cravex2-reachability: Expose reachability in API

[pombredanne]

API Code to expose reachability results for integration in DejaCode CRAVEX/ vulnerability management

[ziadhany]

@tdruez, as I understand it, we have code to run a Scancode pipeline in DejaCode and get the output

The reachability pipeline will return a JSON output file structured like this:

{
  "pypa/nova/PYSEC-2012-36": {
    "reachable": "UNKNOWN",
    "details": [
      {
        "resource_path": "nova-18.2.0/nova/api/ec2/cloud.py",
        "patch": {
          "vcs_url": "https://github.com/openstack/nova",
          "commit_hash": "8c8735a73afb16d5856f0aa6088e9ae406c52beb"
        },
        "reachability_status": "NO",
        "evidence": [{...}],
        "vulnerable_symbols": [],
        "fixed_symbols": [
          "CloudController"
        ]
      },
    {...}
    ]},
   "pysec/PYSEC-2012-41": {...}
}

and every affected resource file will have the extra data with symbols_reachability details

ex:

symbols_reachability:
  - patch:
      vcs_url: https://github.com/backblaze/b2-sdk-python
      commit_hash: 62476638986e5b6d7459aca5ef8ce220760226e0
    evidence:
      - called: yes
        defined: yes
        imported: no
        fingerprint: 43b2cc475fd9704759ab9c05a4e96e2b24859f9c63873773db7c35fc4ff09991
        symbol_name: SqliteAccountInfo._create_database
        reachable_from:
          - SqliteAccountInfo._validate_database
      - called: no
        defined: yes
        imported: no
        fingerprint: 8878c1a51c52f9f13f4e877c072a045ef5104ae4eeebadec92ba28f19a792e9f
        symbol_name: SqliteAccountInfo
        reachable_from: []
    advisory_uids:
      - pypa/b2sdk/PYSEC-2022-33
    fixed_symbols:
      - SqliteAccountInfo
      - SqliteAccountInfo._create_database
    vulnerable_symbols:
      - SqliteAccountInfo
      - SqliteAccountInfo._create_database
    reachability_status: YES

Do we need to implement any additional code to expose the reachability results ?

[tdruez]

we have code to run a Scancode pipeline in DejaCode and get the output

Not exactly, DejaCode does not "run ScanCode pipeline", it imports results directly from the ScanCode.io API.

The reachability pipeline will return a JSON output file structured like this
Do we need to implement any additional code to expose the reachability results ?

It should store the reachability data in the database, along the relevant models and make that data available through the REST API.

[ziadhany]

the new pipeline output structure:

{
  "purl": "pkg:pypi/b2sdk@1.14.0",
  "advisories": [
    {
      "advisory_uid": "pypa/b2sdk/PYSEC-2022-33",
      "is_reachable": "yes",
      "details": [
        {
          "resource_path": "b2sdk-1.14.0/b2sdk/account_info/sqlite_account_info.py",
          "patch": {
            "vcs_url": "https://github.com/backblaze/b2-sdk-python",
            "commit_hash": "62476638986e5b6d7459aca5ef8ce220760226e0"
          },
          "is_reachable": "yes",
          "tool_details": {
            "vulnerable_details": [
              {
                "symbol_name": "SqliteAccountInfo._create_database",
                "is_called": true,
                "is_defined": true,
                "is_imported": false,
                "is_exact": true,
                "reachable_from": [
                  "SqliteAccountInfo._validate_database"
                ]
              },
              {
                "symbol_name": "SqliteAccountInfo",
                "is_called": false,
                "is_defined": true,
                "is_imported": false,
                "is_exact": true,
                "reachable_from": []
              }
            ],
            "fixed_details": [
              {
                "symbol_name": "SqliteAccountInfo._create_database",
                "is_called": true,
                "is_defined": true,
                "is_imported": false,
                "is_exact": false,
                "reachable_from": [
                  "SqliteAccountInfo._validate_database"
                ]
              },
              {
                "symbol_name": "SqliteAccountInfo",
                "is_called": false,
                "is_defined": true,
                "is_imported": false,
                "is_exact": false,
                "reachable_from": []
              }
            ]
          },
          "vulnerable_symbols": [
            "SqliteAccountInfo",
            "SqliteAccountInfo._create_database"
          ],
          "fixed_symbols": [
            "SqliteAccountInfo",
            "SqliteAccountInfo._create_database"
          ]
        }
      ]
    }
  ]
}

[tdruez]

the new pipeline output structure

@ziadhany could you clarify the availability of this data in the REST API?

As discussed, the is_reachable and its details should be added to the affected_by_vulnerabilities data to be easily consumed by API integrations as required for aboutcode-org/dejacode#368

Also, in that context, the details is too generic, I would suggest using something along reachability_analysis instead.

---

Expected structure:

"affected_by_vulnerabilities": [
    {
        "advisory_id": "GHSA-xxxxxx",
        "advisory_uid": "github_osv/GHSA-xxxxxxx",
        "aliases": [
            "CVE-xxxxxxx"
        ],
        "summary": "....",
        "risk_score": 3.9,
        "ssvc_trees": [],
        "exploitability": 0.5,
        "fixed_in_patches": [],
        "fixed_by_packages": [
            "pkg:pypi/black@26.3.1"
        ],
        "weighted_severity": 7.8,
        "introduced_in_patches": []

        # NEW ENTRIES
        "is_reachable": "yes",
        "reachability_analysis": [....]
    }
]

[ziadhany]

@tdruez According to my understanding, it will be GET /api/projects/{project_id}/packages/. However, to get the data, you need to run the fetch_vulnerabilities and analyze_symbols_reachability pipelines first. The analyze_symbols_reachability pipeline will save the data in the affected_by_vulnerabilities field.

After that, the data will be available at GET /api/projects/{project_id}/packages/.

{
    "count": 1,
    "next": null,
    "previous": null,
    "results": [
        {
            "purl": "pkg:pypi/b2sdk@1.14.0",
            "type": "pypi",
            "namespace": "",
            "name": "b2sdk",
            "version": "1.14.0",
            "qualifiers": "",
            "subpath": "",
            "tag": "",
            "primary_language": "Python",
            "description": "...",
            "notes": "",
            "release_date": null,
            "parties": [..],
            "keywords": [],
            "homepage_url": "https://github.com/Backblaze/b2-sdk-python",
            "download_url": "",
            "bug_tracking_url": "",
            "code_view_url": "",
            "vcs_url": "",
            "repository_homepage_url": "https://pypi.org/project/b2sdk",
            .....
            "affected_by_vulnerabilities": [
                {
                    "advisory_id": "GHSA-xxxxxx",
                    "advisory_uid": "github_osv/GHSA-xxxxxxx",
                    "aliases": [
                        "CVE-xxxxxxx"
                    ],
                    "summary": "....",
                    "risk_score": 3.9,
                    "ssvc_trees": [],
                    "exploitability": 0.5,
                    "fixed_in_patches": [],
                    "fixed_by_packages": [
                        "pkg:pypi/black@26.3.1"
                    ],
                    "weighted_severity": 7.8,
                    "introduced_in_patches": []
            
                    # NEW ENTRIES
                    "is_reachable": "yes",
                    "reachability_analysis": [....]
                }
            ]
        }
    ]
}

Is this the right approach, or do I need to change anything?

[tdruez]

Yes, both pipeline runs are required.

After that, the data will be available at GET /api/projects/{project_id}/packages/

Right, it should also be available in the /api/projects/{project_id}/dependencies/ which should not be an issue as affected_by_vulnerabilities has the same implementation for packages and dependencies .

[ziadhany]

Done! Implemented API Code to expose reachability results for integration in DejaCode CRAVEX/ vulnerability management

see:

• cravex2-reachability: Expose reachability in API  #2213

You can view updated API response examples for both endpoints:

• GET /api/projects/{project_id}/packages/

API output Example

{
    "count": 1,
    "next": null,
    "previous": null,
    "results": [
        {
            "purl": "pkg:pypi/b2sdk@1.14.0",
            "type": "pypi",
            "namespace": "",
            "name": "b2sdk",
            "version": "1.14.0",
            "qualifiers": "",
            "subpath": "",
            "tag": "",
            "primary_language": "Python",
            "description": "Backblaze B2 SDK\n# B2 Python SDK\n&nbsp;[![Continuous Integration](https://github.com/Backblaze/b2-sdk-python/workflows/Continuous%20Integration/badge.svg)](https://github.com/Backblaze/b2-sdk-python/actions?query=workflow%3A%22Continuous+Integration%22)&nbsp;[![License](https://img.shields.io/pypi/l/b2sdk.svg?label=License)](https://pypi.python.org/pypi/b2)&nbsp;[![python versions](https://img.shields.io/pypi/pyversions/b2sdk.svg?label=python%20versions)](https://pypi.python.org/pypi/b2sdk)&nbsp;[![PyPI version](https://img.shields.io/pypi/v/b2sdk.svg?label=PyPI%20version)](https://pypi.python.org/pypi/b2sdk)&nbsp;[![Docs](https://readthedocs.org/projects/b2-sdk-python/badge/?version=master)](https://b2-sdk-python.readthedocs.io/en/master/)\n\n\n\nThis repository contains a client library and a few handy utilities for easy access to all of the capabilities of B2 Cloud Storage.\n\n[B2 command-line tool](https://github.com/Backblaze/B2_Command_Line_Tool) is an example of how it can be used to provide command-line access to the B2 service, but there are many possible applications (including FUSE filesystems, storage backend drivers for backup applications etc).\n\n# Documentation\n\nThe latest documentation is available on [Read the Docs](https://b2-sdk-python.readthedocs.io).\n\n# Installation\n\nThe sdk can be installed with:\n\n    pip install b2sdk\n\n# Version policy\n\nb2sdk follows [Semantic Versioning](https://semver.org/) policy, so in essence the version number is MAJOR.MINOR.PATCH (for example 1.2.3) and:\n- we increase MAJOR version when we make incompatible API changes\n- we increase MINOR version when we add functionality in a backwards-compatible manner, and\n- we increase PATCH version when we make backwards-compatible bug fixes (unless someone relies on the undocumented behavior of a fixed bug)\n\nTherefore when setting up b2sdk as a dependency, please make sure to match the version appropriately, for example you could put this in your `requirements.txt` to make sure your code is compatible with the `b2sdk` version your user will get from pypi:\n\n```\nb2sdk>=0.0.0,<1.0.0\n```\n\n# Release History\n\nPlease refer to the [changelog](CHANGELOG.md).\n\n# Developer Info\n\nPlease see our [contributing guidelines](CONTRIBUTING.md).",
            "notes": "",
            "release_date": null,
            "parties": [
                {
                    "url": null,
                    "name": "Backblaze, Inc.",
                    "role": "author",
                    "type": "person",
                    "email": "support@backblaze.com"
                }
            ],
            "keywords": [
                "backblaze b2 cloud storage",
                "Development Status :: 5 - Production/Stable",
                "Intended Audience :: Developers",
                "Topic :: Software Development :: Libraries",
                "Programming Language :: Python :: 3",
                "Programming Language :: Python :: 3.5",
                "Programming Language :: Python :: 3.6",
                "Programming Language :: Python :: 3.7",
                "Programming Language :: Python :: 3.8",
                "Programming Language :: Python :: 3.9",
                "Programming Language :: Python :: 3.10"
            ],
            "homepage_url": "https://github.com/Backblaze/b2-sdk-python",
            "download_url": "",
            "bug_tracking_url": "",
            "code_view_url": "",
            "vcs_url": "",
            "repository_homepage_url": "https://pypi.org/project/b2sdk",
            "repository_download_url": "https://pypi.org/packages/source/b/b2sdk/b2sdk-1.14.0.tar.gz",
            "api_data_url": "https://pypi.org/pypi/b2sdk/1.14.0/json",
            "size": null,
            "md5": "",
            "sha1": "",
            "sha256": "",
            "sha512": "",
            "copyright": "",
            "holder": "",
            "declared_license_expression": "mit",
            "declared_license_expression_spdx": "MIT",
            "license_detections": [
                {
                    "matches": [
                        {
                            "score": 100.0,
                            "matcher": "1-spdx-id",
                            "end_line": 1,
                            "rule_url": null,
                            "from_file": "codebase/b2sdk-1.14.0/b2sdk.egg-info/PKG-INFO",
                            "start_line": 1,
                            "matched_text": "MIT",
                            "match_coverage": 100.0,
                            "matched_length": 1,
                            "rule_relevance": 100,
                            "rule_identifier": "spdx-license-identifier-mit-5da48780aba670b0860c46d899ed42a0f243ff06",
                            "license_expression": "mit",
                            "license_expression_spdx": "MIT"
                        }
                    ],
                    "identifier": "mit-a822f434-d61f-f2b1-c792-8b8cb9e7b9bf",
                    "license_expression": "mit",
                    "license_expression_spdx": "MIT"
                },
                {
                    "matches": [
                        {
                            "score": 100.0,
                            "matcher": "1-hash",
                            "end_line": 1,
                            "rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/pypi_mit_license.RULE",
                            "from_file": "codebase/b2sdk-1.14.0/b2sdk.egg-info/PKG-INFO",
                            "start_line": 1,
                            "matched_text": "- 'License :: OSI Approved :: MIT License'",
                            "match_coverage": 100.0,
                            "matched_length": 5,
                            "rule_relevance": 100,
                            "rule_identifier": "pypi_mit_license.RULE",
                            "license_expression": "mit",
                            "license_expression_spdx": "MIT"
                        }
                    ],
                    "identifier": "mit-24a5293c-14d7-5403-efac-1a8b7532c0e8",
                    "license_expression": "mit",
                    "license_expression_spdx": "MIT"
                }
            ],
            "other_license_expression": "",
            "other_license_expression_spdx": "",
            "other_license_detections": [],
            "extracted_license_statement": "license: MIT\nclassifiers:\n  - 'License :: OSI Approved :: MIT License'\n",
            "compliance_alert": "",
            "notice_text": "",
            "source_packages": [],
            "extra_data": {
                "license_file": "LICENSE"
            },
            "package_uid": "pkg:pypi/b2sdk@1.14.0?uuid=f38257f7-ded4-4955-b6c2-9d6e22e3aa47",
            "is_private": false,
            "is_virtual": false,
            "datasource_ids": [
                "pypi_editable_egg_pkginfo"
            ],
            "datafile_paths": [
                "b2sdk-1.14.0/b2sdk.egg-info/PKG-INFO"
            ],
            "file_references": [],
            "missing_resources": [],
            "modified_resources": [],
            "affected_by_vulnerabilities": [
                {
                    "aliases": [
                        "CVE-2022-23651",
                        "GHSA-p867-fxfr-ph2w"
                    ],
                    "summary": "b2-sdk-python is a python library to access cloud storage provided by backblaze. Linux and Mac releases of the SDK version 1.14.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by local attackers through a time-of-check-time-of-use (TOCTOU) race condition. SDK users of the SqliteAccountInfo format are vulnerable while users of the InMemoryAccountInfo format are safe. The SqliteAccountInfo saves API keys (and bucket name-to-id mapping) in a local database file ($XDG_CONFIG_HOME/b2/account_info, ~/.b2_account_info or a user-defined path). When first created, the file is world readable and is (typically a few milliseconds) later altered to be private to the user. If the directory containing the file is readable by a local attacker then during the brief period between file creation and permission modification, a local attacker can race to open the file and maintain a handle to it. This allows the local attacker to read the contents after the file after the sensitive information has been saved to it. Consumers of this SDK who rely on it to save data using SqliteAccountInfo class should upgrade to the latest version of the SDK. Those who believe a local user might have opened a handle using this race condition, should remove the affected database files and regenerate all application keys. Users should upgrade to b2-sdk-python 1.14.1 or later.",
                    "risk_score": 2.6,
                    "ssvc_trees": [
                        {
                            "vector": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T14:10:06Z/",
                            "options": [
                                {
                                    "Exploitation": "none"
                                },
                                {
                                    "Automatable": "no"
                                },
                                {
                                    "Technical Impact": "partial"
                                },
                                {
                                    "Mission Prevalence": "minimal"
                                },
                                {
                                    "Public Well-being Impact": "material"
                                },
                                {
                                    "Mission & Well-being": "medium"
                                }
                            ],
                            "decision": "Track",
                            "source_url": "https://github.com/cisagov/vulnrichment/blob/develop/2022/23xxx/CVE-2022-23651.json"
                        }
                    ],
                    "advisory_id": "PYSEC-2022-33",
                    "advisory_uid": "pypa/b2sdk/PYSEC-2022-33",
                    "is_reachable": "yes",
                    "resource_url": "http://public.vulnerablecode.io/advisories/pypa/b2sdk/PYSEC-2022-33",
                    "exploitability": 0.5,
                    "fixed_in_patches": [
                        {
                            "vcs_url": "https://github.com/backblaze/b2-sdk-python",
                            "commit_hash": "62476638986e5b6d7459aca5ef8ce220760226e0"
                        }
                    ],
                    "fixed_by_packages": [
                        "pkg:pypi/b2sdk@1.14.1"
                    ],
                    "weighted_severity": 5.1,
                    "introduced_in_patches": [],
                    "reachability_analysis": [
                        {
                            "patch": {
                                "vcs_url": "https://github.com/backblaze/b2-sdk-python",
                                "commit_hash": "62476638986e5b6d7459aca5ef8ce220760226e0"
                            },
                            "is_reachable": "yes",
                            "tool_details": [
                                {
                                    "is_exact": true,
                                    "is_called": true,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "SqliteAccountInfo._create_database",
                                    "reachable_from": [
                                        "SqliteAccountInfo._validate_database"
                                    ]
                                },
                                {
                                    "is_exact": true,
                                    "is_called": false,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "SqliteAccountInfo",
                                    "reachable_from": []
                                }
                            ],
                            "fixed_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database"
                            ],
                            "resource_path": "b2sdk-1.14.0/b2sdk/account_info/sqlite_account_info.py",
                            "vulnerable_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database"
                            ]
                        },
                        {
                            "patch": {
                                "vcs_url": "https://github.com/backblaze/b2-sdk-python",
                                "commit_hash": "62476638986e5b6d7459aca5ef8ce220760226e0"
                            },
                            "is_reachable": "yes",
                            "tool_details": [
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo._create_database",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": false,
                                    "is_called": true,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo",
                                    "reachable_from": [
                                        "test_upload_url_concurrency"
                                    ]
                                }
                            ],
                            "fixed_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database",
                                "SqliteAccountInfo._create_database.fd"
                            ],
                            "resource_path": "b2sdk-1.14.0/b2sdk/account_info/test_upload_url_concurrency.py",
                            "vulnerable_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database"
                            ]
                        },
                        {
                            "patch": {
                                "vcs_url": "https://github.com/backblaze/b2-sdk-python",
                                "commit_hash": "62476638986e5b6d7459aca5ef8ce220760226e0"
                            },
                            "is_reachable": "unknown",
                            "tool_details": [
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo._create_database",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo",
                                    "reachable_from": []
                                }
                            ],
                            "fixed_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database",
                                "SqliteAccountInfo._create_database.fd"
                            ],
                            "resource_path": "b2sdk-1.14.0/b2sdk/session.py",
                            "vulnerable_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database"
                            ]
                        },
                        {
                            "patch": {
                                "vcs_url": "https://github.com/backblaze/b2-sdk-python",
                                "commit_hash": "62476638986e5b6d7459aca5ef8ce220760226e0"
                            },
                            "is_reachable": "unknown",
                            "tool_details": [
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "SqliteAccountInfo",
                                    "reachable_from": []
                                }
                            ],
                            "fixed_symbols": [
                                "SqliteAccountInfo"
                            ],
                            "resource_path": "b2sdk-1.14.0/b2sdk/v0/account_info.py",
                            "vulnerable_symbols": [
                                "SqliteAccountInfo"
                            ]
                        },
                        {
                            "patch": {
                                "vcs_url": "https://github.com/backblaze/b2-sdk-python",
                                "commit_hash": "62476638986e5b6d7459aca5ef8ce220760226e0"
                            },
                            "is_reachable": "unknown",
                            "tool_details": [
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo._create_database",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo",
                                    "reachable_from": []
                                }
                            ],
                            "fixed_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database",
                                "SqliteAccountInfo._create_database.fd"
                            ],
                            "resource_path": "b2sdk-1.14.0/b2sdk/v0/__init__.py",
                            "vulnerable_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database"
                            ]
                        },
                        {
                            "patch": {
                                "vcs_url": "https://github.com/backblaze/b2-sdk-python",
                                "commit_hash": "62476638986e5b6d7459aca5ef8ce220760226e0"
                            },
                            "is_reachable": "unknown",
                            "tool_details": [
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "SqliteAccountInfo",
                                    "reachable_from": []
                                }
                            ],
                            "fixed_symbols": [
                                "SqliteAccountInfo"
                            ],
                            "resource_path": "b2sdk-1.14.0/b2sdk/v1/account_info.py",
                            "vulnerable_symbols": [
                                "SqliteAccountInfo"
                            ]
                        },
                        {
                            "patch": {
                                "vcs_url": "https://github.com/backblaze/b2-sdk-python",
                                "commit_hash": "62476638986e5b6d7459aca5ef8ce220760226e0"
                            },
                            "is_reachable": "unknown",
                            "tool_details": [
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo._create_database",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo",
                                    "reachable_from": []
                                }
                            ],
                            "fixed_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database",
                                "SqliteAccountInfo._create_database.fd"
                            ],
                            "resource_path": "b2sdk-1.14.0/b2sdk/v1/__init__.py",
                            "vulnerable_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database"
                            ]
                        },
                        {
                            "patch": {
                                "vcs_url": "https://github.com/backblaze/b2-sdk-python",
                                "commit_hash": "62476638986e5b6d7459aca5ef8ce220760226e0"
                            },
                            "is_reachable": "unknown",
                            "tool_details": [
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo._create_database",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo",
                                    "reachable_from": []
                                }
                            ],
                            "fixed_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database",
                                "SqliteAccountInfo._create_database.fd"
                            ],
                            "resource_path": "b2sdk-1.14.0/b2sdk/v1/session.py",
                            "vulnerable_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database"
                            ]
                        },
                        {
                            "patch": {
                                "vcs_url": "https://github.com/backblaze/b2-sdk-python",
                                "commit_hash": "62476638986e5b6d7459aca5ef8ce220760226e0"
                            },
                            "is_reachable": "unknown",
                            "tool_details": [
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo._create_database",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo",
                                    "reachable_from": []
                                }
                            ],
                            "fixed_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database",
                                "SqliteAccountInfo._create_database.fd"
                            ],
                            "resource_path": "b2sdk-1.14.0/b2sdk/_v3/__init__.py",
                            "vulnerable_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database"
                            ]
                        },
                        {
                            "patch": {
                                "vcs_url": "https://github.com/backblaze/b2-sdk-python",
                                "commit_hash": "62476638986e5b6d7459aca5ef8ce220760226e0"
                            },
                            "is_reachable": "yes",
                            "tool_details": [
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo._create_database",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": false,
                                    "is_called": true,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo",
                                    "reachable_from": [
                                        "main"
                                    ]
                                }
                            ],
                            "fixed_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database",
                                "SqliteAccountInfo._create_database.fd"
                            ],
                            "resource_path": "b2sdk-1.14.0/doc/sqlite_account_info_schema.py",
                            "vulnerable_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database"
                            ]
                        },
                        {
                            "patch": {
                                "vcs_url": "https://github.com/backblaze/b2-sdk-python",
                                "commit_hash": "62476638986e5b6d7459aca5ef8ce220760226e0"
                            },
                            "is_reachable": "yes",
                            "tool_details": [
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo._create_database",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": false,
                                    "is_called": true,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo",
                                    "reachable_from": [
                                        "sqlite_account_info_factory",
                                        "sqlite_account_info_factory.get_account_info"
                                    ]
                                }
                            ],
                            "fixed_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database",
                                "SqliteAccountInfo._create_database.fd"
                            ],
                            "resource_path": "b2sdk-1.14.0/test/unit/account_info/fixtures.py",
                            "vulnerable_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database"
                            ]
                        },
                        {
                            "patch": {
                                "vcs_url": "https://github.com/backblaze/b2-sdk-python",
                                "commit_hash": "62476638986e5b6d7459aca5ef8ce220760226e0"
                            },
                            "is_reachable": "yes",
                            "tool_details": [
                                {
                                    "is_exact": false,
                                    "is_called": false,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo._create_database",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": false,
                                    "is_called": true,
                                    "is_defined": false,
                                    "is_imported": true,
                                    "symbol_name": "SqliteAccountInfo",
                                    "reachable_from": [
                                        "TestSqliteAccountInfo._make_sqlite_account_info"
                                    ]
                                },
                                {
                                    "is_exact": true,
                                    "is_called": false,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "TestSqliteAccountInfo.setUp",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": true,
                                    "is_called": false,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "TestSqliteAccountInfo",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": true,
                                    "is_called": true,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "TestSqliteAccountInfo._make_sqlite_account_info",
                                    "reachable_from": [
                                        "TestSqliteAccountInfo._make_info",
                                        "TestSqliteAccountInfo.test_account_info_env_var_overrides_xdg_config_home",
                                        "TestSqliteAccountInfo.test_uses_default",
                                        "TestSqliteAccountInfo.test_uses_existing_file_and_ignores_xdg",
                                        "TestSqliteAccountInfo.test_uses_xdg_config_home"
                                    ]
                                },
                                {
                                    "is_exact": true,
                                    "is_called": false,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "TestSqliteAccountInfo.test_uses_default.account_info",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": true,
                                    "is_called": false,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "TestSqliteAccountInfo.test_uses_default",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": true,
                                    "is_called": false,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "TestSqliteAccountInfo.test_uses_xdg_config_home.account_info",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": true,
                                    "is_called": false,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "TestSqliteAccountInfo.test_uses_xdg_config_home",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": true,
                                    "is_called": false,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "TestSqliteAccountInfo.test_uses_existing_file_and_ignores_xdg",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": true,
                                    "is_called": false,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "TestSqliteAccountInfo.test_uses_existing_file_and_ignores_xdg.account_info",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": true,
                                    "is_called": false,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "TestSqliteAccountInfo.test_account_info_env_var_overrides_xdg_config_home.account_info",
                                    "reachable_from": []
                                },
                                {
                                    "is_exact": true,
                                    "is_called": false,
                                    "is_defined": true,
                                    "is_imported": false,
                                    "symbol_name": "TestSqliteAccountInfo.test_account_info_env_var_overrides_xdg_config_home",
                                    "reachable_from": []
                                }
                            ],
                            "fixed_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database",
                                "SqliteAccountInfo._create_database.fd",
                                "TestSqliteAccountInfo",
                                "TestSqliteAccountInfo._make_sqlite_account_info",
                                "TestSqliteAccountInfo.setUp",
                                "TestSqliteAccountInfo.test_account_info_env_var_overrides_xdg_config_home",
                                "TestSqliteAccountInfo.test_account_info_env_var_overrides_xdg_config_home.account_info",
                                "TestSqliteAccountInfo.test_uses_default",
                                "TestSqliteAccountInfo.test_uses_default.account_info",
                                "TestSqliteAccountInfo.test_uses_existing_file_and_ignores_xdg",
                                "TestSqliteAccountInfo.test_uses_existing_file_and_ignores_xdg.account_info",
                                "TestSqliteAccountInfo.test_uses_xdg_config_home",
                                "TestSqliteAccountInfo.test_uses_xdg_config_home.account_info"
                            ],
                            "resource_path": "b2sdk-1.14.0/test/unit/account_info/test_account_info.py",
                            "vulnerable_symbols": [
                                "SqliteAccountInfo",
                                "SqliteAccountInfo._create_database",
                                "TestSqliteAccountInfo",
                                "TestSqliteAccountInfo._make_sqlite_account_info",
                                "TestSqliteAccountInfo.setUp",
                                "TestSqliteAccountInfo.test_account_info_env_var_overrides_xdg_config_home",
                                "TestSqliteAccountInfo.test_account_info_env_var_overrides_xdg_config_home.account_info",
                                "TestSqliteAccountInfo.test_uses_default",
                                "TestSqliteAccountInfo.test_uses_default.account_info",
                                "TestSqliteAccountInfo.test_uses_existing_file_and_ignores_xdg",
                                "TestSqliteAccountInfo.test_uses_existing_file_and_ignores_xdg.account_info",
                                "TestSqliteAccountInfo.test_uses_xdg_config_home",
                                "TestSqliteAccountInfo.test_uses_xdg_config_home.account_info"
                            ]
                        }
                    ]
                }
            ]
        }
    ]
}

• GET /api/projects/{project_id}/dependencies/

API output Example

{
    "aliases": [
        "CVE-2026-54279"
    ],
    "summary": "aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence\n### Summary\n\nHost-only cookies that are saved with ``CookieJar.save()`` and then restored later with ``CookieJar.load()`` lose their host-only status.\n\n### Impact\n\nHost-only cookies that have been loaded from disk may get sent to subdomains that previously should have been disallowed.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2",
    "risk_score": 0.6,
    "ssvc_trees": [
        {
            "vector": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-06-22T17:40:17Z/",
            "options": [
                {
                    "Exploitation": "none"
                },
                {
                    "Automatable": "no"
                },
                {
                    "Technical Impact": "partial"
                },
                {
                    "Mission Prevalence": "minimal"
                },
                {
                    "Public Well-being Impact": "material"
                },
                {
                    "Mission & Well-being": "medium"
                }
            ],
            "decision": "Track",
            "source_url": "https://github.com/cisagov/vulnrichment/blob/develop/2026/54xxx/CVE-2026-54279.json"
        }
    ],
    "advisory_id": "GHSA-2fqr-mr3j-6wp8",
    "advisory_uid": "github_osv/GHSA-2fqr-mr3j-6wp8",
    "resource_url": "http://public.vulnerablecode.io/advisories/github_osv/GHSA-2fqr-mr3j-6wp8",
    "exploitability": 0.5,
    "fixed_in_patches": [],
    "fixed_by_packages": [
        "pkg:pypi/aiohttp@3.14.1"
    ],
    "weighted_severity": 1.2,
    "introduced_in_patches": []
},
{
    "aliases": [
        "CVE-2022-33124"
    ],
    "summary": "Withdrawn: Denial of Service in aiohttp\n## Withdrawn\nThis advisory has been withdrawn because the maintainers of aiohttp and multiple third parties disputed the validity of the issue. There is not sufficient evidence for the claims in the original report.\n\n## Original Description\naiohttp v3.8.1 was discovered to contain an invalid IPv6 URL which can lead to a Denial of Service (DoS).",
    "risk_score": 2.5,
    "ssvc_trees": [],
    "advisory_id": "GHSA-rwqr-c348-m5wr",
    "advisory_uid": "github_osv/GHSA-rwqr-c348-m5wr",
    "resource_url": "http://public.vulnerablecode.io/advisories/github_osv/GHSA-rwqr-c348-m5wr",
    "exploitability": 0.5,
    "fixed_in_patches": [],
    "fixed_by_packages": [],
    "weighted_severity": 5.0,
    "introduced_in_patches": []
},
{
    "aliases": [
        "CVE-2026-54275",
        "GHSA-4m7w-qmgq-4wj5"
    ],
    "summary": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain, but with different per-request server_hostname parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check. This vulnerability is fixed in 3.14.1.",
    "risk_score": 3.4,
    "ssvc_trees": [
        {
            "vector": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-06-22T17:27:21Z/",
            "options": [
                {
                    "Exploitation": "none"
                },
                {
                    "Automatable": "no"
                },
                {
                    "Technical Impact": "partial"
                },
                {
                    "Mission Prevalence": "minimal"
                },
                {
                    "Public Well-being Impact": "material"
                },
                {
                    "Mission & Well-being": "medium"
                }
            ],
            "decision": "Track",
            "source_url": "https://github.com/cisagov/vulnrichment/blob/develop/2026/54xxx/CVE-2026-54275.json"
        }
    ],
    "advisory_id": "PYSEC-2026-237",
    "advisory_uid": "pypa/aiohttp/PYSEC-2026-237",
    "resource_url": "http://public.vulnerablecode.io/advisories/pypa/aiohttp/PYSEC-2026-237",
    "exploitability": 0.5,
    "fixed_in_patches": [],
    "fixed_by_packages": [
        "pkg:pypi/aiohttp@3.14.1"
    ],
    "weighted_severity": 6.8,
    "introduced_in_patches": []
},
{
    "aliases": [
        "CVE-2024-23829",
        "GHSA-8qpw-xqxj-h4r2"
    ],
    "summary": "aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against injection of additional requests. Additionally, validation could trigger exceptions that were not handled consistently with processing of other malformed input.  Being more lenient than internet standards require could, depending on deployment environment, assist in request smuggling. The unhandled exception could cause excessive resource consumption on the application server and/or its logging facilities. This vulnerability exists due to an incomplete fix for CVE-2023-47627. Version 3.9.2 fixes this vulnerability.",
    "risk_score": 3.1,
    "ssvc_trees": [
        {
            "vector": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-02-01T16:40:08Z/",
            "options": [
                {
                    "Exploitation": "none"
                },
                {
                    "Automatable": "yes"
                },
                {
                    "Technical Impact": "partial"
                },
                {
                    "Mission Prevalence": "minimal"
                },
                {
                    "Public Well-being Impact": "material"
                },
                {
                    "Mission & Well-being": "medium"
                }
            ],
            "decision": "Track",
            "source_url": "https://github.com/cisagov/vulnrichment/blob/develop/2024/23xxx/CVE-2024-23829.json"
        }
    ],
    "advisory_id": "PYSEC-2024-26",
    "advisory_uid": "pypa/aiohttp/PYSEC-2024-26",
    "is_reachable": "yes",
    "resource_url": "http://public.vulnerablecode.io/advisories/pypa/aiohttp/PYSEC-2024-26",
    "exploitability": 0.5,
    "fixed_in_patches": [
        {
            "vcs_url": "https://github.com/aio-libs/aiohttp",
            "commit_hash": "33ccdfb0a12690af5bb49bda2319ec0907fa7827"
        }
    ],
    "fixed_by_packages": [
        "pkg:pypi/aiohttp@3.9.2"
    ],
    "weighted_severity": 6.2,
    "introduced_in_patches": [],
    "reachability_analysis": [
        {
            "patch": {
                "vcs_url": "https://github.com/aio-libs/aiohttp",
                "commit_hash": "33ccdfb0a12690af5bb49bda2319ec0907fa7827"
            },
            "is_reachable": "yes",
            "tool_details": [
                {
                    "is_exact": false,
                    "is_called": true,
                    "is_defined": false,
                    "is_imported": true,
                    "symbol_name": "HttpRequestParser.parse_message",
                    "reachable_from": []
                }
            ],
            "fixed_symbols": [
                "HttpRequestParser.parse_message"
            ],
            "resource_path": "vulnerablecode-20.10/vulnerabilities/importers/debian_oval.py",
            "vulnerable_symbols": [
                "HttpRequestParser.parse_message"
            ]
        }
    ]
}