{
  "SchemaVersion": 2,
  "CreatedAt": "2021-08-25T12:20:30.000000005Z",
  "ArtifactName": "testdata/fixtures/images/photon-30.tar.gz",
  "ArtifactType": "container_image",
  "Metadata": {
    "OS": {
      "Family": "photon",
      "Name": "3.0"
    },
    "ImageID": "sha256:5ccb5186b75cd13ff0d028f5b5b2bdf7ef7ca2b3d56eb2c6eb6c136077a6991a",
    "DiffIDs": [
      "sha256:0f379947a276b7b051643960392fa66c2f0cb493bc1dcd471abb5545005949fd"
    ],
    "ImageConfig": {
      "architecture": "amd64",
      "container": "ed27e7f1fbd8ef9d3ea89947f682907e9a65a8e51bbe2e0eba60db6e69213848",
      "created": "2019-08-23T22:26:32.857588774Z",
      "docker_version": "18.06.1-ce",
      "history": [
        {
          "created": "2019-08-23T22:26:32.53400229Z",
          "created_by": "/bin/sh -c #(nop) ADD file:0d19c0b1adc18a00f073eeb1a9d6e5e4fdde392b20a3229ec0ef88642549b2df in / "
        },
        {
          "created": "2019-08-23T22:26:32.689364313Z",
          "created_by": "/bin/sh -c #(nop)  LABEL name=Photon OS x86_64/3.0 Base Image vendor=VMware build-date=20190823",
          "empty_layer": true
        },
        {
          "created": "2019-08-23T22:26:32.857588774Z",
          "created_by": "/bin/sh -c #(nop)  CMD [\"/bin/bash\"]",
          "empty_layer": true
        }
      ],
      "os": "linux",
      "rootfs": {
        "type": "layers",
        "diff_ids": [
          "sha256:0f379947a276b7b051643960392fa66c2f0cb493bc1dcd471abb5545005949fd"
        ]
      },
      "config": {
        "Cmd": [
          "/bin/bash"
        ],
        "Env": [
          "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
        ],
        "Image": "sha256:e7cbb54381cebcd7eea8e391127352224e1d8268fd14bfa5c7dd53e507299f60",
        "Labels": {
          "build-date": "20190823",
          "name": "Photon OS x86_64/3.0 Base Image",
          "vendor": "VMware"
        },
        "ArgsEscaped": true
      }
    }
  },
  "Results": [
    {
      "Target": "testdata/fixtures/images/photon-30.tar.gz (photon 3.0)",
      "Class": "os-pkgs",
      "Type": "photon",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2019-18276",
          "PkgID": "bash@4.4.18-1.ph3.x86_64",
          "PkgName": "bash",
          "PkgIdentifier": {
            "PURL": "pkg:rpm/photon/bash@4.4.18-1.ph3?arch=x86_64\u0026distro=photon-3.0",
            "UID": "a092142482df7886"
          },
          "InstalledVersion": "4.4.18-1.ph3",
          "FixedVersion": "4.4.18-2.ph3",
          "Status": "fixed",
          "Layer": {
            "Digest": "sha256:675aead3dff5e25094cb9f4d7cc64f05e9f04a3f3397d5d45bfbc1c8a99c3a73",
            "DiffID": "sha256:0f379947a276b7b051643960392fa66c2f0cb493bc1dcd471abb5545005949fd"
          },
          "SeveritySource": "photon",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-18276",
          "DataSource": {
            "ID": "photon",
            "Name": "Photon OS CVE metadata",
            "URL": "https://packages.vmware.com/photon/photon_cve_metadata/"
          },
          "Title": "bash: when effective UID is not equal to its real UID the saved UID is not dropped",
          "Description": "An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support \"saved UID\" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use \"enable -f\" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-273"
          ],
          "VendorSeverity": {
            "cbl-mariner": 3,
            "nvd": 3,
            "oracle-oval": 1,
            "photon": 3,
            "redhat": 1,
            "ubuntu": 1
          },
          "CVSS": {
            "nvd": {
              "V2Vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
              "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 7.2,
              "V3Score": 7.8
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 7.8
            }
          },
          "References": [
            "http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html",
            "https://access.redhat.com/security/cve/CVE-2019-18276",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276",
            "https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff",
            "https://linux.oracle.com/cve/CVE-2019-18276.html",
            "https://linux.oracle.com/errata/ELSA-2021-1679.html",
            "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E",
            "https://nvd.nist.gov/vuln/detail/CVE-2019-18276",
            "https://security.gentoo.org/glsa/202105-34",
            "https://security.netapp.com/advisory/ntap-20200430-0003/",
            "https://www.youtube.com/watch?v=-wGtxJ8opa8"
          ],
          "PublishedDate": "2019-11-28T01:15:00Z",
          "LastModifiedDate": "2021-05-26T12:15:00Z"
        },
        {
          "VulnerabilityID": "CVE-2019-5481",
          "PkgID": "curl@7.61.1-4.ph3.x86_64",
          "PkgName": "curl",
          "PkgIdentifier": {
            "PURL": "pkg:rpm/photon/curl@7.61.1-4.ph3?arch=x86_64\u0026distro=photon-3.0",
            "UID": "1f44492024a630e8"
          },
          "InstalledVersion": "7.61.1-4.ph3",
          "FixedVersion": "7.61.1-5.ph3",
          "Status": "fixed",
          "Layer": {
            "Digest": "sha256:675aead3dff5e25094cb9f4d7cc64f05e9f04a3f3397d5d45bfbc1c8a99c3a73",
            "DiffID": "sha256:0f379947a276b7b051643960392fa66c2f0cb493bc1dcd471abb5545005949fd"
          },
          "SeveritySource": "photon",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-5481",
          "DataSource": {
            "ID": "photon",
            "Name": "Photon OS CVE metadata",
            "URL": "https://packages.vmware.com/photon/photon_cve_metadata/"
          },
          "Title": "curl: double free due to subsequent call of realloc()",
          "Description": "Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-415"
          ],
          "VendorSeverity": {
            "amazon": 2,
            "arch-linux": 2,
            "nvd": 4,
            "oracle-oval": 2,
            "photon": 4,
            "redhat": 2,
            "ubuntu": 2
          },
          "CVSS": {
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 7.5,
              "V3Score": 9.8
            },
            "redhat": {
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
              "V3Score": 5.7
            }
          },
          "References": [
            "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html",
            "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html",
            "https://access.redhat.com/security/cve/CVE-2019-5481",
            "https://curl.haxx.se/docs/CVE-2019-5481.html",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5481",
            "https://linux.oracle.com/cve/CVE-2019-5481.html",
            "https://linux.oracle.com/errata/ELSA-2020-1792.html",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6CI4QQ2RSZX4VCFM76SIWGKY6BY7UWIC/",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/",
            "https://seclists.org/bugtraq/2020/Feb/36",
            "https://security.gentoo.org/glsa/202003-29",
            "https://security.netapp.com/advisory/ntap-20191004-0003/",
            "https://ubuntu.com/security/notices/USN-4129-1",
            "https://www.debian.org/security/2020/dsa-4633",
            "https://www.oracle.com/security-alerts/cpuapr2020.html",
            "https://www.oracle.com/security-alerts/cpujan2020.html",
            "https://www.oracle.com/security-alerts/cpuoct2020.html"
          ],
          "PublishedDate": "2019-09-16T19:15:00Z",
          "LastModifiedDate": "2020-10-20T22:15:00Z"
        },
        {
          "VulnerabilityID": "CVE-2019-5481",
          "PkgID": "curl-libs@7.61.1-4.ph3.x86_64",
          "PkgName": "curl-libs",
          "PkgIdentifier": {
            "PURL": "pkg:rpm/photon/curl-libs@7.61.1-4.ph3?arch=x86_64\u0026distro=photon-3.0",
            "UID": "434cc417a46529a9"
          },
          "InstalledVersion": "7.61.1-4.ph3",
          "FixedVersion": "7.61.1-5.ph3",
          "Status": "fixed",
          "Layer": {
            "Digest": "sha256:675aead3dff5e25094cb9f4d7cc64f05e9f04a3f3397d5d45bfbc1c8a99c3a73",
            "DiffID": "sha256:0f379947a276b7b051643960392fa66c2f0cb493bc1dcd471abb5545005949fd"
          },
          "SeveritySource": "photon",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-5481",
          "DataSource": {
            "ID": "photon",
            "Name": "Photon OS CVE metadata",
            "URL": "https://packages.vmware.com/photon/photon_cve_metadata/"
          },
          "Title": "curl: double free due to subsequent call of realloc()",
          "Description": "Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-415"
          ],
          "VendorSeverity": {
            "amazon": 2,
            "arch-linux": 2,
            "nvd": 4,
            "oracle-oval": 2,
            "photon": 4,
            "redhat": 2,
            "ubuntu": 2
          },
          "CVSS": {
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 7.5,
              "V3Score": 9.8
            },
            "redhat": {
              "V3Vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
              "V3Score": 5.7
            }
          },
          "References": [
            "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html",
            "http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html",
            "https://access.redhat.com/security/cve/CVE-2019-5481",
            "https://curl.haxx.se/docs/CVE-2019-5481.html",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5481",
            "https://linux.oracle.com/cve/CVE-2019-5481.html",
            "https://linux.oracle.com/errata/ELSA-2020-1792.html",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6CI4QQ2RSZX4VCFM76SIWGKY6BY7UWIC/",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/",
            "https://seclists.org/bugtraq/2020/Feb/36",
            "https://security.gentoo.org/glsa/202003-29",
            "https://security.netapp.com/advisory/ntap-20191004-0003/",
            "https://ubuntu.com/security/notices/USN-4129-1",
            "https://www.debian.org/security/2020/dsa-4633",
            "https://www.oracle.com/security-alerts/cpuapr2020.html",
            "https://www.oracle.com/security-alerts/cpujan2020.html",
            "https://www.oracle.com/security-alerts/cpuoct2020.html"
          ],
          "PublishedDate": "2019-09-16T19:15:00Z",
          "LastModifiedDate": "2020-10-20T22:15:00Z"
        }
      ]
    }
  ]
}
