[
  {
    "Target": "testdata/fixtures/amazon-2.tar.gz (amazon 2 (Karoo))",
    "Type": "amazon",
    "Vulnerabilities": [
      {
        "VulnerabilityID": "CVE-2019-5481",
        "PkgName": "curl",
        "InstalledVersion": "7.61.1-9.amzn2.0.1",
        "FixedVersion": "7.61.1-12.amzn2.0.1",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-5481",
        "Title": "curl: double free due to subsequent call of realloc()",
        "Description": "Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-415"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "V2Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
            "V3Score": 5.7
          }
        },
        "References": [
          "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html",
          "https://curl.haxx.se/docs/CVE-2019-5481.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5481",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/",
          "https://usn.ubuntu.com/usn/usn-4129-1"
        ],
        "PublishedDate": "2019-09-16T19:15:00Z",
        "LastModifiedDate": "2019-09-18T00:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-5482",
        "PkgName": "curl",
        "InstalledVersion": "7.61.1-9.amzn2.0.1",
        "FixedVersion": "7.61.1-12.amzn2.0.1",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-5482",
        "Title": "curl: heap buffer overflow in function tftp_receive_packet()",
        "Description": "Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-120"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "V2Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "V3Score": 6.3
          }
        },
        "References": [
          "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html",
          "https://curl.haxx.se/docs/CVE-2019-5482.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5482",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/",
          "https://usn.ubuntu.com/usn/usn-4129-1",
          "https://usn.ubuntu.com/usn/usn-4129-2"
        ],
        "PublishedDate": "2019-09-16T19:15:00Z",
        "LastModifiedDate": "2019-09-18T00:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-5435",
        "PkgName": "curl",
        "InstalledVersion": "7.61.1-9.amzn2.0.1",
        "FixedVersion": "7.61.1-11.amzn2.0.2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-5435",
        "Title": "curl: Integer overflows in curl_url_set() function",
        "Description": "An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.",
        "Severity": "LOW",
        "CweIDs": [
          "CWE-190"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "V2Score": 4.3,
            "V3Score": 3.7
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "V3Score": 3.7
          }
        },
        "References": [
          "https://curl.haxx.se/docs/CVE-2019-5435.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5435",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/",
          "https://security.netapp.com/advisory/ntap-20190606-0004/",
          "https://usn.ubuntu.com/usn/usn-3993-1"
        ],
        "PublishedDate": "2019-05-28T19:29:00Z",
        "LastModifiedDate": "2019-06-09T05:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-5436",
        "PkgName": "curl",
        "InstalledVersion": "7.61.1-9.amzn2.0.1",
        "FixedVersion": "7.61.1-11.amzn2.0.2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-5436",
        "Title": "curl: TFTP receive heap buffer overflow in tftp_receive_packet() function",
        "Description": "A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.",
        "Severity": "LOW",
        "CweIDs": [
          "CWE-119"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "V2Score": 4.6,
            "V3Score": 7.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "V3Score": 5.5
          }
        },
        "References": [
          "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html",
          "https://curl.haxx.se/docs/CVE-2019-5436.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5436",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/",
          "https://security.netapp.com/advisory/ntap-20190606-0004/",
          "https://usn.ubuntu.com/usn/usn-3993-1",
          "https://usn.ubuntu.com/usn/usn-3993-2"
        ],
        "PublishedDate": "2019-05-28T19:29:00Z",
        "LastModifiedDate": "2019-06-09T05:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-16062",
        "PkgName": "elfutils-libelf",
        "InstalledVersion": "0.170-4.amzn2",
        "FixedVersion": "0.176-2.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-16062",
        "Title": "elfutils: Heap-based buffer over-read in libdw/dwarf_getaranges.c:dwarf_getaranges() via crafted file",
        "Description": "dwarf_getaranges in dwarf_getaranges.c in libdw in elfutils before 2018-08-18 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file.",
        "Severity": "LOW",
        "CweIDs": [
          "CWE-125"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "V2Score": 4.3,
            "V3Score": 5.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 3.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-16062.html",
          "http://linux.oracle.com/errata/ELSA-2019-2197.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html",
          "https://access.redhat.com/errata/RHSA-2019:2197",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16062",
          "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
          "https://sourceware.org/bugzilla/show_bug.cgi?id=23541",
          "https://sourceware.org/git/?p=elfutils.git;a=commit;h=29e31978ba51c1051743a503ee325b5ebc03d7e9",
          "https://usn.ubuntu.com/4012-1/",
          "https://usn.ubuntu.com/usn/usn-4012-1"
        ],
        "PublishedDate": "2018-08-29T03:29:00Z",
        "LastModifiedDate": "2019-10-03T00:03:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-16402",
        "PkgName": "elfutils-libelf",
        "InstalledVersion": "0.170-4.amzn2",
        "FixedVersion": "0.176-2.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-16402",
        "Title": "elfutils: Double-free due to double decompression of sections in crafted ELF causes crash",
        "Description": "libelf/elf_end.c in elfutils 0.173 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact because it tries to decompress twice.",
        "Severity": "LOW",
        "CweIDs": [
          "CWE-415"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V2Score": 7.5,
            "V3Score": 9.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 4.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-16402.html",
          "http://linux.oracle.com/errata/ELSA-2019-2197.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16402",
          "https://sourceware.org/bugzilla/show_bug.cgi?id=23528",
          "https://usn.ubuntu.com/4012-1/",
          "https://usn.ubuntu.com/usn/usn-4012-1"
        ],
        "PublishedDate": "2018-09-03T19:29:00Z",
        "LastModifiedDate": "2019-06-10T17:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-16403",
        "PkgName": "elfutils-libelf",
        "InstalledVersion": "0.170-4.amzn2",
        "FixedVersion": "0.176-2.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-16403",
        "Title": "elfutils: Heap-based buffer over-read in libdw/dwarf_getabbrev.c and libwd/dwarf_hasattr.c causes crash",
        "Description": "libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c and dwarf_hasattr in dwarf_hasattr.c, leading to a heap-based buffer over-read and an application crash.",
        "Severity": "LOW",
        "CweIDs": [
          "CWE-125"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "V2Score": 4.3,
            "V3Score": 5.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 3.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-16403.html",
          "http://linux.oracle.com/errata/ELSA-2019-2197.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html",
          "https://access.redhat.com/errata/RHSA-2019:2197",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16403",
          "https://sourceware.org/bugzilla/show_bug.cgi?id=23529",
          "https://sourceware.org/git/?p=elfutils.git;a=commit;h=6983e59b727458a6c64d9659c85f08218bc4fcda",
          "https://usn.ubuntu.com/4012-1/",
          "https://usn.ubuntu.com/usn/usn-4012-1"
        ],
        "PublishedDate": "2018-09-03T19:29:00Z",
        "LastModifiedDate": "2019-10-03T00:03:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-18310",
        "PkgName": "elfutils-libelf",
        "InstalledVersion": "0.170-4.amzn2",
        "FixedVersion": "0.176-2.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-18310",
        "Title": "elfutils: invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl",
        "Description": "An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by consider_notes.",
        "Severity": "LOW",
        "CweIDs": [
          "CWE-119"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "V2Score": 4.3,
            "V3Score": 5.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 3.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-18310.html",
          "http://linux.oracle.com/errata/ELSA-2019-2197.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18310",
          "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
          "https://sourceware.org/bugzilla/show_bug.cgi?id=23752",
          "https://sourceware.org/ml/elfutils-devel/2018-q4/msg00022.html",
          "https://usn.ubuntu.com/4012-1/",
          "https://usn.ubuntu.com/usn/usn-4012-1"
        ],
        "PublishedDate": "2018-10-15T02:29:00Z",
        "LastModifiedDate": "2019-06-10T17:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-18520",
        "PkgName": "elfutils-libelf",
        "InstalledVersion": "0.170-4.amzn2",
        "FixedVersion": "0.176-2.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-18520",
        "Title": "elfutils: eu-size cannot handle recursive ar files",
        "Description": "An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file.",
        "Severity": "LOW",
        "CweIDs": [
          "CWE-119"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "V2Score": 4.3,
            "V3Score": 6.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 3.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-18520.html",
          "http://linux.oracle.com/errata/ELSA-2019-2197.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18520",
          "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
          "https://sourceware.org/bugzilla/show_bug.cgi?id=23787",
          "https://sourceware.org/ml/elfutils-devel/2018-q4/msg00057.html",
          "https://usn.ubuntu.com/4012-1/",
          "https://usn.ubuntu.com/usn/usn-4012-1"
        ],
        "PublishedDate": "2018-10-19T17:29:00Z",
        "LastModifiedDate": "2019-06-10T17:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-18521",
        "PkgName": "elfutils-libelf",
        "InstalledVersion": "0.170-4.amzn2",
        "FixedVersion": "0.176-2.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-18521",
        "Title": "elfutils: Divide-by-zero in arlib_add_symbols function in arlib.c",
        "Description": "Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by eu-ranlib, because a zero sh_entsize is mishandled.",
        "Severity": "LOW",
        "CweIDs": [
          "CWE-369"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "V2Score": 4.3,
            "V3Score": 5.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 3.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-18521.html",
          "http://linux.oracle.com/errata/ELSA-2019-2197.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18521",
          "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
          "https://sourceware.org/bugzilla/show_bug.cgi?id=23786",
          "https://sourceware.org/ml/elfutils-devel/2018-q4/msg00055.html",
          "https://usn.ubuntu.com/4012-1/",
          "https://usn.ubuntu.com/usn/usn-4012-1"
        ],
        "PublishedDate": "2018-10-19T17:29:00Z",
        "LastModifiedDate": "2019-06-10T17:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-7149",
        "PkgName": "elfutils-libelf",
        "InstalledVersion": "0.170-4.amzn2",
        "FixedVersion": "0.176-2.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-7149",
        "Title": "elfutils: heap-based buffer over-read in read_srclines in dwarf_getsrclines.c in libdw",
        "Description": "A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by eu-nm.",
        "Severity": "LOW",
        "CweIDs": [
          "CWE-125"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "V2Score": 4.3,
            "V3Score": 6.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 3.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-7149.html",
          "http://linux.oracle.com/errata/ELSA-2019-3575.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7149",
          "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
          "https://sourceware.org/bugzilla/show_bug.cgi?id=24102",
          "https://sourceware.org/ml/elfutils-devel/2019-q1/msg00068.html",
          "https://usn.ubuntu.com/4012-1/",
          "https://usn.ubuntu.com/usn/usn-4012-1"
        ],
        "PublishedDate": "2019-01-29T00:29:00Z",
        "LastModifiedDate": "2019-06-10T17:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-7150",
        "PkgName": "elfutils-libelf",
        "InstalledVersion": "0.170-4.amzn2",
        "FixedVersion": "0.176-2.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-7150",
        "Title": "elfutils: segmentation fault in elf64_xlatetom in libelf/elf32_xlatetom.c",
        "Description": "An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack.",
        "Severity": "LOW",
        "CweIDs": [
          "CWE-125"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "V2Score": 4.3,
            "V3Score": 5.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 3.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-7150.html",
          "http://linux.oracle.com/errata/ELSA-2019-3575.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7150",
          "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
          "https://sourceware.org/bugzilla/show_bug.cgi?id=24103",
          "https://sourceware.org/ml/elfutils-devel/2019-q1/msg00070.html",
          "https://usn.ubuntu.com/4012-1/",
          "https://usn.ubuntu.com/usn/usn-4012-1"
        ],
        "PublishedDate": "2019-01-29T00:29:00Z",
        "LastModifiedDate": "2019-06-10T17:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-7664",
        "PkgName": "elfutils-libelf",
        "InstalledVersion": "0.170-4.amzn2",
        "FixedVersion": "0.176-2.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-7664",
        "Title": "elfutils: out of bound write in elf_cvt_note in libelf/note_xlate.h",
        "Description": "In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service (program crash).",
        "Severity": "LOW",
        "CweIDs": [
          "CWE-119"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "V2Score": 4.3,
            "V3Score": 5.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 3.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-7664.html",
          "http://linux.oracle.com/errata/ELSA-2019-3575.html",
          "https://access.redhat.com/errata/RHSA-2019:2197",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7664",
          "https://sourceware.org/bugzilla/show_bug.cgi?id=24084"
        ],
        "PublishedDate": "2019-02-09T16:29:00Z",
        "LastModifiedDate": "2019-08-06T17:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-7665",
        "PkgName": "elfutils-libelf",
        "InstalledVersion": "0.170-4.amzn2",
        "FixedVersion": "0.176-2.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-7665",
        "Title": "elfutils: heap-based buffer over-read in function elf32_xlatetom in elf32_xlatetom.c",
        "Description": "In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes.",
        "Severity": "LOW",
        "CweIDs": [
          "CWE-119"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "V2Score": 4.3,
            "V3Score": 5.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 3.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-7665.html",
          "http://linux.oracle.com/errata/ELSA-2019-3575.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7665",
          "https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html",
          "https://sourceware.org/bugzilla/show_bug.cgi?id=24089",
          "https://sourceware.org/ml/elfutils-devel/2019-q1/msg00049.html",
          "https://usn.ubuntu.com/4012-1/",
          "https://usn.ubuntu.com/usn/usn-4012-1"
        ],
        "PublishedDate": "2019-02-09T16:29:00Z",
        "LastModifiedDate": "2019-06-10T17:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-18218",
        "PkgName": "file-libs",
        "InstalledVersion": "5.11-33.amzn2.0.2",
        "FixedVersion": "5.11-35.amzn2.0.2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-18218",
        "Title": "file: heap-based buffer overflow in cdf_read_property_info in cdf.c",
        "Description": "cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write).",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-787"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "V2Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "V3Score": 7.8
          }
        },
        "References": [
          "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16780",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18218",
          "https://github.com/file/file/commit/46a8443f76cec4b41ec736eca396984c74664f84",
          "https://lists.debian.org/debian-lts-announce/2019/10/msg00032.html",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CV6PFCEYHYALMTT45QE2U5C5TEJZQPXJ/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VBK6XOJR6OVWT2FUEBO7V7KCOSSLAP52/",
          "https://usn.ubuntu.com/4172-1/",
          "https://usn.ubuntu.com/4172-2/",
          "https://usn.ubuntu.com/usn/usn-4172-1",
          "https://usn.ubuntu.com/usn/usn-4172-2",
          "https://www.debian.org/security/2019/dsa-4550"
        ],
        "PublishedDate": "2019-10-21T05:15:00Z",
        "LastModifiedDate": "2019-10-26T11:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-12450",
        "PkgName": "glib2",
        "InstalledVersion": "2.54.2-2.amzn2",
        "FixedVersion": "2.56.1-4.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-12450",
        "Title": "glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress",
        "Description": "file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-275"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V2Score": 7.5,
            "V3Score": 9.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "V3Score": 6.6
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-12450.html",
          "http://linux.oracle.com/errata/ELSA-2019-3530.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12450",
          "https://gitlab.gnome.org/GNOME/glib/commit/d8f8f4d637ce43f8699ba94c9b7648beda0ca174",
          "https://lists.debian.org/debian-lts-announce/2019/06/msg00013.html",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2W4WIOAGO3M743M5KZLVQZM3NGHQDYLI/",
          "https://security.netapp.com/advisory/ntap-20190606-0003/",
          "https://usn.ubuntu.com/4014-1/",
          "https://usn.ubuntu.com/4014-2/",
          "https://usn.ubuntu.com/usn/usn-4014-1",
          "https://usn.ubuntu.com/usn/usn-4014-2"
        ],
        "PublishedDate": "2019-05-29T17:29:00Z",
        "LastModifiedDate": "2019-06-11T14:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-5481",
        "PkgName": "libcurl",
        "InstalledVersion": "7.61.1-9.amzn2.0.1",
        "FixedVersion": "7.61.1-12.amzn2.0.1",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-5481",
        "Title": "curl: double free due to subsequent call of realloc()",
        "Description": "Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-415"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "V2Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
            "V3Score": 5.7
          }
        },
        "References": [
          "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html",
          "https://curl.haxx.se/docs/CVE-2019-5481.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5481",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/",
          "https://usn.ubuntu.com/usn/usn-4129-1"
        ],
        "PublishedDate": "2019-09-16T19:15:00Z",
        "LastModifiedDate": "2019-09-18T00:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-5482",
        "PkgName": "libcurl",
        "InstalledVersion": "7.61.1-9.amzn2.0.1",
        "FixedVersion": "7.61.1-12.amzn2.0.1",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-5482",
        "Title": "curl: heap buffer overflow in function tftp_receive_packet()",
        "Description": "Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-120"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "V2Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "V3Score": 6.3
          }
        },
        "References": [
          "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html",
          "https://curl.haxx.se/docs/CVE-2019-5482.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5482",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/",
          "https://usn.ubuntu.com/usn/usn-4129-1",
          "https://usn.ubuntu.com/usn/usn-4129-2"
        ],
        "PublishedDate": "2019-09-16T19:15:00Z",
        "LastModifiedDate": "2019-09-18T00:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-5435",
        "PkgName": "libcurl",
        "InstalledVersion": "7.61.1-9.amzn2.0.1",
        "FixedVersion": "7.61.1-11.amzn2.0.2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-5435",
        "Title": "curl: Integer overflows in curl_url_set() function",
        "Description": "An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.",
        "Severity": "LOW",
        "CweIDs": [
          "CWE-190"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "V2Score": 4.3,
            "V3Score": 3.7
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "V3Score": 3.7
          }
        },
        "References": [
          "https://curl.haxx.se/docs/CVE-2019-5435.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5435",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/",
          "https://security.netapp.com/advisory/ntap-20190606-0004/",
          "https://usn.ubuntu.com/usn/usn-3993-1"
        ],
        "PublishedDate": "2019-05-28T19:29:00Z",
        "LastModifiedDate": "2019-06-09T05:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-5436",
        "PkgName": "libcurl",
        "InstalledVersion": "7.61.1-9.amzn2.0.1",
        "FixedVersion": "7.61.1-11.amzn2.0.2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-5436",
        "Title": "curl: TFTP receive heap buffer overflow in tftp_receive_packet() function",
        "Description": "A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.",
        "Severity": "LOW",
        "CweIDs": [
          "CWE-119"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "V2Score": 4.6,
            "V3Score": 7.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "V3Score": 5.5
          }
        },
        "References": [
          "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html",
          "https://curl.haxx.se/docs/CVE-2019-5436.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5436",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/",
          "https://security.netapp.com/advisory/ntap-20190606-0004/",
          "https://usn.ubuntu.com/usn/usn-3993-1",
          "https://usn.ubuntu.com/usn/usn-3993-2"
        ],
        "PublishedDate": "2019-05-28T19:29:00Z",
        "LastModifiedDate": "2019-06-09T05:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-12290",
        "PkgName": "libidn2",
        "InstalledVersion": "2.0.4-1.amzn2.0.2",
        "FixedVersion": "2.3.0-1.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-12290",
        "Description": "GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-20"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "V2Score": 5
          }
        },
        "References": [
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12290",
          "https://gitlab.com/libidn/libidn2/commit/241e8f486134793cb0f4a5b0e5817a97883401f5",
          "https://gitlab.com/libidn/libidn2/commit/614117ef6e4c60e1950d742e3edf0a0ef8d389de",
          "https://gitlab.com/libidn/libidn2/merge_requests/71",
          "https://usn.ubuntu.com/4168-1/",
          "https://usn.ubuntu.com/usn/usn-4168-1"
        ],
        "PublishedDate": "2019-10-22T16:15:00Z",
        "LastModifiedDate": "2019-10-29T19:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-18224",
        "PkgName": "libidn2",
        "InstalledVersion": "2.0.4-1.amzn2.0.2",
        "FixedVersion": "2.3.0-1.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-18224",
        "Title": "libidn2: heap-based buffer overflow in idn2_to_ascii_4i in lib/lookup.c",
        "Description": "idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-787"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "V2Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "V3Score": 5.6
          }
        },
        "References": [
          "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12420",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18224",
          "https://github.com/libidn/libidn2/commit/e4d1558aa2c1c04a05066ee8600f37603890ba8c",
          "https://github.com/libidn/libidn2/compare/libidn2-2.1.0...libidn2-2.1.1",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDQVQ2XPV5BTZUFINT7AFJSKNNBVURNJ/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MINU5RKDFE6TKAFY5DRFN3WSFDS4DYVS/",
          "https://usn.ubuntu.com/4168-1/",
          "https://usn.ubuntu.com/usn/usn-4168-1"
        ],
        "PublishedDate": "2019-10-21T17:15:00Z",
        "LastModifiedDate": "2019-10-29T19:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-9511",
        "PkgName": "libnghttp2",
        "InstalledVersion": "1.31.1-1.amzn2.0.2",
        "FixedVersion": "1.39.2-1.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-9511",
        "Title": "HTTP/2: large amount of data requests leads to denial of service",
        "Description": "Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-400"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 7.8,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 6.5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-9511.html",
          "http://linux.oracle.com/errata/ELSA-2019-2925.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9511",
          "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md",
          "https://kb.cert.org/vuls/id/605641/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BP556LEG3WENHZI5TAQ6ZEBFTJB4E2IS/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JUBYAF6ED3O4XCHQ5C2HYENJLXYXZC4M/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZLUYPYY3RX4ZJDWZRJIKSULYRJ4PXW7/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TAZZEVTCN2B4WT6AIBJ7XGYJMBTORJU5/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XHTKU7YQ5EEP2XNSAV4M4VJ7QCBOJMOD/",
          "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/",
          "https://seclists.org/bugtraq/2019/Aug/40",
          "https://security.netapp.com/advisory/ntap-20190823-0002/",
          "https://security.netapp.com/advisory/ntap-20190823-0005/",
          "https://support.f5.com/csp/article/K02591030",
          "https://usn.ubuntu.com/4099-1/",
          "https://usn.ubuntu.com/usn/usn-4099-1",
          "https://www.debian.org/security/2019/dsa-4505",
          "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/",
          "https://www.synology.com/security/advisory/Synology_SA_19_33"
        ],
        "PublishedDate": "2019-08-13T21:15:00Z",
        "LastModifiedDate": "2019-08-23T21:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-9513",
        "PkgName": "libnghttp2",
        "InstalledVersion": "1.31.1-1.amzn2.0.2",
        "FixedVersion": "1.39.2-1.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-9513",
        "Title": "HTTP/2: flood using PRIORITY frames results in excessive resource consumption",
        "Description": "Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-400"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 7.8,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-9513.html",
          "http://linux.oracle.com/errata/ELSA-2019-2925.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9513",
          "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md",
          "https://kb.cert.org/vuls/id/605641/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JUBYAF6ED3O4XCHQ5C2HYENJLXYXZC4M/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZLUYPYY3RX4ZJDWZRJIKSULYRJ4PXW7/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TAZZEVTCN2B4WT6AIBJ7XGYJMBTORJU5/",
          "https://nghttp2.org/blog/2019/08/19/nghttp2-v1-39-2/",
          "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/",
          "https://seclists.org/bugtraq/2019/Aug/40",
          "https://security.netapp.com/advisory/ntap-20190823-0002/",
          "https://security.netapp.com/advisory/ntap-20190823-0005/",
          "https://support.f5.com/csp/article/K02591030",
          "https://usn.ubuntu.com/4099-1/",
          "https://usn.ubuntu.com/usn/usn-4099-1",
          "https://www.debian.org/security/2019/dsa-4505",
          "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/",
          "https://www.synology.com/security/advisory/Synology_SA_19_33"
        ],
        "PublishedDate": "2019-08-13T21:15:00Z",
        "LastModifiedDate": "2019-08-23T21:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-3858",
        "PkgName": "libssh2",
        "InstalledVersion": "1.4.3-12.amzn2.2",
        "FixedVersion": "1.4.3-12.amzn2.2.1",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-3858",
        "Title": "libssh2: Zero-byte allocation with a specially crafted SFTP packed leading to an out-of-bounds read",
        "Description": "An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-125"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "V2Score": 6.4,
            "V3Score": 9.1
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "V3Score": 5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-3858.html",
          "http://linux.oracle.com/errata/ELSA-2019-2136.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html",
          "http://packetstormsecurity.com/files/152136/Slackware-Security-Advisory-libssh2-Updates.html",
          "http://www.openwall.com/lists/oss-security/2019/03/18/3",
          "http://www.securityfocus.com/bid/107485",
          "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3858",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3858",
          "https://github.com/libssh2/libssh2/pull/316",
          "https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XCWEA5ZCLKRDUK62QVVYMFWLWKOPX3LO/",
          "https://seclists.org/bugtraq/2019/Apr/25",
          "https://seclists.org/bugtraq/2019/Mar/25",
          "https://security.netapp.com/advisory/ntap-20190327-0005/",
          "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-767",
          "https://www.debian.org/security/2019/dsa-4431",
          "https://www.libssh2.org/CVE-2019-3858.html"
        ],
        "PublishedDate": "2019-03-21T21:29:00Z",
        "LastModifiedDate": "2019-04-15T12:31:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-3861",
        "PkgName": "libssh2",
        "InstalledVersion": "1.4.3-12.amzn2.2",
        "FixedVersion": "1.4.3-12.amzn2.2.1",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-3861",
        "Title": "libssh2: Out-of-bounds reads with specially crafted SSH packets",
        "Description": "An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-125"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "V2Score": 6.4,
            "V3Score": 9.1
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "V3Score": 5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-3861.html",
          "http://linux.oracle.com/errata/ELSA-2019-2136.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html",
          "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3861",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3861",
          "https://github.com/libssh2/libssh2/pull/316",
          "https://libssh2.org/CVE-2019-3861.html",
          "https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/",
          "https://seclists.org/bugtraq/2019/Apr/25",
          "https://security.netapp.com/advisory/ntap-20190327-0005/",
          "https://www.debian.org/security/2019/dsa-4431",
          "https://www.libssh2.org/CVE-2019-3861.html"
        ],
        "PublishedDate": "2019-03-25T19:29:00Z",
        "LastModifiedDate": "2019-04-15T12:31:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-3862",
        "PkgName": "libssh2",
        "InstalledVersion": "1.4.3-12.amzn2.2",
        "FixedVersion": "1.4.3-12.amzn2.2.2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-3862",
        "Title": "libssh2: Out-of-bounds memory comparison with specially crafted message channel request",
        "Description": "An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-125"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "V2Score": 6.4,
            "V3Score": 9.1
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "V3Score": 7.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-3862.html",
          "http://linux.oracle.com/errata/ELSA-2019-4693.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html",
          "http://packetstormsecurity.com/files/152136/Slackware-Security-Advisory-libssh2-Updates.html",
          "http://www.openwall.com/lists/oss-security/2019/03/18/3",
          "http://www.securityfocus.com/bid/107485",
          "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3862",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3862",
          "https://github.com/libssh2/libssh2/pull/316",
          "https://libssh2.org/CVE-2019-3862.html",
          "https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XCWEA5ZCLKRDUK62QVVYMFWLWKOPX3LO/",
          "https://seclists.org/bugtraq/2019/Apr/25",
          "https://seclists.org/bugtraq/2019/Mar/25",
          "https://security.netapp.com/advisory/ntap-20190327-0005/",
          "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-767",
          "https://www.debian.org/security/2019/dsa-4431",
          "https://www.libssh2.org/CVE-2019-3862.html"
        ],
        "PublishedDate": "2019-03-21T16:01:00Z",
        "LastModifiedDate": "2019-04-15T12:31:00Z"
      },
      {
        "VulnerabilityID": "CVE-2016-4658",
        "PkgName": "libxml2",
        "InstalledVersion": "2.9.1-6.amzn2.3.2",
        "FixedVersion": "2.9.1-6.amzn2.3.3",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2016-4658",
        "Title": "libxml2: Use after free via namespace node in XPointer ranges",
        "Description": "xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-119"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V2Score": 10,
            "V3Score": 9.8
          },
          "redhat": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "V2Score": 4.3,
            "V3Score": 5.3
          }
        },
        "References": [
          "http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html",
          "http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html",
          "http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html",
          "http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html",
          "http://www.securityfocus.com/bid/93054",
          "http://www.securitytracker.com/id/1036858",
          "http://www.securitytracker.com/id/1038623",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4658",
          "https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344b",
          "https://github.com/sparklemotion/nokogiri/issues/1615",
          "https://nvd.nist.gov/vuln/detail/CVE-2016-4658",
          "https://security.gentoo.org/glsa/201701-37",
          "https://support.apple.com/HT207141",
          "https://support.apple.com/HT207142",
          "https://support.apple.com/HT207143",
          "https://support.apple.com/HT207170",
          "https://usn.ubuntu.com/usn/usn-3235-1"
        ],
        "PublishedDate": "2016-09-25T10:59:00Z",
        "LastModifiedDate": "2019-03-13T14:05:00Z"
      },
      {
        "VulnerabilityID": "CVE-2017-16931",
        "PkgName": "libxml2",
        "InstalledVersion": "2.9.1-6.amzn2.3.2",
        "FixedVersion": "2.9.1-6.amzn2.3.3",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-16931",
        "Title": "libxml2: Mishandling parameter-entity references",
        "Description": "parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-119"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V2Score": 7.5,
            "V3Score": 9.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "http://xmlsoft.org/news.html",
          "https://bugzilla.gnome.org/show_bug.cgi?id=766956",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16931",
          "https://github.com/GNOME/libxml2/commit/e26630548e7d138d2c560844c43820b6767251e3",
          "https://lists.debian.org/debian-lts-announce/2017/11/msg00041.html"
        ],
        "PublishedDate": "2017-11-23T21:29:00Z",
        "LastModifiedDate": "2018-02-04T02:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2017-10684",
        "PkgName": "ncurses",
        "InstalledVersion": "6.0-8.20170212.amzn2.1.2",
        "FixedVersion": "6.0-8.20170212.amzn2.1.3",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-10684",
        "Title": "ncurses: Stack-based buffer overflow in fmt_entry function in dump_entry.c",
        "Description": "In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-119"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V2Score": 7.5,
            "V3Score": 9.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H",
            "V3Score": 5.3
          }
        },
        "References": [
          "https://bugzilla.redhat.com/show_bug.cgi?id=1464687",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10684",
          "https://security.gentoo.org/glsa/201804-13"
        ],
        "PublishedDate": "2017-06-29T23:29:00Z",
        "LastModifiedDate": "2018-10-21T10:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2017-10685",
        "PkgName": "ncurses",
        "InstalledVersion": "6.0-8.20170212.amzn2.1.2",
        "FixedVersion": "6.0-8.20170212.amzn2.1.3",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-10685",
        "Title": "ncurses: Stack-based buffer overflow caused by format string vulnerability in fmt_entry function",
        "Description": "In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-134"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V2Score": 7.5,
            "V3Score": 9.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "V3Score": 7
          }
        },
        "References": [
          "https://bugzilla.redhat.com/show_bug.cgi?id=1464692",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10685",
          "https://security.gentoo.org/glsa/201804-13"
        ],
        "PublishedDate": "2017-06-29T23:29:00Z",
        "LastModifiedDate": "2019-10-03T00:03:00Z"
      },
      {
        "VulnerabilityID": "CVE-2017-11112",
        "PkgName": "ncurses",
        "InstalledVersion": "6.0-8.20170212.amzn2.1.2",
        "FixedVersion": "6.0-8.20170212.amzn2.1.3",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-11112",
        "Title": "ncurses: Illegal address access in append_acs function",
        "Description": "In ncurses 6.0, there is an attempted 0xffffffffffffffff access in the append_acs function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-20"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 5,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 3.3
          }
        },
        "References": [
          "https://bugzilla.redhat.com/show_bug.cgi?id=1464686",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11112",
          "https://security.gentoo.org/glsa/201804-13"
        ],
        "PublishedDate": "2017-07-08T17:29:00Z",
        "LastModifiedDate": "2018-10-21T10:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2017-11113",
        "PkgName": "ncurses",
        "InstalledVersion": "6.0-8.20170212.amzn2.1.2",
        "FixedVersion": "6.0-8.20170212.amzn2.1.3",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-11113",
        "Title": "ncurses: Null pointer dereference vulnerability in _nc_parse_entry function",
        "Description": "In ncurses 6.0, there is a NULL Pointer Dereference in the _nc_parse_entry function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-476"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 5,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 3.3
          }
        },
        "References": [
          "https://bugzilla.redhat.com/show_bug.cgi?id=1464691",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11113",
          "https://security.gentoo.org/glsa/201804-13"
        ],
        "PublishedDate": "2017-07-08T17:29:00Z",
        "LastModifiedDate": "2019-05-06T15:00:00Z"
      },
      {
        "VulnerabilityID": "CVE-2017-10684",
        "PkgName": "ncurses-base",
        "InstalledVersion": "6.0-8.20170212.amzn2.1.2",
        "FixedVersion": "6.0-8.20170212.amzn2.1.3",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-10684",
        "Title": "ncurses: Stack-based buffer overflow in fmt_entry function in dump_entry.c",
        "Description": "In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-119"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V2Score": 7.5,
            "V3Score": 9.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H",
            "V3Score": 5.3
          }
        },
        "References": [
          "https://bugzilla.redhat.com/show_bug.cgi?id=1464687",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10684",
          "https://security.gentoo.org/glsa/201804-13"
        ],
        "PublishedDate": "2017-06-29T23:29:00Z",
        "LastModifiedDate": "2018-10-21T10:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2017-10685",
        "PkgName": "ncurses-base",
        "InstalledVersion": "6.0-8.20170212.amzn2.1.2",
        "FixedVersion": "6.0-8.20170212.amzn2.1.3",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-10685",
        "Title": "ncurses: Stack-based buffer overflow caused by format string vulnerability in fmt_entry function",
        "Description": "In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-134"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V2Score": 7.5,
            "V3Score": 9.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "V3Score": 7
          }
        },
        "References": [
          "https://bugzilla.redhat.com/show_bug.cgi?id=1464692",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10685",
          "https://security.gentoo.org/glsa/201804-13"
        ],
        "PublishedDate": "2017-06-29T23:29:00Z",
        "LastModifiedDate": "2019-10-03T00:03:00Z"
      },
      {
        "VulnerabilityID": "CVE-2017-11112",
        "PkgName": "ncurses-base",
        "InstalledVersion": "6.0-8.20170212.amzn2.1.2",
        "FixedVersion": "6.0-8.20170212.amzn2.1.3",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-11112",
        "Title": "ncurses: Illegal address access in append_acs function",
        "Description": "In ncurses 6.0, there is an attempted 0xffffffffffffffff access in the append_acs function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-20"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 5,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 3.3
          }
        },
        "References": [
          "https://bugzilla.redhat.com/show_bug.cgi?id=1464686",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11112",
          "https://security.gentoo.org/glsa/201804-13"
        ],
        "PublishedDate": "2017-07-08T17:29:00Z",
        "LastModifiedDate": "2018-10-21T10:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2017-11113",
        "PkgName": "ncurses-base",
        "InstalledVersion": "6.0-8.20170212.amzn2.1.2",
        "FixedVersion": "6.0-8.20170212.amzn2.1.3",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-11113",
        "Title": "ncurses: Null pointer dereference vulnerability in _nc_parse_entry function",
        "Description": "In ncurses 6.0, there is a NULL Pointer Dereference in the _nc_parse_entry function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-476"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 5,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 3.3
          }
        },
        "References": [
          "https://bugzilla.redhat.com/show_bug.cgi?id=1464691",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11113",
          "https://security.gentoo.org/glsa/201804-13"
        ],
        "PublishedDate": "2017-07-08T17:29:00Z",
        "LastModifiedDate": "2019-05-06T15:00:00Z"
      },
      {
        "VulnerabilityID": "CVE-2017-10684",
        "PkgName": "ncurses-libs",
        "InstalledVersion": "6.0-8.20170212.amzn2.1.2",
        "FixedVersion": "6.0-8.20170212.amzn2.1.3",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-10684",
        "Title": "ncurses: Stack-based buffer overflow in fmt_entry function in dump_entry.c",
        "Description": "In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-119"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V2Score": 7.5,
            "V3Score": 9.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H",
            "V3Score": 5.3
          }
        },
        "References": [
          "https://bugzilla.redhat.com/show_bug.cgi?id=1464687",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10684",
          "https://security.gentoo.org/glsa/201804-13"
        ],
        "PublishedDate": "2017-06-29T23:29:00Z",
        "LastModifiedDate": "2018-10-21T10:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2017-10685",
        "PkgName": "ncurses-libs",
        "InstalledVersion": "6.0-8.20170212.amzn2.1.2",
        "FixedVersion": "6.0-8.20170212.amzn2.1.3",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-10685",
        "Title": "ncurses: Stack-based buffer overflow caused by format string vulnerability in fmt_entry function",
        "Description": "In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-134"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V2Score": 7.5,
            "V3Score": 9.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "V3Score": 7
          }
        },
        "References": [
          "https://bugzilla.redhat.com/show_bug.cgi?id=1464692",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10685",
          "https://security.gentoo.org/glsa/201804-13"
        ],
        "PublishedDate": "2017-06-29T23:29:00Z",
        "LastModifiedDate": "2019-10-03T00:03:00Z"
      },
      {
        "VulnerabilityID": "CVE-2017-11112",
        "PkgName": "ncurses-libs",
        "InstalledVersion": "6.0-8.20170212.amzn2.1.2",
        "FixedVersion": "6.0-8.20170212.amzn2.1.3",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-11112",
        "Title": "ncurses: Illegal address access in append_acs function",
        "Description": "In ncurses 6.0, there is an attempted 0xffffffffffffffff access in the append_acs function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-20"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 5,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 3.3
          }
        },
        "References": [
          "https://bugzilla.redhat.com/show_bug.cgi?id=1464686",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11112",
          "https://security.gentoo.org/glsa/201804-13"
        ],
        "PublishedDate": "2017-07-08T17:29:00Z",
        "LastModifiedDate": "2018-10-21T10:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2017-11113",
        "PkgName": "ncurses-libs",
        "InstalledVersion": "6.0-8.20170212.amzn2.1.2",
        "FixedVersion": "6.0-8.20170212.amzn2.1.3",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2017-11113",
        "Title": "ncurses: Null pointer dereference vulnerability in _nc_parse_entry function",
        "Description": "In ncurses 6.0, there is a NULL Pointer Dereference in the _nc_parse_entry function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-476"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 5,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 3.3
          }
        },
        "References": [
          "https://bugzilla.redhat.com/show_bug.cgi?id=1464691",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11113",
          "https://security.gentoo.org/glsa/201804-13"
        ],
        "PublishedDate": "2017-07-08T17:29:00Z",
        "LastModifiedDate": "2019-05-06T15:00:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-11729",
        "PkgName": "nss",
        "InstalledVersion": "3.36.0-7.amzn2",
        "FixedVersion": "3.44.0-7.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-11729",
        "Title": "nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault",
        "Description": "Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR \u003c 60.8, Firefox \u003c 68, and Thunderbird \u003c 60.8.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-20"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 5,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-11729.html",
          "http://linux.oracle.com/errata/ELSA-2019-4190.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html",
          "https://access.redhat.com/errata/RHSA-2019:1951",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=1515342",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11729",
          "https://usn.ubuntu.com/usn/usn-4054-1",
          "https://usn.ubuntu.com/usn/usn-4060-1",
          "https://usn.ubuntu.com/usn/usn-4060-2",
          "https://usn.ubuntu.com/usn/usn-4064-1",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11729",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11729",
          "https://www.mozilla.org/security/advisories/mfsa2019-21/",
          "https://www.mozilla.org/security/advisories/mfsa2019-22/",
          "https://www.mozilla.org/security/advisories/mfsa2019-23/"
        ],
        "PublishedDate": "2019-07-23T14:15:00Z",
        "LastModifiedDate": "2019-07-29T16:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-11745",
        "PkgName": "nss",
        "InstalledVersion": "3.36.0-7.amzn2",
        "FixedVersion": "3.44.0-7.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-11745",
        "Title": "nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate",
        "Description": "When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 68.3, Firefox ESR \u003c 68.3, and Firefox \u003c 71.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-787"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "V2Score": 6.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V3Score": 8.1
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-11745.html",
          "http://linux.oracle.com/errata/ELSA-2019-4190.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=1586176",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11745",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.3_release_notes",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47.1_release_notes",
          "https://usn.ubuntu.com/4241-1/",
          "https://usn.ubuntu.com/usn/usn-4203-1",
          "https://usn.ubuntu.com/usn/usn-4203-2",
          "https://usn.ubuntu.com/usn/usn-4216-1",
          "https://usn.ubuntu.com/usn/usn-4216-2",
          "https://usn.ubuntu.com/usn/usn-4241-1",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-38/#CVE-2019-11745",
          "https://www.mozilla.org/security/advisories/mfsa2019-36/",
          "https://www.mozilla.org/security/advisories/mfsa2019-37/",
          "https://www.mozilla.org/security/advisories/mfsa2019-38/"
        ],
        "PublishedDate": "2020-01-08T20:15:00Z",
        "LastModifiedDate": "2020-01-16T19:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-0495",
        "PkgName": "nss",
        "InstalledVersion": "3.36.0-7.amzn2",
        "FixedVersion": "3.44.0-4.amzn2.0.2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-0495",
        "Title": "ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries",
        "Description": "Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-200"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "V2Score": 1.9,
            "V3Score": 4.7
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V3Score": 5.1
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-0495.html",
          "http://linux.oracle.com/errata/ELSA-2019-2237.html",
          "http://www.securitytracker.com/id/1041144",
          "http://www.securitytracker.com/id/1041147",
          "https://access.redhat.com/errata/RHSA-2018:3221",
          "https://access.redhat.com/errata/RHSA-2018:3505",
          "https://access.redhat.com/errata/RHSA-2019:1296",
          "https://access.redhat.com/errata/RHSA-2019:1297",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0495",
          "https://dev.gnupg.org/T4011",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.38_release_notes",
          "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=9010d1576e278a4274ad3f4aa15776c28f6ba965",
          "https://lists.debian.org/debian-lts-announce/2018/06/msg00013.html",
          "https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000426.html",
          "https://usn.ubuntu.com/3689-1/",
          "https://usn.ubuntu.com/3689-2/",
          "https://usn.ubuntu.com/3692-1/",
          "https://usn.ubuntu.com/3692-2/",
          "https://usn.ubuntu.com/3850-1/",
          "https://usn.ubuntu.com/3850-2/",
          "https://usn.ubuntu.com/usn/usn-3689-1",
          "https://usn.ubuntu.com/usn/usn-3689-2",
          "https://usn.ubuntu.com/usn/usn-3692-1",
          "https://usn.ubuntu.com/usn/usn-3692-2",
          "https://usn.ubuntu.com/usn/usn-3850-1",
          "https://usn.ubuntu.com/usn/usn-3850-2",
          "https://www.debian.org/security/2018/dsa-4231",
          "https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/",
          "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
        ],
        "PublishedDate": "2018-06-13T23:29:00Z",
        "LastModifiedDate": "2019-05-30T18:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-12404",
        "PkgName": "nss",
        "InstalledVersion": "3.36.0-7.amzn2",
        "FixedVersion": "3.44.0-4.amzn2.0.2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-12404",
        "Title": "nss: Cache side-channel variant of the Bleichenbacher attack",
        "Description": "A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-310"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V2Score": 4.3,
            "V3Score": 5.9
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V3Score": 5.9
          }
        },
        "References": [
          "http://cat.eyalro.net/",
          "http://linux.oracle.com/cve/CVE-2018-12404.html",
          "http://linux.oracle.com/errata/ELSA-2019-2237.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00021.html",
          "http://www.securityfocus.com/bid/107260",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2018-12404",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12404",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.36.6_release_notes",
          "https://usn.ubuntu.com/usn/usn-3850-1",
          "https://usn.ubuntu.com/usn/usn-3850-2"
        ],
        "PublishedDate": "2019-05-02T17:29:00Z",
        "LastModifiedDate": "2019-07-20T12:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-11729",
        "PkgName": "nss-softokn",
        "InstalledVersion": "3.36.0-5.amzn2",
        "FixedVersion": "3.44.0-8.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-11729",
        "Title": "nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault",
        "Description": "Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR \u003c 60.8, Firefox \u003c 68, and Thunderbird \u003c 60.8.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-20"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 5,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-11729.html",
          "http://linux.oracle.com/errata/ELSA-2019-4190.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html",
          "https://access.redhat.com/errata/RHSA-2019:1951",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=1515342",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11729",
          "https://usn.ubuntu.com/usn/usn-4054-1",
          "https://usn.ubuntu.com/usn/usn-4060-1",
          "https://usn.ubuntu.com/usn/usn-4060-2",
          "https://usn.ubuntu.com/usn/usn-4064-1",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11729",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11729",
          "https://www.mozilla.org/security/advisories/mfsa2019-21/",
          "https://www.mozilla.org/security/advisories/mfsa2019-22/",
          "https://www.mozilla.org/security/advisories/mfsa2019-23/"
        ],
        "PublishedDate": "2019-07-23T14:15:00Z",
        "LastModifiedDate": "2019-07-29T16:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-11745",
        "PkgName": "nss-softokn",
        "InstalledVersion": "3.36.0-5.amzn2",
        "FixedVersion": "3.44.0-8.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-11745",
        "Title": "nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate",
        "Description": "When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 68.3, Firefox ESR \u003c 68.3, and Firefox \u003c 71.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-787"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "V2Score": 6.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V3Score": 8.1
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-11745.html",
          "http://linux.oracle.com/errata/ELSA-2019-4190.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=1586176",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11745",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.3_release_notes",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47.1_release_notes",
          "https://usn.ubuntu.com/4241-1/",
          "https://usn.ubuntu.com/usn/usn-4203-1",
          "https://usn.ubuntu.com/usn/usn-4203-2",
          "https://usn.ubuntu.com/usn/usn-4216-1",
          "https://usn.ubuntu.com/usn/usn-4216-2",
          "https://usn.ubuntu.com/usn/usn-4241-1",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-38/#CVE-2019-11745",
          "https://www.mozilla.org/security/advisories/mfsa2019-36/",
          "https://www.mozilla.org/security/advisories/mfsa2019-37/",
          "https://www.mozilla.org/security/advisories/mfsa2019-38/"
        ],
        "PublishedDate": "2020-01-08T20:15:00Z",
        "LastModifiedDate": "2020-01-16T19:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-11729",
        "PkgName": "nss-softokn-freebl",
        "InstalledVersion": "3.36.0-5.amzn2",
        "FixedVersion": "3.44.0-8.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-11729",
        "Title": "nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault",
        "Description": "Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR \u003c 60.8, Firefox \u003c 68, and Thunderbird \u003c 60.8.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-20"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 5,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-11729.html",
          "http://linux.oracle.com/errata/ELSA-2019-4190.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html",
          "https://access.redhat.com/errata/RHSA-2019:1951",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=1515342",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11729",
          "https://usn.ubuntu.com/usn/usn-4054-1",
          "https://usn.ubuntu.com/usn/usn-4060-1",
          "https://usn.ubuntu.com/usn/usn-4060-2",
          "https://usn.ubuntu.com/usn/usn-4064-1",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11729",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11729",
          "https://www.mozilla.org/security/advisories/mfsa2019-21/",
          "https://www.mozilla.org/security/advisories/mfsa2019-22/",
          "https://www.mozilla.org/security/advisories/mfsa2019-23/"
        ],
        "PublishedDate": "2019-07-23T14:15:00Z",
        "LastModifiedDate": "2019-07-29T16:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-11745",
        "PkgName": "nss-softokn-freebl",
        "InstalledVersion": "3.36.0-5.amzn2",
        "FixedVersion": "3.44.0-8.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-11745",
        "Title": "nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate",
        "Description": "When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 68.3, Firefox ESR \u003c 68.3, and Firefox \u003c 71.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-787"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "V2Score": 6.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V3Score": 8.1
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-11745.html",
          "http://linux.oracle.com/errata/ELSA-2019-4190.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=1586176",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11745",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.3_release_notes",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47.1_release_notes",
          "https://usn.ubuntu.com/4241-1/",
          "https://usn.ubuntu.com/usn/usn-4203-1",
          "https://usn.ubuntu.com/usn/usn-4203-2",
          "https://usn.ubuntu.com/usn/usn-4216-1",
          "https://usn.ubuntu.com/usn/usn-4216-2",
          "https://usn.ubuntu.com/usn/usn-4241-1",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-38/#CVE-2019-11745",
          "https://www.mozilla.org/security/advisories/mfsa2019-36/",
          "https://www.mozilla.org/security/advisories/mfsa2019-37/",
          "https://www.mozilla.org/security/advisories/mfsa2019-38/"
        ],
        "PublishedDate": "2020-01-08T20:15:00Z",
        "LastModifiedDate": "2020-01-16T19:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-11729",
        "PkgName": "nss-sysinit",
        "InstalledVersion": "3.36.0-7.amzn2",
        "FixedVersion": "3.44.0-7.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-11729",
        "Title": "nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault",
        "Description": "Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR \u003c 60.8, Firefox \u003c 68, and Thunderbird \u003c 60.8.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-20"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 5,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-11729.html",
          "http://linux.oracle.com/errata/ELSA-2019-4190.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html",
          "https://access.redhat.com/errata/RHSA-2019:1951",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=1515342",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11729",
          "https://usn.ubuntu.com/usn/usn-4054-1",
          "https://usn.ubuntu.com/usn/usn-4060-1",
          "https://usn.ubuntu.com/usn/usn-4060-2",
          "https://usn.ubuntu.com/usn/usn-4064-1",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11729",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11729",
          "https://www.mozilla.org/security/advisories/mfsa2019-21/",
          "https://www.mozilla.org/security/advisories/mfsa2019-22/",
          "https://www.mozilla.org/security/advisories/mfsa2019-23/"
        ],
        "PublishedDate": "2019-07-23T14:15:00Z",
        "LastModifiedDate": "2019-07-29T16:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-11745",
        "PkgName": "nss-sysinit",
        "InstalledVersion": "3.36.0-7.amzn2",
        "FixedVersion": "3.44.0-7.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-11745",
        "Title": "nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate",
        "Description": "When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 68.3, Firefox ESR \u003c 68.3, and Firefox \u003c 71.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-787"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "V2Score": 6.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V3Score": 8.1
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-11745.html",
          "http://linux.oracle.com/errata/ELSA-2019-4190.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=1586176",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11745",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.3_release_notes",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47.1_release_notes",
          "https://usn.ubuntu.com/4241-1/",
          "https://usn.ubuntu.com/usn/usn-4203-1",
          "https://usn.ubuntu.com/usn/usn-4203-2",
          "https://usn.ubuntu.com/usn/usn-4216-1",
          "https://usn.ubuntu.com/usn/usn-4216-2",
          "https://usn.ubuntu.com/usn/usn-4241-1",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-38/#CVE-2019-11745",
          "https://www.mozilla.org/security/advisories/mfsa2019-36/",
          "https://www.mozilla.org/security/advisories/mfsa2019-37/",
          "https://www.mozilla.org/security/advisories/mfsa2019-38/"
        ],
        "PublishedDate": "2020-01-08T20:15:00Z",
        "LastModifiedDate": "2020-01-16T19:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-0495",
        "PkgName": "nss-sysinit",
        "InstalledVersion": "3.36.0-7.amzn2",
        "FixedVersion": "3.44.0-4.amzn2.0.2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-0495",
        "Title": "ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries",
        "Description": "Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-200"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "V2Score": 1.9,
            "V3Score": 4.7
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V3Score": 5.1
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-0495.html",
          "http://linux.oracle.com/errata/ELSA-2019-2237.html",
          "http://www.securitytracker.com/id/1041144",
          "http://www.securitytracker.com/id/1041147",
          "https://access.redhat.com/errata/RHSA-2018:3221",
          "https://access.redhat.com/errata/RHSA-2018:3505",
          "https://access.redhat.com/errata/RHSA-2019:1296",
          "https://access.redhat.com/errata/RHSA-2019:1297",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0495",
          "https://dev.gnupg.org/T4011",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.38_release_notes",
          "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=9010d1576e278a4274ad3f4aa15776c28f6ba965",
          "https://lists.debian.org/debian-lts-announce/2018/06/msg00013.html",
          "https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000426.html",
          "https://usn.ubuntu.com/3689-1/",
          "https://usn.ubuntu.com/3689-2/",
          "https://usn.ubuntu.com/3692-1/",
          "https://usn.ubuntu.com/3692-2/",
          "https://usn.ubuntu.com/3850-1/",
          "https://usn.ubuntu.com/3850-2/",
          "https://usn.ubuntu.com/usn/usn-3689-1",
          "https://usn.ubuntu.com/usn/usn-3689-2",
          "https://usn.ubuntu.com/usn/usn-3692-1",
          "https://usn.ubuntu.com/usn/usn-3692-2",
          "https://usn.ubuntu.com/usn/usn-3850-1",
          "https://usn.ubuntu.com/usn/usn-3850-2",
          "https://www.debian.org/security/2018/dsa-4231",
          "https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/",
          "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
        ],
        "PublishedDate": "2018-06-13T23:29:00Z",
        "LastModifiedDate": "2019-05-30T18:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-12404",
        "PkgName": "nss-sysinit",
        "InstalledVersion": "3.36.0-7.amzn2",
        "FixedVersion": "3.44.0-4.amzn2.0.2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-12404",
        "Title": "nss: Cache side-channel variant of the Bleichenbacher attack",
        "Description": "A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-310"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V2Score": 4.3,
            "V3Score": 5.9
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V3Score": 5.9
          }
        },
        "References": [
          "http://cat.eyalro.net/",
          "http://linux.oracle.com/cve/CVE-2018-12404.html",
          "http://linux.oracle.com/errata/ELSA-2019-2237.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00021.html",
          "http://www.securityfocus.com/bid/107260",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2018-12404",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12404",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.36.6_release_notes",
          "https://usn.ubuntu.com/usn/usn-3850-1",
          "https://usn.ubuntu.com/usn/usn-3850-2"
        ],
        "PublishedDate": "2019-05-02T17:29:00Z",
        "LastModifiedDate": "2019-07-20T12:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-11729",
        "PkgName": "nss-tools",
        "InstalledVersion": "3.36.0-7.amzn2",
        "FixedVersion": "3.44.0-7.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-11729",
        "Title": "nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault",
        "Description": "Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR \u003c 60.8, Firefox \u003c 68, and Thunderbird \u003c 60.8.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-20"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 5,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-11729.html",
          "http://linux.oracle.com/errata/ELSA-2019-4190.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html",
          "https://access.redhat.com/errata/RHSA-2019:1951",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=1515342",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11729",
          "https://usn.ubuntu.com/usn/usn-4054-1",
          "https://usn.ubuntu.com/usn/usn-4060-1",
          "https://usn.ubuntu.com/usn/usn-4060-2",
          "https://usn.ubuntu.com/usn/usn-4064-1",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11729",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11729",
          "https://www.mozilla.org/security/advisories/mfsa2019-21/",
          "https://www.mozilla.org/security/advisories/mfsa2019-22/",
          "https://www.mozilla.org/security/advisories/mfsa2019-23/"
        ],
        "PublishedDate": "2019-07-23T14:15:00Z",
        "LastModifiedDate": "2019-07-29T16:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-11745",
        "PkgName": "nss-tools",
        "InstalledVersion": "3.36.0-7.amzn2",
        "FixedVersion": "3.44.0-7.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-11745",
        "Title": "nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate",
        "Description": "When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 68.3, Firefox ESR \u003c 68.3, and Firefox \u003c 71.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-787"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "V2Score": 6.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V3Score": 8.1
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-11745.html",
          "http://linux.oracle.com/errata/ELSA-2019-4190.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=1586176",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11745",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.3_release_notes",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47.1_release_notes",
          "https://usn.ubuntu.com/4241-1/",
          "https://usn.ubuntu.com/usn/usn-4203-1",
          "https://usn.ubuntu.com/usn/usn-4203-2",
          "https://usn.ubuntu.com/usn/usn-4216-1",
          "https://usn.ubuntu.com/usn/usn-4216-2",
          "https://usn.ubuntu.com/usn/usn-4241-1",
          "https://www.mozilla.org/en-US/security/advisories/mfsa2019-38/#CVE-2019-11745",
          "https://www.mozilla.org/security/advisories/mfsa2019-36/",
          "https://www.mozilla.org/security/advisories/mfsa2019-37/",
          "https://www.mozilla.org/security/advisories/mfsa2019-38/"
        ],
        "PublishedDate": "2020-01-08T20:15:00Z",
        "LastModifiedDate": "2020-01-16T19:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-0495",
        "PkgName": "nss-tools",
        "InstalledVersion": "3.36.0-7.amzn2",
        "FixedVersion": "3.44.0-4.amzn2.0.2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-0495",
        "Title": "ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries",
        "Description": "Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-200"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "V2Score": 1.9,
            "V3Score": 4.7
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V3Score": 5.1
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-0495.html",
          "http://linux.oracle.com/errata/ELSA-2019-2237.html",
          "http://www.securitytracker.com/id/1041144",
          "http://www.securitytracker.com/id/1041147",
          "https://access.redhat.com/errata/RHSA-2018:3221",
          "https://access.redhat.com/errata/RHSA-2018:3505",
          "https://access.redhat.com/errata/RHSA-2019:1296",
          "https://access.redhat.com/errata/RHSA-2019:1297",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0495",
          "https://dev.gnupg.org/T4011",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.38_release_notes",
          "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=9010d1576e278a4274ad3f4aa15776c28f6ba965",
          "https://lists.debian.org/debian-lts-announce/2018/06/msg00013.html",
          "https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000426.html",
          "https://usn.ubuntu.com/3689-1/",
          "https://usn.ubuntu.com/3689-2/",
          "https://usn.ubuntu.com/3692-1/",
          "https://usn.ubuntu.com/3692-2/",
          "https://usn.ubuntu.com/3850-1/",
          "https://usn.ubuntu.com/3850-2/",
          "https://usn.ubuntu.com/usn/usn-3689-1",
          "https://usn.ubuntu.com/usn/usn-3689-2",
          "https://usn.ubuntu.com/usn/usn-3692-1",
          "https://usn.ubuntu.com/usn/usn-3692-2",
          "https://usn.ubuntu.com/usn/usn-3850-1",
          "https://usn.ubuntu.com/usn/usn-3850-2",
          "https://www.debian.org/security/2018/dsa-4231",
          "https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/",
          "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
        ],
        "PublishedDate": "2018-06-13T23:29:00Z",
        "LastModifiedDate": "2019-05-30T18:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-12404",
        "PkgName": "nss-tools",
        "InstalledVersion": "3.36.0-7.amzn2",
        "FixedVersion": "3.44.0-4.amzn2.0.2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-12404",
        "Title": "nss: Cache side-channel variant of the Bleichenbacher attack",
        "Description": "A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-310"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V2Score": 4.3,
            "V3Score": 5.9
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V3Score": 5.9
          }
        },
        "References": [
          "http://cat.eyalro.net/",
          "http://linux.oracle.com/cve/CVE-2018-12404.html",
          "http://linux.oracle.com/errata/ELSA-2019-2237.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00021.html",
          "http://www.securityfocus.com/bid/107260",
          "https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2018-12404",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12404",
          "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.36.6_release_notes",
          "https://usn.ubuntu.com/usn/usn-3850-1",
          "https://usn.ubuntu.com/usn/usn-3850-2"
        ],
        "PublishedDate": "2019-05-02T17:29:00Z",
        "LastModifiedDate": "2019-07-20T12:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-0734",
        "PkgName": "openssl-libs",
        "InstalledVersion": "1:1.0.2k-16.amzn2.1.1",
        "FixedVersion": "1:1.0.2k-19.amzn2.0.1",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-0734",
        "Title": "openssl: timing side channel attack in the DSA signature algorithm",
        "Description": "The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-320"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V2Score": 4.3,
            "V3Score": 5.9
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V3Score": 5.1
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-0734.html",
          "http://linux.oracle.com/errata/ELSA-2019-3700.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html",
          "http://www.securityfocus.com/bid/105758",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0734",
          "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=43e6a58d4991a451daf4891ff05a48735df871ac",
          "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8abfe72e8c1de1b95f50aa0d9134803b4d00070f",
          "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ef11e19d1365eea2b1851e6f540a0bf365d303e7",
          "https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/",
          "https://security.netapp.com/advisory/ntap-20181105-0002/",
          "https://security.netapp.com/advisory/ntap-20190118-0002/",
          "https://security.netapp.com/advisory/ntap-20190423-0002/",
          "https://usn.ubuntu.com/3840-1/",
          "https://usn.ubuntu.com/usn/usn-3840-1",
          "https://www.debian.org/security/2018/dsa-4348",
          "https://www.debian.org/security/2018/dsa-4355",
          "https://www.openssl.org/news/secadv/20181030.txt",
          "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
          "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html",
          "https://www.tenable.com/security/tns-2018-16",
          "https://www.tenable.com/security/tns-2018-17"
        ],
        "PublishedDate": "2018-10-30T12:29:00Z",
        "LastModifiedDate": "2019-06-11T22:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-1559",
        "PkgName": "openssl-libs",
        "InstalledVersion": "1:1.0.2k-16.amzn2.1.1",
        "FixedVersion": "1:1.0.2k-19.amzn2.0.1",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1559",
        "Title": "openssl: 0-byte record padding oracle",
        "Description": "If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-200"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "V2Score": 4.3,
            "V3Score": 5.9
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "V3Score": 6.8
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-1559.html",
          "http://linux.oracle.com/errata/ELSA-2019-2471.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00019.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00047.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00049.html",
          "http://www.securityfocus.com/bid/107174",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1559",
          "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e9bbefbf0f24c57645e7ad6a5a71ae649d18ac8e",
          "https://github.com/RUB-NDS/TLS-Padding-Oracles",
          "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10282",
          "https://lists.debian.org/debian-lts-announce/2019/03/msg00003.html",
          "https://security.gentoo.org/glsa/201903-10",
          "https://security.netapp.com/advisory/ntap-20190301-0001/",
          "https://security.netapp.com/advisory/ntap-20190301-0002/",
          "https://security.netapp.com/advisory/ntap-20190423-0002/",
          "https://support.f5.com/csp/article/K18549143",
          "https://usn.ubuntu.com/3899-1/",
          "https://usn.ubuntu.com/usn/usn-3899-1",
          "https://www.debian.org/security/2019/dsa-4400",
          "https://www.openssl.org/news/secadv/20190226.txt",
          "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
          "https://www.tenable.com/security/tns-2019-02",
          "https://www.tenable.com/security/tns-2019-03"
        ],
        "PublishedDate": "2019-02-27T23:29:00Z",
        "LastModifiedDate": "2019-05-22T00:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-1060",
        "PkgName": "python",
        "InstalledVersion": "2.7.14-58.amzn2.0.4",
        "FixedVersion": "2.7.16-1.amzn2.0.1",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-1060",
        "Title": "python: DOS via regular expression catastrophic backtracking in apop() method in pop3lib",
        "Description": "python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.",
        "Severity": "HIGH",
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 5,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 4.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-1060.html",
          "http://linux.oracle.com/errata/ELSA-2018-3041.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html",
          "http://www.securitytracker.com/id/1042001",
          "https://access.redhat.com/errata/RHBA-2019:0327",
          "https://access.redhat.com/errata/RHSA-2018:3041",
          "https://access.redhat.com/errata/RHSA-2018:3505",
          "https://access.redhat.com/errata/RHSA-2019:1260",
          "https://access.redhat.com/errata/RHSA-2019:3725",
          "https://bugs.python.org/issue32981",
          "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1060",
          "https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1",
          "https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-final",
          "https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1",
          "https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html",
          "https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/",
          "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbst03951en_us",
          "https://usn.ubuntu.com/3817-1/",
          "https://usn.ubuntu.com/3817-2/",
          "https://usn.ubuntu.com/usn/usn-3817-1",
          "https://usn.ubuntu.com/usn/usn-3817-2",
          "https://www.debian.org/security/2018/dsa-4306",
          "https://www.debian.org/security/2018/dsa-4307",
          "https://www.oracle.com/security-alerts/cpujan2020.html"
        ],
        "PublishedDate": "2018-06-18T14:29:00Z",
        "LastModifiedDate": "2020-01-15T20:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-1061",
        "PkgName": "python",
        "InstalledVersion": "2.7.14-58.amzn2.0.4",
        "FixedVersion": "2.7.16-1.amzn2.0.1",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-1061",
        "Title": "python: DOS via regular expression backtracking in difflib.IS_LINE_JUNK method in difflib",
        "Description": "python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method.  An attacker could use this flaw to cause denial of service.",
        "Severity": "HIGH",
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 5,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "V3Score": 6.5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-1061.html",
          "http://linux.oracle.com/errata/ELSA-2018-3041.html",
          "http://www.securitytracker.com/id/1042001",
          "https://access.redhat.com/errata/RHBA-2019:0327",
          "https://access.redhat.com/errata/RHSA-2018:3041",
          "https://access.redhat.com/errata/RHSA-2018:3505",
          "https://access.redhat.com/errata/RHSA-2019:1260",
          "https://bugs.python.org/issue32981",
          "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1061",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1061",
          "https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1",
          "https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-final",
          "https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1",
          "https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html",
          "https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/",
          "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbst03951en_us",
          "https://usn.ubuntu.com/3817-1/",
          "https://usn.ubuntu.com/3817-2/",
          "https://usn.ubuntu.com/usn/usn-3817-1",
          "https://usn.ubuntu.com/usn/usn-3817-2",
          "https://www.debian.org/security/2018/dsa-4306",
          "https://www.debian.org/security/2018/dsa-4307"
        ],
        "PublishedDate": "2018-06-19T12:29:00Z",
        "LastModifiedDate": "2019-10-03T00:03:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-20406",
        "PkgName": "python",
        "InstalledVersion": "2.7.14-58.amzn2.0.4",
        "FixedVersion": "2.7.16-1.amzn2.0.1",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-20406",
        "Title": "python: Integer overflow in Modules/_pickle.c allows for memory exhaustion if serializing gigabytes of data",
        "Description": "Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a \"resize to twice the size\" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-190"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 5,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 5.9
          }
        },
        "References": [
          "https://bugs.python.org/issue34656",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20406",
          "https://github.com/python/cpython/commit/a4ae828ee416a66d8c7bf5ee71d653c2cc6a26dd",
          "https://lists.debian.org/debian-lts-announce/2019/02/msg00011.html",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D3LXPABKVLFYUHRYJPM3CSS5MS6FXKS7/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ICBEGRHIPHWPG2VGYS6R4EVKVUUF4AQW/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TR6GCO3WTV4D5L23WTCBF275VE6BVNI3/",
          "https://python-security.readthedocs.io/vuln/pickle-load-dos.html",
          "https://security.netapp.com/advisory/ntap-20190416-0010/",
          "https://usn.ubuntu.com/usn/usn-4127-1",
          "https://usn.ubuntu.com/usn/usn-4127-2"
        ],
        "PublishedDate": "2018-12-23T23:29:00Z",
        "LastModifiedDate": "2019-04-16T06:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-10160",
        "PkgName": "python",
        "InstalledVersion": "2.7.14-58.amzn2.0.4",
        "FixedVersion": "2.7.16-2.amzn2.0.1",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-10160",
        "Title": "python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc",
        "Description": "A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-255"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V2Score": 5,
            "V3Score": 9.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V3Score": 9.8
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-10160.html",
          "http://linux.oracle.com/errata/ELSA-2019-1587.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html",
          "https://access.redhat.com/errata/RHSA-2019:1587",
          "https://access.redhat.com/errata/RHSA-2019:1700",
          "https://access.redhat.com/errata/RHSA-2019:2437",
          "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10160",
          "https://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09",
          "https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e",
          "https://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93de",
          "https://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468",
          "https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/",
          "https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html",
          "https://security.netapp.com/advisory/ntap-20190617-0003/",
          "https://usn.ubuntu.com/4127-1/",
          "https://usn.ubuntu.com/4127-2/",
          "https://usn.ubuntu.com/usn/usn-4127-1",
          "https://usn.ubuntu.com/usn/usn-4127-2"
        ],
        "PublishedDate": "2019-06-07T18:29:00Z",
        "LastModifiedDate": "2019-10-25T11:53:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-5010",
        "PkgName": "python",
        "InstalledVersion": "2.7.14-58.amzn2.0.4",
        "FixedVersion": "2.7.16-1.amzn2.0.1",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-5010",
        "Title": "python: NULL pointer dereference using a specially crafted X509 certificate",
        "Description": "An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-476"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V2Score": 5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-5010.html",
          "http://linux.oracle.com/errata/ELSA-2019-3520.html",
          "https://access.redhat.com/errata/RHSA-2019:3520",
          "https://access.redhat.com/errata/RHSA-2019:3725",
          "https://blog.talosintelligence.com/2019/01/vulnerability-spotlight-pythonorg.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5010",
          "https://github.com/python/cpython/pull/11569",
          "https://python-security.readthedocs.io/vuln/ssl-crl-dps-dos.html",
          "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0758",
          "https://usn.ubuntu.com/usn/usn-4127-1",
          "https://usn.ubuntu.com/usn/usn-4127-2"
        ],
        "PublishedDate": "2019-10-31T21:15:00Z",
        "LastModifiedDate": "2019-11-06T01:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-9636",
        "PkgName": "python",
        "InstalledVersion": "2.7.14-58.amzn2.0.4",
        "FixedVersion": "2.7.16-1.amzn2.0.1",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-9636",
        "Title": "python: Information Disclosure due to urlsplit improper NFKC normalization",
        "Description": "Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-255"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V2Score": 5,
            "V3Score": 9.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V3Score": 9.8
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-9636.html",
          "http://linux.oracle.com/errata/ELSA-2019-1467.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00097.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00024.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html",
          "http://www.securityfocus.com/bid/107400",
          "https://access.redhat.com/errata/RHBA-2019:0959",
          "https://access.redhat.com/errata/RHSA-2019:0710",
          "https://access.redhat.com/errata/RHSA-2019:0765",
          "https://access.redhat.com/errata/RHSA-2019:0806",
          "https://access.redhat.com/errata/RHSA-2019:0902",
          "https://access.redhat.com/errata/RHSA-2019:0981",
          "https://access.redhat.com/errata/RHSA-2019:0997",
          "https://access.redhat.com/errata/RHSA-2019:1467",
          "https://bugs.python.org/issue36216",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9636",
          "https://github.com/python/cpython/pull/12201",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CFBAAGM27H73OLYBUA2IAZFSUN6KGLME/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D3LXPABKVLFYUHRYJPM3CSS5MS6FXKS7/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ICBEGRHIPHWPG2VGYS6R4EVKVUUF4AQW/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFAXBEY2TGOBDRKTR556JBXBVFSAKD6I/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L25RTMKCF62DLC2XVSNXGX7C7HXISLVM/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TR6GCO3WTV4D5L23WTCBF275VE6BVNI3/",
          "https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html",
          "https://security.netapp.com/advisory/ntap-20190517-0001/",
          "https://usn.ubuntu.com/usn/usn-4127-1",
          "https://usn.ubuntu.com/usn/usn-4127-2"
        ],
        "PublishedDate": "2019-03-08T21:29:00Z",
        "LastModifiedDate": "2019-06-13T16:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-16056",
        "PkgName": "python",
        "InstalledVersion": "2.7.14-58.amzn2.0.4",
        "FixedVersion": "2.7.16-4.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-16056",
        "Title": "python: email.utils.parseaddr wrongly parses email addresses",
        "Description": "An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-20"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "V2Score": 5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "V3Score": 7.3
          }
        },
        "References": [
          "https://bugs.python.org/issue34155",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16056",
          "https://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9",
          "https://lists.debian.org/debian-lts-announce/2019/09/msg00018.html",
          "https://lists.debian.org/debian-lts-announce/2019/09/msg00019.html",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K4KZEFP6E4YPYB52AF4WXCUDSGQOTF37/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/",
          "https://usn.ubuntu.com/usn/usn-4151-1",
          "https://usn.ubuntu.com/usn/usn-4151-2"
        ],
        "PublishedDate": "2019-09-06T18:15:00Z",
        "LastModifiedDate": "2019-09-11T05:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-9948",
        "PkgName": "python",
        "InstalledVersion": "2.7.14-58.amzn2.0.4",
        "FixedVersion": "2.7.16-3.amzn2.0.1",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-9948",
        "Title": "python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms",
        "Description": "urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-254"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "V2Score": 6.4,
            "V3Score": 9.1
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "V3Score": 7.4
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-9948.html",
          "http://linux.oracle.com/errata/ELSA-2019-3520.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html",
          "http://www.securityfocus.com/bid/107549",
          "https://bugs.python.org/issue35907",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9948",
          "https://github.com/python/cpython/pull/11842",
          "https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html",
          "https://security.netapp.com/advisory/ntap-20190404-0004/",
          "https://usn.ubuntu.com/usn/usn-4127-1",
          "https://usn.ubuntu.com/usn/usn-4127-2"
        ],
        "PublishedDate": "2019-03-23T18:29:00Z",
        "LastModifiedDate": "2019-06-19T02:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-1060",
        "PkgName": "python-libs",
        "InstalledVersion": "2.7.14-58.amzn2.0.4",
        "FixedVersion": "2.7.16-1.amzn2.0.1",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-1060",
        "Title": "python: DOS via regular expression catastrophic backtracking in apop() method in pop3lib",
        "Description": "python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in pop3lib's apop() method. An attacker could use this flaw to cause denial of service.",
        "Severity": "HIGH",
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 5,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "V3Score": 4.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-1060.html",
          "http://linux.oracle.com/errata/ELSA-2018-3041.html",
          "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html",
          "http://www.securitytracker.com/id/1042001",
          "https://access.redhat.com/errata/RHBA-2019:0327",
          "https://access.redhat.com/errata/RHSA-2018:3041",
          "https://access.redhat.com/errata/RHSA-2018:3505",
          "https://access.redhat.com/errata/RHSA-2019:1260",
          "https://access.redhat.com/errata/RHSA-2019:3725",
          "https://bugs.python.org/issue32981",
          "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1060",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1060",
          "https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1",
          "https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-final",
          "https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1",
          "https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html",
          "https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/",
          "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbst03951en_us",
          "https://usn.ubuntu.com/3817-1/",
          "https://usn.ubuntu.com/3817-2/",
          "https://usn.ubuntu.com/usn/usn-3817-1",
          "https://usn.ubuntu.com/usn/usn-3817-2",
          "https://www.debian.org/security/2018/dsa-4306",
          "https://www.debian.org/security/2018/dsa-4307",
          "https://www.oracle.com/security-alerts/cpujan2020.html"
        ],
        "PublishedDate": "2018-06-18T14:29:00Z",
        "LastModifiedDate": "2020-01-15T20:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-1061",
        "PkgName": "python-libs",
        "InstalledVersion": "2.7.14-58.amzn2.0.4",
        "FixedVersion": "2.7.16-1.amzn2.0.1",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-1061",
        "Title": "python: DOS via regular expression backtracking in difflib.IS_LINE_JUNK method in difflib",
        "Description": "python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method.  An attacker could use this flaw to cause denial of service.",
        "Severity": "HIGH",
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 5,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "V3Score": 6.5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2018-1061.html",
          "http://linux.oracle.com/errata/ELSA-2018-3041.html",
          "http://www.securitytracker.com/id/1042001",
          "https://access.redhat.com/errata/RHBA-2019:0327",
          "https://access.redhat.com/errata/RHSA-2018:3041",
          "https://access.redhat.com/errata/RHSA-2018:3505",
          "https://access.redhat.com/errata/RHSA-2019:1260",
          "https://bugs.python.org/issue32981",
          "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1061",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1061",
          "https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-6-release-candidate-1",
          "https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-final",
          "https://docs.python.org/3.6/whatsnew/changelog.html#python-3-6-5-release-candidate-1",
          "https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html",
          "https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/",
          "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbst03951en_us",
          "https://usn.ubuntu.com/3817-1/",
          "https://usn.ubuntu.com/3817-2/",
          "https://usn.ubuntu.com/usn/usn-3817-1",
          "https://usn.ubuntu.com/usn/usn-3817-2",
          "https://www.debian.org/security/2018/dsa-4306",
          "https://www.debian.org/security/2018/dsa-4307"
        ],
        "PublishedDate": "2018-06-19T12:29:00Z",
        "LastModifiedDate": "2019-10-03T00:03:00Z"
      },
      {
        "VulnerabilityID": "CVE-2018-20406",
        "PkgName": "python-libs",
        "InstalledVersion": "2.7.14-58.amzn2.0.4",
        "FixedVersion": "2.7.16-1.amzn2.0.1",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2018-20406",
        "Title": "python: Integer overflow in Modules/_pickle.c allows for memory exhaustion if serializing gigabytes of data",
        "Description": "Modules/_pickle.c in Python before 3.7.1 has an integer overflow via a large LONG_BINPUT value that is mishandled during a \"resize to twice the size\" attempt. This issue might cause memory exhaustion, but is only relevant if the pickle format is used for serializing tens or hundreds of gigabytes of data.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-190"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V2Score": 5,
            "V3Score": 7.5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 5.9
          }
        },
        "References": [
          "https://bugs.python.org/issue34656",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20406",
          "https://github.com/python/cpython/commit/a4ae828ee416a66d8c7bf5ee71d653c2cc6a26dd",
          "https://lists.debian.org/debian-lts-announce/2019/02/msg00011.html",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D3LXPABKVLFYUHRYJPM3CSS5MS6FXKS7/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ICBEGRHIPHWPG2VGYS6R4EVKVUUF4AQW/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TR6GCO3WTV4D5L23WTCBF275VE6BVNI3/",
          "https://python-security.readthedocs.io/vuln/pickle-load-dos.html",
          "https://security.netapp.com/advisory/ntap-20190416-0010/",
          "https://usn.ubuntu.com/usn/usn-4127-1",
          "https://usn.ubuntu.com/usn/usn-4127-2"
        ],
        "PublishedDate": "2018-12-23T23:29:00Z",
        "LastModifiedDate": "2019-04-16T06:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-10160",
        "PkgName": "python-libs",
        "InstalledVersion": "2.7.14-58.amzn2.0.4",
        "FixedVersion": "2.7.16-2.amzn2.0.1",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-10160",
        "Title": "python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc",
        "Description": "A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-255"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V2Score": 5,
            "V3Score": 9.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V3Score": 9.8
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-10160.html",
          "http://linux.oracle.com/errata/ELSA-2019-1587.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html",
          "https://access.redhat.com/errata/RHSA-2019:1587",
          "https://access.redhat.com/errata/RHSA-2019:1700",
          "https://access.redhat.com/errata/RHSA-2019:2437",
          "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10160",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10160",
          "https://github.com/python/cpython/commit/250b62acc59921d399f0db47db3b462cd6037e09",
          "https://github.com/python/cpython/commit/8d0ef0b5edeae52960c7ed05ae8a12388324f87e",
          "https://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3bb93de",
          "https://github.com/python/cpython/commit/fd1771dbdd28709716bd531580c40ae5ed814468",
          "https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/",
          "https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization2.html",
          "https://security.netapp.com/advisory/ntap-20190617-0003/",
          "https://usn.ubuntu.com/4127-1/",
          "https://usn.ubuntu.com/4127-2/",
          "https://usn.ubuntu.com/usn/usn-4127-1",
          "https://usn.ubuntu.com/usn/usn-4127-2"
        ],
        "PublishedDate": "2019-06-07T18:29:00Z",
        "LastModifiedDate": "2019-10-25T11:53:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-5010",
        "PkgName": "python-libs",
        "InstalledVersion": "2.7.14-58.amzn2.0.4",
        "FixedVersion": "2.7.16-1.amzn2.0.1",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-5010",
        "Title": "python: NULL pointer dereference using a specially crafted X509 certificate",
        "Description": "An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-476"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "V2Score": 5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "V3Score": 7.5
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-5010.html",
          "http://linux.oracle.com/errata/ELSA-2019-3520.html",
          "https://access.redhat.com/errata/RHSA-2019:3520",
          "https://access.redhat.com/errata/RHSA-2019:3725",
          "https://blog.talosintelligence.com/2019/01/vulnerability-spotlight-pythonorg.html",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5010",
          "https://github.com/python/cpython/pull/11569",
          "https://python-security.readthedocs.io/vuln/ssl-crl-dps-dos.html",
          "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0758",
          "https://usn.ubuntu.com/usn/usn-4127-1",
          "https://usn.ubuntu.com/usn/usn-4127-2"
        ],
        "PublishedDate": "2019-10-31T21:15:00Z",
        "LastModifiedDate": "2019-11-06T01:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-9636",
        "PkgName": "python-libs",
        "InstalledVersion": "2.7.14-58.amzn2.0.4",
        "FixedVersion": "2.7.16-1.amzn2.0.1",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-9636",
        "Title": "python: Information Disclosure due to urlsplit improper NFKC normalization",
        "Description": "Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-255"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V2Score": 5,
            "V3Score": 9.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "V3Score": 9.8
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-9636.html",
          "http://linux.oracle.com/errata/ELSA-2019-1467.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00097.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00024.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html",
          "http://www.securityfocus.com/bid/107400",
          "https://access.redhat.com/errata/RHBA-2019:0959",
          "https://access.redhat.com/errata/RHSA-2019:0710",
          "https://access.redhat.com/errata/RHSA-2019:0765",
          "https://access.redhat.com/errata/RHSA-2019:0806",
          "https://access.redhat.com/errata/RHSA-2019:0902",
          "https://access.redhat.com/errata/RHSA-2019:0981",
          "https://access.redhat.com/errata/RHSA-2019:0997",
          "https://access.redhat.com/errata/RHSA-2019:1467",
          "https://bugs.python.org/issue36216",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9636",
          "https://github.com/python/cpython/pull/12201",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CFBAAGM27H73OLYBUA2IAZFSUN6KGLME/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D3LXPABKVLFYUHRYJPM3CSS5MS6FXKS7/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ICBEGRHIPHWPG2VGYS6R4EVKVUUF4AQW/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFAXBEY2TGOBDRKTR556JBXBVFSAKD6I/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L25RTMKCF62DLC2XVSNXGX7C7HXISLVM/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TR6GCO3WTV4D5L23WTCBF275VE6BVNI3/",
          "https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html",
          "https://security.netapp.com/advisory/ntap-20190517-0001/",
          "https://usn.ubuntu.com/usn/usn-4127-1",
          "https://usn.ubuntu.com/usn/usn-4127-2"
        ],
        "PublishedDate": "2019-03-08T21:29:00Z",
        "LastModifiedDate": "2019-06-13T16:29:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-16056",
        "PkgName": "python-libs",
        "InstalledVersion": "2.7.14-58.amzn2.0.4",
        "FixedVersion": "2.7.16-4.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-16056",
        "Title": "python: email.utils.parseaddr wrongly parses email addresses",
        "Description": "An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-20"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "V2Score": 5
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "V3Score": 7.3
          }
        },
        "References": [
          "https://bugs.python.org/issue34155",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16056",
          "https://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9",
          "https://lists.debian.org/debian-lts-announce/2019/09/msg00018.html",
          "https://lists.debian.org/debian-lts-announce/2019/09/msg00019.html",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K4KZEFP6E4YPYB52AF4WXCUDSGQOTF37/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/",
          "https://usn.ubuntu.com/usn/usn-4151-1",
          "https://usn.ubuntu.com/usn/usn-4151-2"
        ],
        "PublishedDate": "2019-09-06T18:15:00Z",
        "LastModifiedDate": "2019-09-11T05:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-9948",
        "PkgName": "python-libs",
        "InstalledVersion": "2.7.14-58.amzn2.0.4",
        "FixedVersion": "2.7.16-3.amzn2.0.1",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-9948",
        "Title": "python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms",
        "Description": "urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.",
        "Severity": "MEDIUM",
        "CweIDs": [
          "CWE-254"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "V2Score": 6.4,
            "V3Score": 9.1
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "V3Score": 7.4
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-9948.html",
          "http://linux.oracle.com/errata/ELSA-2019-3520.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html",
          "http://www.securityfocus.com/bid/107549",
          "https://bugs.python.org/issue35907",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9948",
          "https://github.com/python/cpython/pull/11842",
          "https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html",
          "https://security.netapp.com/advisory/ntap-20190404-0004/",
          "https://usn.ubuntu.com/usn/usn-4127-1",
          "https://usn.ubuntu.com/usn/usn-4127-2"
        ],
        "PublishedDate": "2019-03-23T18:29:00Z",
        "LastModifiedDate": "2019-06-19T02:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-13734",
        "PkgName": "sqlite",
        "InstalledVersion": "3.7.17-8.amzn2.0.2",
        "FixedVersion": "3.7.17-8.amzn2.1.1",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-13734",
        "Title": "sqlite: fts3: improve shadow table corruption detection",
        "Description": "Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-787"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "V2Score": 6.8
          },
          "redhat": {
            "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "V3Score": 8.8
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-13734.html",
          "http://linux.oracle.com/errata/ELSA-2020-0273.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00032.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00036.html",
          "https://access.redhat.com/errata/RHSA-2019:4238",
          "https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html",
          "https://crbug.com/1025466",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13734",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2Z5M4FPUMDNX2LDPHJKN5ZV5GIS2AKNU/"
        ],
        "PublishedDate": "2019-12-10T22:15:00Z",
        "LastModifiedDate": "2019-12-16T12:15:00Z"
      },
      {
        "VulnerabilityID": "CVE-2019-12735",
        "PkgName": "vim-minimal",
        "InstalledVersion": "2:7.4.160-4.amzn2.0.16",
        "FixedVersion": "2:8.1.1602-1.amzn2",
        "Layer": {
          "DiffID": "sha256:f387c8b346c85cae37abd1f1a63015acb69f593dc425d0269f57d1012c3a81f6"
        },
        "SeveritySource": "amazon",
        "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-12735",
        "Title": "vim/neovim: ':source!' command allows arbitrary command execution via modelines",
        "Description": "getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.",
        "Severity": "HIGH",
        "CweIDs": [
          "CWE-78"
        ],
        "CVSS": {
          "nvd": {
            "V2Vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
            "V3Vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "V2Score": 9.3,
            "V3Score": 8.6
          },
          "redhat": {
            "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "V3Score": 6.3
          }
        },
        "References": [
          "http://linux.oracle.com/cve/CVE-2019-12735.html",
          "http://linux.oracle.com/errata/ELSA-2019-1774.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00031.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00036.html",
          "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00037.html",
          "http://www.securityfocus.com/bid/108724",
          "https://bugs.debian.org/930020",
          "https://bugs.debian.org/930024",
          "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12735",
          "https://github.com/neovim/neovim/pull/10082",
          "https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md",
          "https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2BMDSHTF754TITC6AQJPCS5IRIDMMIM7/",
          "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TRIRBC2YRGKPAWVRMZS4SZTGGCVRVZPR/",
          "https://usn.ubuntu.com/4016-1/",
          "https://usn.ubuntu.com/4016-2/",
          "https://usn.ubuntu.com/usn/usn-4016-1",
          "https://usn.ubuntu.com/usn/usn-4016-2",
          "https://www.debian.org/security/2019/dsa-4467"
        ],
        "PublishedDate": "2019-06-05T14:29:00Z",
        "LastModifiedDate": "2019-06-13T21:29:00Z"
      }
    ]
  }
]