{
  "SchemaVersion": 2,
  "ReportID": "017b7d41-e09f-7000-80ea-000000000001",
  "CreatedAt": "2021-08-25T12:20:30.000000005Z",
  "ArtifactID": "sha256:7a550fb73ac2bf3e1fe50c96a8a5ba699be62cbb09ba9bd982557e574c904b3d",
  "ArtifactName": "testdata/fixtures/images/fluentd-multiple-lockfiles.tar.gz",
  "ArtifactType": "container_image",
  "Metadata": {
    "Size": 157340160,
    "OS": {
      "Family": "debian",
      "Name": "10.2"
    },
    "ImageID": "sha256:5a992077baba51b97f27591a10d54d2f2723dc9c81a3fe419e261023f2554933",
    "DiffIDs": [
      "sha256:831c5620387fb9efec59fc82a42b948546c6be601e3ab34a87108ecf852aa15f",
      "sha256:02874b2b269dea8dde0f7edb4c9906904dfe38a09de1a214f20c650cfb15c60e",
      "sha256:3752e1f6fd759c795c13aff2c93c081529366e27635ba6621e849b0f9cfc77f0",
      "sha256:75e43d55939745950bc3f8fad56c5834617c4339f0f54755e69a0dd5372624e9",
      "sha256:788c00e2cfc8f2a018ae4344ccf0b2c226ebd756d7effd1ce50eea1a4252cd89",
      "sha256:25165eb51d15842f870f97873e0a58409d5e860e6108e3dd829bd10e484c0065"
    ],
    "RepoTags": [
      "ghcr.io/aquasecurity/trivy-test-images:fluentd-multiple-lockfiles"
    ],
    "Reference": "ghcr.io/aquasecurity/trivy-test-images:fluentd-multiple-lockfiles",
    "ImageConfig": {
      "architecture": "amd64",
      "container": "232f3fc7ddffd71dc3ff52c6c0c3a5feea2f51acffd9b53850a8fc6f1a15319a",
      "created": "2020-03-04T13:59:39.161374106Z",
      "docker_version": "19.03.4",
      "history": [
        {
          "created": "2019-11-22T14:55:09.912242636Z",
          "created_by": "/bin/sh -c #(nop) ADD file:bc8179c87c8dbb3d962bed1801f99e7c860ff03797cde6ad19b107d43b973ada in / "
        },
        {
          "created": "2019-11-22T14:55:10.253859615Z",
          "created_by": "/bin/sh -c #(nop)  CMD [\"bash\"]",
          "empty_layer": true
        },
        {
          "created": "2020-03-04T13:58:17.973854594Z",
          "created_by": "/bin/sh -c #(nop)  ARG DEBIAN_FRONTEND=noninteractive",
          "empty_layer": true
        },
        {
          "created": "2020-03-04T13:58:18.12120844Z",
          "created_by": "/bin/sh -c #(nop) COPY file:4e7fdb1bc31a0f689d88f6af28d4f0352e89a2ac598c523e9637da3de75bfada in /tmp/install.sh "
        },
        {
          "created": "2020-03-04T13:58:18.26894021Z",
          "created_by": "/bin/sh -c #(nop) COPY file:c03560fcb4f0aff4cecd93039c348ba4992564740c77e3d6049a44fe79ca44ab in /Gemfile "
        },
        {
          "created": "2020-03-04T13:59:37.96119583Z",
          "created_by": "|1 DEBIAN_FRONTEND=noninteractive /bin/sh -c chmod +x /tmp/install.sh \u0026\u0026     /bin/bash -l -c /tmp/install.sh \u0026\u0026     rm /tmp/*"
        },
        {
          "created": "2020-03-04T13:59:38.583719926Z",
          "created_by": "/bin/sh -c #(nop) COPY file:f742fdea941d5baccbf9a9c45ccc9cd943377f3c3e07da787a8d8d9f92a8b3d3 in /etc/fluent/fluent.conf "
        },
        {
          "created": "2020-03-04T13:59:38.72131564Z",
          "created_by": "/bin/sh -c #(nop) COPY file:a9ce963551c165ec55bb4d982d96336caa97e8c70011eb4ca58927956bd08e2a in /run.sh "
        },
        {
          "created": "2020-03-04T13:59:38.844116271Z",
          "created_by": "/bin/sh -c #(nop)  EXPOSE 80",
          "empty_layer": true
        },
        {
          "created": "2020-03-04T13:59:38.99446051Z",
          "created_by": "/bin/sh -c #(nop)  ENV LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libjemalloc.so.2",
          "empty_layer": true
        },
        {
          "created": "2020-03-04T13:59:39.161374106Z",
          "created_by": "/bin/sh -c #(nop)  CMD [\"/run.sh\"]",
          "empty_layer": true
        }
      ],
      "os": "linux",
      "rootfs": {
        "type": "layers",
        "diff_ids": [
          "sha256:831c5620387fb9efec59fc82a42b948546c6be601e3ab34a87108ecf852aa15f",
          "sha256:02874b2b269dea8dde0f7edb4c9906904dfe38a09de1a214f20c650cfb15c60e",
          "sha256:3752e1f6fd759c795c13aff2c93c081529366e27635ba6621e849b0f9cfc77f0",
          "sha256:75e43d55939745950bc3f8fad56c5834617c4339f0f54755e69a0dd5372624e9",
          "sha256:788c00e2cfc8f2a018ae4344ccf0b2c226ebd756d7effd1ce50eea1a4252cd89",
          "sha256:25165eb51d15842f870f97873e0a58409d5e860e6108e3dd829bd10e484c0065"
        ]
      },
      "config": {
        "Cmd": [
          "/run.sh"
        ],
        "Env": [
          "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
          "LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libjemalloc.so.2"
        ],
        "Image": "sha256:2a538358cddc4824e9eff1531e0c63ae5e3cda85d2984c647df9b1c816b9b86b",
        "ExposedPorts": {
          "80/tcp": {}
        }
      }
    },
    "Layers": [
      {
        "Size": 72479232,
        "Digest": "sha256:000eee12ec04cc914bf96e8f5dee7767510c2aca3816af6078bd9fbe3150920c",
        "DiffID": "sha256:831c5620387fb9efec59fc82a42b948546c6be601e3ab34a87108ecf852aa15f"
      },
      {
        "Size": 3584,
        "Digest": "sha256:aa8e216680f366acbe83d055382ae12208c341300fefd996fbebae49c59a14a5",
        "DiffID": "sha256:02874b2b269dea8dde0f7edb4c9906904dfe38a09de1a214f20c650cfb15c60e"
      },
      {
        "Size": 2048,
        "Digest": "sha256:2b92c5265c693f3aa71c011dabcfca1da81b3e5aef0530c2192fe9237a0725ed",
        "DiffID": "sha256:3752e1f6fd759c795c13aff2c93c081529366e27635ba6621e849b0f9cfc77f0"
      },
      {
        "Size": 84848640,
        "Digest": "sha256:a8877cad19f14a7044524a145ce33170085441a7922458017db1631dcd5f7602",
        "DiffID": "sha256:75e43d55939745950bc3f8fad56c5834617c4339f0f54755e69a0dd5372624e9"
      },
      {
        "Size": 3584,
        "Digest": "sha256:8c669d8f22e42bdc70ab962cd36f36c44d5299a04fbf8de62654eaf1aa70a01a",
        "DiffID": "sha256:788c00e2cfc8f2a018ae4344ccf0b2c226ebd756d7effd1ce50eea1a4252cd89"
      },
      {
        "Size": 3072,
        "Digest": "sha256:de335f1b3d0014660d2c8617930e431e23ee369075e14597c3fcad6903a81255",
        "DiffID": "sha256:25165eb51d15842f870f97873e0a58409d5e860e6108e3dd829bd10e484c0065"
      }
    ]
  },
  "Results": [
    {
      "Target": "testdata/fixtures/images/fluentd-multiple-lockfiles.tar.gz (debian 10.2)",
      "Class": "os-pkgs",
      "Type": "debian",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2019-18224",
          "VendorIDs": [
            "DSA-4613-1"
          ],
          "PkgID": "libidn2-0@2.0.5-1",
          "PkgName": "libidn2-0",
          "PkgIdentifier": {
            "PURL": "pkg:deb/debian/libidn2-0@2.0.5-1?arch=amd64\u0026distro=debian-10.2",
            "UID": "14f80a7091a08e71"
          },
          "InstalledVersion": "2.0.5-1",
          "FixedVersion": "2.0.5-1+deb10u1",
          "Status": "fixed",
          "Layer": {
            "Digest": "sha256:000eee12ec04cc914bf96e8f5dee7767510c2aca3816af6078bd9fbe3150920c",
            "DiffID": "sha256:831c5620387fb9efec59fc82a42b948546c6be601e3ab34a87108ecf852aa15f"
          },
          "SeveritySource": "nvd",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-18224",
          "DataSource": {
            "ID": "debian",
            "Name": "Debian Security Tracker",
            "URL": "https://salsa.debian.org/security-tracker-team/security-tracker"
          },
          "Fingerprint": "sha256:45d3cfb43101cb3984ae8671cc6104e42b47a8ec1fa9c320295df4c661c708cc",
          "Title": "libidn2: heap-based buffer overflow in idn2_to_ascii_4i in lib/lookup.c",
          "Description": "idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.",
          "Severity": "CRITICAL",
          "CweIDs": [
            "CWE-787"
          ],
          "VendorSeverity": {
            "amazon": 2,
            "nvd": 4,
            "redhat": 2,
            "ubuntu": 2
          },
          "CVSS": {
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 7.5,
              "V3Score": 9.8
            },
            "redhat": {
              "V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "V3Score": 5.6
            }
          },
          "References": [
            "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00008.html",
            "http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00009.html",
            "https://access.redhat.com/security/cve/CVE-2019-18224",
            "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12420",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18224",
            "https://github.com/libidn/libidn2/commit/e4d1558aa2c1c04a05066ee8600f37603890ba8c",
            "https://github.com/libidn/libidn2/compare/libidn2-2.1.0...libidn2-2.1.1",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDQVQ2XPV5BTZUFINT7AFJSKNNBVURNJ/",
            "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MINU5RKDFE6TKAFY5DRFN3WSFDS4DYVS/",
            "https://seclists.org/bugtraq/2020/Feb/4",
            "https://security.gentoo.org/glsa/202003-63",
            "https://ubuntu.com/security/notices/USN-4168-1",
            "https://usn.ubuntu.com/4168-1/",
            "https://www.debian.org/security/2020/dsa-4613"
          ],
          "PublishedDate": "2019-10-21T17:15:00Z",
          "LastModifiedDate": "2019-10-29T19:15:00Z"
        }
      ]
    },
    {
      "Target": "Ruby",
      "Class": "lang-pkgs",
      "Type": "gemspec",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2020-8165",
          "PkgName": "activesupport",
          "PkgPath": "var/lib/gems/2.5.0/specifications/activesupport-6.0.2.1.gemspec",
          "PkgIdentifier": {
            "PURL": "pkg:gem/activesupport@6.0.2.1",
            "UID": "dedd4bd33ed812a3"
          },
          "InstalledVersion": "6.0.2.1",
          "FixedVersion": "6.0.3.1, 5.2.4.3",
          "Status": "fixed",
          "Layer": {
            "Digest": "sha256:a8877cad19f14a7044524a145ce33170085441a7922458017db1631dcd5f7602",
            "DiffID": "sha256:75e43d55939745950bc3f8fad56c5834617c4339f0f54755e69a0dd5372624e9"
          },
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2020-8165",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory RubyGems",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Arubygems"
          },
          "Fingerprint": "sha256:0bf18943adff42d16e0d020edb1c408ccf61081e1cea6476005dd1018102d24a",
          "Title": "rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore",
          "Description": "A deserialization of untrusted data vulnerability exists in rails \u003c 5.2.4.3, rails \u003c 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.",
          "Severity": "HIGH",
          "CweIDs": [
            "CWE-502"
          ],
          "VendorSeverity": {
            "ghsa": 3,
            "nvd": 4,
            "redhat": 3
          },
          "CVSS": {
            "nvd": {
              "V2Vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V2Score": 7.5,
              "V3Score": 9.8
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            }
          },
          "References": [
            "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00031.html",
            "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00034.html",
            "https://access.redhat.com/security/cve/CVE-2020-8165",
            "https://github.com/advisories/GHSA-2p68-f74v-9wc6",
            "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2020-8165.yml",
            "https://groups.google.com/forum/#!msg/rubyonrails-security/bv6fW4S0Y1c/KnkEqM7AAQAJ",
            "https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c",
            "https://groups.google.com/g/rubyonrails-security/c/bv6fW4S0Y1c",
            "https://hackerone.com/reports/413388",
            "https://lists.debian.org/debian-lts-announce/2020/06/msg00022.html",
            "https://lists.debian.org/debian-lts-announce/2020/07/msg00013.html",
            "https://nvd.nist.gov/vuln/detail/CVE-2020-8165",
            "https://weblog.rubyonrails.org/2020/5/18/Rails-5-2-4-3-and-6-0-3-1-have-been-released/",
            "https://www.debian.org/security/2020/dsa-4766"
          ],
          "PublishedDate": "2020-06-19T18:15:00Z",
          "LastModifiedDate": "2020-10-17T12:15:00Z"
        }
      ]
    }
  ]
}
