att-vuln-critical-cve.json

{
    "invocation": {
      "parameters": null,
      "uri": "https://localhost/test",
      "event_id": "FAKE_EVENT_ID",
      "builder.id": "FAKE_BUILDER_ID"
    },
    "scanner": {
      "uri": "https://github.com/aquasecurity/trivy",
      "version": "0.30.4",
      "result": {
  "version": "2.1.0",
  "$schema": "https://json.schemastore.org/sarif-2.1.0-rtm.5.json",
  "runs": [
    {
      "tool": {
        "driver": {
          "fullName": "Trivy Vulnerability Scanner",
          "informationUri": "https://github.com/aquasecurity/trivy",
          "name": "Trivy",
          "rules": [
            {
              "id": "CVE-2011-3374",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2011-3374"
              },
              "fullDescription": {
                "text": "It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2011-3374",
              "help": {
                "text": "Vulnerability CVE-2011-3374\nSeverity: LOW\nPackage: libapt-pkg6.0\nFixed Version: \nLink: [CVE-2011-3374](https://avd.aquasec.com/nvd/cve-2011-3374)\nIt was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.",
                "markdown": "**Vulnerability CVE-2011-3374**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libapt-pkg6.0||[CVE-2011-3374](https://avd.aquasec.com/nvd/cve-2011-3374)|\n\nIt was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2022-0563",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-0563"
              },
              "fullDescription": {
                "text": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-0563",
              "help": {
                "text": "Vulnerability CVE-2022-0563\nSeverity: LOW\nPackage: util-linux\nFixed Version: \nLink: [CVE-2022-0563](https://avd.aquasec.com/nvd/cve-2022-0563)\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.",
                "markdown": "**Vulnerability CVE-2022-0563**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|util-linux||[CVE-2022-0563](https://avd.aquasec.com/nvd/cve-2022-0563)|\n\nA flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2016-2781",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2016-2781"
              },
              "fullDescription": {
                "text": "chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2016-2781",
              "help": {
                "text": "Vulnerability CVE-2016-2781\nSeverity: LOW\nPackage: coreutils\nFixed Version: \nLink: [CVE-2016-2781](https://avd.aquasec.com/nvd/cve-2016-2781)\nchroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.",
                "markdown": "**Vulnerability CVE-2016-2781**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|coreutils||[CVE-2016-2781](https://avd.aquasec.com/nvd/cve-2016-2781)|\n\nchroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2017-18018",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2017-18018"
              },
              "fullDescription": {
                "text": "In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2017-18018",
              "help": {
                "text": "Vulnerability CVE-2017-18018\nSeverity: LOW\nPackage: coreutils\nFixed Version: \nLink: [CVE-2017-18018](https://avd.aquasec.com/nvd/cve-2017-18018)\nIn GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX \"-R -L\" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.",
                "markdown": "**Vulnerability CVE-2017-18018**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|coreutils||[CVE-2017-18018](https://avd.aquasec.com/nvd/cve-2017-18018)|\n\nIn GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX \"-R -L\" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2021-22945",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2021-22945"
              },
              "fullDescription": {
                "text": "When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it *again*."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2021-22945",
              "help": {
                "text": "Vulnerability CVE-2021-22945\nSeverity: CRITICAL\nPackage: libcurl4\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2021-22945](https://avd.aquasec.com/nvd/cve-2021-22945)\nWhen sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it *again*.",
                "markdown": "**Vulnerability CVE-2021-22945**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|CRITICAL|libcurl4|7.74.0-1.3+deb11u2|[CVE-2021-22945](https://avd.aquasec.com/nvd/cve-2021-22945)|\n\nWhen sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call to send data and also free it *again*."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "9.1",
                "tags": [
                  "vulnerability",
                  "security",
                  "CRITICAL"
                ]
              }
            },
            {
              "id": "CVE-2022-32207",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-32207"
              },
              "fullDescription": {
                "text": "When curl &lt; 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-32207",
              "help": {
                "text": "Vulnerability CVE-2022-32207\nSeverity: CRITICAL\nPackage: libcurl4\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-32207](https://avd.aquasec.com/nvd/cve-2022-32207)\nWhen curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended.",
                "markdown": "**Vulnerability CVE-2022-32207**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|CRITICAL|libcurl4|7.74.0-1.3+deb11u2|[CVE-2022-32207](https://avd.aquasec.com/nvd/cve-2022-32207)|\n\nWhen curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "9.8",
                "tags": [
                  "vulnerability",
                  "security",
                  "CRITICAL"
                ]
              }
            },
            {
              "id": "CVE-2021-22946",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2021-22946"
              },
              "fullDescription": {
                "text": "A user can tell curl &gt;= 7.20.0 and &lt;= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2021-22946",
              "help": {
                "text": "Vulnerability CVE-2021-22946\nSeverity: HIGH\nPackage: libcurl4\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2021-22946](https://avd.aquasec.com/nvd/cve-2021-22946)\nA user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.",
                "markdown": "**Vulnerability CVE-2021-22946**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|HIGH|libcurl4|7.74.0-1.3+deb11u2|[CVE-2021-22946](https://avd.aquasec.com/nvd/cve-2021-22946)|\n\nA user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "7.5",
                "tags": [
                  "vulnerability",
                  "security",
                  "HIGH"
                ]
              }
            },
            {
              "id": "CVE-2022-22576",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-22576"
              },
              "fullDescription": {
                "text": "An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only)."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-22576",
              "help": {
                "text": "Vulnerability CVE-2022-22576\nSeverity: HIGH\nPackage: libcurl4\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-22576](https://avd.aquasec.com/nvd/cve-2022-22576)\nAn improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only).",
                "markdown": "**Vulnerability CVE-2022-22576**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|HIGH|libcurl4|7.74.0-1.3+deb11u2|[CVE-2022-22576](https://avd.aquasec.com/nvd/cve-2022-22576)|\n\nAn improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only)."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "8.1",
                "tags": [
                  "vulnerability",
                  "security",
                  "HIGH"
                ]
              }
            },
            {
              "id": "CVE-2022-27775",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-27775"
              },
              "fullDescription": {
                "text": "An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-27775",
              "help": {
                "text": "Vulnerability CVE-2022-27775\nSeverity: HIGH\nPackage: libcurl4\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-27775](https://avd.aquasec.com/nvd/cve-2022-27775)\nAn information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead.",
                "markdown": "**Vulnerability CVE-2022-27775**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|HIGH|libcurl4|7.74.0-1.3+deb11u2|[CVE-2022-27775](https://avd.aquasec.com/nvd/cve-2022-27775)|\n\nAn information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "7.5",
                "tags": [
                  "vulnerability",
                  "security",
                  "HIGH"
                ]
              }
            },
            {
              "id": "CVE-2022-27781",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-27781"
              },
              "fullDescription": {
                "text": "libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server&#39;s certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-27781",
              "help": {
                "text": "Vulnerability CVE-2022-27781\nSeverity: HIGH\nPackage: libcurl4\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-27781](https://avd.aquasec.com/nvd/cve-2022-27781)\nlibcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.",
                "markdown": "**Vulnerability CVE-2022-27781**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|HIGH|libcurl4|7.74.0-1.3+deb11u2|[CVE-2022-27781](https://avd.aquasec.com/nvd/cve-2022-27781)|\n\nlibcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "7.5",
                "tags": [
                  "vulnerability",
                  "security",
                  "HIGH"
                ]
              }
            },
            {
              "id": "CVE-2022-27782",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-27782"
              },
              "fullDescription": {
                "text": "libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-27782",
              "help": {
                "text": "Vulnerability CVE-2022-27782\nSeverity: HIGH\nPackage: libcurl4\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-27782](https://avd.aquasec.com/nvd/cve-2022-27782)\nlibcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily.",
                "markdown": "**Vulnerability CVE-2022-27782**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|HIGH|libcurl4|7.74.0-1.3+deb11u2|[CVE-2022-27782](https://avd.aquasec.com/nvd/cve-2022-27782)|\n\nlibcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "7.5",
                "tags": [
                  "vulnerability",
                  "security",
                  "HIGH"
                ]
              }
            },
            {
              "id": "CVE-2021-22947",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2021-22947"
              },
              "fullDescription": {
                "text": "When curl &gt;= 7.20.0 and &lt;= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker&#39;s injected data comes from the TLS-protected server."
              },
              "defaultConfiguration": {
                "level": "warning"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2021-22947",
              "help": {
                "text": "Vulnerability CVE-2021-22947\nSeverity: MEDIUM\nPackage: libcurl4\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2021-22947](https://avd.aquasec.com/nvd/cve-2021-22947)\nWhen curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.",
                "markdown": "**Vulnerability CVE-2021-22947**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|MEDIUM|libcurl4|7.74.0-1.3+deb11u2|[CVE-2021-22947](https://avd.aquasec.com/nvd/cve-2021-22947)|\n\nWhen curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "5.9",
                "tags": [
                  "vulnerability",
                  "security",
                  "MEDIUM"
                ]
              }
            },
            {
              "id": "CVE-2022-27774",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-27774"
              },
              "fullDescription": {
                "text": "An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers."
              },
              "defaultConfiguration": {
                "level": "warning"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-27774",
              "help": {
                "text": "Vulnerability CVE-2022-27774\nSeverity: MEDIUM\nPackage: libcurl4\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-27774](https://avd.aquasec.com/nvd/cve-2022-27774)\nAn insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers.",
                "markdown": "**Vulnerability CVE-2022-27774**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|MEDIUM|libcurl4|7.74.0-1.3+deb11u2|[CVE-2022-27774](https://avd.aquasec.com/nvd/cve-2022-27774)|\n\nAn insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "5.7",
                "tags": [
                  "vulnerability",
                  "security",
                  "MEDIUM"
                ]
              }
            },
            {
              "id": "CVE-2022-27776",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-27776"
              },
              "fullDescription": {
                "text": "A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number."
              },
              "defaultConfiguration": {
                "level": "warning"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-27776",
              "help": {
                "text": "Vulnerability CVE-2022-27776\nSeverity: MEDIUM\nPackage: libcurl4\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-27776](https://avd.aquasec.com/nvd/cve-2022-27776)\nA insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.",
                "markdown": "**Vulnerability CVE-2022-27776**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|MEDIUM|libcurl4|7.74.0-1.3+deb11u2|[CVE-2022-27776](https://avd.aquasec.com/nvd/cve-2022-27776)|\n\nA insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "6.5",
                "tags": [
                  "vulnerability",
                  "security",
                  "MEDIUM"
                ]
              }
            },
            {
              "id": "CVE-2022-32205",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-32205"
              },
              "fullDescription": {
                "text": "A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl &lt; 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven&#39;t expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a &#34;sister server&#34; to effectively cause a denial of service for a sibling site on the same second level domain using this method."
              },
              "defaultConfiguration": {
                "level": "warning"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-32205",
              "help": {
                "text": "Vulnerability CVE-2022-32205\nSeverity: MEDIUM\nPackage: libcurl4\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-32205](https://avd.aquasec.com/nvd/cve-2022-32205)\nA malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a \"sister server\" to effectively cause a denial of service for a sibling site on the same second level domain using this method.",
                "markdown": "**Vulnerability CVE-2022-32205**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|MEDIUM|libcurl4|7.74.0-1.3+deb11u2|[CVE-2022-32205](https://avd.aquasec.com/nvd/cve-2022-32205)|\n\nA malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a \"sister server\" to effectively cause a denial of service for a sibling site on the same second level domain using this method."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "4.3",
                "tags": [
                  "vulnerability",
                  "security",
                  "MEDIUM"
                ]
              }
            },
            {
              "id": "CVE-2022-32206",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-32206"
              },
              "fullDescription": {
                "text": "curl &lt; 7.84.0 supports &#34;chained&#34; HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable &#34;links&#34; in this &#34;decompression chain&#34; was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a &#34;malloc bomb&#34;, makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors."
              },
              "defaultConfiguration": {
                "level": "warning"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-32206",
              "help": {
                "text": "Vulnerability CVE-2022-32206\nSeverity: MEDIUM\nPackage: libcurl4\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-32206](https://avd.aquasec.com/nvd/cve-2022-32206)\ncurl < 7.84.0 supports \"chained\" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable \"links\" in this \"decompression chain\" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a \"malloc bomb\", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.",
                "markdown": "**Vulnerability CVE-2022-32206**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|MEDIUM|libcurl4|7.74.0-1.3+deb11u2|[CVE-2022-32206](https://avd.aquasec.com/nvd/cve-2022-32206)|\n\ncurl < 7.84.0 supports \"chained\" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable \"links\" in this \"decompression chain\" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a \"malloc bomb\", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "6.5",
                "tags": [
                  "vulnerability",
                  "security",
                  "MEDIUM"
                ]
              }
            },
            {
              "id": "CVE-2022-32208",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-32208"
              },
              "fullDescription": {
                "text": "When curl &lt; 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client."
              },
              "defaultConfiguration": {
                "level": "warning"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-32208",
              "help": {
                "text": "Vulnerability CVE-2022-32208\nSeverity: MEDIUM\nPackage: libcurl4\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-32208](https://avd.aquasec.com/nvd/cve-2022-32208)\nWhen curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.",
                "markdown": "**Vulnerability CVE-2022-32208**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|MEDIUM|libcurl4|7.74.0-1.3+deb11u2|[CVE-2022-32208](https://avd.aquasec.com/nvd/cve-2022-32208)|\n\nWhen curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "5.9",
                "tags": [
                  "vulnerability",
                  "security",
                  "MEDIUM"
                ]
              }
            },
            {
              "id": "CVE-2021-22898",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2021-22898"
              },
              "fullDescription": {
                "text": "curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2021-22898",
              "help": {
                "text": "Vulnerability CVE-2021-22898\nSeverity: LOW\nPackage: libcurl4\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2021-22898](https://avd.aquasec.com/nvd/cve-2021-22898)\ncurl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol.",
                "markdown": "**Vulnerability CVE-2021-22898**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libcurl4|7.74.0-1.3+deb11u2|[CVE-2021-22898](https://avd.aquasec.com/nvd/cve-2021-22898)|\n\ncurl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "3.1",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2021-22922",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2021-22922"
              },
              "fullDescription": {
                "text": "When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2021-22922",
              "help": {
                "text": "Vulnerability CVE-2021-22922\nSeverity: LOW\nPackage: libcurl4\nFixed Version: \nLink: [CVE-2021-22922](https://avd.aquasec.com/nvd/cve-2021-22922)\nWhen curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk.",
                "markdown": "**Vulnerability CVE-2021-22922**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libcurl4||[CVE-2021-22922](https://avd.aquasec.com/nvd/cve-2021-22922)|\n\nWhen curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2021-22923",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2021-22923"
              },
              "fullDescription": {
                "text": "When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user&#39;s expectations and intentions and without telling the user it happened."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2021-22923",
              "help": {
                "text": "Vulnerability CVE-2021-22923\nSeverity: LOW\nPackage: libcurl4\nFixed Version: \nLink: [CVE-2021-22923](https://avd.aquasec.com/nvd/cve-2021-22923)\nWhen curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.",
                "markdown": "**Vulnerability CVE-2021-22923**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libcurl4||[CVE-2021-22923](https://avd.aquasec.com/nvd/cve-2021-22923)|\n\nWhen curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2021-22924",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2021-22924"
              },
              "fullDescription": {
                "text": "libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take &#39;issuercert&#39; into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn&#39;t include the &#39;issuer cert&#39; which a transfer can setto qualify how to verify the server certificate."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2021-22924",
              "help": {
                "text": "Vulnerability CVE-2021-22924\nSeverity: LOW\nPackage: libcurl4\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2021-22924](https://avd.aquasec.com/nvd/cve-2021-22924)\nlibcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate.",
                "markdown": "**Vulnerability CVE-2021-22924**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libcurl4|7.74.0-1.3+deb11u2|[CVE-2021-22924](https://avd.aquasec.com/nvd/cve-2021-22924)|\n\nlibcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "3.7",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2022-35252",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-35252"
              },
              "fullDescription": {
                "text": "No description is available for this CVE."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-35252",
              "help": {
                "text": "Vulnerability CVE-2022-35252\nSeverity: LOW\nPackage: libcurl4\nFixed Version: \nLink: [CVE-2022-35252](https://avd.aquasec.com/nvd/cve-2022-35252)\nNo description is available for this CVE.",
                "markdown": "**Vulnerability CVE-2022-35252**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libcurl4||[CVE-2022-35252](https://avd.aquasec.com/nvd/cve-2022-35252)|\n\nNo description is available for this CVE."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2022-1304",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-1304"
              },
              "fullDescription": {
                "text": "An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-1304",
              "help": {
                "text": "Vulnerability CVE-2022-1304\nSeverity: HIGH\nPackage: logsave\nFixed Version: \nLink: [CVE-2022-1304](https://avd.aquasec.com/nvd/cve-2022-1304)\nAn out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.",
                "markdown": "**Vulnerability CVE-2022-1304**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|HIGH|logsave||[CVE-2022-1304](https://avd.aquasec.com/nvd/cve-2022-1304)|\n\nAn out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "7.8",
                "tags": [
                  "vulnerability",
                  "security",
                  "HIGH"
                ]
              }
            },
            {
              "id": "CVE-2022-34903",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-34903"
              },
              "fullDescription": {
                "text": "GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim&#39;s keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."
              },
              "defaultConfiguration": {
                "level": "warning"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-34903",
              "help": {
                "text": "Vulnerability CVE-2022-34903\nSeverity: MEDIUM\nPackage: gpgv\nFixed Version: 2.2.27-2+deb11u2\nLink: [CVE-2022-34903](https://avd.aquasec.com/nvd/cve-2022-34903)\nGnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line.",
                "markdown": "**Vulnerability CVE-2022-34903**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|MEDIUM|gpgv|2.2.27-2+deb11u2|[CVE-2022-34903](https://avd.aquasec.com/nvd/cve-2022-34903)|\n\nGnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "6.5",
                "tags": [
                  "vulnerability",
                  "security",
                  "MEDIUM"
                ]
              }
            },
            {
              "id": "CVE-2021-3999",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2021-3999"
              },
              "fullDescription": {
                "text": "A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2021-3999",
              "help": {
                "text": "Vulnerability CVE-2021-3999\nSeverity: HIGH\nPackage: libc6\nFixed Version: \nLink: [CVE-2021-3999](https://avd.aquasec.com/nvd/cve-2021-3999)\nA flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.",
                "markdown": "**Vulnerability CVE-2021-3999**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|HIGH|libc6||[CVE-2021-3999](https://avd.aquasec.com/nvd/cve-2021-3999)|\n\nA flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "7.8",
                "tags": [
                  "vulnerability",
                  "security",
                  "HIGH"
                ]
              }
            },
            {
              "id": "CVE-2010-4756",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2010-4756"
              },
              "fullDescription": {
                "text": "The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2010-4756",
              "help": {
                "text": "Vulnerability CVE-2010-4756\nSeverity: LOW\nPackage: libc6\nFixed Version: \nLink: [CVE-2010-4756](https://avd.aquasec.com/nvd/cve-2010-4756)\nThe glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.",
                "markdown": "**Vulnerability CVE-2010-4756**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libc6||[CVE-2010-4756](https://avd.aquasec.com/nvd/cve-2010-4756)|\n\nThe glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2018-20796",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2018-20796"
              },
              "fullDescription": {
                "text": "In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by &#39;(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+&#39; in grep."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2018-20796",
              "help": {
                "text": "Vulnerability CVE-2018-20796\nSeverity: LOW\nPackage: libc6\nFixed Version: \nLink: [CVE-2018-20796](https://avd.aquasec.com/nvd/cve-2018-20796)\nIn the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep.",
                "markdown": "**Vulnerability CVE-2018-20796**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libc6||[CVE-2018-20796](https://avd.aquasec.com/nvd/cve-2018-20796)|\n\nIn the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2019-1010022",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2019-1010022"
              },
              "fullDescription": {
                "text": "** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate &#34;this is being treated as a non-security bug and no real threat.&#34;"
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2019-1010022",
              "help": {
                "text": "Vulnerability CVE-2019-1010022\nSeverity: LOW\nPackage: libc6\nFixed Version: \nLink: [CVE-2019-1010022](https://avd.aquasec.com/nvd/cve-2019-1010022)\n** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.\"",
                "markdown": "**Vulnerability CVE-2019-1010022**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libc6||[CVE-2019-1010022](https://avd.aquasec.com/nvd/cve-2019-1010022)|\n\n** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.\""
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2019-1010023",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2019-1010023"
              },
              "fullDescription": {
                "text": "** DISPUTED ** GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate &#34;this is being treated as a non-security bug and no real threat.&#34;"
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2019-1010023",
              "help": {
                "text": "Vulnerability CVE-2019-1010023\nSeverity: LOW\nPackage: libc6\nFixed Version: \nLink: [CVE-2019-1010023](https://avd.aquasec.com/nvd/cve-2019-1010023)\n** DISPUTED ** GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.\"",
                "markdown": "**Vulnerability CVE-2019-1010023**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libc6||[CVE-2019-1010023](https://avd.aquasec.com/nvd/cve-2019-1010023)|\n\n** DISPUTED ** GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.\""
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2019-1010024",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2019-1010024"
              },
              "fullDescription": {
                "text": "** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate &#34;this is being treated as a non-security bug and no real threat.&#34;"
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2019-1010024",
              "help": {
                "text": "Vulnerability CVE-2019-1010024\nSeverity: LOW\nPackage: libc6\nFixed Version: \nLink: [CVE-2019-1010024](https://avd.aquasec.com/nvd/cve-2019-1010024)\n** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.\"",
                "markdown": "**Vulnerability CVE-2019-1010024**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libc6||[CVE-2019-1010024](https://avd.aquasec.com/nvd/cve-2019-1010024)|\n\n** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.\""
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2019-1010025",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2019-1010025"
              },
              "fullDescription": {
                "text": "** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor&#39;s position is &#34;ASLR bypass itself is not a vulnerability.&#34;"
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2019-1010025",
              "help": {
                "text": "Vulnerability CVE-2019-1010025\nSeverity: LOW\nPackage: libc6\nFixed Version: \nLink: [CVE-2019-1010025](https://avd.aquasec.com/nvd/cve-2019-1010025)\n** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability.\"",
                "markdown": "**Vulnerability CVE-2019-1010025**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libc6||[CVE-2019-1010025](https://avd.aquasec.com/nvd/cve-2019-1010025)|\n\n** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability.\""
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2019-9192",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2019-9192"
              },
              "fullDescription": {
                "text": "** DISPUTED ** In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by &#39;(|)(\\\\1\\\\1)*&#39; in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2019-9192",
              "help": {
                "text": "Vulnerability CVE-2019-9192\nSeverity: LOW\nPackage: libc6\nFixed Version: \nLink: [CVE-2019-9192](https://avd.aquasec.com/nvd/cve-2019-9192)\n** DISPUTED ** In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern.",
                "markdown": "**Vulnerability CVE-2019-9192**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libc6||[CVE-2019-9192](https://avd.aquasec.com/nvd/cve-2019-9192)|\n\n** DISPUTED ** In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2019-8457",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2019-8457"
              },
              "fullDescription": {
                "text": "SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2019-8457",
              "help": {
                "text": "Vulnerability CVE-2019-8457\nSeverity: CRITICAL\nPackage: libdb5.3\nFixed Version: \nLink: [CVE-2019-8457](https://avd.aquasec.com/nvd/cve-2019-8457)\nSQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.",
                "markdown": "**Vulnerability CVE-2019-8457**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|CRITICAL|libdb5.3||[CVE-2019-8457](https://avd.aquasec.com/nvd/cve-2019-8457)|\n\nSQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "9.8",
                "tags": [
                  "vulnerability",
                  "security",
                  "CRITICAL"
                ]
              }
            },
            {
              "id": "CVE-2013-0340",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2013-0340"
              },
              "fullDescription": {
                "text": "expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2013-0340",
              "help": {
                "text": "Vulnerability CVE-2013-0340\nSeverity: LOW\nPackage: libexpat1\nFixed Version: \nLink: [CVE-2013-0340](https://avd.aquasec.com/nvd/cve-2013-0340)\nexpat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.",
                "markdown": "**Vulnerability CVE-2013-0340**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libexpat1||[CVE-2013-0340](https://avd.aquasec.com/nvd/cve-2013-0340)|\n\nexpat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2022-27404",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-27404"
              },
              "fullDescription": {
                "text": "FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfnt_init_face."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-27404",
              "help": {
                "text": "Vulnerability CVE-2022-27404\nSeverity: CRITICAL\nPackage: libfreetype6\nFixed Version: 2.10.4+dfsg-1+deb11u1\nLink: [CVE-2022-27404](https://avd.aquasec.com/nvd/cve-2022-27404)\nFreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfnt_init_face.",
                "markdown": "**Vulnerability CVE-2022-27404**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|CRITICAL|libfreetype6|2.10.4+dfsg-1+deb11u1|[CVE-2022-27404](https://avd.aquasec.com/nvd/cve-2022-27404)|\n\nFreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfnt_init_face."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "9.8",
                "tags": [
                  "vulnerability",
                  "security",
                  "CRITICAL"
                ]
              }
            },
            {
              "id": "CVE-2022-27405",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-27405"
              },
              "fullDescription": {
                "text": "FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-27405",
              "help": {
                "text": "Vulnerability CVE-2022-27405\nSeverity: HIGH\nPackage: libfreetype6\nFixed Version: 2.10.4+dfsg-1+deb11u1\nLink: [CVE-2022-27405](https://avd.aquasec.com/nvd/cve-2022-27405)\nFreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request.",
                "markdown": "**Vulnerability CVE-2022-27405**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|HIGH|libfreetype6|2.10.4+dfsg-1+deb11u1|[CVE-2022-27405](https://avd.aquasec.com/nvd/cve-2022-27405)|\n\nFreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "7.5",
                "tags": [
                  "vulnerability",
                  "security",
                  "HIGH"
                ]
              }
            },
            {
              "id": "CVE-2022-27406",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-27406"
              },
              "fullDescription": {
                "text": "FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT_Request_Size."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-27406",
              "help": {
                "text": "Vulnerability CVE-2022-27406\nSeverity: HIGH\nPackage: libfreetype6\nFixed Version: 2.10.4+dfsg-1+deb11u1\nLink: [CVE-2022-27406](https://avd.aquasec.com/nvd/cve-2022-27406)\nFreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT_Request_Size.",
                "markdown": "**Vulnerability CVE-2022-27406**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|HIGH|libfreetype6|2.10.4+dfsg-1+deb11u1|[CVE-2022-27406](https://avd.aquasec.com/nvd/cve-2022-27406)|\n\nFreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT_Request_Size."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "7.5",
                "tags": [
                  "vulnerability",
                  "security",
                  "HIGH"
                ]
              }
            },
            {
              "id": "CVE-2022-31782",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-31782"
              },
              "fullDescription": {
                "text": "ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-31782",
              "help": {
                "text": "Vulnerability CVE-2022-31782\nSeverity: LOW\nPackage: libfreetype6\nFixed Version: \nLink: [CVE-2022-31782](https://avd.aquasec.com/nvd/cve-2022-31782)\nftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow.",
                "markdown": "**Vulnerability CVE-2022-31782**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libfreetype6||[CVE-2022-31782](https://avd.aquasec.com/nvd/cve-2022-31782)|\n\nftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2021-33560",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2021-33560"
              },
              "fullDescription": {
                "text": "Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2021-33560",
              "help": {
                "text": "Vulnerability CVE-2021-33560\nSeverity: HIGH\nPackage: libgcrypt20\nFixed Version: \nLink: [CVE-2021-33560](https://avd.aquasec.com/nvd/cve-2021-33560)\nLibgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.",
                "markdown": "**Vulnerability CVE-2021-33560**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|HIGH|libgcrypt20||[CVE-2021-33560](https://avd.aquasec.com/nvd/cve-2021-33560)|\n\nLibgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "7.5",
                "tags": [
                  "vulnerability",
                  "security",
                  "HIGH"
                ]
              }
            },
            {
              "id": "CVE-2018-6829",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2018-6829"
              },
              "fullDescription": {
                "text": "cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt&#39;s ElGamal implementation."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2018-6829",
              "help": {
                "text": "Vulnerability CVE-2018-6829\nSeverity: LOW\nPackage: libgcrypt20\nFixed Version: \nLink: [CVE-2018-6829](https://avd.aquasec.com/nvd/cve-2018-6829)\ncipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.",
                "markdown": "**Vulnerability CVE-2018-6829**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libgcrypt20||[CVE-2018-6829](https://avd.aquasec.com/nvd/cve-2018-6829)|\n\ncipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2021-38115",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2021-38115"
              },
              "fullDescription": {
                "text": "read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file."
              },
              "defaultConfiguration": {
                "level": "warning"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2021-38115",
              "help": {
                "text": "Vulnerability CVE-2021-38115\nSeverity: MEDIUM\nPackage: libgd3\nFixed Version: \nLink: [CVE-2021-38115](https://avd.aquasec.com/nvd/cve-2021-38115)\nread_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.",
                "markdown": "**Vulnerability CVE-2021-38115**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|MEDIUM|libgd3||[CVE-2021-38115](https://avd.aquasec.com/nvd/cve-2021-38115)|\n\nread_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "6.5",
                "tags": [
                  "vulnerability",
                  "security",
                  "MEDIUM"
                ]
              }
            },
            {
              "id": "CVE-2021-40812",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2021-40812"
              },
              "fullDescription": {
                "text": "The GD Graphics Library (aka LibGD) through 2.3.2 has an out-of-bounds read because of the lack of certain gdGetBuf and gdPutBuf return value checks."
              },
              "defaultConfiguration": {
                "level": "warning"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2021-40812",
              "help": {
                "text": "Vulnerability CVE-2021-40812\nSeverity: MEDIUM\nPackage: libgd3\nFixed Version: \nLink: [CVE-2021-40812](https://avd.aquasec.com/nvd/cve-2021-40812)\nThe GD Graphics Library (aka LibGD) through 2.3.2 has an out-of-bounds read because of the lack of certain gdGetBuf and gdPutBuf return value checks.",
                "markdown": "**Vulnerability CVE-2021-40812**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|MEDIUM|libgd3||[CVE-2021-40812](https://avd.aquasec.com/nvd/cve-2021-40812)|\n\nThe GD Graphics Library (aka LibGD) through 2.3.2 has an out-of-bounds read because of the lack of certain gdGetBuf and gdPutBuf return value checks."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "6.5",
                "tags": [
                  "vulnerability",
                  "security",
                  "MEDIUM"
                ]
              }
            },
            {
              "id": "CVE-2021-40145",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2021-40145"
              },
              "fullDescription": {
                "text": "** DISPUTED ** gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor&#39;s position is &#34;The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes.&#34;"
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2021-40145",
              "help": {
                "text": "Vulnerability CVE-2021-40145\nSeverity: LOW\nPackage: libgd3\nFixed Version: \nLink: [CVE-2021-40145](https://avd.aquasec.com/nvd/cve-2021-40145)\n** DISPUTED ** gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is \"The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes.\"",
                "markdown": "**Vulnerability CVE-2021-40145**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libgd3||[CVE-2021-40145](https://avd.aquasec.com/nvd/cve-2021-40145)|\n\n** DISPUTED ** gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. NOTE: the vendor's position is \"The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and testing purposes.\""
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2022-2509",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-2509"
              },
              "fullDescription": {
                "text": "A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verify function."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-2509",
              "help": {
                "text": "Vulnerability CVE-2022-2509\nSeverity: HIGH\nPackage: libgnutls30\nFixed Version: 3.7.1-5+deb11u2\nLink: [CVE-2022-2509](https://avd.aquasec.com/nvd/cve-2022-2509)\nA vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verify function.",
                "markdown": "**Vulnerability CVE-2022-2509**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|HIGH|libgnutls30|3.7.1-5+deb11u2|[CVE-2022-2509](https://avd.aquasec.com/nvd/cve-2022-2509)|\n\nA vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verify function."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "7.5",
                "tags": [
                  "vulnerability",
                  "security",
                  "HIGH"
                ]
              }
            },
            {
              "id": "CVE-2021-4209",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2021-4209"
              },
              "fullDescription": {
                "text": "A NULL pointer dereference flaw was found in GnuTLS. As Nettle&#39;s hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances."
              },
              "defaultConfiguration": {
                "level": "warning"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2021-4209",
              "help": {
                "text": "Vulnerability CVE-2021-4209\nSeverity: MEDIUM\nPackage: libgnutls30\nFixed Version: 3.7.1-5+deb11u1\nLink: [CVE-2021-4209](https://avd.aquasec.com/nvd/cve-2021-4209)\nA NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.",
                "markdown": "**Vulnerability CVE-2021-4209**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|MEDIUM|libgnutls30|3.7.1-5+deb11u1|[CVE-2021-4209](https://avd.aquasec.com/nvd/cve-2021-4209)|\n\nA NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "6.5",
                "tags": [
                  "vulnerability",
                  "security",
                  "MEDIUM"
                ]
              }
            },
            {
              "id": "CVE-2011-3389",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2011-3389"
              },
              "fullDescription": {
                "text": "The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a &#34;BEAST&#34; attack."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2011-3389",
              "help": {
                "text": "Vulnerability CVE-2011-3389\nSeverity: LOW\nPackage: libgnutls30\nFixed Version: \nLink: [CVE-2011-3389](https://avd.aquasec.com/nvd/cve-2011-3389)\nThe SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack.",
                "markdown": "**Vulnerability CVE-2011-3389**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libgnutls30||[CVE-2011-3389](https://avd.aquasec.com/nvd/cve-2011-3389)|\n\nThe SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2004-0971",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2004-0971"
              },
              "fullDescription": {
                "text": "The krb5-send-pr script in the kerberos5 (krb5) package in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2004-0971",
              "help": {
                "text": "Vulnerability CVE-2004-0971\nSeverity: LOW\nPackage: libkrb5support0\nFixed Version: \nLink: [CVE-2004-0971](https://avd.aquasec.com/nvd/cve-2004-0971)\nThe krb5-send-pr script in the kerberos5 (krb5) package in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files.",
                "markdown": "**Vulnerability CVE-2004-0971**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libkrb5support0||[CVE-2004-0971](https://avd.aquasec.com/nvd/cve-2004-0971)|\n\nThe krb5-send-pr script in the kerberos5 (krb5) package in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2018-5709",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2018-5709"
              },
              "fullDescription": {
                "text": "An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable &#34;dbentry-&gt;n_key_data&#34; in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a &#34;u4&#34; variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2018-5709",
              "help": {
                "text": "Vulnerability CVE-2018-5709\nSeverity: LOW\nPackage: libkrb5support0\nFixed Version: \nLink: [CVE-2018-5709](https://avd.aquasec.com/nvd/cve-2018-5709)\nAn issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.",
                "markdown": "**Vulnerability CVE-2018-5709**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libkrb5support0||[CVE-2018-5709](https://avd.aquasec.com/nvd/cve-2018-5709)|\n\nAn issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2017-9937",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2017-9937"
              },
              "fullDescription": {
                "text": "In LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2017-9937",
              "help": {
                "text": "Vulnerability CVE-2017-9937\nSeverity: LOW\nPackage: libjbig0\nFixed Version: \nLink: [CVE-2017-9937](https://avd.aquasec.com/nvd/cve-2017-9937)\nIn LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack.",
                "markdown": "**Vulnerability CVE-2017-9937**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libjbig0||[CVE-2017-9937](https://avd.aquasec.com/nvd/cve-2017-9937)|\n\nIn LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2021-46822",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2021-46822"
              },
              "fullDescription": {
                "text": "The PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a grayscale buffer and loading a 16-bit binary PGM file into an RGB buffer. This is related to a heap-based buffer overflow in the get_word_rgb_row function in rdppm.c."
              },
              "defaultConfiguration": {
                "level": "warning"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2021-46822",
              "help": {
                "text": "Vulnerability CVE-2021-46822\nSeverity: MEDIUM\nPackage: libjpeg62-turbo\nFixed Version: \nLink: [CVE-2021-46822](https://avd.aquasec.com/nvd/cve-2021-46822)\nThe PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a grayscale buffer and loading a 16-bit binary PGM file into an RGB buffer. This is related to a heap-based buffer overflow in the get_word_rgb_row function in rdppm.c.",
                "markdown": "**Vulnerability CVE-2021-46822**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|MEDIUM|libjpeg62-turbo||[CVE-2021-46822](https://avd.aquasec.com/nvd/cve-2021-46822)|\n\nThe PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a grayscale buffer and loading a 16-bit binary PGM file into an RGB buffer. This is related to a heap-based buffer overflow in the get_word_rgb_row function in rdppm.c."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "5.5",
                "tags": [
                  "vulnerability",
                  "security",
                  "MEDIUM"
                ]
              }
            },
            {
              "id": "CVE-2015-3276",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2015-3276"
              },
              "fullDescription": {
                "text": "The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2015-3276",
              "help": {
                "text": "Vulnerability CVE-2015-3276\nSeverity: LOW\nPackage: libldap-2.4-2\nFixed Version: \nLink: [CVE-2015-3276](https://avd.aquasec.com/nvd/cve-2015-3276)\nThe nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.",
                "markdown": "**Vulnerability CVE-2015-3276**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libldap-2.4-2||[CVE-2015-3276](https://avd.aquasec.com/nvd/cve-2015-3276)|\n\nThe nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2017-14159",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2017-14159"
              },
              "fullDescription": {
                "text": "slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a &#34;kill `cat /pathname`&#34; command, as demonstrated by openldap-initscript."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2017-14159",
              "help": {
                "text": "Vulnerability CVE-2017-14159\nSeverity: LOW\nPackage: libldap-2.4-2\nFixed Version: \nLink: [CVE-2017-14159](https://avd.aquasec.com/nvd/cve-2017-14159)\nslapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a \"kill `cat /pathname`\" command, as demonstrated by openldap-initscript.",
                "markdown": "**Vulnerability CVE-2017-14159**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libldap-2.4-2||[CVE-2017-14159](https://avd.aquasec.com/nvd/cve-2017-14159)|\n\nslapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a \"kill `cat /pathname`\" command, as demonstrated by openldap-initscript."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2017-17740",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2017-17740"
              },
              "fullDescription": {
                "text": "contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2017-17740",
              "help": {
                "text": "Vulnerability CVE-2017-17740\nSeverity: LOW\nPackage: libldap-2.4-2\nFixed Version: \nLink: [CVE-2017-17740](https://avd.aquasec.com/nvd/cve-2017-17740)\ncontrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.",
                "markdown": "**Vulnerability CVE-2017-17740**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libldap-2.4-2||[CVE-2017-17740](https://avd.aquasec.com/nvd/cve-2017-17740)|\n\ncontrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2020-15719",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2020-15719"
              },
              "fullDescription": {
                "text": "libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2020-15719",
              "help": {
                "text": "Vulnerability CVE-2020-15719\nSeverity: LOW\nPackage: libldap-2.4-2\nFixed Version: \nLink: [CVE-2020-15719](https://avd.aquasec.com/nvd/cve-2020-15719)\nlibldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.",
                "markdown": "**Vulnerability CVE-2020-15719**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libldap-2.4-2||[CVE-2020-15719](https://avd.aquasec.com/nvd/cve-2020-15719)|\n\nlibldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2022-1586",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-1586"
              },
              "fullDescription": {
                "text": "An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-1586",
              "help": {
                "text": "Vulnerability CVE-2022-1586\nSeverity: CRITICAL\nPackage: libpcre2-8-0\nFixed Version: \nLink: [CVE-2022-1586](https://avd.aquasec.com/nvd/cve-2022-1586)\nAn out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT.",
                "markdown": "**Vulnerability CVE-2022-1586**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|CRITICAL|libpcre2-8-0||[CVE-2022-1586](https://avd.aquasec.com/nvd/cve-2022-1586)|\n\nAn out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "9.1",
                "tags": [
                  "vulnerability",
                  "security",
                  "CRITICAL"
                ]
              }
            },
            {
              "id": "CVE-2022-1587",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-1587"
              },
              "fullDescription": {
                "text": "An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-1587",
              "help": {
                "text": "Vulnerability CVE-2022-1587\nSeverity: CRITICAL\nPackage: libpcre2-8-0\nFixed Version: \nLink: [CVE-2022-1587](https://avd.aquasec.com/nvd/cve-2022-1587)\nAn out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers.",
                "markdown": "**Vulnerability CVE-2022-1587**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|CRITICAL|libpcre2-8-0||[CVE-2022-1587](https://avd.aquasec.com/nvd/cve-2022-1587)|\n\nAn out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "9.1",
                "tags": [
                  "vulnerability",
                  "security",
                  "CRITICAL"
                ]
              }
            },
            {
              "id": "CVE-2017-11164",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2017-11164"
              },
              "fullDescription": {
                "text": "In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2017-11164",
              "help": {
                "text": "Vulnerability CVE-2017-11164\nSeverity: LOW\nPackage: libpcre3\nFixed Version: \nLink: [CVE-2017-11164](https://avd.aquasec.com/nvd/cve-2017-11164)\nIn PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.",
                "markdown": "**Vulnerability CVE-2017-11164**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libpcre3||[CVE-2017-11164](https://avd.aquasec.com/nvd/cve-2017-11164)|\n\nIn PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2017-16231",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2017-16231"
              },
              "fullDescription": {
                "text": "** DISPUTED ** In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of stack that is used."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2017-16231",
              "help": {
                "text": "Vulnerability CVE-2017-16231\nSeverity: LOW\nPackage: libpcre3\nFixed Version: \nLink: [CVE-2017-16231](https://avd.aquasec.com/nvd/cve-2017-16231)\n** DISPUTED ** In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of stack that is used.",
                "markdown": "**Vulnerability CVE-2017-16231**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libpcre3||[CVE-2017-16231](https://avd.aquasec.com/nvd/cve-2017-16231)|\n\n** DISPUTED ** In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of stack that is used."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2017-7245",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2017-7245"
              },
              "fullDescription": {
                "text": "Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2017-7245",
              "help": {
                "text": "Vulnerability CVE-2017-7245\nSeverity: LOW\nPackage: libpcre3\nFixed Version: \nLink: [CVE-2017-7245](https://avd.aquasec.com/nvd/cve-2017-7245)\nStack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file.",
                "markdown": "**Vulnerability CVE-2017-7245**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libpcre3||[CVE-2017-7245](https://avd.aquasec.com/nvd/cve-2017-7245)|\n\nStack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2017-7246",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2017-7246"
              },
              "fullDescription": {
                "text": "Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2017-7246",
              "help": {
                "text": "Vulnerability CVE-2017-7246\nSeverity: LOW\nPackage: libpcre3\nFixed Version: \nLink: [CVE-2017-7246](https://avd.aquasec.com/nvd/cve-2017-7246)\nStack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file.",
                "markdown": "**Vulnerability CVE-2017-7246**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libpcre3||[CVE-2017-7246](https://avd.aquasec.com/nvd/cve-2017-7246)|\n\nStack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2019-20838",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2019-20838"
              },
              "fullDescription": {
                "text": "libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \\X or \\R has more than one fixed quantifier, a related issue to CVE-2019-20454."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2019-20838",
              "help": {
                "text": "Vulnerability CVE-2019-20838\nSeverity: LOW\nPackage: libpcre3\nFixed Version: \nLink: [CVE-2019-20838](https://avd.aquasec.com/nvd/cve-2019-20838)\nlibpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \\X or \\R has more than one fixed quantifier, a related issue to CVE-2019-20454.",
                "markdown": "**Vulnerability CVE-2019-20838**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libpcre3||[CVE-2019-20838](https://avd.aquasec.com/nvd/cve-2019-20838)|\n\nlibpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \\X or \\R has more than one fixed quantifier, a related issue to CVE-2019-20454."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2019-6129",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2019-6129"
              },
              "fullDescription": {
                "text": "** DISPUTED ** png_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp. NOTE: a third party has stated &#34;I don&#39;t think it is libpng&#39;s job to free this buffer.&#34;"
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2019-6129",
              "help": {
                "text": "Vulnerability CVE-2019-6129\nSeverity: LOW\nPackage: libpng16-16\nFixed Version: \nLink: [CVE-2019-6129](https://avd.aquasec.com/nvd/cve-2019-6129)\n** DISPUTED ** png_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp. NOTE: a third party has stated \"I don't think it is libpng's job to free this buffer.\"",
                "markdown": "**Vulnerability CVE-2019-6129**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libpng16-16||[CVE-2019-6129](https://avd.aquasec.com/nvd/cve-2019-6129)|\n\n** DISPUTED ** png_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp. NOTE: a third party has stated \"I don't think it is libpng's job to free this buffer.\""
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2021-4214",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2021-4214"
              },
              "fullDescription": {
                "text": "A heap overflow flaw was found in libpngs&#39; pngimage.c program. This flaw allows an attacker with local network access to pass a specially crafted PNG file to the pngimage utility, causing an application to crash, leading to a denial of service."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2021-4214",
              "help": {
                "text": "Vulnerability CVE-2021-4214\nSeverity: LOW\nPackage: libpng16-16\nFixed Version: \nLink: [CVE-2021-4214](https://avd.aquasec.com/nvd/cve-2021-4214)\nA heap overflow flaw was found in libpngs' pngimage.c program. This flaw allows an attacker with local network access to pass a specially crafted PNG file to the pngimage utility, causing an application to crash, leading to a denial of service.",
                "markdown": "**Vulnerability CVE-2021-4214**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libpng16-16||[CVE-2021-4214](https://avd.aquasec.com/nvd/cve-2021-4214)|\n\nA heap overflow flaw was found in libpngs' pngimage.c program. This flaw allows an attacker with local network access to pass a specially crafted PNG file to the pngimage utility, causing an application to crash, leading to a denial of service."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2021-36084",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2021-36084"
              },
              "fullDescription": {
                "text": "The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper)."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2021-36084",
              "help": {
                "text": "Vulnerability CVE-2021-36084\nSeverity: LOW\nPackage: libsepol1\nFixed Version: \nLink: [CVE-2021-36084](https://avd.aquasec.com/nvd/cve-2021-36084)\nThe CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper).",
                "markdown": "**Vulnerability CVE-2021-36084**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libsepol1||[CVE-2021-36084](https://avd.aquasec.com/nvd/cve-2021-36084)|\n\nThe CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper)."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "3.3",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2021-36085",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2021-36085"
              },
              "fullDescription": {
                "text": "The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map)."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2021-36085",
              "help": {
                "text": "Vulnerability CVE-2021-36085\nSeverity: LOW\nPackage: libsepol1\nFixed Version: \nLink: [CVE-2021-36085](https://avd.aquasec.com/nvd/cve-2021-36085)\nThe CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map).",
                "markdown": "**Vulnerability CVE-2021-36085**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libsepol1||[CVE-2021-36085](https://avd.aquasec.com/nvd/cve-2021-36085)|\n\nThe CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map)."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "3.3",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2021-36086",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2021-36086"
              },
              "fullDescription": {
                "text": "The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list)."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2021-36086",
              "help": {
                "text": "Vulnerability CVE-2021-36086\nSeverity: LOW\nPackage: libsepol1\nFixed Version: \nLink: [CVE-2021-36086](https://avd.aquasec.com/nvd/cve-2021-36086)\nThe CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list).",
                "markdown": "**Vulnerability CVE-2021-36086**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libsepol1||[CVE-2021-36086](https://avd.aquasec.com/nvd/cve-2021-36086)|\n\nThe CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list)."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "3.3",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2021-36087",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2021-36087"
              },
              "fullDescription": {
                "text": "The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2021-36087",
              "help": {
                "text": "Vulnerability CVE-2021-36087\nSeverity: LOW\nPackage: libsepol1\nFixed Version: \nLink: [CVE-2021-36087](https://avd.aquasec.com/nvd/cve-2021-36087)\nThe CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.",
                "markdown": "**Vulnerability CVE-2021-36087**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libsepol1||[CVE-2021-36087](https://avd.aquasec.com/nvd/cve-2021-36087)|\n\nThe CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "3.3",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2022-2068",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-2068"
              },
              "fullDescription": {
                "text": "In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze)."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-2068",
              "help": {
                "text": "Vulnerability CVE-2022-2068\nSeverity: CRITICAL\nPackage: openssl\nFixed Version: 1.1.1n-0+deb11u3\nLink: [CVE-2022-2068](https://avd.aquasec.com/nvd/cve-2022-2068)\nIn addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).",
                "markdown": "**Vulnerability CVE-2022-2068**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|CRITICAL|openssl|1.1.1n-0+deb11u3|[CVE-2022-2068](https://avd.aquasec.com/nvd/cve-2022-2068)|\n\nIn addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze)."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "9.8",
                "tags": [
                  "vulnerability",
                  "security",
                  "CRITICAL"
                ]
              }
            },
            {
              "id": "CVE-2022-2097",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-2097"
              },
              "fullDescription": {
                "text": "AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn&#39;t written. In the special case of &#34;in place&#34; encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p)."
              },
              "defaultConfiguration": {
                "level": "warning"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-2097",
              "help": {
                "text": "Vulnerability CVE-2022-2097\nSeverity: MEDIUM\nPackage: openssl\nFixed Version: \nLink: [CVE-2022-2097](https://avd.aquasec.com/nvd/cve-2022-2097)\nAES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of \"in place\" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p).",
                "markdown": "**Vulnerability CVE-2022-2097**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|MEDIUM|openssl||[CVE-2022-2097](https://avd.aquasec.com/nvd/cve-2022-2097)|\n\nAES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of \"in place\" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p)."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "5.3",
                "tags": [
                  "vulnerability",
                  "security",
                  "MEDIUM"
                ]
              }
            },
            {
              "id": "CVE-2007-6755",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2007-6755"
              },
              "fullDescription": {
                "text": "The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain &#34;skeleton key&#34; values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values.  NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2007-6755",
              "help": {
                "text": "Vulnerability CVE-2007-6755\nSeverity: LOW\nPackage: openssl\nFixed Version: \nLink: [CVE-2007-6755](https://avd.aquasec.com/nvd/cve-2007-6755)\nThe NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain \"skeleton key\" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values.  NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE.",
                "markdown": "**Vulnerability CVE-2007-6755**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|openssl||[CVE-2007-6755](https://avd.aquasec.com/nvd/cve-2007-6755)|\n\nThe NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain \"skeleton key\" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values.  NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2010-0928",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2010-0928"
              },
              "fullDescription": {
                "text": "OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a &#34;fault-based attack.&#34;"
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2010-0928",
              "help": {
                "text": "Vulnerability CVE-2010-0928\nSeverity: LOW\nPackage: openssl\nFixed Version: \nLink: [CVE-2010-0928](https://avd.aquasec.com/nvd/cve-2010-0928)\nOpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a \"fault-based attack.\"",
                "markdown": "**Vulnerability CVE-2010-0928**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|openssl||[CVE-2010-0928](https://avd.aquasec.com/nvd/cve-2010-0928)|\n\nOpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a \"fault-based attack.\""
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2013-4392",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2013-4392"
              },
              "fullDescription": {
                "text": "systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2013-4392",
              "help": {
                "text": "Vulnerability CVE-2013-4392\nSeverity: LOW\nPackage: libudev1\nFixed Version: \nLink: [CVE-2013-4392](https://avd.aquasec.com/nvd/cve-2013-4392)\nsystemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.",
                "markdown": "**Vulnerability CVE-2013-4392**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libudev1||[CVE-2013-4392](https://avd.aquasec.com/nvd/cve-2013-4392)|\n\nsystemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2020-13529",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2020-13529"
              },
              "fullDescription": {
                "text": "An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2020-13529",
              "help": {
                "text": "Vulnerability CVE-2020-13529\nSeverity: LOW\nPackage: libudev1\nFixed Version: \nLink: [CVE-2020-13529](https://avd.aquasec.com/nvd/cve-2020-13529)\nAn exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.",
                "markdown": "**Vulnerability CVE-2020-13529**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libudev1||[CVE-2020-13529](https://avd.aquasec.com/nvd/cve-2020-13529)|\n\nAn exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2022-2867",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-2867"
              },
              "fullDescription": {
                "text": "libtiff&#39;s tiffcrop utility has a uint32_t underflow that can lead to out of bounds read and write. An attacker who supplies a crafted file to tiffcrop (likely via tricking a user to run tiffcrop on it with certain parameters) could cause a crash or in some cases, further exploitation."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-2867",
              "help": {
                "text": "Vulnerability CVE-2022-2867\nSeverity: HIGH\nPackage: libtiff5\nFixed Version: \nLink: [CVE-2022-2867](https://avd.aquasec.com/nvd/cve-2022-2867)\nlibtiff's tiffcrop utility has a uint32_t underflow that can lead to out of bounds read and write. An attacker who supplies a crafted file to tiffcrop (likely via tricking a user to run tiffcrop on it with certain parameters) could cause a crash or in some cases, further exploitation.",
                "markdown": "**Vulnerability CVE-2022-2867**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|HIGH|libtiff5||[CVE-2022-2867](https://avd.aquasec.com/nvd/cve-2022-2867)|\n\nlibtiff's tiffcrop utility has a uint32_t underflow that can lead to out of bounds read and write. An attacker who supplies a crafted file to tiffcrop (likely via tricking a user to run tiffcrop on it with certain parameters) could cause a crash or in some cases, further exploitation."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "8.8",
                "tags": [
                  "vulnerability",
                  "security",
                  "HIGH"
                ]
              }
            },
            {
              "id": "CVE-2022-2868",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-2868"
              },
              "fullDescription": {
                "text": "libtiff&#39;s tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-2868",
              "help": {
                "text": "Vulnerability CVE-2022-2868\nSeverity: HIGH\nPackage: libtiff5\nFixed Version: \nLink: [CVE-2022-2868](https://avd.aquasec.com/nvd/cve-2022-2868)\nlibtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop.",
                "markdown": "**Vulnerability CVE-2022-2868**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|HIGH|libtiff5||[CVE-2022-2868](https://avd.aquasec.com/nvd/cve-2022-2868)|\n\nlibtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "8.1",
                "tags": [
                  "vulnerability",
                  "security",
                  "HIGH"
                ]
              }
            },
            {
              "id": "CVE-2022-2869",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-2869"
              },
              "fullDescription": {
                "text": "libtiff&#39;s tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the extractContigSamples8bits routine. An attacker who supplies a crafted file to tiffcrop could trigger this flaw, most likely by tricking a user into opening the crafted file with tiffcrop. Triggering this flaw could cause a crash or potentially further exploitation."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-2869",
              "help": {
                "text": "Vulnerability CVE-2022-2869\nSeverity: HIGH\nPackage: libtiff5\nFixed Version: \nLink: [CVE-2022-2869](https://avd.aquasec.com/nvd/cve-2022-2869)\nlibtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the extractContigSamples8bits routine. An attacker who supplies a crafted file to tiffcrop could trigger this flaw, most likely by tricking a user into opening the crafted file with tiffcrop. Triggering this flaw could cause a crash or potentially further exploitation.",
                "markdown": "**Vulnerability CVE-2022-2869**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|HIGH|libtiff5||[CVE-2022-2869](https://avd.aquasec.com/nvd/cve-2022-2869)|\n\nlibtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the extractContigSamples8bits routine. An attacker who supplies a crafted file to tiffcrop could trigger this flaw, most likely by tricking a user into opening the crafted file with tiffcrop. Triggering this flaw could cause a crash or potentially further exploitation."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "8.8",
                "tags": [
                  "vulnerability",
                  "security",
                  "HIGH"
                ]
              }
            },
            {
              "id": "CVE-2022-1354",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-1354"
              },
              "fullDescription": {
                "text": "A heap buffer overflow flaw was found in Libtiffs&#39; tiffinfo.c in TIFFReadRawDataStriped() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer overflow issue and causing a crash that leads to a denial of service."
              },
              "defaultConfiguration": {
                "level": "warning"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-1354",
              "help": {
                "text": "Vulnerability CVE-2022-1354\nSeverity: MEDIUM\nPackage: libtiff5\nFixed Version: \nLink: [CVE-2022-1354](https://avd.aquasec.com/nvd/cve-2022-1354)\nA heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer overflow issue and causing a crash that leads to a denial of service.",
                "markdown": "**Vulnerability CVE-2022-1354**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|MEDIUM|libtiff5||[CVE-2022-1354](https://avd.aquasec.com/nvd/cve-2022-1354)|\n\nA heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer overflow issue and causing a crash that leads to a denial of service."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "5.5",
                "tags": [
                  "vulnerability",
                  "security",
                  "MEDIUM"
                ]
              }
            },
            {
              "id": "CVE-2022-1355",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-1355"
              },
              "fullDescription": {
                "text": "A stack buffer overflow flaw was found in Libtiffs&#39; tiffcp.c in main() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffcp tool, triggering a stack buffer overflow issue, possibly corrupting the memory, and causing a crash that leads to a denial of service."
              },
              "defaultConfiguration": {
                "level": "warning"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-1355",
              "help": {
                "text": "Vulnerability CVE-2022-1355\nSeverity: MEDIUM\nPackage: libtiff5\nFixed Version: \nLink: [CVE-2022-1355](https://avd.aquasec.com/nvd/cve-2022-1355)\nA stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffcp tool, triggering a stack buffer overflow issue, possibly corrupting the memory, and causing a crash that leads to a denial of service.",
                "markdown": "**Vulnerability CVE-2022-1355**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|MEDIUM|libtiff5||[CVE-2022-1355](https://avd.aquasec.com/nvd/cve-2022-1355)|\n\nA stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an attacker to pass a crafted TIFF file to the tiffcp tool, triggering a stack buffer overflow issue, possibly corrupting the memory, and causing a crash that leads to a denial of service."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "6.1",
                "tags": [
                  "vulnerability",
                  "security",
                  "MEDIUM"
                ]
              }
            },
            {
              "id": "CVE-2022-1622",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-1622"
              },
              "fullDescription": {
                "text": "LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa."
              },
              "defaultConfiguration": {
                "level": "warning"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-1622",
              "help": {
                "text": "Vulnerability CVE-2022-1622\nSeverity: MEDIUM\nPackage: libtiff5\nFixed Version: \nLink: [CVE-2022-1622](https://avd.aquasec.com/nvd/cve-2022-1622)\nLibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa.",
                "markdown": "**Vulnerability CVE-2022-1622**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|MEDIUM|libtiff5||[CVE-2022-1622](https://avd.aquasec.com/nvd/cve-2022-1622)|\n\nLibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "5.5",
                "tags": [
                  "vulnerability",
                  "security",
                  "MEDIUM"
                ]
              }
            },
            {
              "id": "CVE-2022-1623",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-1623"
              },
              "fullDescription": {
                "text": "LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:624, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa."
              },
              "defaultConfiguration": {
                "level": "warning"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-1623",
              "help": {
                "text": "Vulnerability CVE-2022-1623\nSeverity: MEDIUM\nPackage: libtiff5\nFixed Version: \nLink: [CVE-2022-1623](https://avd.aquasec.com/nvd/cve-2022-1623)\nLibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:624, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa.",
                "markdown": "**Vulnerability CVE-2022-1623**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|MEDIUM|libtiff5||[CVE-2022-1623](https://avd.aquasec.com/nvd/cve-2022-1623)|\n\nLibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:624, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "5.5",
                "tags": [
                  "vulnerability",
                  "security",
                  "MEDIUM"
                ]
              }
            },
            {
              "id": "CVE-2022-2056",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-2056"
              },
              "fullDescription": {
                "text": "Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010."
              },
              "defaultConfiguration": {
                "level": "warning"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-2056",
              "help": {
                "text": "Vulnerability CVE-2022-2056\nSeverity: MEDIUM\nPackage: libtiff5\nFixed Version: \nLink: [CVE-2022-2056](https://avd.aquasec.com/nvd/cve-2022-2056)\nDivide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.",
                "markdown": "**Vulnerability CVE-2022-2056**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|MEDIUM|libtiff5||[CVE-2022-2056](https://avd.aquasec.com/nvd/cve-2022-2056)|\n\nDivide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "6.5",
                "tags": [
                  "vulnerability",
                  "security",
                  "MEDIUM"
                ]
              }
            },
            {
              "id": "CVE-2022-2057",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-2057"
              },
              "fullDescription": {
                "text": "Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010."
              },
              "defaultConfiguration": {
                "level": "warning"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-2057",
              "help": {
                "text": "Vulnerability CVE-2022-2057\nSeverity: MEDIUM\nPackage: libtiff5\nFixed Version: \nLink: [CVE-2022-2057](https://avd.aquasec.com/nvd/cve-2022-2057)\nDivide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.",
                "markdown": "**Vulnerability CVE-2022-2057**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|MEDIUM|libtiff5||[CVE-2022-2057](https://avd.aquasec.com/nvd/cve-2022-2057)|\n\nDivide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "6.5",
                "tags": [
                  "vulnerability",
                  "security",
                  "MEDIUM"
                ]
              }
            },
            {
              "id": "CVE-2022-2058",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-2058"
              },
              "fullDescription": {
                "text": "Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010."
              },
              "defaultConfiguration": {
                "level": "warning"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-2058",
              "help": {
                "text": "Vulnerability CVE-2022-2058\nSeverity: MEDIUM\nPackage: libtiff5\nFixed Version: \nLink: [CVE-2022-2058](https://avd.aquasec.com/nvd/cve-2022-2058)\nDivide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.",
                "markdown": "**Vulnerability CVE-2022-2058**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|MEDIUM|libtiff5||[CVE-2022-2058](https://avd.aquasec.com/nvd/cve-2022-2058)|\n\nDivide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "6.5",
                "tags": [
                  "vulnerability",
                  "security",
                  "MEDIUM"
                ]
              }
            },
            {
              "id": "CVE-2022-34526",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-34526"
              },
              "fullDescription": {
                "text": "A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted TIFF file."
              },
              "defaultConfiguration": {
                "level": "warning"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-34526",
              "help": {
                "text": "Vulnerability CVE-2022-34526\nSeverity: MEDIUM\nPackage: libtiff5\nFixed Version: \nLink: [CVE-2022-34526](https://avd.aquasec.com/nvd/cve-2022-34526)\nA stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted TIFF file.",
                "markdown": "**Vulnerability CVE-2022-34526**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|MEDIUM|libtiff5||[CVE-2022-34526](https://avd.aquasec.com/nvd/cve-2022-34526)|\n\nA stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted TIFF file."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "6.5",
                "tags": [
                  "vulnerability",
                  "security",
                  "MEDIUM"
                ]
              }
            },
            {
              "id": "CVE-2014-8130",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2014-8130"
              },
              "fullDescription": {
                "text": "The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image that is mishandled by the TIFFWriteScanline function in tif_write.c, as demonstrated by tiffdither."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2014-8130",
              "help": {
                "text": "Vulnerability CVE-2014-8130\nSeverity: LOW\nPackage: libtiff5\nFixed Version: \nLink: [CVE-2014-8130](https://avd.aquasec.com/nvd/cve-2014-8130)\nThe _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image that is mishandled by the TIFFWriteScanline function in tif_write.c, as demonstrated by tiffdither.",
                "markdown": "**Vulnerability CVE-2014-8130**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libtiff5||[CVE-2014-8130](https://avd.aquasec.com/nvd/cve-2014-8130)|\n\nThe _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted TIFF image that is mishandled by the TIFFWriteScanline function in tif_write.c, as demonstrated by tiffdither."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2017-16232",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2017-16232"
              },
              "fullDescription": {
                "text": "** DISPUTED ** LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2017-16232",
              "help": {
                "text": "Vulnerability CVE-2017-16232\nSeverity: LOW\nPackage: libtiff5\nFixed Version: \nLink: [CVE-2017-16232](https://avd.aquasec.com/nvd/cve-2017-16232)\n** DISPUTED ** LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue.",
                "markdown": "**Vulnerability CVE-2017-16232**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libtiff5||[CVE-2017-16232](https://avd.aquasec.com/nvd/cve-2017-16232)|\n\n** DISPUTED ** LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2017-17973",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2017-17973"
              },
              "fullDescription": {
                "text": "** DISPUTED ** In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE: there is a third-party report of inability to reproduce this issue."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2017-17973",
              "help": {
                "text": "Vulnerability CVE-2017-17973\nSeverity: LOW\nPackage: libtiff5\nFixed Version: \nLink: [CVE-2017-17973](https://avd.aquasec.com/nvd/cve-2017-17973)\n** DISPUTED ** In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE: there is a third-party report of inability to reproduce this issue.",
                "markdown": "**Vulnerability CVE-2017-17973**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libtiff5||[CVE-2017-17973](https://avd.aquasec.com/nvd/cve-2017-17973)|\n\n** DISPUTED ** In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE: there is a third-party report of inability to reproduce this issue."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2017-5563",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2017-5563"
              },
              "fullDescription": {
                "text": "LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2017-5563",
              "help": {
                "text": "Vulnerability CVE-2017-5563\nSeverity: LOW\nPackage: libtiff5\nFixed Version: \nLink: [CVE-2017-5563](https://avd.aquasec.com/nvd/cve-2017-5563)\nLibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff.",
                "markdown": "**Vulnerability CVE-2017-5563**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libtiff5||[CVE-2017-5563](https://avd.aquasec.com/nvd/cve-2017-5563)|\n\nLibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2017-9117",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2017-9117"
              },
              "fullDescription": {
                "text": "In LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, leading to a heap-based buffer over-read in bmp2tiff."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2017-9117",
              "help": {
                "text": "Vulnerability CVE-2017-9117\nSeverity: LOW\nPackage: libtiff5\nFixed Version: \nLink: [CVE-2017-9117](https://avd.aquasec.com/nvd/cve-2017-9117)\nIn LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, leading to a heap-based buffer over-read in bmp2tiff.",
                "markdown": "**Vulnerability CVE-2017-9117**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libtiff5||[CVE-2017-9117](https://avd.aquasec.com/nvd/cve-2017-9117)|\n\nIn LibTIFF 4.0.7, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, leading to a heap-based buffer over-read in bmp2tiff."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2018-10126",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2018-10126"
              },
              "fullDescription": {
                "text": "LibTIFF 4.0.9 has a NULL pointer dereference in the jpeg_fdct_16x16 function in jfdctint.c."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2018-10126",
              "help": {
                "text": "Vulnerability CVE-2018-10126\nSeverity: LOW\nPackage: libtiff5\nFixed Version: \nLink: [CVE-2018-10126](https://avd.aquasec.com/nvd/cve-2018-10126)\nLibTIFF 4.0.9 has a NULL pointer dereference in the jpeg_fdct_16x16 function in jfdctint.c.",
                "markdown": "**Vulnerability CVE-2018-10126**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libtiff5||[CVE-2018-10126](https://avd.aquasec.com/nvd/cve-2018-10126)|\n\nLibTIFF 4.0.9 has a NULL pointer dereference in the jpeg_fdct_16x16 function in jfdctint.c."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2022-1056",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-1056"
              },
              "fullDescription": {
                "text": "Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 46dc8fcd."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-1056",
              "help": {
                "text": "Vulnerability CVE-2022-1056\nSeverity: LOW\nPackage: libtiff5\nFixed Version: \nLink: [CVE-2022-1056](https://avd.aquasec.com/nvd/cve-2022-1056)\nOut-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 46dc8fcd.",
                "markdown": "**Vulnerability CVE-2022-1056**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libtiff5||[CVE-2022-1056](https://avd.aquasec.com/nvd/cve-2022-1056)|\n\nOut-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 46dc8fcd."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2022-1210",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-1210"
              },
              "fullDescription": {
                "text": "A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requires user interaction. The exploit has been disclosed to the public and may be used."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-1210",
              "help": {
                "text": "Vulnerability CVE-2022-1210\nSeverity: LOW\nPackage: libtiff5\nFixed Version: \nLink: [CVE-2022-1210](https://avd.aquasec.com/nvd/cve-2022-1210)\nA vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requires user interaction. The exploit has been disclosed to the public and may be used.",
                "markdown": "**Vulnerability CVE-2022-1210**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libtiff5||[CVE-2022-1210](https://avd.aquasec.com/nvd/cve-2022-1210)|\n\nA vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requires user interaction. The exploit has been disclosed to the public and may be used."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2022-2519",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-2519"
              },
              "fullDescription": {
                "text": "There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1"
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-2519",
              "help": {
                "text": "Vulnerability CVE-2022-2519\nSeverity: LOW\nPackage: libtiff5\nFixed Version: \nLink: [CVE-2022-2519](https://avd.aquasec.com/nvd/cve-2022-2519)\nThere is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1",
                "markdown": "**Vulnerability CVE-2022-2519**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libtiff5||[CVE-2022-2519](https://avd.aquasec.com/nvd/cve-2022-2519)|\n\nThere is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1"
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2022-2520",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-2520"
              },
              "fullDescription": {
                "text": "A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage() at tiffcrop.c:8621 that can cause program crash when reading a crafted input."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-2520",
              "help": {
                "text": "Vulnerability CVE-2022-2520\nSeverity: LOW\nPackage: libtiff5\nFixed Version: \nLink: [CVE-2022-2520](https://avd.aquasec.com/nvd/cve-2022-2520)\nA flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage() at tiffcrop.c:8621 that can cause program crash when reading a crafted input.",
                "markdown": "**Vulnerability CVE-2022-2520**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libtiff5||[CVE-2022-2520](https://avd.aquasec.com/nvd/cve-2022-2520)|\n\nA flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage() at tiffcrop.c:8621 that can cause program crash when reading a crafted input."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2022-2521",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-2521"
              },
              "fullDescription": {
                "text": "It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tif_close.c:131 called by tiffcrop.c:2522 that can cause a program crash and denial of service while processing crafted input."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-2521",
              "help": {
                "text": "Vulnerability CVE-2022-2521\nSeverity: LOW\nPackage: libtiff5\nFixed Version: \nLink: [CVE-2022-2521](https://avd.aquasec.com/nvd/cve-2022-2521)\nIt was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tif_close.c:131 called by tiffcrop.c:2522 that can cause a program crash and denial of service while processing crafted input.",
                "markdown": "**Vulnerability CVE-2022-2521**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libtiff5||[CVE-2022-2521](https://avd.aquasec.com/nvd/cve-2022-2521)|\n\nIt was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tif_close.c:131 called by tiffcrop.c:2522 that can cause a program crash and denial of service while processing crafted input."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2022-2953",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-2953"
              },
              "fullDescription": {
                "text": "LibTIFF 4.4.0 has an out-of-bounds read in extractImageSection in tools/tiffcrop.c:6905, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 48d6ece8."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-2953",
              "help": {
                "text": "Vulnerability CVE-2022-2953\nSeverity: LOW\nPackage: libtiff5\nFixed Version: \nLink: [CVE-2022-2953](https://avd.aquasec.com/nvd/cve-2022-2953)\nLibTIFF 4.4.0 has an out-of-bounds read in extractImageSection in tools/tiffcrop.c:6905, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 48d6ece8.",
                "markdown": "**Vulnerability CVE-2022-2953**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libtiff5||[CVE-2022-2953](https://avd.aquasec.com/nvd/cve-2022-2953)|\n\nLibTIFF 4.4.0 has an out-of-bounds read in extractImageSection in tools/tiffcrop.c:6905, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 48d6ece8."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2022-29458",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-29458"
              },
              "fullDescription": {
                "text": "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-29458",
              "help": {
                "text": "Vulnerability CVE-2022-29458\nSeverity: HIGH\nPackage: ncurses-bin\nFixed Version: \nLink: [CVE-2022-29458](https://avd.aquasec.com/nvd/cve-2022-29458)\nncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.",
                "markdown": "**Vulnerability CVE-2022-29458**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|HIGH|ncurses-bin||[CVE-2022-29458](https://avd.aquasec.com/nvd/cve-2022-29458)|\n\nncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "7.1",
                "tags": [
                  "vulnerability",
                  "security",
                  "HIGH"
                ]
              }
            },
            {
              "id": "CVE-2021-39537",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2021-39537"
              },
              "fullDescription": {
                "text": "An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2021-39537",
              "help": {
                "text": "Vulnerability CVE-2021-39537\nSeverity: LOW\nPackage: ncurses-bin\nFixed Version: \nLink: [CVE-2021-39537](https://avd.aquasec.com/nvd/cve-2021-39537)\nAn issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.",
                "markdown": "**Vulnerability CVE-2021-39537**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|ncurses-bin||[CVE-2021-39537](https://avd.aquasec.com/nvd/cve-2021-39537)|\n\nAn issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2021-46828",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2021-46828"
              },
              "fullDescription": {
                "text": "In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connections."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2021-46828",
              "help": {
                "text": "Vulnerability CVE-2021-46828\nSeverity: HIGH\nPackage: libtirpc3\nFixed Version: 1.3.1-1+deb11u1\nLink: [CVE-2021-46828](https://avd.aquasec.com/nvd/cve-2021-46828)\nIn libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connections.",
                "markdown": "**Vulnerability CVE-2021-46828**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|HIGH|libtirpc3|1.3.1-1+deb11u1|[CVE-2021-46828](https://avd.aquasec.com/nvd/cve-2021-46828)|\n\nIn libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connections."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "7.5",
                "tags": [
                  "vulnerability",
                  "security",
                  "HIGH"
                ]
              }
            },
            {
              "id": "CVE-2016-9085",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2016-9085"
              },
              "fullDescription": {
                "text": "Multiple integer overflows in libwebp allows attackers to have unspecified impact via unknown vectors."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2016-9085",
              "help": {
                "text": "Vulnerability CVE-2016-9085\nSeverity: LOW\nPackage: libwebp6\nFixed Version: \nLink: [CVE-2016-9085](https://avd.aquasec.com/nvd/cve-2016-9085)\nMultiple integer overflows in libwebp allows attackers to have unspecified impact via unknown vectors.",
                "markdown": "**Vulnerability CVE-2016-9085**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libwebp6||[CVE-2016-9085](https://avd.aquasec.com/nvd/cve-2016-9085)|\n\nMultiple integer overflows in libwebp allows attackers to have unspecified impact via unknown vectors."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2016-3709",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2016-3709"
              },
              "fullDescription": {
                "text": "Possible cross-site scripting vulnerability in libxml after commit 960f0e2."
              },
              "defaultConfiguration": {
                "level": "warning"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2016-3709",
              "help": {
                "text": "Vulnerability CVE-2016-3709\nSeverity: MEDIUM\nPackage: libxml2\nFixed Version: \nLink: [CVE-2016-3709](https://avd.aquasec.com/nvd/cve-2016-3709)\nPossible cross-site scripting vulnerability in libxml after commit 960f0e2.",
                "markdown": "**Vulnerability CVE-2016-3709**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|MEDIUM|libxml2||[CVE-2016-3709](https://avd.aquasec.com/nvd/cve-2016-3709)|\n\nPossible cross-site scripting vulnerability in libxml after commit 960f0e2."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "6.1",
                "tags": [
                  "vulnerability",
                  "security",
                  "MEDIUM"
                ]
              }
            },
            {
              "id": "CVE-2021-30560",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2021-30560"
              },
              "fullDescription": {
                "text": "Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2021-30560",
              "help": {
                "text": "Vulnerability CVE-2021-30560\nSeverity: HIGH\nPackage: libxslt1.1\nFixed Version: 1.1.34-4+deb11u1\nLink: [CVE-2021-30560](https://avd.aquasec.com/nvd/cve-2021-30560)\nUse after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
                "markdown": "**Vulnerability CVE-2021-30560**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|HIGH|libxslt1.1|1.1.34-4+deb11u1|[CVE-2021-30560](https://avd.aquasec.com/nvd/cve-2021-30560)|\n\nUse after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "8.8",
                "tags": [
                  "vulnerability",
                  "security",
                  "HIGH"
                ]
              }
            },
            {
              "id": "CVE-2015-9019",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2015-9019"
              },
              "fullDescription": {
                "text": "In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2015-9019",
              "help": {
                "text": "Vulnerability CVE-2015-9019\nSeverity: LOW\nPackage: libxslt1.1\nFixed Version: \nLink: [CVE-2015-9019](https://avd.aquasec.com/nvd/cve-2015-9019)\nIn libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.",
                "markdown": "**Vulnerability CVE-2015-9019**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|libxslt1.1||[CVE-2015-9019](https://avd.aquasec.com/nvd/cve-2015-9019)|\n\nIn libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2007-5686",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2007-5686"
              },
              "fullDescription": {
                "text": "initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts.  NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2007-5686",
              "help": {
                "text": "Vulnerability CVE-2007-5686\nSeverity: LOW\nPackage: passwd\nFixed Version: \nLink: [CVE-2007-5686](https://avd.aquasec.com/nvd/cve-2007-5686)\ninitscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts.  NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.",
                "markdown": "**Vulnerability CVE-2007-5686**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|passwd||[CVE-2007-5686](https://avd.aquasec.com/nvd/cve-2007-5686)|\n\ninitscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts.  NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2013-4235",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2013-4235"
              },
              "fullDescription": {
                "text": "shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees"
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2013-4235",
              "help": {
                "text": "Vulnerability CVE-2013-4235\nSeverity: LOW\nPackage: passwd\nFixed Version: \nLink: [CVE-2013-4235](https://avd.aquasec.com/nvd/cve-2013-4235)\nshadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees",
                "markdown": "**Vulnerability CVE-2013-4235**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|passwd||[CVE-2013-4235](https://avd.aquasec.com/nvd/cve-2013-4235)|\n\nshadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees"
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2019-19882",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2019-19882"
              },
              "fullDescription": {
                "text": "shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8)."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2019-19882",
              "help": {
                "text": "Vulnerability CVE-2019-19882\nSeverity: LOW\nPackage: passwd\nFixed Version: \nLink: [CVE-2019-19882](https://avd.aquasec.com/nvd/cve-2019-19882)\nshadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).",
                "markdown": "**Vulnerability CVE-2019-19882**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|passwd||[CVE-2019-19882](https://avd.aquasec.com/nvd/cve-2019-19882)|\n\nshadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8)."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2020-36309",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2020-36309"
              },
              "fullDescription": {
                "text": "ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header."
              },
              "defaultConfiguration": {
                "level": "warning"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2020-36309",
              "help": {
                "text": "Vulnerability CVE-2020-36309\nSeverity: MEDIUM\nPackage: nginx\nFixed Version: \nLink: [CVE-2020-36309](https://avd.aquasec.com/nvd/cve-2020-36309)\nngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.",
                "markdown": "**Vulnerability CVE-2020-36309**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|MEDIUM|nginx||[CVE-2020-36309](https://avd.aquasec.com/nvd/cve-2020-36309)|\n\nngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "5.3",
                "tags": [
                  "vulnerability",
                  "security",
                  "MEDIUM"
                ]
              }
            },
            {
              "id": "CVE-2009-4487",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2009-4487"
              },
              "fullDescription": {
                "text": "nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window&#39;s title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2009-4487",
              "help": {
                "text": "Vulnerability CVE-2009-4487\nSeverity: LOW\nPackage: nginx\nFixed Version: \nLink: [CVE-2009-4487](https://avd.aquasec.com/nvd/cve-2009-4487)\nnginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.",
                "markdown": "**Vulnerability CVE-2009-4487**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|nginx||[CVE-2009-4487](https://avd.aquasec.com/nvd/cve-2009-4487)|\n\nnginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2013-0337",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2013-0337"
              },
              "fullDescription": {
                "text": "The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2013-0337",
              "help": {
                "text": "Vulnerability CVE-2013-0337\nSeverity: LOW\nPackage: nginx\nFixed Version: \nLink: [CVE-2013-0337](https://avd.aquasec.com/nvd/cve-2013-0337)\nThe default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.",
                "markdown": "**Vulnerability CVE-2013-0337**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|nginx||[CVE-2013-0337](https://avd.aquasec.com/nvd/cve-2013-0337)|\n\nThe default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2020-16156",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2020-16156"
              },
              "fullDescription": {
                "text": "CPAN 2.28 allows Signature Verification Bypass."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2020-16156",
              "help": {
                "text": "Vulnerability CVE-2020-16156\nSeverity: HIGH\nPackage: perl-base\nFixed Version: \nLink: [CVE-2020-16156](https://avd.aquasec.com/nvd/cve-2020-16156)\nCPAN 2.28 allows Signature Verification Bypass.",
                "markdown": "**Vulnerability CVE-2020-16156**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|HIGH|perl-base||[CVE-2020-16156](https://avd.aquasec.com/nvd/cve-2020-16156)|\n\nCPAN 2.28 allows Signature Verification Bypass."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "7.8",
                "tags": [
                  "vulnerability",
                  "security",
                  "HIGH"
                ]
              }
            },
            {
              "id": "CVE-2011-4116",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2011-4116"
              },
              "fullDescription": {
                "text": "_is_safe in the File::Temp module for Perl does not properly handle symlinks."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2011-4116",
              "help": {
                "text": "Vulnerability CVE-2011-4116\nSeverity: LOW\nPackage: perl-base\nFixed Version: \nLink: [CVE-2011-4116](https://avd.aquasec.com/nvd/cve-2011-4116)\n_is_safe in the File::Temp module for Perl does not properly handle symlinks.",
                "markdown": "**Vulnerability CVE-2011-4116**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|perl-base||[CVE-2011-4116](https://avd.aquasec.com/nvd/cve-2011-4116)|\n\n_is_safe in the File::Temp module for Perl does not properly handle symlinks."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2005-2541",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2005-2541"
              },
              "fullDescription": {
                "text": "Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges."
              },
              "defaultConfiguration": {
                "level": "note"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2005-2541",
              "help": {
                "text": "Vulnerability CVE-2005-2541\nSeverity: LOW\nPackage: tar\nFixed Version: \nLink: [CVE-2005-2541](https://avd.aquasec.com/nvd/cve-2005-2541)\nTar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.",
                "markdown": "**Vulnerability CVE-2005-2541**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|LOW|tar||[CVE-2005-2541](https://avd.aquasec.com/nvd/cve-2005-2541)|\n\nTar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "2.0",
                "tags": [
                  "vulnerability",
                  "security",
                  "LOW"
                ]
              }
            },
            {
              "id": "CVE-2022-37434",
              "name": "OsPackageVulnerability",
              "shortDescription": {
                "text": "CVE-2022-37434"
              },
              "fullDescription": {
                "text": "zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference)."
              },
              "defaultConfiguration": {
                "level": "error"
              },
              "helpUri": "https://avd.aquasec.com/nvd/cve-2022-37434",
              "help": {
                "text": "Vulnerability CVE-2022-37434\nSeverity: CRITICAL\nPackage: zlib1g\nFixed Version: 1:1.2.11.dfsg-2+deb11u2\nLink: [CVE-2022-37434](https://avd.aquasec.com/nvd/cve-2022-37434)\nzlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).",
                "markdown": "**Vulnerability CVE-2022-37434**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|CRITICAL|zlib1g|1:1.2.11.dfsg-2+deb11u2|[CVE-2022-37434](https://avd.aquasec.com/nvd/cve-2022-37434)|\n\nzlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference)."
              },
              "properties": {
                "precision": "very-high",
                "security-severity": "9.8",
                "tags": [
                  "vulnerability",
                  "security",
                  "CRITICAL"
                ]
              }
            }
          ],
          "version": "0.30.4"
        }
      },
      "results": [
        {
          "ruleId": "CVE-2011-3374",
          "ruleIndex": 0,
          "level": "note",
          "message": {
            "text": "Package: apt\nInstalled Version: 2.2.4\nVulnerability CVE-2011-3374\nSeverity: LOW\nFixed Version: \nLink: [CVE-2011-3374](https://avd.aquasec.com/nvd/cve-2011-3374)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-0563",
          "ruleIndex": 1,
          "level": "note",
          "message": {
            "text": "Package: bsdutils\nInstalled Version: 2.36.1-8+deb11u1\nVulnerability CVE-2022-0563\nSeverity: LOW\nFixed Version: \nLink: [CVE-2022-0563](https://avd.aquasec.com/nvd/cve-2022-0563)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2016-2781",
          "ruleIndex": 2,
          "level": "note",
          "message": {
            "text": "Package: coreutils\nInstalled Version: 8.32-4\nVulnerability CVE-2016-2781\nSeverity: LOW\nFixed Version: \nLink: [CVE-2016-2781](https://avd.aquasec.com/nvd/cve-2016-2781)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2017-18018",
          "ruleIndex": 3,
          "level": "note",
          "message": {
            "text": "Package: coreutils\nInstalled Version: 8.32-4\nVulnerability CVE-2017-18018\nSeverity: LOW\nFixed Version: \nLink: [CVE-2017-18018](https://avd.aquasec.com/nvd/cve-2017-18018)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-22945",
          "ruleIndex": 4,
          "level": "error",
          "message": {
            "text": "Package: curl\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2021-22945\nSeverity: CRITICAL\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2021-22945](https://avd.aquasec.com/nvd/cve-2021-22945)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-32207",
          "ruleIndex": 5,
          "level": "error",
          "message": {
            "text": "Package: curl\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2022-32207\nSeverity: CRITICAL\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-32207](https://avd.aquasec.com/nvd/cve-2022-32207)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-22946",
          "ruleIndex": 6,
          "level": "error",
          "message": {
            "text": "Package: curl\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2021-22946\nSeverity: HIGH\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2021-22946](https://avd.aquasec.com/nvd/cve-2021-22946)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-22576",
          "ruleIndex": 7,
          "level": "error",
          "message": {
            "text": "Package: curl\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2022-22576\nSeverity: HIGH\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-22576](https://avd.aquasec.com/nvd/cve-2022-22576)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-27775",
          "ruleIndex": 8,
          "level": "error",
          "message": {
            "text": "Package: curl\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2022-27775\nSeverity: HIGH\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-27775](https://avd.aquasec.com/nvd/cve-2022-27775)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-27781",
          "ruleIndex": 9,
          "level": "error",
          "message": {
            "text": "Package: curl\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2022-27781\nSeverity: HIGH\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-27781](https://avd.aquasec.com/nvd/cve-2022-27781)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-27782",
          "ruleIndex": 10,
          "level": "error",
          "message": {
            "text": "Package: curl\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2022-27782\nSeverity: HIGH\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-27782](https://avd.aquasec.com/nvd/cve-2022-27782)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-22947",
          "ruleIndex": 11,
          "level": "warning",
          "message": {
            "text": "Package: curl\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2021-22947\nSeverity: MEDIUM\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2021-22947](https://avd.aquasec.com/nvd/cve-2021-22947)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-27774",
          "ruleIndex": 12,
          "level": "warning",
          "message": {
            "text": "Package: curl\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2022-27774\nSeverity: MEDIUM\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-27774](https://avd.aquasec.com/nvd/cve-2022-27774)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-27776",
          "ruleIndex": 13,
          "level": "warning",
          "message": {
            "text": "Package: curl\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2022-27776\nSeverity: MEDIUM\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-27776](https://avd.aquasec.com/nvd/cve-2022-27776)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-32205",
          "ruleIndex": 14,
          "level": "warning",
          "message": {
            "text": "Package: curl\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2022-32205\nSeverity: MEDIUM\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-32205](https://avd.aquasec.com/nvd/cve-2022-32205)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-32206",
          "ruleIndex": 15,
          "level": "warning",
          "message": {
            "text": "Package: curl\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2022-32206\nSeverity: MEDIUM\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-32206](https://avd.aquasec.com/nvd/cve-2022-32206)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-32208",
          "ruleIndex": 16,
          "level": "warning",
          "message": {
            "text": "Package: curl\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2022-32208\nSeverity: MEDIUM\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-32208](https://avd.aquasec.com/nvd/cve-2022-32208)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-22898",
          "ruleIndex": 17,
          "level": "note",
          "message": {
            "text": "Package: curl\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2021-22898\nSeverity: LOW\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2021-22898](https://avd.aquasec.com/nvd/cve-2021-22898)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-22922",
          "ruleIndex": 18,
          "level": "note",
          "message": {
            "text": "Package: curl\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2021-22922\nSeverity: LOW\nFixed Version: \nLink: [CVE-2021-22922](https://avd.aquasec.com/nvd/cve-2021-22922)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-22923",
          "ruleIndex": 19,
          "level": "note",
          "message": {
            "text": "Package: curl\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2021-22923\nSeverity: LOW\nFixed Version: \nLink: [CVE-2021-22923](https://avd.aquasec.com/nvd/cve-2021-22923)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-22924",
          "ruleIndex": 20,
          "level": "note",
          "message": {
            "text": "Package: curl\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2021-22924\nSeverity: LOW\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2021-22924](https://avd.aquasec.com/nvd/cve-2021-22924)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-35252",
          "ruleIndex": 21,
          "level": "note",
          "message": {
            "text": "Package: curl\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2022-35252\nSeverity: LOW\nFixed Version: \nLink: [CVE-2022-35252](https://avd.aquasec.com/nvd/cve-2022-35252)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-1304",
          "ruleIndex": 22,
          "level": "error",
          "message": {
            "text": "Package: e2fsprogs\nInstalled Version: 1.46.2-2\nVulnerability CVE-2022-1304\nSeverity: HIGH\nFixed Version: \nLink: [CVE-2022-1304](https://avd.aquasec.com/nvd/cve-2022-1304)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-34903",
          "ruleIndex": 23,
          "level": "warning",
          "message": {
            "text": "Package: gpgv\nInstalled Version: 2.2.27-2+deb11u1\nVulnerability CVE-2022-34903\nSeverity: MEDIUM\nFixed Version: 2.2.27-2+deb11u2\nLink: [CVE-2022-34903](https://avd.aquasec.com/nvd/cve-2022-34903)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2011-3374",
          "ruleIndex": 0,
          "level": "note",
          "message": {
            "text": "Package: libapt-pkg6.0\nInstalled Version: 2.2.4\nVulnerability CVE-2011-3374\nSeverity: LOW\nFixed Version: \nLink: [CVE-2011-3374](https://avd.aquasec.com/nvd/cve-2011-3374)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-0563",
          "ruleIndex": 1,
          "level": "note",
          "message": {
            "text": "Package: libblkid1\nInstalled Version: 2.36.1-8+deb11u1\nVulnerability CVE-2022-0563\nSeverity: LOW\nFixed Version: \nLink: [CVE-2022-0563](https://avd.aquasec.com/nvd/cve-2022-0563)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-3999",
          "ruleIndex": 24,
          "level": "error",
          "message": {
            "text": "Package: libc-bin\nInstalled Version: 2.31-13+deb11u3\nVulnerability CVE-2021-3999\nSeverity: HIGH\nFixed Version: \nLink: [CVE-2021-3999](https://avd.aquasec.com/nvd/cve-2021-3999)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2010-4756",
          "ruleIndex": 25,
          "level": "note",
          "message": {
            "text": "Package: libc-bin\nInstalled Version: 2.31-13+deb11u3\nVulnerability CVE-2010-4756\nSeverity: LOW\nFixed Version: \nLink: [CVE-2010-4756](https://avd.aquasec.com/nvd/cve-2010-4756)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2018-20796",
          "ruleIndex": 26,
          "level": "note",
          "message": {
            "text": "Package: libc-bin\nInstalled Version: 2.31-13+deb11u3\nVulnerability CVE-2018-20796\nSeverity: LOW\nFixed Version: \nLink: [CVE-2018-20796](https://avd.aquasec.com/nvd/cve-2018-20796)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2019-1010022",
          "ruleIndex": 27,
          "level": "note",
          "message": {
            "text": "Package: libc-bin\nInstalled Version: 2.31-13+deb11u3\nVulnerability CVE-2019-1010022\nSeverity: LOW\nFixed Version: \nLink: [CVE-2019-1010022](https://avd.aquasec.com/nvd/cve-2019-1010022)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2019-1010023",
          "ruleIndex": 28,
          "level": "note",
          "message": {
            "text": "Package: libc-bin\nInstalled Version: 2.31-13+deb11u3\nVulnerability CVE-2019-1010023\nSeverity: LOW\nFixed Version: \nLink: [CVE-2019-1010023](https://avd.aquasec.com/nvd/cve-2019-1010023)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2019-1010024",
          "ruleIndex": 29,
          "level": "note",
          "message": {
            "text": "Package: libc-bin\nInstalled Version: 2.31-13+deb11u3\nVulnerability CVE-2019-1010024\nSeverity: LOW\nFixed Version: \nLink: [CVE-2019-1010024](https://avd.aquasec.com/nvd/cve-2019-1010024)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2019-1010025",
          "ruleIndex": 30,
          "level": "note",
          "message": {
            "text": "Package: libc-bin\nInstalled Version: 2.31-13+deb11u3\nVulnerability CVE-2019-1010025\nSeverity: LOW\nFixed Version: \nLink: [CVE-2019-1010025](https://avd.aquasec.com/nvd/cve-2019-1010025)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2019-9192",
          "ruleIndex": 31,
          "level": "note",
          "message": {
            "text": "Package: libc-bin\nInstalled Version: 2.31-13+deb11u3\nVulnerability CVE-2019-9192\nSeverity: LOW\nFixed Version: \nLink: [CVE-2019-9192](https://avd.aquasec.com/nvd/cve-2019-9192)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-3999",
          "ruleIndex": 24,
          "level": "error",
          "message": {
            "text": "Package: libc6\nInstalled Version: 2.31-13+deb11u3\nVulnerability CVE-2021-3999\nSeverity: HIGH\nFixed Version: \nLink: [CVE-2021-3999](https://avd.aquasec.com/nvd/cve-2021-3999)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2010-4756",
          "ruleIndex": 25,
          "level": "note",
          "message": {
            "text": "Package: libc6\nInstalled Version: 2.31-13+deb11u3\nVulnerability CVE-2010-4756\nSeverity: LOW\nFixed Version: \nLink: [CVE-2010-4756](https://avd.aquasec.com/nvd/cve-2010-4756)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2018-20796",
          "ruleIndex": 26,
          "level": "note",
          "message": {
            "text": "Package: libc6\nInstalled Version: 2.31-13+deb11u3\nVulnerability CVE-2018-20796\nSeverity: LOW\nFixed Version: \nLink: [CVE-2018-20796](https://avd.aquasec.com/nvd/cve-2018-20796)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2019-1010022",
          "ruleIndex": 27,
          "level": "note",
          "message": {
            "text": "Package: libc6\nInstalled Version: 2.31-13+deb11u3\nVulnerability CVE-2019-1010022\nSeverity: LOW\nFixed Version: \nLink: [CVE-2019-1010022](https://avd.aquasec.com/nvd/cve-2019-1010022)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2019-1010023",
          "ruleIndex": 28,
          "level": "note",
          "message": {
            "text": "Package: libc6\nInstalled Version: 2.31-13+deb11u3\nVulnerability CVE-2019-1010023\nSeverity: LOW\nFixed Version: \nLink: [CVE-2019-1010023](https://avd.aquasec.com/nvd/cve-2019-1010023)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2019-1010024",
          "ruleIndex": 29,
          "level": "note",
          "message": {
            "text": "Package: libc6\nInstalled Version: 2.31-13+deb11u3\nVulnerability CVE-2019-1010024\nSeverity: LOW\nFixed Version: \nLink: [CVE-2019-1010024](https://avd.aquasec.com/nvd/cve-2019-1010024)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2019-1010025",
          "ruleIndex": 30,
          "level": "note",
          "message": {
            "text": "Package: libc6\nInstalled Version: 2.31-13+deb11u3\nVulnerability CVE-2019-1010025\nSeverity: LOW\nFixed Version: \nLink: [CVE-2019-1010025](https://avd.aquasec.com/nvd/cve-2019-1010025)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2019-9192",
          "ruleIndex": 31,
          "level": "note",
          "message": {
            "text": "Package: libc6\nInstalled Version: 2.31-13+deb11u3\nVulnerability CVE-2019-9192\nSeverity: LOW\nFixed Version: \nLink: [CVE-2019-9192](https://avd.aquasec.com/nvd/cve-2019-9192)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-1304",
          "ruleIndex": 22,
          "level": "error",
          "message": {
            "text": "Package: libcom-err2\nInstalled Version: 1.46.2-2\nVulnerability CVE-2022-1304\nSeverity: HIGH\nFixed Version: \nLink: [CVE-2022-1304](https://avd.aquasec.com/nvd/cve-2022-1304)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-22945",
          "ruleIndex": 4,
          "level": "error",
          "message": {
            "text": "Package: libcurl4\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2021-22945\nSeverity: CRITICAL\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2021-22945](https://avd.aquasec.com/nvd/cve-2021-22945)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-32207",
          "ruleIndex": 5,
          "level": "error",
          "message": {
            "text": "Package: libcurl4\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2022-32207\nSeverity: CRITICAL\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-32207](https://avd.aquasec.com/nvd/cve-2022-32207)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-22946",
          "ruleIndex": 6,
          "level": "error",
          "message": {
            "text": "Package: libcurl4\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2021-22946\nSeverity: HIGH\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2021-22946](https://avd.aquasec.com/nvd/cve-2021-22946)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-22576",
          "ruleIndex": 7,
          "level": "error",
          "message": {
            "text": "Package: libcurl4\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2022-22576\nSeverity: HIGH\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-22576](https://avd.aquasec.com/nvd/cve-2022-22576)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-27775",
          "ruleIndex": 8,
          "level": "error",
          "message": {
            "text": "Package: libcurl4\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2022-27775\nSeverity: HIGH\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-27775](https://avd.aquasec.com/nvd/cve-2022-27775)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-27781",
          "ruleIndex": 9,
          "level": "error",
          "message": {
            "text": "Package: libcurl4\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2022-27781\nSeverity: HIGH\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-27781](https://avd.aquasec.com/nvd/cve-2022-27781)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-27782",
          "ruleIndex": 10,
          "level": "error",
          "message": {
            "text": "Package: libcurl4\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2022-27782\nSeverity: HIGH\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-27782](https://avd.aquasec.com/nvd/cve-2022-27782)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-22947",
          "ruleIndex": 11,
          "level": "warning",
          "message": {
            "text": "Package: libcurl4\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2021-22947\nSeverity: MEDIUM\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2021-22947](https://avd.aquasec.com/nvd/cve-2021-22947)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-27774",
          "ruleIndex": 12,
          "level": "warning",
          "message": {
            "text": "Package: libcurl4\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2022-27774\nSeverity: MEDIUM\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-27774](https://avd.aquasec.com/nvd/cve-2022-27774)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-27776",
          "ruleIndex": 13,
          "level": "warning",
          "message": {
            "text": "Package: libcurl4\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2022-27776\nSeverity: MEDIUM\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-27776](https://avd.aquasec.com/nvd/cve-2022-27776)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-32205",
          "ruleIndex": 14,
          "level": "warning",
          "message": {
            "text": "Package: libcurl4\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2022-32205\nSeverity: MEDIUM\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-32205](https://avd.aquasec.com/nvd/cve-2022-32205)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-32206",
          "ruleIndex": 15,
          "level": "warning",
          "message": {
            "text": "Package: libcurl4\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2022-32206\nSeverity: MEDIUM\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-32206](https://avd.aquasec.com/nvd/cve-2022-32206)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-32208",
          "ruleIndex": 16,
          "level": "warning",
          "message": {
            "text": "Package: libcurl4\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2022-32208\nSeverity: MEDIUM\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2022-32208](https://avd.aquasec.com/nvd/cve-2022-32208)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-22898",
          "ruleIndex": 17,
          "level": "note",
          "message": {
            "text": "Package: libcurl4\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2021-22898\nSeverity: LOW\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2021-22898](https://avd.aquasec.com/nvd/cve-2021-22898)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-22922",
          "ruleIndex": 18,
          "level": "note",
          "message": {
            "text": "Package: libcurl4\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2021-22922\nSeverity: LOW\nFixed Version: \nLink: [CVE-2021-22922](https://avd.aquasec.com/nvd/cve-2021-22922)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-22923",
          "ruleIndex": 19,
          "level": "note",
          "message": {
            "text": "Package: libcurl4\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2021-22923\nSeverity: LOW\nFixed Version: \nLink: [CVE-2021-22923](https://avd.aquasec.com/nvd/cve-2021-22923)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-22924",
          "ruleIndex": 20,
          "level": "note",
          "message": {
            "text": "Package: libcurl4\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2021-22924\nSeverity: LOW\nFixed Version: 7.74.0-1.3+deb11u2\nLink: [CVE-2021-22924](https://avd.aquasec.com/nvd/cve-2021-22924)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-35252",
          "ruleIndex": 21,
          "level": "note",
          "message": {
            "text": "Package: libcurl4\nInstalled Version: 7.74.0-1.3+deb11u1\nVulnerability CVE-2022-35252\nSeverity: LOW\nFixed Version: \nLink: [CVE-2022-35252](https://avd.aquasec.com/nvd/cve-2022-35252)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2019-8457",
          "ruleIndex": 32,
          "level": "error",
          "message": {
            "text": "Package: libdb5.3\nInstalled Version: 5.3.28+dfsg1-0.8\nVulnerability CVE-2019-8457\nSeverity: CRITICAL\nFixed Version: \nLink: [CVE-2019-8457](https://avd.aquasec.com/nvd/cve-2019-8457)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2013-0340",
          "ruleIndex": 33,
          "level": "note",
          "message": {
            "text": "Package: libexpat1\nInstalled Version: 2.2.10-2+deb11u3\nVulnerability CVE-2013-0340\nSeverity: LOW\nFixed Version: \nLink: [CVE-2013-0340](https://avd.aquasec.com/nvd/cve-2013-0340)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-1304",
          "ruleIndex": 22,
          "level": "error",
          "message": {
            "text": "Package: libext2fs2\nInstalled Version: 1.46.2-2\nVulnerability CVE-2022-1304\nSeverity: HIGH\nFixed Version: \nLink: [CVE-2022-1304](https://avd.aquasec.com/nvd/cve-2022-1304)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-27404",
          "ruleIndex": 34,
          "level": "error",
          "message": {
            "text": "Package: libfreetype6\nInstalled Version: 2.10.4+dfsg-1\nVulnerability CVE-2022-27404\nSeverity: CRITICAL\nFixed Version: 2.10.4+dfsg-1+deb11u1\nLink: [CVE-2022-27404](https://avd.aquasec.com/nvd/cve-2022-27404)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-27405",
          "ruleIndex": 35,
          "level": "error",
          "message": {
            "text": "Package: libfreetype6\nInstalled Version: 2.10.4+dfsg-1\nVulnerability CVE-2022-27405\nSeverity: HIGH\nFixed Version: 2.10.4+dfsg-1+deb11u1\nLink: [CVE-2022-27405](https://avd.aquasec.com/nvd/cve-2022-27405)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-27406",
          "ruleIndex": 36,
          "level": "error",
          "message": {
            "text": "Package: libfreetype6\nInstalled Version: 2.10.4+dfsg-1\nVulnerability CVE-2022-27406\nSeverity: HIGH\nFixed Version: 2.10.4+dfsg-1+deb11u1\nLink: [CVE-2022-27406](https://avd.aquasec.com/nvd/cve-2022-27406)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-31782",
          "ruleIndex": 37,
          "level": "note",
          "message": {
            "text": "Package: libfreetype6\nInstalled Version: 2.10.4+dfsg-1\nVulnerability CVE-2022-31782\nSeverity: LOW\nFixed Version: \nLink: [CVE-2022-31782](https://avd.aquasec.com/nvd/cve-2022-31782)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-33560",
          "ruleIndex": 38,
          "level": "error",
          "message": {
            "text": "Package: libgcrypt20\nInstalled Version: 1.8.7-6\nVulnerability CVE-2021-33560\nSeverity: HIGH\nFixed Version: \nLink: [CVE-2021-33560](https://avd.aquasec.com/nvd/cve-2021-33560)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2018-6829",
          "ruleIndex": 39,
          "level": "note",
          "message": {
            "text": "Package: libgcrypt20\nInstalled Version: 1.8.7-6\nVulnerability CVE-2018-6829\nSeverity: LOW\nFixed Version: \nLink: [CVE-2018-6829](https://avd.aquasec.com/nvd/cve-2018-6829)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-38115",
          "ruleIndex": 40,
          "level": "warning",
          "message": {
            "text": "Package: libgd3\nInstalled Version: 2.3.0-2\nVulnerability CVE-2021-38115\nSeverity: MEDIUM\nFixed Version: \nLink: [CVE-2021-38115](https://avd.aquasec.com/nvd/cve-2021-38115)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-40812",
          "ruleIndex": 41,
          "level": "warning",
          "message": {
            "text": "Package: libgd3\nInstalled Version: 2.3.0-2\nVulnerability CVE-2021-40812\nSeverity: MEDIUM\nFixed Version: \nLink: [CVE-2021-40812](https://avd.aquasec.com/nvd/cve-2021-40812)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-40145",
          "ruleIndex": 42,
          "level": "note",
          "message": {
            "text": "Package: libgd3\nInstalled Version: 2.3.0-2\nVulnerability CVE-2021-40145\nSeverity: LOW\nFixed Version: \nLink: [CVE-2021-40145](https://avd.aquasec.com/nvd/cve-2021-40145)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-2509",
          "ruleIndex": 43,
          "level": "error",
          "message": {
            "text": "Package: libgnutls30\nInstalled Version: 3.7.1-5\nVulnerability CVE-2022-2509\nSeverity: HIGH\nFixed Version: 3.7.1-5+deb11u2\nLink: [CVE-2022-2509](https://avd.aquasec.com/nvd/cve-2022-2509)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-4209",
          "ruleIndex": 44,
          "level": "warning",
          "message": {
            "text": "Package: libgnutls30\nInstalled Version: 3.7.1-5\nVulnerability CVE-2021-4209\nSeverity: MEDIUM\nFixed Version: 3.7.1-5+deb11u1\nLink: [CVE-2021-4209](https://avd.aquasec.com/nvd/cve-2021-4209)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2011-3389",
          "ruleIndex": 45,
          "level": "note",
          "message": {
            "text": "Package: libgnutls30\nInstalled Version: 3.7.1-5\nVulnerability CVE-2011-3389\nSeverity: LOW\nFixed Version: \nLink: [CVE-2011-3389](https://avd.aquasec.com/nvd/cve-2011-3389)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2004-0971",
          "ruleIndex": 46,
          "level": "note",
          "message": {
            "text": "Package: libgssapi-krb5-2\nInstalled Version: 1.18.3-6+deb11u1\nVulnerability CVE-2004-0971\nSeverity: LOW\nFixed Version: \nLink: [CVE-2004-0971](https://avd.aquasec.com/nvd/cve-2004-0971)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2018-5709",
          "ruleIndex": 47,
          "level": "note",
          "message": {
            "text": "Package: libgssapi-krb5-2\nInstalled Version: 1.18.3-6+deb11u1\nVulnerability CVE-2018-5709\nSeverity: LOW\nFixed Version: \nLink: [CVE-2018-5709](https://avd.aquasec.com/nvd/cve-2018-5709)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2017-9937",
          "ruleIndex": 48,
          "level": "note",
          "message": {
            "text": "Package: libjbig0\nInstalled Version: 2.1-3.1\nVulnerability CVE-2017-9937\nSeverity: LOW\nFixed Version: \nLink: [CVE-2017-9937](https://avd.aquasec.com/nvd/cve-2017-9937)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-46822",
          "ruleIndex": 49,
          "level": "warning",
          "message": {
            "text": "Package: libjpeg62-turbo\nInstalled Version: 1:2.0.6-4\nVulnerability CVE-2021-46822\nSeverity: MEDIUM\nFixed Version: \nLink: [CVE-2021-46822](https://avd.aquasec.com/nvd/cve-2021-46822)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2004-0971",
          "ruleIndex": 46,
          "level": "note",
          "message": {
            "text": "Package: libk5crypto3\nInstalled Version: 1.18.3-6+deb11u1\nVulnerability CVE-2004-0971\nSeverity: LOW\nFixed Version: \nLink: [CVE-2004-0971](https://avd.aquasec.com/nvd/cve-2004-0971)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2018-5709",
          "ruleIndex": 47,
          "level": "note",
          "message": {
            "text": "Package: libk5crypto3\nInstalled Version: 1.18.3-6+deb11u1\nVulnerability CVE-2018-5709\nSeverity: LOW\nFixed Version: \nLink: [CVE-2018-5709](https://avd.aquasec.com/nvd/cve-2018-5709)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2004-0971",
          "ruleIndex": 46,
          "level": "note",
          "message": {
            "text": "Package: libkrb5-3\nInstalled Version: 1.18.3-6+deb11u1\nVulnerability CVE-2004-0971\nSeverity: LOW\nFixed Version: \nLink: [CVE-2004-0971](https://avd.aquasec.com/nvd/cve-2004-0971)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2018-5709",
          "ruleIndex": 47,
          "level": "note",
          "message": {
            "text": "Package: libkrb5-3\nInstalled Version: 1.18.3-6+deb11u1\nVulnerability CVE-2018-5709\nSeverity: LOW\nFixed Version: \nLink: [CVE-2018-5709](https://avd.aquasec.com/nvd/cve-2018-5709)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2004-0971",
          "ruleIndex": 46,
          "level": "note",
          "message": {
            "text": "Package: libkrb5support0\nInstalled Version: 1.18.3-6+deb11u1\nVulnerability CVE-2004-0971\nSeverity: LOW\nFixed Version: \nLink: [CVE-2004-0971](https://avd.aquasec.com/nvd/cve-2004-0971)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2018-5709",
          "ruleIndex": 47,
          "level": "note",
          "message": {
            "text": "Package: libkrb5support0\nInstalled Version: 1.18.3-6+deb11u1\nVulnerability CVE-2018-5709\nSeverity: LOW\nFixed Version: \nLink: [CVE-2018-5709](https://avd.aquasec.com/nvd/cve-2018-5709)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2015-3276",
          "ruleIndex": 50,
          "level": "note",
          "message": {
            "text": "Package: libldap-2.4-2\nInstalled Version: 2.4.57+dfsg-3+deb11u1\nVulnerability CVE-2015-3276\nSeverity: LOW\nFixed Version: \nLink: [CVE-2015-3276](https://avd.aquasec.com/nvd/cve-2015-3276)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2017-14159",
          "ruleIndex": 51,
          "level": "note",
          "message": {
            "text": "Package: libldap-2.4-2\nInstalled Version: 2.4.57+dfsg-3+deb11u1\nVulnerability CVE-2017-14159\nSeverity: LOW\nFixed Version: \nLink: [CVE-2017-14159](https://avd.aquasec.com/nvd/cve-2017-14159)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2017-17740",
          "ruleIndex": 52,
          "level": "note",
          "message": {
            "text": "Package: libldap-2.4-2\nInstalled Version: 2.4.57+dfsg-3+deb11u1\nVulnerability CVE-2017-17740\nSeverity: LOW\nFixed Version: \nLink: [CVE-2017-17740](https://avd.aquasec.com/nvd/cve-2017-17740)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2020-15719",
          "ruleIndex": 53,
          "level": "note",
          "message": {
            "text": "Package: libldap-2.4-2\nInstalled Version: 2.4.57+dfsg-3+deb11u1\nVulnerability CVE-2020-15719\nSeverity: LOW\nFixed Version: \nLink: [CVE-2020-15719](https://avd.aquasec.com/nvd/cve-2020-15719)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-0563",
          "ruleIndex": 1,
          "level": "note",
          "message": {
            "text": "Package: libmount1\nInstalled Version: 2.36.1-8+deb11u1\nVulnerability CVE-2022-0563\nSeverity: LOW\nFixed Version: \nLink: [CVE-2022-0563](https://avd.aquasec.com/nvd/cve-2022-0563)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-1586",
          "ruleIndex": 54,
          "level": "error",
          "message": {
            "text": "Package: libpcre2-8-0\nInstalled Version: 10.36-2\nVulnerability CVE-2022-1586\nSeverity: CRITICAL\nFixed Version: \nLink: [CVE-2022-1586](https://avd.aquasec.com/nvd/cve-2022-1586)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-1587",
          "ruleIndex": 55,
          "level": "error",
          "message": {
            "text": "Package: libpcre2-8-0\nInstalled Version: 10.36-2\nVulnerability CVE-2022-1587\nSeverity: CRITICAL\nFixed Version: \nLink: [CVE-2022-1587](https://avd.aquasec.com/nvd/cve-2022-1587)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2017-11164",
          "ruleIndex": 56,
          "level": "note",
          "message": {
            "text": "Package: libpcre3\nInstalled Version: 2:8.39-13\nVulnerability CVE-2017-11164\nSeverity: LOW\nFixed Version: \nLink: [CVE-2017-11164](https://avd.aquasec.com/nvd/cve-2017-11164)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2017-16231",
          "ruleIndex": 57,
          "level": "note",
          "message": {
            "text": "Package: libpcre3\nInstalled Version: 2:8.39-13\nVulnerability CVE-2017-16231\nSeverity: LOW\nFixed Version: \nLink: [CVE-2017-16231](https://avd.aquasec.com/nvd/cve-2017-16231)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2017-7245",
          "ruleIndex": 58,
          "level": "note",
          "message": {
            "text": "Package: libpcre3\nInstalled Version: 2:8.39-13\nVulnerability CVE-2017-7245\nSeverity: LOW\nFixed Version: \nLink: [CVE-2017-7245](https://avd.aquasec.com/nvd/cve-2017-7245)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2017-7246",
          "ruleIndex": 59,
          "level": "note",
          "message": {
            "text": "Package: libpcre3\nInstalled Version: 2:8.39-13\nVulnerability CVE-2017-7246\nSeverity: LOW\nFixed Version: \nLink: [CVE-2017-7246](https://avd.aquasec.com/nvd/cve-2017-7246)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2019-20838",
          "ruleIndex": 60,
          "level": "note",
          "message": {
            "text": "Package: libpcre3\nInstalled Version: 2:8.39-13\nVulnerability CVE-2019-20838\nSeverity: LOW\nFixed Version: \nLink: [CVE-2019-20838](https://avd.aquasec.com/nvd/cve-2019-20838)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2019-6129",
          "ruleIndex": 61,
          "level": "note",
          "message": {
            "text": "Package: libpng16-16\nInstalled Version: 1.6.37-3\nVulnerability CVE-2019-6129\nSeverity: LOW\nFixed Version: \nLink: [CVE-2019-6129](https://avd.aquasec.com/nvd/cve-2019-6129)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-4214",
          "ruleIndex": 62,
          "level": "note",
          "message": {
            "text": "Package: libpng16-16\nInstalled Version: 1.6.37-3\nVulnerability CVE-2021-4214\nSeverity: LOW\nFixed Version: \nLink: [CVE-2021-4214](https://avd.aquasec.com/nvd/cve-2021-4214)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-36084",
          "ruleIndex": 63,
          "level": "note",
          "message": {
            "text": "Package: libsepol1\nInstalled Version: 3.1-1\nVulnerability CVE-2021-36084\nSeverity: LOW\nFixed Version: \nLink: [CVE-2021-36084](https://avd.aquasec.com/nvd/cve-2021-36084)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-36085",
          "ruleIndex": 64,
          "level": "note",
          "message": {
            "text": "Package: libsepol1\nInstalled Version: 3.1-1\nVulnerability CVE-2021-36085\nSeverity: LOW\nFixed Version: \nLink: [CVE-2021-36085](https://avd.aquasec.com/nvd/cve-2021-36085)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-36086",
          "ruleIndex": 65,
          "level": "note",
          "message": {
            "text": "Package: libsepol1\nInstalled Version: 3.1-1\nVulnerability CVE-2021-36086\nSeverity: LOW\nFixed Version: \nLink: [CVE-2021-36086](https://avd.aquasec.com/nvd/cve-2021-36086)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-36087",
          "ruleIndex": 66,
          "level": "note",
          "message": {
            "text": "Package: libsepol1\nInstalled Version: 3.1-1\nVulnerability CVE-2021-36087\nSeverity: LOW\nFixed Version: \nLink: [CVE-2021-36087](https://avd.aquasec.com/nvd/cve-2021-36087)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-0563",
          "ruleIndex": 1,
          "level": "note",
          "message": {
            "text": "Package: libsmartcols1\nInstalled Version: 2.36.1-8+deb11u1\nVulnerability CVE-2022-0563\nSeverity: LOW\nFixed Version: \nLink: [CVE-2022-0563](https://avd.aquasec.com/nvd/cve-2022-0563)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-1304",
          "ruleIndex": 22,
          "level": "error",
          "message": {
            "text": "Package: libss2\nInstalled Version: 1.46.2-2\nVulnerability CVE-2022-1304\nSeverity: HIGH\nFixed Version: \nLink: [CVE-2022-1304](https://avd.aquasec.com/nvd/cve-2022-1304)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-2068",
          "ruleIndex": 67,
          "level": "error",
          "message": {
            "text": "Package: libssl1.1\nInstalled Version: 1.1.1n-0+deb11u2\nVulnerability CVE-2022-2068\nSeverity: CRITICAL\nFixed Version: 1.1.1n-0+deb11u3\nLink: [CVE-2022-2068](https://avd.aquasec.com/nvd/cve-2022-2068)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-2097",
          "ruleIndex": 68,
          "level": "warning",
          "message": {
            "text": "Package: libssl1.1\nInstalled Version: 1.1.1n-0+deb11u2\nVulnerability CVE-2022-2097\nSeverity: MEDIUM\nFixed Version: \nLink: [CVE-2022-2097](https://avd.aquasec.com/nvd/cve-2022-2097)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2007-6755",
          "ruleIndex": 69,
          "level": "note",
          "message": {
            "text": "Package: libssl1.1\nInstalled Version: 1.1.1n-0+deb11u2\nVulnerability CVE-2007-6755\nSeverity: LOW\nFixed Version: \nLink: [CVE-2007-6755](https://avd.aquasec.com/nvd/cve-2007-6755)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2010-0928",
          "ruleIndex": 70,
          "level": "note",
          "message": {
            "text": "Package: libssl1.1\nInstalled Version: 1.1.1n-0+deb11u2\nVulnerability CVE-2010-0928\nSeverity: LOW\nFixed Version: \nLink: [CVE-2010-0928](https://avd.aquasec.com/nvd/cve-2010-0928)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2013-4392",
          "ruleIndex": 71,
          "level": "note",
          "message": {
            "text": "Package: libsystemd0\nInstalled Version: 247.3-7\nVulnerability CVE-2013-4392\nSeverity: LOW\nFixed Version: \nLink: [CVE-2013-4392](https://avd.aquasec.com/nvd/cve-2013-4392)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2020-13529",
          "ruleIndex": 72,
          "level": "note",
          "message": {
            "text": "Package: libsystemd0\nInstalled Version: 247.3-7\nVulnerability CVE-2020-13529\nSeverity: LOW\nFixed Version: \nLink: [CVE-2020-13529](https://avd.aquasec.com/nvd/cve-2020-13529)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-2867",
          "ruleIndex": 73,
          "level": "error",
          "message": {
            "text": "Package: libtiff5\nInstalled Version: 4.2.0-1+deb11u1\nVulnerability CVE-2022-2867\nSeverity: HIGH\nFixed Version: \nLink: [CVE-2022-2867](https://avd.aquasec.com/nvd/cve-2022-2867)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-2868",
          "ruleIndex": 74,
          "level": "error",
          "message": {
            "text": "Package: libtiff5\nInstalled Version: 4.2.0-1+deb11u1\nVulnerability CVE-2022-2868\nSeverity: HIGH\nFixed Version: \nLink: [CVE-2022-2868](https://avd.aquasec.com/nvd/cve-2022-2868)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-2869",
          "ruleIndex": 75,
          "level": "error",
          "message": {
            "text": "Package: libtiff5\nInstalled Version: 4.2.0-1+deb11u1\nVulnerability CVE-2022-2869\nSeverity: HIGH\nFixed Version: \nLink: [CVE-2022-2869](https://avd.aquasec.com/nvd/cve-2022-2869)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-1354",
          "ruleIndex": 76,
          "level": "warning",
          "message": {
            "text": "Package: libtiff5\nInstalled Version: 4.2.0-1+deb11u1\nVulnerability CVE-2022-1354\nSeverity: MEDIUM\nFixed Version: \nLink: [CVE-2022-1354](https://avd.aquasec.com/nvd/cve-2022-1354)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-1355",
          "ruleIndex": 77,
          "level": "warning",
          "message": {
            "text": "Package: libtiff5\nInstalled Version: 4.2.0-1+deb11u1\nVulnerability CVE-2022-1355\nSeverity: MEDIUM\nFixed Version: \nLink: [CVE-2022-1355](https://avd.aquasec.com/nvd/cve-2022-1355)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-1622",
          "ruleIndex": 78,
          "level": "warning",
          "message": {
            "text": "Package: libtiff5\nInstalled Version: 4.2.0-1+deb11u1\nVulnerability CVE-2022-1622\nSeverity: MEDIUM\nFixed Version: \nLink: [CVE-2022-1622](https://avd.aquasec.com/nvd/cve-2022-1622)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-1623",
          "ruleIndex": 79,
          "level": "warning",
          "message": {
            "text": "Package: libtiff5\nInstalled Version: 4.2.0-1+deb11u1\nVulnerability CVE-2022-1623\nSeverity: MEDIUM\nFixed Version: \nLink: [CVE-2022-1623](https://avd.aquasec.com/nvd/cve-2022-1623)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-2056",
          "ruleIndex": 80,
          "level": "warning",
          "message": {
            "text": "Package: libtiff5\nInstalled Version: 4.2.0-1+deb11u1\nVulnerability CVE-2022-2056\nSeverity: MEDIUM\nFixed Version: \nLink: [CVE-2022-2056](https://avd.aquasec.com/nvd/cve-2022-2056)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-2057",
          "ruleIndex": 81,
          "level": "warning",
          "message": {
            "text": "Package: libtiff5\nInstalled Version: 4.2.0-1+deb11u1\nVulnerability CVE-2022-2057\nSeverity: MEDIUM\nFixed Version: \nLink: [CVE-2022-2057](https://avd.aquasec.com/nvd/cve-2022-2057)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-2058",
          "ruleIndex": 82,
          "level": "warning",
          "message": {
            "text": "Package: libtiff5\nInstalled Version: 4.2.0-1+deb11u1\nVulnerability CVE-2022-2058\nSeverity: MEDIUM\nFixed Version: \nLink: [CVE-2022-2058](https://avd.aquasec.com/nvd/cve-2022-2058)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-34526",
          "ruleIndex": 83,
          "level": "warning",
          "message": {
            "text": "Package: libtiff5\nInstalled Version: 4.2.0-1+deb11u1\nVulnerability CVE-2022-34526\nSeverity: MEDIUM\nFixed Version: \nLink: [CVE-2022-34526](https://avd.aquasec.com/nvd/cve-2022-34526)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2014-8130",
          "ruleIndex": 84,
          "level": "note",
          "message": {
            "text": "Package: libtiff5\nInstalled Version: 4.2.0-1+deb11u1\nVulnerability CVE-2014-8130\nSeverity: LOW\nFixed Version: \nLink: [CVE-2014-8130](https://avd.aquasec.com/nvd/cve-2014-8130)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2017-16232",
          "ruleIndex": 85,
          "level": "note",
          "message": {
            "text": "Package: libtiff5\nInstalled Version: 4.2.0-1+deb11u1\nVulnerability CVE-2017-16232\nSeverity: LOW\nFixed Version: \nLink: [CVE-2017-16232](https://avd.aquasec.com/nvd/cve-2017-16232)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2017-17973",
          "ruleIndex": 86,
          "level": "note",
          "message": {
            "text": "Package: libtiff5\nInstalled Version: 4.2.0-1+deb11u1\nVulnerability CVE-2017-17973\nSeverity: LOW\nFixed Version: \nLink: [CVE-2017-17973](https://avd.aquasec.com/nvd/cve-2017-17973)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2017-5563",
          "ruleIndex": 87,
          "level": "note",
          "message": {
            "text": "Package: libtiff5\nInstalled Version: 4.2.0-1+deb11u1\nVulnerability CVE-2017-5563\nSeverity: LOW\nFixed Version: \nLink: [CVE-2017-5563](https://avd.aquasec.com/nvd/cve-2017-5563)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2017-9117",
          "ruleIndex": 88,
          "level": "note",
          "message": {
            "text": "Package: libtiff5\nInstalled Version: 4.2.0-1+deb11u1\nVulnerability CVE-2017-9117\nSeverity: LOW\nFixed Version: \nLink: [CVE-2017-9117](https://avd.aquasec.com/nvd/cve-2017-9117)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2018-10126",
          "ruleIndex": 89,
          "level": "note",
          "message": {
            "text": "Package: libtiff5\nInstalled Version: 4.2.0-1+deb11u1\nVulnerability CVE-2018-10126\nSeverity: LOW\nFixed Version: \nLink: [CVE-2018-10126](https://avd.aquasec.com/nvd/cve-2018-10126)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-1056",
          "ruleIndex": 90,
          "level": "note",
          "message": {
            "text": "Package: libtiff5\nInstalled Version: 4.2.0-1+deb11u1\nVulnerability CVE-2022-1056\nSeverity: LOW\nFixed Version: \nLink: [CVE-2022-1056](https://avd.aquasec.com/nvd/cve-2022-1056)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-1210",
          "ruleIndex": 91,
          "level": "note",
          "message": {
            "text": "Package: libtiff5\nInstalled Version: 4.2.0-1+deb11u1\nVulnerability CVE-2022-1210\nSeverity: LOW\nFixed Version: \nLink: [CVE-2022-1210](https://avd.aquasec.com/nvd/cve-2022-1210)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-2519",
          "ruleIndex": 92,
          "level": "note",
          "message": {
            "text": "Package: libtiff5\nInstalled Version: 4.2.0-1+deb11u1\nVulnerability CVE-2022-2519\nSeverity: LOW\nFixed Version: \nLink: [CVE-2022-2519](https://avd.aquasec.com/nvd/cve-2022-2519)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-2520",
          "ruleIndex": 93,
          "level": "note",
          "message": {
            "text": "Package: libtiff5\nInstalled Version: 4.2.0-1+deb11u1\nVulnerability CVE-2022-2520\nSeverity: LOW\nFixed Version: \nLink: [CVE-2022-2520](https://avd.aquasec.com/nvd/cve-2022-2520)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-2521",
          "ruleIndex": 94,
          "level": "note",
          "message": {
            "text": "Package: libtiff5\nInstalled Version: 4.2.0-1+deb11u1\nVulnerability CVE-2022-2521\nSeverity: LOW\nFixed Version: \nLink: [CVE-2022-2521](https://avd.aquasec.com/nvd/cve-2022-2521)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-2953",
          "ruleIndex": 95,
          "level": "note",
          "message": {
            "text": "Package: libtiff5\nInstalled Version: 4.2.0-1+deb11u1\nVulnerability CVE-2022-2953\nSeverity: LOW\nFixed Version: \nLink: [CVE-2022-2953](https://avd.aquasec.com/nvd/cve-2022-2953)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-29458",
          "ruleIndex": 96,
          "level": "error",
          "message": {
            "text": "Package: libtinfo6\nInstalled Version: 6.2+20201114-2\nVulnerability CVE-2022-29458\nSeverity: HIGH\nFixed Version: \nLink: [CVE-2022-29458](https://avd.aquasec.com/nvd/cve-2022-29458)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-39537",
          "ruleIndex": 97,
          "level": "note",
          "message": {
            "text": "Package: libtinfo6\nInstalled Version: 6.2+20201114-2\nVulnerability CVE-2021-39537\nSeverity: LOW\nFixed Version: \nLink: [CVE-2021-39537](https://avd.aquasec.com/nvd/cve-2021-39537)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-46828",
          "ruleIndex": 98,
          "level": "error",
          "message": {
            "text": "Package: libtirpc-common\nInstalled Version: 1.3.1-1\nVulnerability CVE-2021-46828\nSeverity: HIGH\nFixed Version: 1.3.1-1+deb11u1\nLink: [CVE-2021-46828](https://avd.aquasec.com/nvd/cve-2021-46828)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-46828",
          "ruleIndex": 98,
          "level": "error",
          "message": {
            "text": "Package: libtirpc3\nInstalled Version: 1.3.1-1\nVulnerability CVE-2021-46828\nSeverity: HIGH\nFixed Version: 1.3.1-1+deb11u1\nLink: [CVE-2021-46828](https://avd.aquasec.com/nvd/cve-2021-46828)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2013-4392",
          "ruleIndex": 71,
          "level": "note",
          "message": {
            "text": "Package: libudev1\nInstalled Version: 247.3-7\nVulnerability CVE-2013-4392\nSeverity: LOW\nFixed Version: \nLink: [CVE-2013-4392](https://avd.aquasec.com/nvd/cve-2013-4392)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2020-13529",
          "ruleIndex": 72,
          "level": "note",
          "message": {
            "text": "Package: libudev1\nInstalled Version: 247.3-7\nVulnerability CVE-2020-13529\nSeverity: LOW\nFixed Version: \nLink: [CVE-2020-13529](https://avd.aquasec.com/nvd/cve-2020-13529)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-0563",
          "ruleIndex": 1,
          "level": "note",
          "message": {
            "text": "Package: libuuid1\nInstalled Version: 2.36.1-8+deb11u1\nVulnerability CVE-2022-0563\nSeverity: LOW\nFixed Version: \nLink: [CVE-2022-0563](https://avd.aquasec.com/nvd/cve-2022-0563)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2016-9085",
          "ruleIndex": 99,
          "level": "note",
          "message": {
            "text": "Package: libwebp6\nInstalled Version: 0.6.1-2.1\nVulnerability CVE-2016-9085\nSeverity: LOW\nFixed Version: \nLink: [CVE-2016-9085](https://avd.aquasec.com/nvd/cve-2016-9085)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2016-3709",
          "ruleIndex": 100,
          "level": "warning",
          "message": {
            "text": "Package: libxml2\nInstalled Version: 2.9.10+dfsg-6.7+deb11u2\nVulnerability CVE-2016-3709\nSeverity: MEDIUM\nFixed Version: \nLink: [CVE-2016-3709](https://avd.aquasec.com/nvd/cve-2016-3709)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-30560",
          "ruleIndex": 101,
          "level": "error",
          "message": {
            "text": "Package: libxslt1.1\nInstalled Version: 1.1.34-4\nVulnerability CVE-2021-30560\nSeverity: HIGH\nFixed Version: 1.1.34-4+deb11u1\nLink: [CVE-2021-30560](https://avd.aquasec.com/nvd/cve-2021-30560)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2015-9019",
          "ruleIndex": 102,
          "level": "note",
          "message": {
            "text": "Package: libxslt1.1\nInstalled Version: 1.1.34-4\nVulnerability CVE-2015-9019\nSeverity: LOW\nFixed Version: \nLink: [CVE-2015-9019](https://avd.aquasec.com/nvd/cve-2015-9019)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2007-5686",
          "ruleIndex": 103,
          "level": "note",
          "message": {
            "text": "Package: login\nInstalled Version: 1:4.8.1-1\nVulnerability CVE-2007-5686\nSeverity: LOW\nFixed Version: \nLink: [CVE-2007-5686](https://avd.aquasec.com/nvd/cve-2007-5686)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2013-4235",
          "ruleIndex": 104,
          "level": "note",
          "message": {
            "text": "Package: login\nInstalled Version: 1:4.8.1-1\nVulnerability CVE-2013-4235\nSeverity: LOW\nFixed Version: \nLink: [CVE-2013-4235](https://avd.aquasec.com/nvd/cve-2013-4235)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2019-19882",
          "ruleIndex": 105,
          "level": "note",
          "message": {
            "text": "Package: login\nInstalled Version: 1:4.8.1-1\nVulnerability CVE-2019-19882\nSeverity: LOW\nFixed Version: \nLink: [CVE-2019-19882](https://avd.aquasec.com/nvd/cve-2019-19882)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-1304",
          "ruleIndex": 22,
          "level": "error",
          "message": {
            "text": "Package: logsave\nInstalled Version: 1.46.2-2\nVulnerability CVE-2022-1304\nSeverity: HIGH\nFixed Version: \nLink: [CVE-2022-1304](https://avd.aquasec.com/nvd/cve-2022-1304)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-0563",
          "ruleIndex": 1,
          "level": "note",
          "message": {
            "text": "Package: mount\nInstalled Version: 2.36.1-8+deb11u1\nVulnerability CVE-2022-0563\nSeverity: LOW\nFixed Version: \nLink: [CVE-2022-0563](https://avd.aquasec.com/nvd/cve-2022-0563)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-29458",
          "ruleIndex": 96,
          "level": "error",
          "message": {
            "text": "Package: ncurses-base\nInstalled Version: 6.2+20201114-2\nVulnerability CVE-2022-29458\nSeverity: HIGH\nFixed Version: \nLink: [CVE-2022-29458](https://avd.aquasec.com/nvd/cve-2022-29458)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-39537",
          "ruleIndex": 97,
          "level": "note",
          "message": {
            "text": "Package: ncurses-base\nInstalled Version: 6.2+20201114-2\nVulnerability CVE-2021-39537\nSeverity: LOW\nFixed Version: \nLink: [CVE-2021-39537](https://avd.aquasec.com/nvd/cve-2021-39537)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-29458",
          "ruleIndex": 96,
          "level": "error",
          "message": {
            "text": "Package: ncurses-bin\nInstalled Version: 6.2+20201114-2\nVulnerability CVE-2022-29458\nSeverity: HIGH\nFixed Version: \nLink: [CVE-2022-29458](https://avd.aquasec.com/nvd/cve-2022-29458)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2021-39537",
          "ruleIndex": 97,
          "level": "note",
          "message": {
            "text": "Package: ncurses-bin\nInstalled Version: 6.2+20201114-2\nVulnerability CVE-2021-39537\nSeverity: LOW\nFixed Version: \nLink: [CVE-2021-39537](https://avd.aquasec.com/nvd/cve-2021-39537)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2020-36309",
          "ruleIndex": 106,
          "level": "warning",
          "message": {
            "text": "Package: nginx\nInstalled Version: 1.23.0-1~bullseye\nVulnerability CVE-2020-36309\nSeverity: MEDIUM\nFixed Version: \nLink: [CVE-2020-36309](https://avd.aquasec.com/nvd/cve-2020-36309)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2009-4487",
          "ruleIndex": 107,
          "level": "note",
          "message": {
            "text": "Package: nginx\nInstalled Version: 1.23.0-1~bullseye\nVulnerability CVE-2009-4487\nSeverity: LOW\nFixed Version: \nLink: [CVE-2009-4487](https://avd.aquasec.com/nvd/cve-2009-4487)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2013-0337",
          "ruleIndex": 108,
          "level": "note",
          "message": {
            "text": "Package: nginx\nInstalled Version: 1.23.0-1~bullseye\nVulnerability CVE-2013-0337\nSeverity: LOW\nFixed Version: \nLink: [CVE-2013-0337](https://avd.aquasec.com/nvd/cve-2013-0337)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-2068",
          "ruleIndex": 67,
          "level": "error",
          "message": {
            "text": "Package: openssl\nInstalled Version: 1.1.1n-0+deb11u2\nVulnerability CVE-2022-2068\nSeverity: CRITICAL\nFixed Version: 1.1.1n-0+deb11u3\nLink: [CVE-2022-2068](https://avd.aquasec.com/nvd/cve-2022-2068)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-2097",
          "ruleIndex": 68,
          "level": "warning",
          "message": {
            "text": "Package: openssl\nInstalled Version: 1.1.1n-0+deb11u2\nVulnerability CVE-2022-2097\nSeverity: MEDIUM\nFixed Version: \nLink: [CVE-2022-2097](https://avd.aquasec.com/nvd/cve-2022-2097)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2007-6755",
          "ruleIndex": 69,
          "level": "note",
          "message": {
            "text": "Package: openssl\nInstalled Version: 1.1.1n-0+deb11u2\nVulnerability CVE-2007-6755\nSeverity: LOW\nFixed Version: \nLink: [CVE-2007-6755](https://avd.aquasec.com/nvd/cve-2007-6755)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2010-0928",
          "ruleIndex": 70,
          "level": "note",
          "message": {
            "text": "Package: openssl\nInstalled Version: 1.1.1n-0+deb11u2\nVulnerability CVE-2010-0928\nSeverity: LOW\nFixed Version: \nLink: [CVE-2010-0928](https://avd.aquasec.com/nvd/cve-2010-0928)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2007-5686",
          "ruleIndex": 103,
          "level": "note",
          "message": {
            "text": "Package: passwd\nInstalled Version: 1:4.8.1-1\nVulnerability CVE-2007-5686\nSeverity: LOW\nFixed Version: \nLink: [CVE-2007-5686](https://avd.aquasec.com/nvd/cve-2007-5686)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2013-4235",
          "ruleIndex": 104,
          "level": "note",
          "message": {
            "text": "Package: passwd\nInstalled Version: 1:4.8.1-1\nVulnerability CVE-2013-4235\nSeverity: LOW\nFixed Version: \nLink: [CVE-2013-4235](https://avd.aquasec.com/nvd/cve-2013-4235)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2019-19882",
          "ruleIndex": 105,
          "level": "note",
          "message": {
            "text": "Package: passwd\nInstalled Version: 1:4.8.1-1\nVulnerability CVE-2019-19882\nSeverity: LOW\nFixed Version: \nLink: [CVE-2019-19882](https://avd.aquasec.com/nvd/cve-2019-19882)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2020-16156",
          "ruleIndex": 109,
          "level": "error",
          "message": {
            "text": "Package: perl-base\nInstalled Version: 5.32.1-4+deb11u2\nVulnerability CVE-2020-16156\nSeverity: HIGH\nFixed Version: \nLink: [CVE-2020-16156](https://avd.aquasec.com/nvd/cve-2020-16156)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2011-4116",
          "ruleIndex": 110,
          "level": "note",
          "message": {
            "text": "Package: perl-base\nInstalled Version: 5.32.1-4+deb11u2\nVulnerability CVE-2011-4116\nSeverity: LOW\nFixed Version: \nLink: [CVE-2011-4116](https://avd.aquasec.com/nvd/cve-2011-4116)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2005-2541",
          "ruleIndex": 111,
          "level": "note",
          "message": {
            "text": "Package: tar\nInstalled Version: 1.34+dfsg-1\nVulnerability CVE-2005-2541\nSeverity: LOW\nFixed Version: \nLink: [CVE-2005-2541](https://avd.aquasec.com/nvd/cve-2005-2541)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-0563",
          "ruleIndex": 1,
          "level": "note",
          "message": {
            "text": "Package: util-linux\nInstalled Version: 2.36.1-8+deb11u1\nVulnerability CVE-2022-0563\nSeverity: LOW\nFixed Version: \nLink: [CVE-2022-0563](https://avd.aquasec.com/nvd/cve-2022-0563)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        },
        {
          "ruleId": "CVE-2022-37434",
          "ruleIndex": 112,
          "level": "error",
          "message": {
            "text": "Package: zlib1g\nInstalled Version: 1:1.2.11.dfsg-2+deb11u1\nVulnerability CVE-2022-37434\nSeverity: CRITICAL\nFixed Version: 1:1.2.11.dfsg-2+deb11u2\nLink: [CVE-2022-37434](https://avd.aquasec.com/nvd/cve-2022-37434)"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "chainguard-demo/nginx-trivy",
                  "uriBaseId": "ROOTPATH"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              }
            }
          ]
        }
      ],
      "columnKind": "utf16CodeUnits",
      "originalUriBaseIds": {
        "ROOTPATH": {
          "uri": "file:///"
        }
      }
    }
  ]
}
    },
    "metadata": {
      "scanStartedOn": "2022-09-08T23:42:50Z",
      "scanFinishedOn": "2022-09-08T23:42:50Z"
    }
}