedVersion": "3.27.2-7.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-19603",
        "Title": "sqlite: mishandles certain SELECT statements with a nonexistent VIEW, leading to DoS",
        "Description": "SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash.",
        "Severity": "CRITICAL",
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V2Score": 5
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19603",
          "https://github.com/sqlite/sqlite/commit/527cbd4a104cb93bf3994b3dd3619a6299a78b13",
          "https://security.netapp.com/advisory/ntap-20191223-0001/",
          "https://www.sqlite.org/"
        ],
        "PublishedDate": "2019-12-09T19:15:00Z",
        "LastModifiedDate": "2020-02-03T14:22:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-19646",
        "PkgName": "sqlite-libs",
        "InstalledVersion": "3.27.2-3.ph2",
        "FixedVersion": "3.27.2-7.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-19646",
        "Title": "sqlite: pragma.c mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns",
        "Description": "pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.",
        "Severity": "CRITICAL",
        "CweIDs": [
          "CWE-754"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "V2Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "V3Score": 6.3
          }
        },
        "References": [
          "https://github.com/sqlite/sqlite/commit/926f796e8feec15f3836aa0a060ed906f8ae04d3",
          "https://github.com/sqlite/sqlite/commit/ebd70eedd5d6e6a890a670b5ee874a5eae86b4dd",
          "https://security.netapp.com/advisory/ntap-20191223-0001/",
          "https://www.sqlite.org/"
        ],
        "PublishedDate": "2019-12-09T19:15:00Z",
        "LastModifiedDate": "2019-12-23T05:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-20218",
        "PkgName": "sqlite-libs",
        "InstalledVersion": "3.27.2-3.ph2",
        "FixedVersion": "3.30.1-1.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-20218",
        "Title": "sqlite: selectExpander in select.c proceeds with WITH stack unwinding even after a parsing error",
        "Description": "selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.",
        "Severity": "CRITICAL",
        "CweIDs": [
          "CWE-755"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V2Score": 5
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20218",
          "https://github.com/sqlite/sqlite/commit/a6c1a71cde082e09750465d5675699062922e387"
        ],
        "PublishedDate": "2020-01-02T14:16:00Z",
        "LastModifiedDate": "2020-01-16T20:35:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-16168",
        "PkgName": "sqlite-libs",
        "InstalledVersion": "3.27.2-3.ph2",
        "FixedVersion": "3.27.2-5.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-16168",
        "Title": "sqlite: division by zero in whereLoopAddBtreeIndex in sqlite3.c",
        "Description": "In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a \"severe division by zero in the query planner.\"",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-369"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "V2Score": 4.3
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "V3Score": 6.5
          }
        },
        "References": [
          "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00032.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00033.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16168",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XZARJHJJDBHI7CE5PZEBXS5HKK6HXKW2/",
          "https://security.netapp.com/advisory/ntap-20190926-0003/",
          "https://security.netapp.com/advisory/ntap-20200122-0003/",
          "https://usn.ubuntu.com/4205-1/",
          "https://usn.ubuntu.com/usn/usn-4205-1",
          "https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg116312.html",
          "https://www.oracle.com/security-alerts/cpujan2020.html",
          "https://www.sqlite.org/src/info/e4598ecbdd18bd82945f6029013296690e719a62",
          "https://www.sqlite.org/src/timeline?c=98357d8c1263920b"
        ],
        "PublishedDate": "2019-09-09T17:15:00Z",
        "LastModifiedDate": "2020-01-15T20:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-19244",
        "PkgName": "sqlite-libs",
        "InstalledVersion": "3.27.2-3.ph2",
        "FixedVersion": "3.31.1-1.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-19244",
        "Title": "sqlite: allows a crash if a sub-select uses both DISTINCT and window functions and also has certain ORDER BY usage",
        "Description": "sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-20"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V2Score": 5
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19244",
          "https://github.com/sqlite/sqlite/commit/e59c562b3f6894f84c715772c4b116d7b5c01348",
          "https://usn.ubuntu.com/4205-1/",
          "https://usn.ubuntu.com/usn/usn-4205-1"
        ],
        "PublishedDate": "2019-11-25T20:15:00Z",
        "LastModifiedDate": "2019-12-04T16:11:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-19880",
        "PkgName": "sqlite-libs",
        "InstalledVersion": "3.27.2-3.ph2",
        "FixedVersion": "3.30.1-1.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-19880",
        "Title": "sqlite: invalid pointer dereference in exprListAppendList in window.c",
        "Description": "exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-476"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V2Score": 5
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19880",
          "https://github.com/sqlite/sqlite/commit/75e95e1fcd52d3ec8282edb75ac8cd0814095d54",
          "https://security.netapp.com/advisory/ntap-20200114-0001/"
        ],
        "PublishedDate": "2019-12-18T06:15:00Z",
        "LastModifiedDate": "2020-01-14T11:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-19923",
        "PkgName": "sqlite-libs",
        "InstalledVersion": "3.27.2-3.ph2",
        "FixedVersion": "3.31.1-1.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-19923",
        "Title": "sqlite: mishandling of certain uses of SELECT DISTINCT involving a LEFT JOIN in flattenSubquery in select.c leads to a NULL pointer dereference",
        "Description": "flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect results).",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-476"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V2Score": 5
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19923",
          "https://github.com/sqlite/sqlite/commit/396afe6f6aa90a31303c183e11b2b2d4b7956b35",
          "https://security.netapp.com/advisory/ntap-20200114-0003/"
        ],
        "PublishedDate": "2019-12-24T16:15:00Z",
        "LastModifiedDate": "2020-01-14T11:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-19925",
        "PkgName": "sqlite-libs",
        "InstalledVersion": "3.27.2-3.ph2",
        "FixedVersion": "3.31.1-1.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-19925",
        "Title": "sqlite: zipfileUpdate in ext/misc/zipfile.c mishandles a NULL pathname during an update of a ZIP archive",
        "Description": "zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-434"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V2Score": 5
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19925",
          "https://github.com/sqlite/sqlite/commit/54d501092d88c0cf89bec4279951f548fb0b8618",
          "https://security.netapp.com/advisory/ntap-20200114-0003/"
        ],
        "PublishedDate": "2019-12-24T17:15:00Z",
        "LastModifiedDate": "2020-01-14T11:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-19926",
        "PkgName": "sqlite-libs",
        "InstalledVersion": "3.27.2-3.ph2",
        "FixedVersion": "3.31.1-1.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-19926",
        "Title": "sqlite: error mishandling because of incomplete fix of CVE-2019-19880",
        "Description": "multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-476"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V2Score": 5
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19926",
          "https://github.com/sqlite/sqlite/commit/8428b3b437569338a9d1e10c4cd8154acbe33089",
          "https://security.netapp.com/advisory/ntap-20200114-0003/"
        ],
        "PublishedDate": "2019-12-23T01:15:00Z",
        "LastModifiedDate": "2020-01-14T11:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-19959",
        "PkgName": "sqlite-libs",
        "InstalledVersion": "3.27.2-3.ph2",
        "FixedVersion": "3.31.1-1.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-19959",
        "Title": "sqlite: mishandles certain uses of INSERT INTO in situations involving embedded '\\0' characters in filenames",
        "Description": "ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\\0' characters in filenames, leading to a memory-management error that can be detected by (for example) valgrind.",
        "Severity": "HIGH",
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "V2Score": 5
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "V3Score": 7.3
          }
        },
        "References": [
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19959",
          "https://github.com/sqlite/sqlite/commit/1e490c4ca6b43a9cf8637d695907888349f69bec",
          "https://github.com/sqlite/sqlite/commit/d8f2d46cbc9925e034a68aaaf60aad788d9373c1",
          "https://security.netapp.com/advisory/ntap-20200204-0001/"
        ],
        "PublishedDate": "2020-01-03T22:15:00Z",
        "LastModifiedDate": "2020-02-04T12:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-19645",
        "PkgName": "sqlite-libs",
        "InstalledVersion": "3.27.2-3.ph2",
        "FixedVersion": "3.30.1-1.ph2",
        "Layer": {
          "DiffID": "sha256:41cdb0d109d6a7cf33d6a439c3d6e586d7dba0be84606066693ea4573a4a9b66"
        },
        "SeveritySource": "photon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-19645",
        "Title": "sqlite: infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements",
        "Description": "alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-674"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
            "V2Score": 2.1
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 5.5
          }
        },
        "References": [
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19645",
          "https://github.com/sqlite/sqlite/commit/38096961c7cd109110ac21d3ed7dad7e0cb0ae06",
          "https://security.netapp.com/advisory/ntap-20191223-0001/"
        ],
        "PublishedDate": "2019-12-09T16:15:00Z",
        "LastModifiedDate": "2019-12-23T05:15:00Z"
      }
    ]
  }
]