Skip to content

Commit 07a7434

Browse files
pombredannepombredanne
authored
Merge pull request #788 from keshav-space/osv_validator
add OSVDataSource
2 parents 78dd5ae + 536dd91 commit 07a7434

10 files changed

Lines changed: 692 additions & 0 deletions

File tree

‎vulntotal/__init__.py‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#
2+
# Copyright (c) nexB Inc. and others. All rights reserved.
3+
# VulnerableCode is a trademark of nexB Inc.
4+
# SPDX-License-Identifier: Apache-2.0
5+
# See http://www.apache.org/licenses/LICENSE-2.0 for the license text.
6+
# See https://github.com/nexB/vulnerablecode for support or download.
7+
# See https://aboutcode.org for more information about nexB OSS projects.
8+
#

‎vulntotal/datasources/osv.py‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
#
2+
# Copyright (c) nexB Inc. and others. All rights reserved.
3+
# VulnerableCode is a trademark of nexB Inc.
4+
# SPDX-License-Identifier: Apache-2.0
5+
# See http://www.apache.org/licenses/LICENSE-2.0 for the license text.
6+
# See https://github.com/nexB/vulnerablecode for support or download.
7+
# See https://aboutcode.org for more information about nexB OSS projects.
8+
#
9+
10+
import logging
11+
from typing import Iterable
12+
13+
import requests
14+
from packageurl import PackageURL
15+
16+
from vulntotal.ecosystem.nuget import get_closest_nuget_package_name
17+
from vulntotal.validator import DataSource
18+
from vulntotal.validator import VendorData
19+
from vulntotal.vulntotal_utils import get_item
20+
21+
logger = logging.getLogger(__name__)
22+
23+
24+
class OSVDataSource(DataSource):
25+
spdx_license_expression = "Apache-2.0"
26+
license_url = "https://github.com/google/osv/blob/master/LICENSE"
27+
url = "https://api.osv.dev/v1/query"
28+
29+
def fetch_advisory(self, payload):
30+
"""Fetch JSON advisory from OSV API for a given package payload """
31+
32+
response = requests.post(self.url, data=str(payload))
33+
if not response.status_code == 200:
34+
logger.error(f"Error while fetching {payload}: {response.status_code}")
35+
return
36+
return response.json()
37+
38+
def datasource_advisory(self, purl) -> Iterable[VendorData]:
39+
payload = generate_payload(purl)
40+
if not payload:
41+
return
42+
advisory = self.fetch_advisory(payload)
43+
self._raw_dump.append(advisory)
44+
return parse_advisory(advisory)
45+
46+
@classmethod
47+
def supported_ecosystem(cls):
48+
# source https://ossf.github.io/osv-schema/
49+
return {
50+
"npm": "npm",
51+
"maven": "Maven",
52+
"golang": "Go",
53+
"nuget": "NuGet",
54+
"pypi": "PyPI",
55+
"rubygems": "RubyGems",
56+
"crates.io": "crates.io",
57+
"composer": "Packagist",
58+
"linux": "Linux",
59+
"oss-fuzz": "OSS-Fuzz",
60+
"debian": "Debian",
61+
"hex": "Hex",
62+
"android": "Android",
63+
}
64+
65+
66+
def parse_advisory(response) -> Iterable[VendorData]:
67+
"""Parse response from OSV API and yield VendorData"""
68+
69+
for vuln in response.get("vulns") or []:
70+
aliases = []
71+
affected_versions = []
72+
fixed = []
73+
74+
aliases.extend(vuln.get("aliases") or [])
75+
aliases.append(vuln.get("id")) if vuln.get("id") else None
76+
77+
try:
78+
affected_versions.extend(get_item(vuln, "affected", 0, "versions") or [])
79+
except:
80+
pass
81+
82+
try:
83+
for event in get_item(vuln, "affected", 0, "ranges", 0, "events") or []:
84+
affected_versions.append(event.get("introduced")) if event.get(
85+
"introduced"
86+
) else None
87+
fixed.append(event.get("fixed")) if event.get("fixed") else None
88+
except:
89+
pass
90+
91+
yield VendorData(
92+
aliases=sorted(list(set(aliases))),
93+
affected_versions=sorted(list(set(affected_versions))),
94+
fixed_versions=sorted(list(set(fixed))),
95+
)
96+
97+
98+
def generate_payload(purl):
99+
"""Generate compatible payload for OSV API from a PURL"""
100+
101+
supported_ecosystem = OSVDataSource.supported_ecosystem()
102+
payload = {}
103+
payload["version"] = purl.version
104+
payload["package"] = {}
105+
106+
if purl.type in supported_ecosystem:
107+
payload["package"]["ecosystem"] = supported_ecosystem[purl.type]
108+
109+
if purl.type == "maven":
110+
if not purl.namespace:
111+
logger.error(f"Invalid Maven PURL {str(purl)}")
112+
return
113+
payload["package"]["name"] = f"{purl.namespace}:{purl.name}"
114+
115+
elif purl.type == "packagist":
116+
if not purl.namespace:
117+
logger.error(f"Invalid Packagist PURL {str(purl)}")
118+
return
119+
payload["package"]["name"] = f"{purl.namespace}/{purl.name}"
120+
121+
elif purl.type == "linux":
122+
if purl.name not in ("kernel", "Kernel"):
123+
logger.error(f"Invalid Linux PURL {str(purl)}")
124+
return
125+
payload["package"]["name"] = "Kernel"
126+
127+
elif purl.type == "nuget":
128+
nuget_package = get_closest_nuget_package_name(purl.name)
129+
if not nuget_package:
130+
logger.error(f"Invalid NuGet PURL {str(purl)}")
131+
return
132+
payload["package"]["name"] = nuget_package
133+
134+
elif purl.type == "golang" and purl.namespace:
135+
payload["package"]["name"] = f"{purl.namespace}/{purl.name}"
136+
137+
else:
138+
payload["package"]["name"] = purl.name
139+
140+
return payload

‎vulntotal/ecosystem/__init__.py‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#
2+
# Copyright (c) nexB Inc. and others. All rights reserved.
3+
# VulnerableCode is a trademark of nexB Inc.
4+
# SPDX-License-Identifier: Apache-2.0
5+
# See http://www.apache.org/licenses/LICENSE-2.0 for the license text.
6+
# See https://github.com/nexB/vulnerablecode for support or download.
7+
# See https://aboutcode.org for more information about nexB OSS projects.
8+
#

‎vulntotal/ecosystem/nuget.py‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#
2+
# Copyright (c) nexB Inc. and others. All rights reserved.
3+
# VulnerableCode is a trademark of nexB Inc.
4+
# SPDX-License-Identifier: Apache-2.0
5+
# See http://www.apache.org/licenses/LICENSE-2.0 for the license text.
6+
# See https://github.com/nexB/vulnerablecode for support or download.
7+
# See https://aboutcode.org for more information about nexB OSS projects.
8+
#
9+
10+
from urllib.parse import urljoin
11+
12+
import requests
13+
14+
15+
def get_closest_nuget_package_name(query):
16+
"""
17+
Return case-sensitive NuGet package name using
18+
SearchQueryService provided by NuGet
19+
"""
20+
url_nuget_service = "https://api.nuget.org/v3/index.json"
21+
url_nuget_search = ""
22+
23+
api_resources = requests.get(url_nuget_service).json()
24+
for resource in api_resources.get("resources") or []:
25+
if resource.get("@type") == "SearchQueryService":
26+
url_nuget_search = resource["@id"]
27+
break
28+
29+
if url_nuget_search:
30+
url_query = urljoin(url_nuget_search, f"?q={query}")
31+
query_response = requests.get(url_query).json()
32+
if query_response.get("data"):
33+
return query_response["data"][0]["id"]

‎vulntotal/tests/test_data/osv/advisory.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"vulns":[{"id":"PYSEC-2014-8","details":"The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp.","aliases":["CVE-2014-1402"],"modified":"2021-07-05T00:01:22.043149Z","published":"2014-05-19T14:55:00Z","references":[{"type":"WEB","url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734747"},{"type":"ADVISORY","url":"http://advisories.mageia.org/MGASA-2014-0028.html"},{"type":"WEB","url":"http://jinja.pocoo.org/docs/changelog/"},{"type":"WEB","url":"http://openwall.com/lists/oss-security/2014/01/10/3"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1051421"},{"type":"ADVISORY","url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:096"},{"type":"WEB","url":"http://openwall.com/lists/oss-security/2014/01/10/2"},{"type":"ADVISORY","url":"http://secunia.com/advisories/59017"},{"type":"ADVISORY","url":"http://secunia.com/advisories/58918"},{"type":"ADVISORY","url":"http://secunia.com/advisories/60770"},{"type":"ADVISORY","url":"http://secunia.com/advisories/60738"},{"type":"ADVISORY","url":"http://secunia.com/advisories/56287"},{"type":"WEB","url":"http://www.gentoo.org/security/en/glsa/glsa-201408-13.xml"},{"type":"WEB","url":"https://oss.oracle.com/pipermail/el-errata/2014-June/004192.html"},{"type":"ADVISORY","url":"http://secunia.com/advisories/58783"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2014-0748.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2014-0747.html"}],"affected":[{"package":{"name":"jinja2","ecosystem":"PyPI","purl":"pkg:pypi/jinja2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.2"}]}],"versions":["2.0","2.0rc1","2.1","2.1.1","2.2","2.2.1","2.3","2.3.1","2.4","2.4.1","2.5","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.6","2.7","2.7.1"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/jinja2/PYSEC-2014-8.yaml"}}],"schema_version":"1.2.0"},{"id":"PYSEC-2014-82","details":"FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.","aliases":["CVE-2014-0012"],"modified":"2021-08-27T03:22:05.027573Z","published":"2014-05-19T14:55:00Z","references":[{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1051421"},{"type":"WEB","url":"https://github.com/mitsuhiko/jinja2/pull/292"},{"type":"FIX","url":"https://github.com/mitsuhiko/jinja2/commit/acb672b6a179567632e032f547582f30fa2f4aa7"},{"type":"WEB","url":"http://seclists.org/oss-sec/2014/q1/73"},{"type":"WEB","url":"https://github.com/mitsuhiko/jinja2/pull/296"},{"type":"ADVISORY","url":"http://secunia.com/advisories/60738"},{"type":"WEB","url":"http://www.gentoo.org/security/en/glsa/glsa-201408-13.xml"},{"type":"ADVISORY","url":"http://secunia.com/advisories/56328"}],"affected":[{"package":{"name":"jinja2","ecosystem":"PyPI","purl":"pkg:pypi/jinja2"},"ranges":[{"type":"GIT","repo":"https://github.com/mitsuhiko/jinja2","events":[{"introduced":"0"},{"fixed":"acb672b6a179567632e032f547582f30fa2f4aa7"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.3"}]}],"versions":["2.0","2.0rc1","2.1","2.1.1","2.2","2.2.1","2.3","2.3.1","2.4","2.4.1","2.5","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.6","2.7","2.7.1","2.7.2"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/jinja2/PYSEC-2014-82.yaml"}}],"schema_version":"1.2.0"},{"id":"PYSEC-2019-217","details":"In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.","aliases":["CVE-2019-10906","GHSA-462w-v97r-4m45"],"modified":"2021-11-22T04:57:52.862665Z","published":"2019-04-07T00:29:00Z","references":[{"type":"ARTICLE","url":"https://palletsprojects.com/blog/jinja-2-10-1-released"},{"type":"WEB","url":"https://lists.apache.org/thread.html/b2380d147b508bbcb90d2cad443c159e63e12555966ab4f320ee22da@%3Ccommits.airflow.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/46c055e173b52d599c648a98199972dbd6a89d2b4c4647b0500f2284@%3Cdevnull.infra.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/f0c4a03418bcfe70c539c5dbaf99c04c98da13bfa1d3266f08564316@%3Ccommits.airflow.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/7f39f01392d320dfb48e4901db68daeece62fd60ef20955966739993@%3Ccommits.airflow.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/57673a78c4d5c870d3f21465c7e2946b9f8285c7c57e54c2ae552f02@%3Ccommits.airflow.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/320441dccbd9a545320f5f07306d711d4bbd31ba43dc9eebcfc602df@%3Cdevnull.infra.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/2b52b9c8b9d6366a4f1b407a8bde6af28d9fc73fdb3b37695fd0d9ac@%3Cdevnull.infra.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/09fc842ff444cd43d9d4c510756fec625ef8eb1175f14fd21de2605f@%3Cdevnull.infra.apache.org%3E"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QCDYIS254EJMBNWOG4S5QY6AOTOR4TZU/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DSW3QZMFVVR7YE3UT4YRQA272TYAL5AF/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TS7IVZAJBWOHNRDMFJDIZVFCMRP6YIUQ/"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:1152"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:1237"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:1329"},{"type":"WEB","url":"https://usn.ubuntu.com/4011-1/"},{"type":"WEB","url":"https://usn.ubuntu.com/4011-2/"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-462w-v97r-4m45"}],"affected":[{"package":{"name":"jinja2","ecosystem":"PyPI","purl":"pkg:pypi/jinja2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1"}]}],"versions":["2.0","2.0rc1","2.1","2.1.1","2.10","2.2","2.2.1","2.3","2.3.1","2.4","2.4.1","2.5","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.6","2.7","2.7.1","2.7.2","2.7.3","2.8","2.8.1","2.9","2.9.1","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/jinja2/PYSEC-2019-217.yaml"}}],"schema_version":"1.2.0"},{"id":"PYSEC-2019-220","details":"In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.","aliases":["CVE-2016-10745","GHSA-hj2j-77xm-mc5v"],"modified":"2021-11-22T04:57:52.929678Z","published":"2019-04-08T13:29:00Z","references":[{"type":"ARTICLE","url":"https://palletsprojects.com/blog/jinja-281-released/"},{"type":"FIX","url":"https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:1022"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:1237"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:1260"},{"type":"WEB","url":"https://usn.ubuntu.com/4011-1/"},{"type":"WEB","url":"https://usn.ubuntu.com/4011-2/"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:3964"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:4062"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hj2j-77xm-mc5v"}],"affected":[{"package":{"name":"jinja2","ecosystem":"PyPI","purl":"pkg:pypi/jinja2"},"ranges":[{"type":"GIT","repo":"https://github.com/pallets/jinja","events":[{"introduced":"0"},{"fixed":"9b53045c34e61013dc8f09b7e52a555fa16bed16"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1"}]}],"versions":["2.0","2.0rc1","2.1","2.1.1","2.2","2.2.1","2.3","2.3.1","2.4","2.4.1","2.5","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.6","2.7","2.7.1","2.7.2","2.7.3","2.8"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/jinja2/PYSEC-2019-220.yaml"}}],"schema_version":"1.2.0"},{"id":"PYSEC-2021-66","details":"This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.","aliases":["CVE-2020-28493","SNYK-PYTHON-JINJA2-1012994","GHSA-g3rq-g295-4j3m"],"modified":"2021-03-22T16:34:00Z","published":"2021-02-01T20:15:00Z","references":[{"type":"WEB","url":"https://github.com/pallets/jinja/blob/ab81fd9c277900c85da0c322a2ff9d68a235b2e6/src/jinja2/utils.py%23L20"},{"type":"WEB","url":"https://github.com/pallets/jinja/pull/1343"},{"type":"ADVISORY","url":"https://snyk.io/vuln/SNYK-PYTHON-JINJA2-1012994"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVAKCOO7VBVUBM3Q6CBBTPBFNP5NDXF4/"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-g3rq-g295-4j3m"}],"affected":[{"package":{"name":"jinja2","ecosystem":"PyPI","purl":"pkg:pypi/jinja2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.3"}]}],"versions":["2.0rc1","2.0","2.1","2.1.1","2.2","2.2.1","2.3","2.3.1","2.4","2.4.1","2.5","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.6","2.7","2.7.1","2.7.2","2.7.3","2.8","2.8.1","2.9","2.9.1","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.10","2.10.1","2.10.2","2.10.3","2.11.0","2.11.1","2.11.2"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/jinja2/PYSEC-2021-66.yaml"}}],"schema_version":"1.2.0"}]}

‎vulntotal/tests/test_data/osv/parse_advisory_data-expected.json‎

Lines changed: 195 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,195 @@
1+
[
2+
{
3+
"affected_versions": [
4+
"0",
5+
"2.0",
6+
"2.0rc1",
7+
"2.1",
8+
"2.1.1",
9+
"2.2",
10+
"2.2.1",
11+
"2.3",
12+
"2.3.1",
13+
"2.4",
14+
"2.4.1",
15+
"2.5",
16+
"2.5.1",
17+
"2.5.2",
18+
"2.5.3",
19+
"2.5.4",
20+
"2.5.5",
21+
"2.6",
22+
"2.7",
23+
"2.7.1"
24+
],
25+
"fixed_versions": [
26+
"2.7.2"
27+
],
28+
"aliases": [
29+
"CVE-2014-1402",
30+
"PYSEC-2014-8"
31+
]
32+
},
33+
{
34+
"affected_versions": [
35+
"0",
36+
"2.0",
37+
"2.0rc1",
38+
"2.1",
39+
"2.1.1",
40+
"2.2",
41+
"2.2.1",
42+
"2.3",
43+
"2.3.1",
44+
"2.4",
45+
"2.4.1",
46+
"2.5",
47+
"2.5.1",
48+
"2.5.2",
49+
"2.5.3",
50+
"2.5.4",
51+
"2.5.5",
52+
"2.6",
53+
"2.7",
54+
"2.7.1",
55+
"2.7.2"
56+
],
57+
"fixed_versions": [
58+
"acb672b6a179567632e032f547582f30fa2f4aa7"
59+
],
60+
"aliases": [
61+
"CVE-2014-0012",
62+
"PYSEC-2014-82"
63+
]
64+
},
65+
{
66+
"affected_versions": [
67+
"0",
68+
"2.0",
69+
"2.0rc1",
70+
"2.1",
71+
"2.1.1",
72+
"2.10",
73+
"2.2",
74+
"2.2.1",
75+
"2.3",
76+
"2.3.1",
77+
"2.4",
78+
"2.4.1",
79+
"2.5",
80+
"2.5.1",
81+
"2.5.2",
82+
"2.5.3",
83+
"2.5.4",
84+
"2.5.5",
85+
"2.6",
86+
"2.7",
87+
"2.7.1",
88+
"2.7.2",
89+
"2.7.3",
90+
"2.8",
91+
"2.8.1",
92+
"2.9",
93+
"2.9.1",
94+
"2.9.2",
95+
"2.9.3",
96+
"2.9.4",
97+
"2.9.5",
98+
"2.9.6"
99+
],
100+
"fixed_versions": [
101+
"2.10.1"
102+
],
103+
"aliases": [
104+
"CVE-2019-10906",
105+
"GHSA-462w-v97r-4m45",
106+
"PYSEC-2019-217"
107+
]
108+
},
109+
{
110+
"affected_versions": [
111+
"0",
112+
"2.0",
113+
"2.0rc1",
114+
"2.1",
115+
"2.1.1",
116+
"2.2",
117+
"2.2.1",
118+
"2.3",
119+
"2.3.1",
120+
"2.4",
121+
"2.4.1",
122+
"2.5",
123+
"2.5.1",
124+
"2.5.2",
125+
"2.5.3",
126+
"2.5.4",
127+
"2.5.5",
128+
"2.6",
129+
"2.7",
130+
"2.7.1",
131+
"2.7.2",
132+
"2.7.3",
133+
"2.8"
134+
],
135+
"fixed_versions": [
136+
"9b53045c34e61013dc8f09b7e52a555fa16bed16"
137+
],
138+
"aliases": [
139+
"CVE-2016-10745",
140+
"GHSA-hj2j-77xm-mc5v",
141+
"PYSEC-2019-220"
142+
]
143+
},
144+
{
145+
"affected_versions": [
146+
"0",
147+
"2.0",
148+
"2.0rc1",
149+
"2.1",
150+
"2.1.1",
151+
"2.10",
152+
"2.10.1",
153+
"2.10.2",
154+
"2.10.3",
155+
"2.11.0",
156+
"2.11.1",
157+
"2.11.2",
158+
"2.2",
159+
"2.2.1",
160+
"2.3",
161+
"2.3.1",
162+
"2.4",
163+
"2.4.1",
164+
"2.5",
165+
"2.5.1",
166+
"2.5.2",
167+
"2.5.3",
168+
"2.5.4",
169+
"2.5.5",
170+
"2.6",
171+
"2.7",
172+
"2.7.1",
173+
"2.7.2",
174+
"2.7.3",
175+
"2.8",
176+
"2.8.1",
177+
"2.9",
178+
"2.9.1",
179+
"2.9.2",
180+
"2.9.3",
181+
"2.9.4",
182+
"2.9.5",
183+
"2.9.6"
184+
],
185+
"fixed_versions": [
186+
"2.11.3"
187+
],
188+
"aliases": [
189+
"CVE-2020-28493",
190+
"GHSA-g3rq-g295-4j3m",
191+
"PYSEC-2021-66",
192+
"SNYK-PYTHON-JINJA2-1012994"
193+
]
194+
}
195+
]

0 commit comments

Comments
 (0)