From e1cda0bcb681e706e2f10509fd14d7c2c5baeade Mon Sep 17 00:00:00 2001 From: Tomas Gonzalez Date: Thu, 3 Jul 2025 14:17:19 -0400 Subject: [PATCH 1/9] commit what works --- SARIF_ENHANCEMENT_GUIDE.md | 357 ++ src/workbench_cli/cli.py | 59 +- src/workbench_cli/handlers/__init__.py | 4 +- src/workbench_cli/handlers/export_sarif.py | 168 + src/workbench_cli/handlers/show_results.py | 4 + src/workbench_cli/main.py | 2 + .../utilities/sarif_converter.py | 1238 +++++ src/workbench_cli/utilities/scan_workflows.py | 54 +- .../utilities/vulnerability_enricher.py | 447 ++ tests/fixtures/test-sbom.json | 51 + tests/unit/handlers/test_export_sarif.py | 317 ++ tests/unit/handlers/test_show_results.py | 75 +- tests/unit/utilities/test_sarif_converter.py | 628 +++ tests/unit/utilities/test_scan_workflows.py | 108 +- .../utilities/test_vulnerability_enricher.py | 596 +++ vulns-basic.sarif | 4578 +++++++++++++++++ vulns.json | 814 +++ 17 files changed, 9491 insertions(+), 9 deletions(-) create mode 100644 SARIF_ENHANCEMENT_GUIDE.md create mode 100644 src/workbench_cli/handlers/export_sarif.py create mode 100644 src/workbench_cli/utilities/sarif_converter.py create mode 100644 src/workbench_cli/utilities/vulnerability_enricher.py create mode 100644 tests/fixtures/test-sbom.json create mode 100644 tests/unit/handlers/test_export_sarif.py create mode 100644 tests/unit/utilities/test_sarif_converter.py create mode 100644 tests/unit/utilities/test_vulnerability_enricher.py create mode 100644 vulns-basic.sarif create mode 100644 vulns.json diff --git a/SARIF_ENHANCEMENT_GUIDE.md b/SARIF_ENHANCEMENT_GUIDE.md new file mode 100644 index 0000000..8d28c47 --- /dev/null +++ b/SARIF_ENHANCEMENT_GUIDE.md @@ -0,0 +1,357 @@ +# SARIF Enhancement Guide for Workbench CLI + +## Overview + +The Workbench CLI now supports enhanced SARIF (Static Analysis Results Interchange Format) export that integrates multiple external security intelligence sources to provide comprehensive vulnerability reporting for security teams. + +## Current Enhancements + +### 1. **VEX (Vulnerability Exploitability eXchange) Integration** +- **Source**: Workbench vulnerability assessments +- **Data**: VEX status, justification, response, details, and metadata +- **Supported Statuses**: not_affected, fixed, mitigated, under_investigation, accepted_risk, affected +- **Benefits**: Provides organizational context for vulnerabilities including impact assessments, mitigations, and risk acceptance decisions +- **SARIF Features**: + - Automatic result level adjustment based on VEX status + - Suppression information for resolved/mitigated vulnerabilities + - Enhanced descriptions and remediation guidance + - VEX metadata in properties and tags + +### 2. **EPSS (Exploit Prediction Scoring System) Integration** +- **Source**: FIRST.org EPSS API +- **URL**: `https://api.first.org/data/v1/epss` +- **Data**: Probability scores (0-1) indicating likelihood of exploitation +- **Rate Limits**: 100 requests/minute (batch queries supported) +- **Cost**: Free + +### 3. **CISA Known Exploited Vulnerabilities (KEV)** +- **Source**: CISA KEV Catalog +- **URL**: `https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json` +- **Data**: CVEs with confirmed active exploitation +- **Updates**: Daily by CISA +- **Cost**: Free + +### 4. **Enhanced CVE Details with Improved Performance** +- **Source**: NIST NVD API 2.0 +- **URL**: `https://services.nvd.nist.gov/rest/json/cves/2.0` +- **Data**: Complete CVE descriptions, CWE mappings, full CVSS vectors, references +- **Rate Limits**: 5 requests/30 seconds (without API key), 50 requests/30 seconds (with API key) +- **Cost**: Free +- **New Features**: + - **Concurrent Processing**: 2-5 parallel requests based on API key availability + - **Intelligent Rate Limiting**: Token bucket algorithm prevents API limit violations + - **Exponential Backoff**: Automatic retry with increasing delays for failed requests + - **Alternative Data Sources**: Fallback to Vulners API when NVD is unavailable + - **Progress Tracking**: Real-time progress logging for large CVE lists + - **In-Memory Caching**: Avoids duplicate API calls within the same session + +### 5. **Alternative Vulnerability Data Sources** +- **Vulners API**: 8+ million vulnerability records with rich metadata +- **OSV API**: Open Source Vulnerabilities database (planned) +- **VulnCheck NVD++**: Enhanced NVD data with better availability (planned) + +## Enhanced SARIF Features + +### **Risk-Based Prioritization** +- Vulnerabilities are tagged with risk indicators: + - `cisa-kev`: Listed in CISA's Known Exploited Vulnerabilities + - `high-epss`: EPSS score > 0.1 (elevated exploitation risk) + - `severity-critical`: Critical severity vulnerabilities + - `vex-resolved`: VEX status indicates not_affected or fixed + - `vex-mitigated`: VEX status indicates mitigations are in place + - `vex-accepted`: VEX status indicates accepted risk + +### **Enhanced Descriptions** +- **Before**: "Security vulnerability CVE-2022-46337" +- **After**: "Security vulnerability CVE-2022-46337 (CVSS 9.8) [CISA KEV, EPSS: 0.234, VEX: mitigated]" + +### **Comprehensive Help Information** +- Rich Markdown documentation with: + - Detailed vulnerability descriptions from NVD + - Risk assessment with EPSS scores + - Prioritized remediation guidance + - Direct links to security databases + +### **VEX-Aware Result Processing** +- **Automatic Level Adjustment**: VEX status influences SARIF result levels + - `not_affected`, `fixed` → demoted to `note` level + - `mitigated`, `accepted_risk` → demoted to `note` level + - `under_investigation`, `affected` → maintains original level +- **Suppression Information**: Resolved/mitigated vulnerabilities include SARIF suppression metadata +- **Enhanced Remediation**: Context-aware guidance based on VEX status +- **VEX Metadata**: Full VEX information preserved in result properties + +### **Metadata and Analytics** +- Severity distribution across the scan +- High-risk vulnerability counts +- External data source attribution +- VEX statement statistics and status distribution +- Fingerprints for deduplication + +## API Integration Details + +### **Required Python Libraries** +```python +# Already included in pyproject.toml +requests>=2.20.0 # HTTP requests to external APIs + +# Additional libraries for enhanced functionality +import asyncio # For async API calls (future enhancement) +import aiohttp # Async HTTP client (future enhancement) +import time # Rate limiting +import logging # Error handling and debugging +``` + +### **Available APIs for Further Enhancement** + +#### **1. Vulnerability Intelligence** + +**CVE.org API** +- **URL**: `https://cveawg.mitre.org/api/cve/` +- **Data**: CVE descriptions, references +- **Cost**: Free +- **Use Case**: Backup source for CVE details + +**ExploitDB API** +- **URL**: `https://www.exploit-db.com/api/v1/search/` +- **Data**: Public exploit code availability +- **Cost**: Free +- **Use Case**: Check for available exploit code + +**VulnDB API** (Commercial) +- **URL**: `https://vulndb.cyberriskanalytics.com/` +- **Data**: Enhanced vulnerability intelligence, exploit predictions +- **Cost**: Paid subscription +- **Use Case**: Premium vulnerability intelligence + +#### **2. Package Intelligence** + +**OSV (Open Source Vulnerabilities) API** +- **URL**: `https://osv.dev/` +- **Data**: Vulnerability data for open source packages +- **Cost**: Free +- **Use Case**: Package-specific vulnerability information + +**Snyk API** (Commercial) +- **URL**: `https://snyk.io/api/` +- **Data**: Vulnerability data, fix recommendations +- **Cost**: Paid (free tier available) +- **Use Case**: Enhanced package vulnerability data + +**GitHub Advisory Database** +- **URL**: `https://api.github.com/advisories` +- **Data**: Security advisories for packages +- **Cost**: Free +- **Use Case**: GitHub-specific vulnerability data + +#### **3. Threat Intelligence** + +**MITRE ATT&CK API** +- **URL**: `https://attack.mitre.org/` +- **Data**: Attack techniques, tactics +- **Cost**: Free +- **Use Case**: Map vulnerabilities to attack techniques + +**CIRCL CVE Search** +- **URL**: `https://cve.circl.lu/api/` +- **Data**: CVE search and browsing +- **Cost**: Free +- **Use Case**: Alternative CVE source + +#### **4. Package Registries** + +**npm Registry API** +- **URL**: `https://registry.npmjs.org/` +- **Data**: Package versions, dependencies +- **Cost**: Free +- **Use Case**: JavaScript package information + +**PyPI API** +- **URL**: `https://pypi.org/pypi/{package}/json` +- **Data**: Python package information +- **Cost**: Free +- **Use Case**: Python package details + +**Maven Central API** +- **URL**: `https://search.maven.org/solrsearch/select` +- **Data**: Java package information +- **Cost**: Free +- **Use Case**: Java package details + +## Implementation Examples + +### **Adding EPSS Score Filtering** +```python +# Filter high-risk vulnerabilities based on EPSS score +high_risk_threshold = 0.1 +high_risk_vulns = [ + vuln for vuln in vulnerabilities + if external_data.get(vuln.get("cve"), {}).get("epss_score", 0) > high_risk_threshold +] +``` + +### **Adding Custom Risk Scoring** +```python +def calculate_risk_score(vuln, ext_data): + """Calculate custom risk score based on multiple factors.""" + score = 0 + + # Base CVSS score (0-10) + cvss_score = float(vuln.get("base_score", 0)) + score += cvss_score + + # EPSS multiplier (0-1) * 5 for weight + epss_score = ext_data.get("epss_score", 0) + score += epss_score * 5 + + # CISA KEV adds significant weight + if ext_data.get("cisa_kev"): + score += 3 + + # Age factor (newer CVEs might be more critical) + # Implementation would need CVE publication date + + return min(score, 10) # Cap at 10 +``` + +### **Adding Package Registry Integration** +```python +async def fetch_package_info(component_name, ecosystem): + """Fetch additional package information from registries.""" + if ecosystem == "npm": + url = f"https://registry.npmjs.org/{component_name}" + elif ecosystem == "maven": + # Maven Central search + url = f"https://search.maven.org/solrsearch/select?q=g:{component_name}" + elif ecosystem == "pypi": + url = f"https://pypi.org/pypi/{component_name}/json" + + # Fetch and return package metadata +``` + +## Configuration Options + +The enhanced SARIF converter supports the following configuration: + +```python +sarif_data = convert_vulns_to_sarif( + vulnerabilities=vulns, + scan_code=scan_code, + include_cve_descriptions=True, # Fetch from NVD + include_epss_scores=True, # Fetch from FIRST + include_exploit_info=True, # Fetch from CISA KEV + api_timeout=30 # API timeout in seconds +) +``` + +### **NVD API Key Configuration** + +For significantly improved performance when fetching CVE data from NVD, configure an API key: + +#### **1. Request NVD API Key** +1. Visit [NVD API Key Request](https://nvd.nist.gov/developers/request-an-api-key) +2. Fill out the form with your email address +3. Check your email for the API key activation link +4. Activate your API key (note: the key is shown only once) + +#### **2. Set Environment Variable** +```bash +# Linux/macOS +export NVD_API_KEY="your-api-key-here" + +# Windows +set NVD_API_KEY=your-api-key-here + +# Or add to .bashrc/.zshrc for persistence +echo 'export NVD_API_KEY="your-api-key-here"' >> ~/.bashrc +``` + +#### **3. Performance Improvement** +- **Without API Key**: 5 requests per 30 seconds (6-second delays) +- **With API Key**: 50 requests per 30 seconds (0.6-second delays) +- **Concurrency**: 2 parallel requests → 5 parallel requests +- **Overall Speed**: ~10x faster for large CVE lists + +#### **4. Verification** +The tool will automatically detect the API key and log: +``` +INFO: Fetching NVD data for 25 CVEs using API key +INFO: Processed 10/25 CVEs +INFO: Processed 20/25 CVEs +INFO: Processed 25/25 CVEs +``` + +Without an API key, you'll see: +``` +INFO: Fetching NVD data for 25 CVEs using public rate limits +``` + +## Future Enhancement Ideas + +### **1. Advanced Risk Analytics** +- **EPSS Trending**: Track EPSS score changes over time +- **Exploit Timeline**: Map vulnerability age to exploitation likelihood +- **Component Popularity**: Factor in package download statistics + +### **2. Remediation Intelligence** +- **Fix Version Detection**: Query package registries for versions that fix vulnerabilities +- **Dependency Path Analysis**: Show how vulnerable components were introduced +- **Alternative Package Suggestions**: Recommend safer alternatives + +### **3. Integration Enhancements** +- **Async API Calls**: Improve performance with concurrent requests +- **Caching**: Cache external API responses to reduce rate limiting +- **Offline Mode**: Support for pre-downloaded vulnerability databases + +### **4. Custom Filtering** +- **Risk Thresholds**: Filter vulnerabilities by custom risk scores +- **Environment Context**: Different risk calculations for dev/staging/prod +- **Compliance Mapping**: Map vulnerabilities to compliance frameworks + +## Performance Considerations + +### **Rate Limiting** +- NVD API: 5 requests/30 seconds (6-second delays implemented) +- EPSS API: 100 requests/minute (1-second delays implemented) +- CISA KEV: Single bulk download (no rate limiting) + +### **Optimization Strategies** +- **Batch Processing**: EPSS API supports batch queries for up to 100 CVEs +- **Caching**: Implement local caching for frequently queried CVEs +- **Async Processing**: Use `aiohttp` for concurrent API calls +- **Fallback Sources**: Use multiple sources for redundancy + +### **Error Handling** +- Graceful degradation when external APIs are unavailable +- Comprehensive logging for debugging API issues +- Timeout handling for slow API responses + +## Security Considerations + +### **API Key Management** +- Store API keys in environment variables +- Use different keys for different environments +- Implement key rotation policies + +### **Data Privacy** +- Be mindful of CVE data containing sensitive information +- Consider proxy/caching solutions for corporate environments +- Implement audit logging for external API calls + +## Testing Strategy + +### **Unit Tests** +- Mock external API responses for consistent testing +- Test error handling and fallback scenarios +- Validate SARIF output format compliance + +### **Integration Tests** +- Test with real API endpoints (rate-limited) +- Validate external data integration +- Test performance with large vulnerability datasets + +## Conclusion + +The enhanced SARIF export provides security teams with comprehensive, actionable vulnerability intelligence by integrating multiple authoritative sources. The modular design allows for easy extension with additional data sources and custom risk scoring algorithms. + +For questions or suggestions, please refer to the project documentation or submit an issue on the project repository. \ No newline at end of file diff --git a/src/workbench_cli/cli.py b/src/workbench_cli/cli.py index 1da017d..92ca33b 100644 --- a/src/workbench_cli/cli.py +++ b/src/workbench_cli/cli.py @@ -52,7 +52,8 @@ def add_common_result_options(subparser): results_display_args.add_argument("--show-scan-metrics", help="Show metrics on file identifications (total files, pending id, identified, no matches).", action="store_true", default=False) results_display_args.add_argument("--show-policy-warnings", help="Shows Policy Warnings in identified components or dependencies.", action="store_true", default=False) results_display_args.add_argument("--show-vulnerabilities", help="Shows a summary of vulnerabilities found in the scan.", action="store_true", default=False) - results_display_args.add_argument("--path-result", help="Saves the requested results to this file/directory (JSON format).", metavar="PATH") + results_display_args.add_argument("--json-result-path", help="Saves the requested results to this file/directory (JSON format).", metavar="PATH") + results_display_args.add_argument("--sarif-result-path", help="Saves vulnerability results to this file in SARIF format (only works with --show-vulnerabilities).", metavar="PATH") # --- Main Parsing Function --- def parse_cmdline_args(): @@ -114,6 +115,20 @@ def parse_cmdline_args(): # Download reports for a specific scan (globally) workbench-cli --api-url --api-user --api-token \\ download-reports --scan-name MYSCAN01 --report-scope scan --report-type html --report-save-path reports/ + + # Export vulnerability results in SARIF format for security tooling + workbench-cli --api-url --api-user --api-token \\ + export-sarif --project-name MYPROJ --scan-name MYSCAN01 --output security-report.sarif + + # Export SARIF with custom enrichment options + workbench-cli --api-url --api-user --api-token \\ + export-sarif --project-name MYPROJ --scan-name MYSCAN01 --output vulns.sarif \\ + --no-enrich-epss --no-enrich-cisa-kev --external-timeout 60 --severity-threshold high + + # Export SARIF in offline mode (no external enrichment) + workbench-cli --api-url --api-user --api-token \\ + export-sarif --project-name MYPROJ --scan-name MYSCAN01 --output vulns.sarif \\ + --skip-enrichment --quiet """ ) @@ -297,6 +312,48 @@ def parse_cmdline_args(): add_common_monitoring_options(scan_git_parser) add_common_result_options(scan_git_parser) + # --- 'export-sarif' Subcommand --- + export_sarif_parser = subparsers.add_parser( + 'export-sarif', + help='Export vulnerability results in SARIF format for security tooling integration.', + description='Export vulnerability results from an existing scan in SARIF (Static Analysis Results Interchange Format) v2.1.0 format. This format is compatible with GitHub Advanced Security, security scanners, and other DevSecOps tools.', + formatter_class=RawTextHelpFormatter + ) + + # Required arguments + required_args = export_sarif_parser.add_argument_group("Required") + required_args.add_argument("--project-name", help="Project name containing the scan.", type=str, required=True, metavar="NAME") + required_args.add_argument("--scan-name", help="Scan name to export vulnerability results from.", type=str, required=True, metavar="NAME") + required_args.add_argument("--output", help="Output file path for the SARIF report (Default: vulns.sarif).", type=str, default="vulns.sarif", metavar="PATH") + + # Workbench data sources + workbench_data_args = export_sarif_parser.add_argument_group("Workbench Data Sources") + workbench_data_args.add_argument("--include-vex", help="Include VEX assessments from Workbench (Default: True).", action=argparse.BooleanOptionalAction, default=True) + workbench_data_args.add_argument("--severity-threshold", help="Filter vulnerabilities by CVSS severity.", choices=["critical", "high", "medium", "low"], metavar="LEVEL") + workbench_data_args.add_argument("--include-scan-metadata", help="Include scan timing, settings, and other metadata (Default: True).", action=argparse.BooleanOptionalAction, default=True) + + # External API enrichment + external_api_args = export_sarif_parser.add_argument_group("External API Enrichment (Network Calls)") + external_api_args.add_argument("--enrich-nvd", help="Fetch CVE descriptions from NVD API (Default: True).", action=argparse.BooleanOptionalAction, default=True) + external_api_args.add_argument("--enrich-epss", help="Fetch EPSS scores from FIRST API (Default: True).", action=argparse.BooleanOptionalAction, default=True) + external_api_args.add_argument("--enrich-cisa-kev", help="Fetch CISA Known Exploited Vulnerabilities (Default: True).", action=argparse.BooleanOptionalAction, default=True) + external_api_args.add_argument("--external-timeout", help="Timeout for external API calls in seconds (Default: 30).", type=int, default=30, metavar="SECONDS") + external_api_args.add_argument("--skip-enrichment", help="Skip all external enrichment (offline mode).", action="store_true") + + # Output processing & suppression + processing_args = export_sarif_parser.add_argument_group("Output Processing & Suppression") + processing_args.add_argument("--suppress-vex-mitigated", help="Suppress findings with VEX mitigation status (Default: True).", action=argparse.BooleanOptionalAction, default=True) + processing_args.add_argument("--suppress-accepted-risk", help="Suppress findings marked as accepted risk (Default: True).", action=argparse.BooleanOptionalAction, default=True) + processing_args.add_argument("--suppress-false-positives", help="Suppress findings marked as false positives (Default: True).", action=argparse.BooleanOptionalAction, default=True) + processing_args.add_argument("--group-by-component", help="Group findings by component in SARIF (Default: True).", action=argparse.BooleanOptionalAction, default=True) + + # Output control + output_control_args = export_sarif_parser.add_argument_group("Output Control") + output_control_args.add_argument("--quiet", help="Suppress progress output.", action="store_true") + output_control_args.add_argument("--validate", help="Validate SARIF schema.", action="store_true") + + add_common_monitoring_options(export_sarif_parser) + # --- Validate args after parsing --- args = parser.parse_args() diff --git a/src/workbench_cli/handlers/__init__.py b/src/workbench_cli/handlers/__init__.py index b3cd199..80ccc89 100644 --- a/src/workbench_cli/handlers/__init__.py +++ b/src/workbench_cli/handlers/__init__.py @@ -13,6 +13,7 @@ from .show_results import handle_show_results from .evaluate_gates import handle_evaluate_gates from .download_reports import handle_download_reports +from .export_sarif import handle_export_sarif __all__ = [ 'handle_scan', @@ -21,5 +22,6 @@ 'handle_import_sbom', 'handle_show_results', 'handle_evaluate_gates', - 'handle_download_reports' + 'handle_download_reports', + 'handle_export_sarif' ] diff --git a/src/workbench_cli/handlers/export_sarif.py b/src/workbench_cli/handlers/export_sarif.py new file mode 100644 index 0000000..6eb71d2 --- /dev/null +++ b/src/workbench_cli/handlers/export_sarif.py @@ -0,0 +1,168 @@ +# workbench_cli/handlers/export_sarif.py + +import logging +import argparse +from typing import TYPE_CHECKING + +from ..utilities.error_handling import handler_error_wrapper +from ..utilities.sarif_converter import save_vulns_to_sarif +from ..exceptions import ( + ApiError, + NetworkError, + ValidationError, + ProcessTimeoutError, + ProcessError +) + +if TYPE_CHECKING: + from ..api import WorkbenchAPI + +logger = logging.getLogger("workbench-cli") + + +@handler_error_wrapper +def handle_export_sarif(workbench: "WorkbenchAPI", params: argparse.Namespace) -> bool: + """ + Handler for the 'export-sarif' command. Exports vulnerability results in SARIF format. + + Args: + workbench: The Workbench API client + params: Command line parameters + + Returns: + bool: True if the operation was successful + """ + print(f"\n--- Running {params.command.upper()} Command ---") + + # Resolve project and scan (find only) + if not params.quiet: + print("\nResolving scan for SARIF export...") + project_code = workbench.resolve_project(params.project_name, create_if_missing=False) + scan_code, scan_id = workbench.resolve_scan( + scan_name=params.scan_name, + project_name=params.project_name, + create_if_missing=False, + params=params + ) + + # Ensure scan processes are idle before fetching results + if not params.quiet: + print("\nEnsuring scan processes are idle before fetching vulnerability data...") + try: + workbench.ensure_scan_is_idle(scan_code, params, ["SCAN", "DEPENDENCY_ANALYSIS"]) + except (ProcessTimeoutError, ProcessError, ApiError, NetworkError) as e: + logger.warning(f"Could not verify scan completion for '{scan_code}': {e}. Proceeding anyway.") + if not params.quiet: + print("\nWarning: Could not verify scan completion status. Results may be incomplete.") + + # Fetch vulnerability data + if not params.quiet: + print("\nFetching vulnerability data for SARIF export...") + try: + vulnerabilities = workbench.list_vulnerabilities(scan_code) + + # Apply severity filtering if specified + if getattr(params, 'severity_threshold', None): + severity_order = {'critical': 4, 'high': 3, 'medium': 2, 'low': 1} + min_severity = severity_order.get(params.severity_threshold.lower(), 0) + original_count = len(vulnerabilities) + vulnerabilities = [ + vuln for vuln in vulnerabilities + if severity_order.get(vuln.get('severity', '').lower(), 0) >= min_severity + ] + if not params.quiet and original_count != len(vulnerabilities): + print(f"Filtered {original_count - len(vulnerabilities)} vulnerabilities below {params.severity_threshold} severity") + + if not vulnerabilities: + if not params.quiet: + print("⚠️ No vulnerabilities found in the scan.") + print("An empty SARIF report will be generated.") + else: + if not params.quiet: + print(f"✅ Found {len(vulnerabilities)} vulnerabilities to export.") + + # Display summary of what will be included + severity_counts = {} + vex_counts = {"with_vex": 0, "without_vex": 0} + + for vuln in vulnerabilities: + severity = vuln.get("severity", "UNKNOWN") + severity_counts[severity] = severity_counts.get(severity, 0) + 1 + + # Check for VEX information + if vuln.get("vuln_exp_id"): + vex_counts["with_vex"] += 1 + else: + vex_counts["without_vex"] += 1 + + print("\n📊 Vulnerability Summary:") + for severity, count in sorted(severity_counts.items()): + print(f" • {severity}: {count}") + + if vex_counts["with_vex"] > 0: + print(f"\n📋 VEX Information:") + print(f" • With VEX assessments: {vex_counts['with_vex']}") + print(f" • Without VEX assessments: {vex_counts['without_vex']}") + + # Display export configuration + if not params.quiet: + print(f"\n🔧 SARIF Export Configuration:") + print(f" • Output file: {params.output}") + print(f" • Include VEX assessments: {params.include_vex}") + if params.severity_threshold: + print(f" • Severity threshold: {params.severity_threshold}") + print(f" • Include scan metadata: {params.include_scan_metadata}") + + # External enrichment status + if params.skip_enrichment: + print(f" • External enrichment: DISABLED (offline mode)") + else: + print(f" • Enrich with NVD descriptions: {params.enrich_nvd}") + print(f" • Enrich with EPSS scores: {params.enrich_epss}") + print(f" • Enrich with CISA KEV: {params.enrich_cisa_kev}") + print(f" • External API timeout: {params.external_timeout}s") + + # Suppression settings + print(f" • Suppress VEX mitigated: {params.suppress_vex_mitigated}") + print(f" • Suppress accepted risk: {params.suppress_accepted_risk}") + print(f" • Suppress false positives: {params.suppress_false_positives}") + print(f" • Group by component: {params.group_by_component}") + + # Export to SARIF + if not params.quiet: + print(f"\n📤 Exporting SARIF report...") + save_vulns_to_sarif( + filepath=params.output, + vulnerabilities=vulnerabilities, + scan_code=scan_code, + include_cve_descriptions=params.enrich_nvd if not params.skip_enrichment else False, + include_epss_scores=params.enrich_epss if not params.skip_enrichment else False, + include_exploit_info=params.enrich_cisa_kev if not params.skip_enrichment else False, + api_timeout=params.external_timeout, + include_vex=params.include_vex, + include_scan_metadata=params.include_scan_metadata, + suppress_vex_mitigated=params.suppress_vex_mitigated, + suppress_accepted_risk=params.suppress_accepted_risk, + suppress_false_positives=params.suppress_false_positives, + group_by_component=params.group_by_component, + quiet=params.quiet + ) + + if not params.quiet: + print(f"\n✅ SARIF export completed successfully!") + print(f"📄 Report saved to: {params.output}") + + # Provide integration guidance + print(f"\n💡 Integration Tips:") + print(f" • Upload to GitHub: Add this file to your repository for GitHub Advanced Security integration") + print(f" • CI/CD Integration: Use this report in your security scanning pipeline") + print(f" • Security Tools: Import into SARIF-compatible security analysis tools") + + return True + + except Exception as e: + logger.error(f"Failed to export SARIF: {e}") + if isinstance(e, (ApiError, NetworkError, ProcessTimeoutError, ProcessError)): + raise + else: + raise ProcessError(f"Failed to export vulnerability data to SARIF format: {str(e)}") \ No newline at end of file diff --git a/src/workbench_cli/handlers/show_results.py b/src/workbench_cli/handlers/show_results.py index 3d12e28..e5e9ef7 100644 --- a/src/workbench_cli/handlers/show_results.py +++ b/src/workbench_cli/handlers/show_results.py @@ -42,6 +42,10 @@ def handle_show_results(workbench: "WorkbenchAPI", params: argparse.Namespace) - if not any(show_flags): raise ValidationError("At least one '--show-*' flag must be provided to display results") + # Validate SARIF output requirements + if getattr(params, 'sarif_result_path', None) and not params.show_vulnerabilities: + raise ValidationError("--sarif-result-path requires --show-vulnerabilities flag") + # Resolve project and scan (find only) print("\nResolving scan for results display...") project_code = workbench.resolve_project(params.project_name, create_if_missing=False) diff --git a/src/workbench_cli/main.py b/src/workbench_cli/main.py index 124bc3d..0c4413f 100644 --- a/src/workbench_cli/main.py +++ b/src/workbench_cli/main.py @@ -31,6 +31,7 @@ handle_evaluate_gates, handle_download_reports, handle_scan_git, + handle_export_sarif, ) @@ -89,6 +90,7 @@ def main() -> int: "evaluate-gates": handle_evaluate_gates, "download-reports": handle_download_reports, "scan-git": handle_scan_git, + "export-sarif": handle_export_sarif, } handler = COMMAND_HANDLERS.get(params.command) diff --git a/src/workbench_cli/utilities/sarif_converter.py b/src/workbench_cli/utilities/sarif_converter.py new file mode 100644 index 0000000..79c9373 --- /dev/null +++ b/src/workbench_cli/utilities/sarif_converter.py @@ -0,0 +1,1238 @@ +""" +SARIF conversion utilities for vulnerability data. + +This module provides functionality to convert vulnerability data from the Workbench API +into SARIF (Static Analysis Results Interchange Format) v2.1.0 format, which is +compatible with GitHub Advanced Security and other security tools. + +Enhanced with external API integration for EPSS scores, known exploits, CVE details, +and VEX (Vulnerability Exploitability eXchange) information. +""" + +import json +import logging +import os +from typing import Dict, List, Any, Optional +from datetime import datetime + +from .vulnerability_enricher import enrich_vulnerabilities + +logger = logging.getLogger(__name__) + + +def _apply_vex_suppression(vulnerabilities: List[Dict[str, Any]], + suppress_vex_mitigated: bool = True, + suppress_accepted_risk: bool = True, + suppress_false_positives: bool = True) -> List[Dict[str, Any]]: + """ + Apply VEX-based suppression to vulnerabilities. + + Args: + vulnerabilities: List of vulnerability dictionaries + suppress_vex_mitigated: Whether to suppress findings with VEX mitigation status + suppress_accepted_risk: Whether to suppress findings marked as accepted risk + suppress_false_positives: Whether to suppress findings marked as false positives + + Returns: + Filtered list of vulnerabilities after applying suppression rules + """ + filtered_vulns = [] + + for vuln in vulnerabilities: + should_suppress = False + + # Check VEX status for suppression + vex_status = (vuln.get("vuln_exp_status") or "").lower() + vex_justification = (vuln.get("vuln_exp_justification") or "").lower() + vex_response = (vuln.get("vuln_exp_response") or "").lower() + + # Suppress VEX mitigated findings + if suppress_vex_mitigated and vex_status in ["not_affected", "resolved"]: + should_suppress = True + + # Suppress accepted risk findings + if suppress_accepted_risk and vex_response in ["will_not_fix", "update", "can_not_fix"]: + should_suppress = True + + # Suppress false positives + if suppress_false_positives and vex_status == "false_positive": + should_suppress = True + + if not should_suppress: + filtered_vulns.append(vuln) + + return filtered_vulns + + +def convert_vulns_to_sarif(vulnerabilities: List[Dict[str, Any]], scan_code: str, + include_cve_descriptions: bool = True, + include_epss_scores: bool = True, + include_exploit_info: bool = True, + api_timeout: int = 30, + include_vex: bool = True, + include_scan_metadata: bool = True, + group_by_component: bool = True) -> Dict[str, Any]: + """ + Convert vulnerability data to SARIF v2.1.0 format with external enrichment and VEX information. + + Args: + vulnerabilities: List of vulnerability dictionaries from the Workbench API + scan_code: The scan code for reference + include_cve_descriptions: Whether to fetch CVE descriptions from NVD + include_epss_scores: Whether to fetch EPSS scores from FIRST + include_exploit_info: Whether to fetch known exploit information + api_timeout: Timeout for external API calls in seconds + + Returns: + Dict containing SARIF-formatted data compatible with GitHub Advanced Security, + enhanced with VEX (Vulnerability Exploitability eXchange) information + """ + if not vulnerabilities: + return _create_empty_sarif_report(scan_code) + + # Extract unique CVEs for batch processing + unique_cves = list(set(vuln.get("cve", "UNKNOWN") for vuln in vulnerabilities if vuln.get("cve") != "UNKNOWN")) + + # Fetch external data using the enricher module + external_data = {} + if unique_cves: + try: + external_data = enrich_vulnerabilities( + unique_cves, + include_cve_descriptions, + include_epss_scores, + include_exploit_info, + api_timeout + ) + except Exception as e: + logger.warning(f"Failed to fetch external vulnerability data: {e}") + + # Count VEX statements for reporting + vex_stats = _analyze_vex_statements(vulnerabilities) + + # Generate notifications for high-risk findings + notifications = [] + cisa_kev_count = sum(1 for vuln in vulnerabilities if external_data.get(vuln.get("cve", ""), {}).get("cisa_kev")) + high_epss_count = sum(1 for vuln in vulnerabilities if (external_data.get(vuln.get("cve", ""), {}).get("epss_score") or 0) > 0.1) + vex_suppressed_count = sum(1 for vuln in vulnerabilities if _get_vex_info(vuln) and _get_vex_info(vuln).get("vuln_exp_status") in ["not_affected", "fixed", "mitigated", "resolved", "false_positive"]) + + if cisa_kev_count > 0: + notifications.append({ + "level": "error", + "message": { + "text": f"⚠️ URGENT: {cisa_kev_count} vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog and require immediate attention" + }, + "properties": { + "cisa_kev_count": cisa_kev_count, + "category": "security", + "priority": "critical" + } + }) + + if high_epss_count > 0: + notifications.append({ + "level": "warning", + "message": { + "text": f"🔍 HIGH RISK: {high_epss_count} vulnerabilities have elevated EPSS exploitation probability scores (>0.1)" + }, + "properties": { + "high_epss_count": high_epss_count, + "category": "security", + "priority": "high" + } + }) + + if vex_suppressed_count > 0: + notifications.append({ + "level": "note", + "message": { + "text": f"✅ VEX ASSESSMENTS: {vex_suppressed_count} vulnerabilities have been assessed and suppressed based on organizational VEX statements" + }, + "properties": { + "vex_suppressed_count": vex_suppressed_count, + "category": "assessment", + "priority": "info" + } + }) + + return { + "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", + "version": "2.1.0", + "runs": [{ + "tool": { + "driver": { + "name": "FossID Workbench", + "version": "1.0.0", + "informationUri": "https://fossid.com/products/workbench/", + "rules": _generate_enhanced_rules(vulnerabilities, external_data), + "notifications": notifications + } + }, + "results": _generate_enhanced_results(vulnerabilities, external_data), + "properties": { + "scan_code": scan_code, + "generated_at": datetime.utcnow().isoformat() + "Z", + "total_vulnerabilities": len(vulnerabilities), + "severity_distribution": _calculate_severity_distribution(vulnerabilities), + "external_data_sources": _get_data_sources_used(external_data), + "high_risk_vulnerabilities": _count_high_risk_vulnerabilities(vulnerabilities, external_data), + "vex_statements": vex_stats + } + }] + } + + +def _generate_enhanced_rules(vulnerabilities: List[Dict[str, Any]], + external_data: Dict[str, Dict[str, Any]]) -> List[Dict[str, Any]]: + """ + Generate enhanced SARIF rules from vulnerability data with external enrichment and VEX information. + """ + rules = {} + + for vuln in vulnerabilities: + cve = vuln.get("cve", "UNKNOWN") + if cve not in rules: + # Get external data for this CVE + ext_data = external_data.get(cve, {}) + + # Get VEX information for this vulnerability + vex_info = _get_vex_info(vuln) + + # Build enhanced CVSS vector + cvss_vector = ext_data.get("full_cvss_vector") or _build_cvss_vector(vuln) + + # Enhanced rule with external data and VEX information + rule = { + "id": cve, + "name": f"Vulnerability {cve}", + "shortDescription": { + "text": _generate_enhanced_short_description(cve, vuln, ext_data, vex_info) + }, + "fullDescription": { + "text": _generate_enhanced_full_description(cve, vuln, ext_data, vex_info) + }, + "defaultConfiguration": { + "level": _map_severity_to_sarif_level(vuln.get("severity", "UNKNOWN")) + }, + "properties": { + "security-severity": str(vuln.get("base_score", "0.0")), + "cvss_version": vuln.get("cvss_version", "N/A"), + "cvss_vector": cvss_vector, + "base_score": vuln.get("base_score", "N/A"), + "attack_vector": vuln.get("attack_vector", "N/A"), + "attack_complexity": vuln.get("attack_complexity", "N/A"), + "availability_impact": vuln.get("availability_impact", "N/A"), + "severity": vuln.get("severity", "UNKNOWN"), + "tags": _generate_enhanced_vulnerability_tags(vuln, ext_data, vex_info) + }, + "helpUri": f"https://nvd.nist.gov/vuln/detail/{cve}" if cve != "UNKNOWN" else None + } + + # Add external data properties + if ext_data.get("epss_score") is not None: + rule["properties"]["epss_score"] = ext_data["epss_score"] + rule["properties"]["epss_percentile"] = ext_data["epss_percentile"] + + if ext_data.get("cisa_kev"): + rule["properties"]["cisa_known_exploited"] = True + + if ext_data.get("nvd_cwe"): + rule["properties"]["cwe_ids"] = ext_data["nvd_cwe"] + + # Add VEX properties + if vex_info: + vex_properties = _generate_vex_properties(vex_info) + rule["properties"].update(vex_properties) + + # Enhanced help text + rule["help"] = { + "text": _generate_enhanced_help_text(cve, vuln, ext_data, vex_info), + "markdown": _generate_enhanced_help_markdown(cve, vuln, ext_data, vex_info) + } + + rules[cve] = rule + + return list(rules.values()) + + +def _generate_enhanced_short_description(cve: str, vuln: Dict[str, Any], ext_data: Dict[str, Any], vex_info: Optional[Dict[str, Any]] = None) -> str: + """Generate enhanced short description with risk indicators and VEX status.""" + base_desc = f"Security vulnerability {cve} (CVSS {vuln.get('base_score', 'N/A')})" + + risk_indicators = [] + if ext_data.get("cisa_kev"): + risk_indicators.append("CISA KEV") + epss_score = ext_data.get("epss_score") + if epss_score is not None and epss_score > 0.1: # High EPSS score + risk_indicators.append(f"EPSS: {epss_score:.3f}") + + # Add VEX status indicator + if vex_info and vex_info.get("vuln_exp_status"): + vex_status = vex_info["vuln_exp_status"] + risk_indicators.append(f"VEX: {vex_status}") + + if risk_indicators: + base_desc += f" [{', '.join(risk_indicators)}]" + + return base_desc + + +def _generate_enhanced_full_description(cve: str, vuln: Dict[str, Any], ext_data: Dict[str, Any], vex_info: Optional[Dict[str, Any]] = None) -> str: + """Generate comprehensive description with external data and VEX information.""" + # Start with NVD description if available, adding a blank line afterwards for clarity + if ext_data.get("nvd_description"): + base_desc = ext_data["nvd_description"].rstrip() + separator = "\n\n" # Paragraph break after canonical description + else: + base_desc = f"Security vulnerability {cve} with CVSS score {vuln.get('base_score', 'N/A')}" + separator = " " # Continue in same paragraph if no NVD text + + # Add risk context + severity = vuln.get("severity", "UNKNOWN") + attack_vector = vuln.get("attack_vector", "") + attack_complexity = vuln.get("attack_complexity", "") + + if attack_vector and attack_complexity: + base_desc += f"{separator}This is a {severity.lower()} severity vulnerability with {attack_vector.lower()} attack vector and {attack_complexity.lower()} attack complexity." + + # Add exploit information + if ext_data.get("cisa_kev"): + base_desc += " This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild." + + epss_score = ext_data.get("epss_score") + if epss_score is not None and epss_score > 0.1: + base_desc += f" EPSS score of {epss_score:.3f} indicates elevated risk of exploitation." + + # Add CWE information + if ext_data.get("nvd_cwe"): + cwe_list = ", ".join(ext_data["nvd_cwe"]) + base_desc += f" Associated with {cwe_list}." + + # Add VEX information + if vex_info: + vex_status = vex_info.get("vuln_exp_status") + if vex_status: + base_desc += f" VEX Status: {vex_status}" + + # Add VEX justification if available + if vex_info.get("vuln_exp_justification"): + base_desc += f" - {vex_info['vuln_exp_justification']}" + + # Add VEX response if available + if vex_info.get("vuln_exp_response"): + base_desc += f" Response: {vex_info['vuln_exp_response']}" + + return base_desc + + +def _generate_enhanced_help_markdown(cve: str, vuln: Dict[str, Any], ext_data: Dict[str, Any], vex_info: Optional[Dict[str, Any]] = None) -> str: + """Generate enhanced help text in Markdown format with external data and VEX information.""" + component = vuln.get("component_name", "Unknown") + version = vuln.get("component_version", "Unknown") + severity = vuln.get("severity", "UNKNOWN") + score = vuln.get("base_score", "N/A") + + # Risk assessment with VEX consideration + risk_level = "Standard" + epss_score = ext_data.get("epss_score") + if ext_data.get("cisa_kev") or (epss_score is not None and epss_score > 0.1): + risk_level = "**HIGH RISK**" + + # Adjust risk level based on VEX status + if vex_info and vex_info.get("vuln_exp_status"): + vex_status = vex_info["vuln_exp_status"].lower() + if vex_status in ["not_affected", "fixed", "mitigated", "resolved"]: + risk_level = "**MITIGATED**" + elif vex_status in ["accepted_risk"]: + risk_level = "**ACCEPTED RISK**" + elif vex_status in ["false_positive"]: + risk_level = "**FALSE POSITIVE**" + + markdown = f"""## Vulnerability: {cve} ({risk_level}) + +**Component:** `{component}` +**Version:** `{version}` +**Severity:** {severity} ({score})""" + + # Add external data + if ext_data.get("epss_score") is not None: + markdown += f" \n**EPSS Score:** {ext_data['epss_score']:.3f} (percentile: {ext_data.get('epss_percentile', 'N/A')})" + + if ext_data.get("cisa_kev"): + markdown += f" \n**⚠️ CISA KEV:** Listed in Known Exploited Vulnerabilities" + + if ext_data.get("nvd_cwe"): + markdown += f" \n**CWE:** {', '.join(ext_data['nvd_cwe'])}" + + # Add VEX information + if vex_info: + markdown += f"\n\n### VEX Assessment" + if vex_info.get("vuln_exp_status"): + markdown += f" \n**Status:** {vex_info['vuln_exp_status']}" + + if vex_info.get("vuln_exp_justification"): + markdown += f" \n**Justification:** {vex_info['vuln_exp_justification']}" + + if vex_info.get("vuln_exp_response"): + markdown += f" \n**Response:** {vex_info['vuln_exp_response']}" + + if vex_info.get("vuln_exp_details"): + markdown += f" \n**Details:** {vex_info['vuln_exp_details']}" + + if vex_info.get("vuln_exp_updated"): + markdown += f" \n**Last Updated:** {vex_info['vuln_exp_updated']}" + if vex_info.get("vuln_exp_updated_by_username"): + markdown += f" by {vex_info['vuln_exp_updated_by_username']}" + + markdown += f""" + +### Description +{ext_data.get('nvd_description', f'This vulnerability affects {component} version {version}.')} + +### Risk Assessment +- **Severity:** {severity} ({score})""" + + epss_score = ext_data.get("epss_score") + if epss_score is not None: + if epss_score > 0.1: + markdown += f"\n- **Exploitation Risk:** HIGH (EPSS: {epss_score:.3f})" + else: + markdown += f"\n- **Exploitation Risk:** Low (EPSS: {epss_score:.3f})" + + if ext_data.get("cisa_kev"): + markdown += f"\n- **Known Exploits:** YES - Active exploitation detected" + + # Add VEX risk assessment + if vex_info and vex_info.get("vuln_exp_status"): + vex_status = vex_info["vuln_exp_status"].lower() + if vex_status in ["not_affected"]: + markdown += f"\n- **VEX Assessment:** NOT AFFECTED - This component is not impacted by this vulnerability" + elif vex_status in ["fixed"]: + markdown += f"\n- **VEX Assessment:** FIXED - This vulnerability has been resolved" + elif vex_status in ["mitigated"]: + markdown += f"\n- **VEX Assessment:** MITIGATED - Controls are in place to reduce risk" + elif vex_status in ["accepted_risk"]: + markdown += f"\n- **VEX Assessment:** ACCEPTED RISK - Organization has accepted this risk" + elif vex_status in ["under_investigation"]: + markdown += f"\n- **VEX Assessment:** UNDER INVESTIGATION - Impact is being evaluated" + + markdown += f""" + +### Remediation +1. **PRIORITY:** {'CRITICAL - Patch immediately' if ext_data.get('cisa_kev') else 'Update the component'} to the latest version that fixes this vulnerability +2. **Monitor:** Check for security advisories and patches +3. **Automate:** Implement automated dependency scanning and updates +4. **Validate:** Test patches in a staging environment before production deployment""" + + if ext_data.get("cisa_kev"): + markdown += f"\n5. **URGENT:** This vulnerability has known exploits - prioritize patching" + + # Adjust remediation based on VEX status + if vex_info and vex_info.get("vuln_exp_status"): + vex_status = vex_info["vuln_exp_status"].lower() + if vex_status in ["not_affected", "fixed"]: + markdown += f"\n\n**Note:** VEX assessment indicates this vulnerability is {vex_status.replace('_', ' ')}. Verify that assessment is current and accurate." + elif vex_status in ["mitigated"]: + markdown += f"\n\n**Note:** VEX assessment indicates mitigations are in place. Ensure mitigations remain effective and consider patching for defense in depth." + + markdown += f""" + +### References +- [NVD Details](https://nvd.nist.gov/vuln/detail/{cve}) +- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name={cve})""" + + if ext_data.get("epss_score") is not None: + markdown += f"\n- [EPSS Details](https://www.first.org/epss/model)" + + if ext_data.get("cisa_kev"): + markdown += f"\n- [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)" + + # Add additional references from NVD + if ext_data.get("nvd_references"): + markdown += f"\n- Additional References:" + for ref in ext_data["nvd_references"][:3]: # Limit to 3 additional refs + if ref.get("url"): + markdown += f"\n - [{ref.get('source', 'Reference')}]({ref['url']})" + + return markdown + + +def _generate_enhanced_vulnerability_tags(vuln: Dict[str, Any], ext_data: Dict[str, Any], vex_info: Optional[Dict[str, Any]] = None) -> List[str]: + """Generate enhanced tags including external data indicators and VEX status.""" + tags = ["security", "vulnerability"] + + severity = vuln.get("severity", "").lower() + if severity: + tags.append(f"severity-{severity}") + + attack_vector = vuln.get("attack_vector", "").lower() + if attack_vector: + tags.append(f"attack-vector-{attack_vector}") + + # Add ecosystem-specific tags + component_name = vuln.get("component_name", "") + ecosystem = _detect_package_ecosystem(component_name) + tags.append(f"ecosystem-{ecosystem}") + + # Add external data tags + if ext_data.get("cisa_kev"): + tags.append("cisa-kev") + tags.append("known-exploited") + + epss_score = ext_data.get("epss_score") + if epss_score is not None and epss_score > 0.1: + tags.append("high-epss") + + if ext_data.get("nvd_cwe"): + for cwe in ext_data["nvd_cwe"][:2]: # Limit to 2 CWE tags + if cwe.startswith("CWE-"): + tags.append(f"cwe-{cwe[4:]}") + + # Add VEX tags + if vex_info and vex_info.get("vuln_exp_status"): + vex_status = vex_info["vuln_exp_status"].lower() + tags.append(f"vex-{vex_status}") + + # Add semantic VEX tags + if vex_status in ["not_affected", "fixed", "resolved"]: + tags.append("vex-resolved") + elif vex_status in ["mitigated"]: + tags.append("vex-mitigated") + elif vex_status in ["accepted_risk"]: + tags.append("vex-accepted") + elif vex_status in ["false_positive"]: + tags.append("vex-false-positive") + elif vex_status in ["under_investigation", "in_triage"]: + tags.append("vex-investigating") + + return tags + + +def _count_high_risk_vulnerabilities(vulnerabilities: List[Dict[str, Any]], + external_data: Dict[str, Dict[str, Any]]) -> Dict[str, int]: + """Count high-risk vulnerabilities based on external data.""" + counts = { + "cisa_kev": 0, + "high_epss": 0, + "critical_severity": 0, + "total_high_risk": 0 + } + + high_risk_cves = set() + + for vuln in vulnerabilities: + cve = vuln.get("cve", "UNKNOWN") + ext_data = external_data.get(cve, {}) + + is_high_risk = False + + if ext_data.get("cisa_kev"): + counts["cisa_kev"] += 1 + is_high_risk = True + + epss_score = ext_data.get("epss_score") + if epss_score is not None and epss_score > 0.1: + counts["high_epss"] += 1 + is_high_risk = True + + if vuln.get("severity", "").upper() == "CRITICAL": + counts["critical_severity"] += 1 + is_high_risk = True + + if is_high_risk: + high_risk_cves.add(cve) + + counts["total_high_risk"] = len(high_risk_cves) + return counts + + +def _get_data_sources_used(external_data: Dict[str, Dict[str, Any]]) -> List[str]: + """Get list of external data sources that were successfully used.""" + sources = [] + + for cve_data in external_data.values(): + if cve_data.get("epss_score") is not None and "FIRST EPSS" not in sources: + sources.append("FIRST EPSS") + if cve_data.get("cisa_kev") and "CISA KEV" not in sources: + sources.append("CISA KEV") + if cve_data.get("nvd_description") and "NVD" not in sources: + sources.append("NVD") + + return sources + + +def _generate_enhanced_help_text(cve: str, vuln: Dict[str, Any], ext_data: Dict[str, Any], vex_info: Optional[Dict[str, Any]] = None) -> str: + """Generate enhanced help text with external data and VEX information.""" + component = vuln.get("component_name", "Unknown") + version = vuln.get("component_version", "Unknown") + + help_text = f"The component {component} version {version} contains vulnerability {cve}. " + + # Add VEX status context first + if vex_info and vex_info.get("vuln_exp_status"): + vex_status = vex_info["vuln_exp_status"].lower() + if vex_status in ["not_affected"]: + help_text += "VEX Assessment: Component is not affected by this vulnerability. " + elif vex_status in ["fixed"]: + help_text += "VEX Assessment: This vulnerability has been fixed. " + elif vex_status in ["mitigated"]: + help_text += "VEX Assessment: Mitigations are in place to reduce risk. " + elif vex_status in ["accepted_risk"]: + help_text += "VEX Assessment: Organization has accepted this risk. " + elif vex_status in ["false_positive"]: + help_text += "VEX Assessment: This vulnerability is a false positive. " + elif vex_status in ["resolved"]: + help_text += "VEX Assessment: This vulnerability has been resolved. " + elif vex_status in ["under_investigation", "in_triage"]: + help_text += "VEX Assessment: Impact is currently being evaluated. " + + # Add urgency based on external data + if ext_data.get("cisa_kev"): + help_text += "⚠️ URGENT: This vulnerability is actively exploited in the wild according to CISA. " + else: + epss_score = ext_data.get("epss_score") + if epss_score is not None and epss_score > 0.1: + help_text += f"HIGH RISK: EPSS score of {epss_score:.3f} indicates elevated exploitation risk. " + + # Adjust recommendations based on VEX status + if vex_info and vex_info.get("vuln_exp_status"): + vex_status = vex_info["vuln_exp_status"].lower() + if vex_status in ["not_affected", "fixed"]: + help_text += "Verify that the VEX assessment is current and accurate. " + elif vex_status in ["mitigated"]: + help_text += "Ensure mitigations remain effective and consider patching for defense in depth. " + elif vex_status in ["accepted_risk"]: + help_text += "Review accepted risk decision periodically and monitor for changes in threat landscape. " + elif vex_status in ["false_positive"]: + help_text += "Verify that the false positive assessment is accurate and documented. " + elif vex_status in ["resolved"]: + help_text += "Verify that the resolution is complete and effective. " + else: + help_text += "Consider upgrading to a newer version that addresses this vulnerability. " + else: + help_text += "Consider upgrading to a newer version that addresses this vulnerability. " + + help_text += "Review your dependency management and consider using tools like Dependabot or Renovate for automated updates." + + return help_text + + +def _generate_enhanced_results(vulnerabilities: List[Dict[str, Any]], + external_data: Dict[str, Dict[str, Any]]) -> List[Dict[str, Any]]: + """Generate enhanced SARIF results with external data and VEX information.""" + results = [] + + for vuln in vulnerabilities: + cve = vuln.get("cve", "UNKNOWN") + component_name = vuln.get("component_name", "Unknown") + component_version = vuln.get("component_version", "Unknown") + severity = vuln.get("severity", "UNKNOWN") + base_score = vuln.get("base_score", "N/A") + + # Get external data and VEX information + ext_data = external_data.get(cve, {}) + vex_info = _get_vex_info(vuln) + + # Create enhanced package URL with ecosystem detection + ecosystem = _detect_package_ecosystem(component_name) + artifact_uri = f"pkg:{ecosystem}/{component_name}@{component_version}" + + # Enhanced message with risk context and VEX information + message_text = _generate_enhanced_result_message(cve, component_name, component_version, severity, base_score, ext_data, vex_info) + + # Map severity to SARIF level with VEX consideration + original_level = _map_severity_to_sarif_level(severity) + vex_status = vex_info.get("vuln_exp_status") if vex_info else None + final_level = _map_vex_status_to_sarif_level(vex_status, original_level) + + result = { + "ruleId": cve, + "level": final_level, + "message": { + "text": message_text + }, + "locations": [{ + "physicalLocation": { + "artifactLocation": { + "uri": artifact_uri, + "description": { + "text": f"Vulnerable component: {component_name} version {component_version}" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": f"{component_name}@{component_version}" + } + } + }, + "logicalLocations": [{ + "name": component_name, + "fullyQualifiedName": artifact_uri, + "kind": "package" + }] + }], + "properties": { + # Core vulnerability metadata + "vulnerability_id": vuln.get("id"), + "cvss_version": vuln.get("cvss_version"), + "base_score": base_score, + "attack_vector": vuln.get("attack_vector"), + "attack_complexity": vuln.get("attack_complexity"), + "availability_impact": vuln.get("availability_impact"), + "rejected": vuln.get("rejected", 0), + + # Component information + "component_id": vuln.get("component_id"), + "ecosystem": ecosystem, + "package_url": artifact_uri, + + # Scan metadata + "scan_id": vuln.get("scan_id"), + "original_level": original_level, + + # Standard taxonomies for better tool interoperability + "security-severity": base_score, + "precision": "high" if vex_info else "medium", + "kind": "review", + "rank": _calculate_risk_rank(vuln, ext_data, vex_info), + "baseline": "unchanged", + "tags": { + "vulnerability": [cve], + "component": [f"{component_name}@{component_version}"], + "severity": [severity.lower() if severity != "UNKNOWN" else "unknown"] + } + } + } + + # Add external data properties + if ext_data.get("epss_score") is not None: + result["properties"]["epss_score"] = ext_data["epss_score"] + result["properties"]["epss_percentile"] = ext_data["epss_percentile"] + + if ext_data.get("cisa_kev"): + result["properties"]["cisa_known_exploited"] = True + + if ext_data.get("nvd_cwe"): + result["properties"]["cwe_ids"] = ext_data["nvd_cwe"] + + # Add VEX properties + if vex_info: + vex_properties = _generate_vex_properties(vex_info) + result["properties"].update(vex_properties) + + # Enhanced remediation information with VEX consideration + remediation = _generate_enhanced_remediation_info(component_name, component_version, cve, ext_data, vex_info) + if remediation: + result["fixes"] = [remediation] + + # Add fingerprints for deduplication + result["fingerprints"] = { + "workbench/component": f"{component_name}@{component_version}", + "workbench/vulnerability": f"{cve}#{vuln.get('id', 'unknown')}", + "primary": f"{component_name}@{component_version}#{cve}", + "stable": f"{cve}" + } + + # Add relationships to group vulnerabilities by component + result["relatedLocations"] = [{ + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": f"pkg:{ecosystem}/{component_name}@{component_version}", + "description": { + "text": f"Component manifest for {component_name}" + } + } + }, + "message": { + "text": f"Component {component_name} version {component_version}" + } + }] + + # Add suppression information if VEX status indicates resolved/mitigated + if vex_info and vex_info.get("vuln_exp_status"): + vex_status = vex_info["vuln_exp_status"].lower() + if vex_status in ["not_affected", "fixed", "mitigated", "accepted_risk", "false_positive", "resolved"]: + result["suppressions"] = [{ + "kind": "inSource", + "status": "accepted", + "justification": vex_info.get("vuln_exp_justification", f"VEX status: {vex_status}") + }] + + results.append(result) + + return results + + +def _generate_enhanced_result_message(cve: str, component: str, version: str, severity: str, + score: str, ext_data: Dict[str, Any], vex_info: Optional[Dict[str, Any]] = None) -> str: + """Generate an enhanced message with risk indicators and VEX information.""" + base_message = f"Found {severity.lower()} severity vulnerability {cve} (CVSS {score}) in component {component} version {version}." + + # Add risk indicators + risk_indicators = [] + if ext_data.get("cisa_kev"): + risk_indicators.append("CISA KEV - Active exploitation detected") + epss_score = ext_data.get("epss_score") + if epss_score is not None and epss_score > 0.1: + risk_indicators.append(f"High EPSS score: {epss_score:.3f}") + + if risk_indicators: + base_message += f" ⚠️ {' | '.join(risk_indicators)}." + + # Add VEX status information + if vex_info and vex_info.get("vuln_exp_status"): + vex_status = vex_info["vuln_exp_status"] + base_message += f" VEX Status: {vex_status}." + + if vex_info.get("vuln_exp_justification"): + base_message += f" Justification: {vex_info['vuln_exp_justification']}" + + # Adjust recommendation based on VEX status + if vex_info and vex_info.get("vuln_exp_status"): + vex_status = vex_info["vuln_exp_status"].lower() + if vex_status in ["not_affected", "fixed"]: + base_message += " Verify VEX assessment is current and accurate." + elif vex_status in ["mitigated"]: + base_message += " Ensure mitigations remain effective." + elif vex_status in ["accepted_risk"]: + base_message += " Review accepted risk periodically." + elif vex_status in ["false_positive"]: + base_message += " Verify false positive assessment is accurate." + elif vex_status in ["resolved"]: + base_message += " Verify resolution is complete and effective." + else: + base_message += " This vulnerability should be addressed by updating to a patched version." + else: + base_message += " This vulnerability should be addressed by updating to a patched version." + + return base_message + + +def _generate_enhanced_remediation_info(component: str, version: str, cve: str, + ext_data: Dict[str, Any], vex_info: Optional[Dict[str, Any]] = None) -> Optional[Dict[str, Any]]: + """Generate enhanced remediation information with urgency indicators and VEX context.""" + urgency = "standard" + if ext_data.get("cisa_kev"): + urgency = "critical" + else: + epss_score = ext_data.get("epss_score") + if epss_score is not None and epss_score > 0.1: + urgency = "high" + + # Adjust urgency based on VEX status + description_text = f"Update {component} to a version that fixes {cve} - {urgency.upper()} priority" + guidance_text = "Check for newer versions of this component that address the vulnerability" + + if vex_info and vex_info.get("vuln_exp_status"): + vex_status = vex_info["vuln_exp_status"].lower() + if vex_status in ["not_affected", "fixed"]: + description_text = f"Verify VEX assessment for {component} {cve} - Component reported as {vex_status}" + guidance_text = "Validate that VEX assessment is current and accurate" + elif vex_status in ["mitigated"]: + description_text = f"Monitor mitigation effectiveness for {component} {cve} - MITIGATED status" + guidance_text = "Ensure mitigations remain effective and consider patching for defense in depth" + elif vex_status in ["accepted_risk"]: + description_text = f"Review accepted risk for {component} {cve} - ACCEPTED RISK status" + guidance_text = "Periodically review risk acceptance and monitor for changes in threat landscape" + elif vex_status in ["false_positive"]: + description_text = f"Verify false positive assessment for {component} {cve} - FALSE POSITIVE status" + guidance_text = "Validate that false positive assessment is accurate and documented" + elif vex_status in ["resolved"]: + description_text = f"Verify resolution for {component} {cve} - RESOLVED status" + guidance_text = "Confirm that resolution is complete and effective" + elif vex_status in ["under_investigation", "in_triage"]: + description_text = f"Monitor investigation progress for {component} {cve} - {vex_status.upper().replace('_', ' ')}" + guidance_text = "Follow up on investigation status and prepare for potential remediation" + + remediation_info = { + "description": { + "text": description_text + }, + "properties": { + "urgency": urgency, + "guidance": guidance_text, + "automation": "Consider using automated dependency update tools", + "cisa_kev": ext_data.get("cisa_kev", False), + "epss_score": ext_data.get("epss_score") + } + } + + # Add VEX properties + if vex_info: + vex_properties = _generate_vex_properties(vex_info) + remediation_info["properties"].update(vex_properties) + + return remediation_info + + +def _create_empty_sarif_report(scan_code: str) -> Dict[str, Any]: + """Create an empty SARIF report when no vulnerabilities are found.""" + return { + "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", + "version": "2.1.0", + "runs": [{ + "tool": { + "driver": { + "name": "FossID Workbench", + "version": "1.0.0", + "informationUri": "https://fossid.com/products/workbench/", + "rules": [] + } + }, + "results": [], + "properties": { + "scan_code": scan_code, + "generated_at": datetime.utcnow().isoformat() + "Z", + "total_vulnerabilities": 0, + "severity_distribution": {"CRITICAL": 0, "HIGH": 0, "MEDIUM": 0, "LOW": 0, "UNKNOWN": 0}, + "external_data_sources": [], + "high_risk_vulnerabilities": {"cisa_kev": 0, "high_epss": 0, "critical_severity": 0, "total_high_risk": 0} + } + }] + } + + +def _build_cvss_vector(vuln: Dict[str, Any]) -> str: + """Build a CVSS vector string from available vulnerability data.""" + version = vuln.get("cvss_version", "3.1") + + # Build vector components that we have data for + vector_parts = [f"CVSS:{version}"] + + # Attack Vector + av = vuln.get("attack_vector", "") + if av: + av_map = {"NETWORK": "N", "ADJACENT_NETWORK": "A", "LOCAL": "L", "PHYSICAL": "P"} + vector_parts.append(f"AV:{av_map.get(av, av[0] if av else 'N')}") + + # Attack Complexity + ac = vuln.get("attack_complexity", "") + if ac: + ac_map = {"LOW": "L", "HIGH": "H"} + vector_parts.append(f"AC:{ac_map.get(ac, ac[0] if ac else 'L')}") + + # Availability Impact + a = vuln.get("availability_impact", "") + if a: + a_map = {"NONE": "N", "LOW": "L", "HIGH": "H"} + vector_parts.append(f"A:{a_map.get(a, a[0] if a else 'N')}") + + return "/".join(vector_parts) if len(vector_parts) > 1 else "CVSS vector not available" + + +def _detect_package_ecosystem(component_name: str) -> str: + """Detect the package ecosystem based on component name patterns.""" + if "/" in component_name: + if component_name.startswith("org.") or component_name.startswith("com."): + return "maven" + elif "@" in component_name: + return "npm" + else: + return "generic" + elif "." in component_name and any(component_name.startswith(prefix) for prefix in ["org.", "com.", "net.", "io."]): + return "maven" + elif component_name.count(".") >= 2: # Likely a Java package + return "maven" + else: + return "generic" + + +def _calculate_severity_distribution(vulnerabilities: List[Dict[str, Any]]) -> Dict[str, int]: + """Calculate the distribution of vulnerabilities by severity.""" + distribution = {"CRITICAL": 0, "HIGH": 0, "MEDIUM": 0, "LOW": 0, "UNKNOWN": 0} + + for vuln in vulnerabilities: + severity = vuln.get("severity", "UNKNOWN").upper() + if severity in distribution: + distribution[severity] += 1 + else: + distribution["UNKNOWN"] += 1 + + return distribution + + +def _map_severity_to_sarif_level(severity: str) -> str: + """ + Map Workbench severity levels to SARIF levels. + + SARIF levels: error, warning, note, none + Workbench severities: CRITICAL, HIGH, MEDIUM, LOW, UNKNOWN + """ + severity_upper = severity.upper() if severity else "UNKNOWN" + + mapping = { + "CRITICAL": "error", + "HIGH": "error", + "MEDIUM": "warning", + "LOW": "note", + "UNKNOWN": "warning" + } + + return mapping.get(severity_upper, "warning") + + +def save_vulns_to_sarif(filepath: str, vulnerabilities: List[Dict[str, Any]], scan_code: str, + include_cve_descriptions: bool = True, + include_epss_scores: bool = True, + include_exploit_info: bool = True, + api_timeout: int = 30, + include_vex: bool = True, + include_scan_metadata: bool = True, + suppress_vex_mitigated: bool = True, + suppress_accepted_risk: bool = True, + suppress_false_positives: bool = True, + group_by_component: bool = True, + quiet: bool = False) -> None: + """ + Save vulnerability results in SARIF format to a file with external enrichment. + + Args: + filepath: Path where the SARIF file should be saved + vulnerabilities: List of vulnerability dictionaries from the API + scan_code: The scan code for reference + include_cve_descriptions: Whether to include enhanced CVE descriptions from NVD + include_epss_scores: Whether to include EPSS scores from FIRST + include_exploit_info: Whether to include known exploit information + api_timeout: Timeout for external API calls in seconds + include_vex: Whether to include VEX assessments from Workbench + include_scan_metadata: Whether to include scan timing and metadata + suppress_vex_mitigated: Whether to suppress findings with VEX mitigation status + suppress_accepted_risk: Whether to suppress findings marked as accepted risk + suppress_false_positives: Whether to suppress findings marked as false positives + group_by_component: Whether to group findings by component in SARIF + quiet: Whether to suppress progress output + + Raises: + IOError: If the file cannot be written + OSError: If the directory cannot be created + """ + output_dir = os.path.dirname(filepath) or "." + + try: + os.makedirs(output_dir, exist_ok=True) + + # Calculate how many findings would be suppressed by VEX without actually removing them. + # The demotion to "note" level happens later in _generate_enhanced_results via _map_vex_status_to_sarif_level. + original_count = len(vulnerabilities) + suppressed_count = 0 + if include_vex and (suppress_vex_mitigated or suppress_accepted_risk or suppress_false_positives): + suppressed_count = original_count - len(_apply_vex_suppression( + vulnerabilities, + suppress_vex_mitigated, + suppress_accepted_risk, + suppress_false_positives + )) + if not quiet and suppressed_count > 0: + print( + f"Suppressed {suppressed_count} vulnerabilities based on VEX assessments (demoted to 'note' level)" + ) + + sarif_data = convert_vulns_to_sarif( + vulnerabilities, + scan_code, + include_cve_descriptions, + include_epss_scores, + include_exploit_info, + api_timeout, + include_vex, + include_scan_metadata, + group_by_component + ) + + with open(filepath, 'w', encoding='utf-8') as f: + json.dump(sarif_data, f, indent=2, ensure_ascii=False) + + if not quiet: + print(f"Saved enhanced SARIF results to: {filepath}") + + # Print summary of external data + props = sarif_data["runs"][0]["properties"] + if props.get("external_data_sources"): + print(f"External data sources used: {', '.join(props['external_data_sources'])}") + + high_risk = props.get("high_risk_vulnerabilities", {}) + if high_risk.get("total_high_risk", 0) > 0: + print(f"High-risk vulnerabilities found: {high_risk['total_high_risk']}") + if high_risk.get("cisa_kev", 0) > 0: + print(f" - CISA KEV: {high_risk['cisa_kev']}") + if high_risk.get("high_epss", 0) > 0: + print(f" - High EPSS: {high_risk['high_epss']}") + + # Print VEX summary + vex_stats = props.get("vex_statements", {}) + if vex_stats.get("total_with_vex", 0) > 0: + print(f"VEX statements found: {vex_stats['total_with_vex']}") + if vex_stats.get("status_distribution"): + print(" VEX status distribution:") + for status, count in vex_stats["status_distribution"].items(): + print(f" - {status}: {count}") + if vex_stats.get("with_justification", 0) > 0: + print(f" - With justification: {vex_stats['with_justification']}") + if vex_stats.get("with_response", 0) > 0: + print(f" - With response: {vex_stats['with_response']}") + if vex_stats.get("with_details", 0) > 0: + print(f" - With details: {vex_stats['with_details']}") + + except (IOError, OSError) as e: + if not quiet: + print(f"\nWarning: Failed to save SARIF results to {filepath}: {e}") + raise + + +# Legacy function names for backward compatibility +def _generate_rules(vulnerabilities: List[Dict[str, Any]]) -> List[Dict[str, Any]]: + """Legacy function for backward compatibility.""" + return _generate_enhanced_rules(vulnerabilities, {}) + + +def _generate_results(vulnerabilities: List[Dict[str, Any]]) -> List[Dict[str, Any]]: + """Legacy function for backward compatibility.""" + return _generate_enhanced_results(vulnerabilities, {}) + + +def _analyze_vex_statements(vulnerabilities: List[Dict[str, Any]]) -> Dict[str, int]: + """Analyze VEX statements in vulnerability data.""" + vex_stats = { + "total_with_vex": 0, + "status_distribution": {}, + "with_justification": 0, + "with_response": 0, + "with_details": 0 + } + + for vuln in vulnerabilities: + # Check if vulnerability has VEX information + has_vex = any([ + vuln.get("vuln_exp_status"), + vuln.get("vuln_exp_justification"), + vuln.get("vuln_exp_response"), + vuln.get("vuln_exp_details") + ]) + + if has_vex: + vex_stats["total_with_vex"] += 1 + + # Count status distribution + status = vuln.get("vuln_exp_status") + if status: + vex_stats["status_distribution"][status] = vex_stats["status_distribution"].get(status, 0) + 1 + + # Count fields with content + if vuln.get("vuln_exp_justification"): + vex_stats["with_justification"] += 1 + if vuln.get("vuln_exp_response"): + vex_stats["with_response"] += 1 + if vuln.get("vuln_exp_details"): + vex_stats["with_details"] += 1 + + return vex_stats + + +def _get_vex_info(vuln: Dict[str, Any]) -> Optional[Dict[str, Any]]: + """Extract VEX information from vulnerability data.""" + vex_fields = [ + "vuln_exp_id", "vuln_exp_status", "vuln_exp_justification", + "vuln_exp_response", "vuln_exp_details", "vuln_exp_created", + "vuln_exp_updated", "vuln_exp_created_by", "vuln_exp_updated_by", + "vuln_exp_created_by_username", "vuln_exp_updated_by_username" + ] + + vex_info = {} + has_vex_data = False + + for field in vex_fields: + value = vuln.get(field) + if value is not None: + vex_info[field] = value + has_vex_data = True + + return vex_info if has_vex_data else None + + +def _map_vex_status_to_sarif_level(vex_status: str, original_level: str) -> str: + """Map VEX status to appropriate SARIF level, potentially suppressing findings.""" + if not vex_status: + return original_level + + # VEX status mapping to SARIF levels + vex_status_lower = vex_status.lower() + + # Standard VEX statuses + if vex_status_lower in ["not_affected", "fixed"]: + return "note" # Demote to informational + elif vex_status_lower in ["under_investigation", "in_triage"]: + return original_level # Keep original level + elif vex_status_lower in ["affected", "exploitable"]: + return original_level # Keep original level, but add VEX context + + # Custom statuses (organization-specific) + elif vex_status_lower in ["accepted_risk", "mitigated", "false_positive", "resolved"]: + return "note" # Demote to informational + elif vex_status_lower in ["workaround_available"]: + return "warning" # Reduce severity slightly + + return original_level + + +def _generate_vex_properties(vex_info: Dict[str, Any]) -> Dict[str, Any]: + """Generate VEX-related properties for SARIF output.""" + properties = {} + + if vex_info.get("vuln_exp_status"): + properties["vex_status"] = vex_info["vuln_exp_status"] + + if vex_info.get("vuln_exp_justification"): + properties["vex_justification"] = vex_info["vuln_exp_justification"] + + if vex_info.get("vuln_exp_response"): + properties["vex_response"] = vex_info["vuln_exp_response"] + + if vex_info.get("vuln_exp_details"): + properties["vex_details"] = vex_info["vuln_exp_details"] + + if vex_info.get("vuln_exp_created"): + properties["vex_created"] = vex_info["vuln_exp_created"] + + if vex_info.get("vuln_exp_updated"): + properties["vex_updated"] = vex_info["vuln_exp_updated"] + + if vex_info.get("vuln_exp_created_by_username"): + properties["vex_created_by"] = vex_info["vuln_exp_created_by_username"] + + if vex_info.get("vuln_exp_updated_by_username"): + properties["vex_updated_by"] = vex_info["vuln_exp_updated_by_username"] + + return properties + + +def _calculate_risk_rank(vuln: Dict[str, Any], ext_data: Dict[str, Any], vex_info: Optional[Dict[str, Any]] = None) -> float: + """Calculate a numerical risk ranking for prioritization (0-100, higher = more risk).""" + base_score = float(vuln.get("base_score", 0)) + rank = base_score * 10 # Start with CVSS score * 10 (max 100) + + # CISA KEV adds significant risk + if ext_data.get("cisa_kev"): + rank += 20 + + # High EPSS score adds risk + epss_score = ext_data.get("epss_score") or 0 + if epss_score > 0.1: + rank += 15 + elif epss_score > 0.01: + rank += 5 + + # VEX status can reduce risk + if vex_info and vex_info.get("vuln_exp_status"): + vex_status = vex_info["vuln_exp_status"].lower() + if vex_status in ["not_affected", "fixed", "resolved"]: + rank *= 0.1 # Greatly reduce risk + elif vex_status in ["mitigated", "false_positive"]: + rank *= 0.2 # Significantly reduce risk + elif vex_status in ["accepted_risk"]: + rank *= 0.5 # Moderately reduce risk + + # Cap at 100 + return min(100.0, max(0.0, rank)) \ No newline at end of file diff --git a/src/workbench_cli/utilities/scan_workflows.py b/src/workbench_cli/utilities/scan_workflows.py index 6737328..5e95097 100644 --- a/src/workbench_cli/utilities/scan_workflows.py +++ b/src/workbench_cli/utilities/scan_workflows.py @@ -436,11 +436,57 @@ def fetch_display_save_results(workbench: 'WorkbenchAPI', params: argparse.Names if any_results_requested: display_results(collected_results, params) - save_path = getattr(params, 'path_result', None) - if save_path: + # Handle JSON output + json_path = getattr(params, 'json_result_path', None) + if json_path: if collected_results: - print(f"\nSaving collected results to '{save_path}'...") - save_results_to_file(save_path, collected_results, scan_code) + print(f"\nSaving collected results to '{json_path}'...") + save_results_to_file(json_path, collected_results, scan_code) + else: + print("\nNo results were successfully collected, skipping JSON save.") + + # Handle SARIF output for vulnerabilities + sarif_path = getattr(params, 'sarif_result_path', None) + if sarif_path: + if not getattr(params, 'show_vulnerabilities', False): + print("\nWarning: --sarif-result-path requires --show-vulnerabilities flag") + elif not collected_results.get('vulnerabilities'): + print("\nNo vulnerability results to save in SARIF format") + else: + from .sarif_converter import save_vulns_to_sarif + print(f"\nSaving enhanced vulnerability results in SARIF format to '{sarif_path}'...") + try: + # Configure external data fetching (can be extended with CLI options later) + include_descriptions = True # Fetch CVE descriptions from NVD + include_epss = True # Fetch EPSS scores from FIRST + include_exploits = True # Fetch CISA KEV data + api_timeout = 30 # API timeout in seconds + + save_vulns_to_sarif( + sarif_path, + collected_results['vulnerabilities'], + scan_code, + include_descriptions, + include_epss, + include_exploits, + api_timeout, + include_vex=True, + include_scan_metadata=True, + suppress_vex_mitigated=True, + suppress_accepted_risk=True, + suppress_false_positives=True, + group_by_component=True, + quiet=False + ) + except Exception as e: + print(f"Error saving SARIF results: {e}") + + # Legacy support for --path-result (deprecated, use --json-result-path instead) + legacy_path = getattr(params, 'path_result', None) + if legacy_path: + if collected_results: + print(f"\nSaving collected results to '{legacy_path}'...") + save_results_to_file(legacy_path, collected_results, scan_code) else: print("\nNo results were successfully collected, skipping save.") diff --git a/src/workbench_cli/utilities/vulnerability_enricher.py b/src/workbench_cli/utilities/vulnerability_enricher.py new file mode 100644 index 0000000..b0fd22d --- /dev/null +++ b/src/workbench_cli/utilities/vulnerability_enricher.py @@ -0,0 +1,447 @@ +""" +Vulnerability data enrichment utilities. + +This module provides functionality to enhance vulnerability data with external sources +including NVD, EPSS scores, CISA KEV data, and alternative vulnerability databases. +""" + +import json +import requests +import time +import logging +import os +import threading +from typing import Dict, List, Any, Optional +from concurrent.futures import ThreadPoolExecutor, as_completed + +logger = logging.getLogger(__name__) + +# External API configurations +EPSS_API_URL = "https://api.first.org/data/v1/epss" +NVD_API_URL = "https://services.nvd.nist.gov/rest/json/cves/2.0" +CISA_KEV_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" +EXPLOITDB_SEARCH_URL = "https://www.exploit-db.com/api/v1/search/" + +# Alternative vulnerability data sources +VULNERS_API_URL = "https://vulners.com/api/v3/search/id" +VULNCHECK_NVD_URL = "https://api.vulncheck.com/v3/index/nvd2-cves" +OSV_API_URL = "https://api.osv.dev/v1/query" + +# Rate limiting settings +NVD_RATE_LIMIT_NO_KEY = 5 # requests per 30 seconds without API key +NVD_RATE_LIMIT_WITH_KEY = 50 # requests per 30 seconds with API key +EPSS_RATE_LIMIT = 100 # requests per minute +REQUEST_TIMEOUT = 30 # seconds + + +def enrich_vulnerabilities(cve_list: List[str], + include_descriptions: bool = True, + include_epss_scores: bool = True, + include_exploit_info: bool = True, + api_timeout: int = 30) -> Dict[str, Dict[str, Any]]: + """ + Enrich vulnerability data with external sources. + + Args: + cve_list: List of CVE IDs to enrich + include_descriptions: Whether to fetch CVE descriptions from NVD + include_epss_scores: Whether to fetch EPSS scores from FIRST + include_exploit_info: Whether to fetch known exploit information + api_timeout: Timeout for external API calls in seconds + + Returns: + Dict mapping CVE IDs to their external data + """ + if not cve_list: + return {} + + return _fetch_external_vulnerability_data( + cve_list, + include_descriptions, + include_epss_scores, + include_exploit_info, + api_timeout + ) + + +def _fetch_external_vulnerability_data(cve_list: List[str], + include_descriptions: bool = True, + include_epss: bool = True, + include_exploits: bool = True, + timeout: int = 30) -> Dict[str, Dict[str, Any]]: + """ + Fetch external vulnerability data from multiple sources. + + Returns: + Dict mapping CVE IDs to their external data + """ + external_data = {} + + # Initialize data structure + for cve in cve_list: + external_data[cve] = { + "epss_score": None, + "epss_percentile": None, + "cisa_kev": False, + "exploitdb_count": 0, + "nvd_description": None, + "nvd_cwe": None, + "nvd_references": [], + "full_cvss_vector": None, + "attack_vector_detail": None + } + + # Fetch data from different sources + try: + if include_epss: + epss_data = _fetch_epss_scores(cve_list, timeout) + for cve, data in epss_data.items(): + if cve in external_data: + external_data[cve].update(data) + except Exception as e: + logger.warning(f"Failed to fetch EPSS data: {e}") + + try: + if include_exploits: + kev_data = _fetch_cisa_kev_data(cve_list, timeout) + for cve in kev_data: + if cve in external_data: + external_data[cve]["cisa_kev"] = True + except Exception as e: + logger.warning(f"Failed to fetch CISA KEV data: {e}") + + try: + if include_descriptions: + nvd_data = _fetch_nvd_data(cve_list, timeout) + for cve, data in nvd_data.items(): + if cve in external_data: + external_data[cve].update(data) + except Exception as e: + logger.warning(f"Failed to fetch NVD data: {e}") + + return external_data + + +def _fetch_epss_scores(cve_list: List[str], timeout: int = 30) -> Dict[str, Dict[str, Any]]: + """Fetch EPSS scores from FIRST API.""" + epss_data = {} + + # EPSS API supports batch queries + batch_size = 100 # API limit + for i in range(0, len(cve_list), batch_size): + batch = cve_list[i:i + batch_size] + cve_param = ",".join(batch) + + try: + response = requests.get( + f"{EPSS_API_URL}?cve={cve_param}", + timeout=timeout, + headers={"User-Agent": "FossID-Workbench-CLI/1.0"} + ) + response.raise_for_status() + + data = response.json() + if data.get("status") == "OK" and "data" in data: + for item in data["data"]: + cve = item.get("cve") + if cve: + epss_data[cve] = { + "epss_score": float(item.get("epss", 0)), + "epss_percentile": float(item.get("percentile", 0)) + } + + # Rate limiting + time.sleep(1) + + except Exception as e: + logger.warning(f"Failed to fetch EPSS data for batch {i//batch_size + 1}: {e}") + + return epss_data + + +def _fetch_cisa_kev_data(cve_list: List[str], timeout: int = 30) -> List[str]: + """Fetch CISA Known Exploited Vulnerabilities data.""" + try: + response = requests.get( + CISA_KEV_URL, + timeout=timeout, + headers={"User-Agent": "FossID-Workbench-CLI/1.0"} + ) + response.raise_for_status() + + kev_data = response.json() + known_exploited = set() + + if "vulnerabilities" in kev_data: + for vuln in kev_data["vulnerabilities"]: + cve = vuln.get("cveID") + if cve and cve in cve_list: + known_exploited.add(cve) + + return list(known_exploited) + + except Exception as e: + logger.warning(f"Failed to fetch CISA KEV data: {e}") + return [] + + +def _fetch_nvd_data(cve_list: List[str], timeout: int = 30) -> Dict[str, Dict[str, Any]]: + """ + Fetch detailed CVE information from NVD API 2.0 with enhanced performance and reliability. + + Improvements: + - Concurrent processing with rate limiting + - Exponential backoff retry logic + - In-memory caching for duplicate requests + - API key support for higher rate limits + - Progress tracking for large CVE lists + - Alternative data source fallback + """ + return _fetch_nvd_data_enhanced(cve_list, timeout) + + +def _fetch_nvd_data_enhanced(cve_list: List[str], timeout: int = 30) -> Dict[str, Dict[str, Any]]: + """Enhanced NVD data fetching with concurrent processing and intelligent rate limiting.""" + nvd_data = {} + + if not cve_list: + return nvd_data + + # Check for API key in environment variables + api_key = os.environ.get('NVD_API_KEY') + max_workers = 5 if api_key else 2 # Higher concurrency with API key + rate_limit_delay = 0.6 if api_key else 6 # 50 requests per 30s with key, 5 per 30s without + + # Initialize rate limiter + rate_limiter = RateLimiter(max_workers, rate_limit_delay) + + # Initialize cache + cache = {} + + logger.info(f"Fetching NVD data for {len(cve_list)} CVEs using {'API key' if api_key else 'public rate limits'}") + + # Filter out already cached CVEs + cves_to_fetch = [cve for cve in cve_list if cve not in cache] + + if not cves_to_fetch: + logger.info("All CVEs found in cache") + return {cve: cache[cve] for cve in cve_list} + + # Process CVEs concurrently + with ThreadPoolExecutor(max_workers=max_workers) as executor: + # Submit all tasks + future_to_cve = { + executor.submit(_fetch_single_cve_nvd, cve, api_key, rate_limiter, timeout): cve + for cve in cves_to_fetch + } + + # Collect results with progress tracking + completed = 0 + for future in as_completed(future_to_cve): + cve = future_to_cve[future] + completed += 1 + + try: + result = future.result() + if result: + nvd_data[cve] = result + cache[cve] = result # Cache successful results + + if completed % 10 == 0 or completed == len(cves_to_fetch): + logger.info(f"Processed {completed}/{len(cves_to_fetch)} CVEs") + + except Exception as e: + logger.warning(f"Failed to fetch NVD data for {cve}: {e}") + # Try alternative data source as fallback + try: + alternative_data = _fetch_alternative_vulnerability_data(cve, timeout) + if alternative_data: + nvd_data[cve] = alternative_data + logger.info(f"Used alternative data source for {cve}") + except Exception as alt_e: + logger.warning(f"Alternative data source also failed for {cve}: {alt_e}") + + return nvd_data + + +def _fetch_single_cve_nvd(cve: str, api_key: Optional[str], rate_limiter: 'RateLimiter', + timeout: int) -> Optional[Dict[str, Any]]: + """Fetch a single CVE from NVD with retry logic and rate limiting.""" + headers = {"User-Agent": "FossID-Workbench-CLI/1.0"} + if api_key: + headers["apiKey"] = api_key + + max_retries = 3 + base_delay = 1.0 + + for attempt in range(max_retries): + try: + # Wait for rate limiter + rate_limiter.wait() + + response = requests.get( + f"{NVD_API_URL}?cveId={cve}", + timeout=timeout, + headers=headers + ) + + # Handle rate limiting + if response.status_code == 429: + retry_after = int(response.headers.get('Retry-After', 60)) + logger.warning(f"Rate limited for {cve}, waiting {retry_after}s") + time.sleep(retry_after) + continue + + response.raise_for_status() + + data = response.json() + if "vulnerabilities" in data and data["vulnerabilities"]: + return _parse_nvd_vulnerability(data["vulnerabilities"][0]["cve"]) + + return None + + except requests.exceptions.RequestException as e: + if attempt < max_retries - 1: + delay = base_delay * (2 ** attempt) # Exponential backoff + logger.warning(f"Request failed for {cve}, retrying in {delay}s: {e}") + time.sleep(delay) + else: + logger.error(f"Failed to fetch {cve} after {max_retries} attempts: {e}") + raise + + return None + + +def _parse_nvd_vulnerability(vuln_data: Dict[str, Any]) -> Dict[str, Any]: + """Parse NVD vulnerability data into standardized format.""" + # Extract description + description = "No description available" + if "descriptions" in vuln_data: + for desc in vuln_data["descriptions"]: + if desc.get("lang") == "en": + description = desc.get("value", description) + break + + # Extract CWE information + cwe_ids = [] + if "weaknesses" in vuln_data: + for weakness in vuln_data["weaknesses"]: + if weakness.get("type") == "Primary": + for desc in weakness.get("description", []): + if desc.get("lang") == "en": + cwe_ids.append(desc.get("value", "")) + + # Extract references + references = [] + if "references" in vuln_data: + for ref in vuln_data["references"][:10]: # Increased to 10 references + references.append({ + "url": ref.get("url", ""), + "source": ref.get("source", ""), + "tags": ref.get("tags", []) + }) + + # Extract full CVSS vector + full_cvss_vector = None + cvss_score = None + if "metrics" in vuln_data: + for metric_type in ["cvssMetricV31", "cvssMetricV30", "cvssMetricV2"]: + if metric_type in vuln_data["metrics"]: + metrics = vuln_data["metrics"][metric_type] + if metrics and len(metrics) > 0: + cvss_data = metrics[0].get("cvssData", {}) + full_cvss_vector = cvss_data.get("vectorString") + cvss_score = cvss_data.get("baseScore") + break + + return { + "nvd_description": description, + "nvd_cwe": cwe_ids, + "nvd_references": references, + "full_cvss_vector": full_cvss_vector, + "cvss_score": cvss_score + } + + +def _fetch_alternative_vulnerability_data(cve: str, timeout: int = 30) -> Optional[Dict[str, Any]]: + """ + Fetch vulnerability data from alternative sources when NVD fails. + Currently supports Vulners API as primary alternative. + """ + # Try Vulners API first + try: + vulners_data = _fetch_vulners_data(cve, timeout) + if vulners_data: + return vulners_data + except Exception as e: + logger.debug(f"Vulners API failed for {cve}: {e}") + + # Could add more alternative sources here + return None + + +def _fetch_vulners_data(cve: str, timeout: int = 30) -> Optional[Dict[str, Any]]: + """Fetch vulnerability data from Vulners API.""" + try: + # Vulners search API endpoint + vulners_url = "https://vulners.com/api/v3/search/id" + + payload = { + "id": cve, + "fields": ["*"] + } + + response = requests.post( + vulners_url, + json=payload, + timeout=timeout, + headers={"User-Agent": "FossID-Workbench-CLI/1.0"} + ) + + if response.status_code == 200: + data = response.json() + if data.get("result") == "OK" and data.get("data"): + vuln_data = data["data"]["documents"][0] + + return { + "nvd_description": vuln_data.get("description", "No description available"), + "nvd_cwe": vuln_data.get("cwe", []), + "nvd_references": [{"url": ref, "source": "vulners"} for ref in vuln_data.get("references", [])[:10]], + "full_cvss_vector": vuln_data.get("cvss", {}).get("vector"), + "cvss_score": vuln_data.get("cvss", {}).get("score"), + "source": "vulners" + } + + except Exception as e: + logger.debug(f"Vulners API request failed for {cve}: {e}") + + return None + + +class RateLimiter: + """Thread-safe rate limiter using token bucket algorithm.""" + + def __init__(self, max_workers: int, delay: float): + self.max_workers = max_workers + self.delay = delay + self.tokens = max_workers + self.last_update = time.time() + self.lock = threading.Lock() + + def wait(self): + """Wait if necessary to respect rate limits.""" + with self.lock: + now = time.time() + # Add tokens based on elapsed time + elapsed = now - self.last_update + self.tokens = min(self.max_workers, self.tokens + elapsed / self.delay) + self.last_update = now + + if self.tokens >= 1: + self.tokens -= 1 + return + + # Need to wait + wait_time = self.delay - (elapsed % self.delay) + time.sleep(wait_time) + self.tokens = max(0, self.tokens - 1) \ No newline at end of file diff --git a/tests/fixtures/test-sbom.json b/tests/fixtures/test-sbom.json new file mode 100644 index 0000000..a62e9b2 --- /dev/null +++ b/tests/fixtures/test-sbom.json @@ -0,0 +1,51 @@ +{ + "spdxVersion": "SPDX-2.2", + "dataLicense": "CC0-1.0", + "SPDXID": "SPDXRef-DOCUMENT", + "name": "LPA Firmware", + "documentNamespace": "http://volvocars.com/volvocars-oss-spdx-index/spa2/lpa-firmware-v2.5.0-b4dea91f-f4de-40f2-851f-8664c2356aa7", + "creationInfo": { + "creators": [ + "Person: Team Trust ()", + "Organization: Volvo Cars Corporation ()", + "Tool: lpa-sbom-generator-0.4.38 ()" + ], + "created": "2025-06-18T13:05:27Z" + }, + "packages": [ + { + "name": "lpa-firmware", + "SPDXID": "SPDXRef-1", + "versionInfo": "2.5.0", + "supplier": "Organization: Volvo Cars Corporation ()", + "downloadLocation": "NOASSERTION", + "filesAnalyzed": false, + "copyrightText": "NOASSERTION", + "licenseConcluded": "NOASSERTION", + "licenseDeclared": "NOASSERTION" + }, + { + "name": "aes", + "SPDXID": "SPDXRef-8", + "versionInfo": "0.7.5", + "downloadLocation": "https://github.com/RustCrypto/block-ciphers", + "filesAnalyzed": false, + "copyrightText": "NOASSERTION", + "licenseConcluded": "MIT OR Apache-2.0", + "licenseDeclared": "MIT OR Apache-2.0", + "summary": "Pure Rust implementation of the Advanced Encryption Standard (a.k.a. Rijndael)\nincluding support for AES in counter mode (a.k.a. AES-CTR)\n" + } + ], + "hasExtractedLicensingInfos": [], + "files": [], + "snippets": [], + "relationships": [ + { + "spdxElementId": "SPDXRef-1", + "relatedSpdxElement": "SPDXRef-8", + "relationshipType": "DEPENDS_ON" + } + ], + "annotations": [], + "documentDescribes": ["SPDXRef-1"] +} \ No newline at end of file diff --git a/tests/unit/handlers/test_export_sarif.py b/tests/unit/handlers/test_export_sarif.py new file mode 100644 index 0000000..b3af010 --- /dev/null +++ b/tests/unit/handlers/test_export_sarif.py @@ -0,0 +1,317 @@ +# tests/unit/handlers/test_export_sarif.py + +import pytest +import argparse +from unittest.mock import Mock, patch, MagicMock +import json +import tempfile +import os + +from workbench_cli.handlers.export_sarif import handle_export_sarif +from workbench_cli.exceptions import ( + ApiError, + NetworkError, + ProcessError, + ProjectNotFoundError, + ScanNotFoundError +) + + +class TestExportSarif: + """Test cases for the export-sarif handler.""" + + @pytest.fixture + def mock_workbench(self): + """Create a mock Workbench API client.""" + workbench = Mock() + workbench.resolve_project.return_value = "TEST_PROJECT_123" + workbench.resolve_scan.return_value = ("TEST_SCAN_456", 456) + workbench.ensure_scan_is_idle.return_value = None + workbench.list_vulnerabilities.return_value = [ + { + "id": 1, + "cve": "CVE-2023-1234", + "severity": "HIGH", + "base_score": "7.5", + "component_name": "test-component", + "component_version": "1.0.0", + "vuln_exp_id": None + }, + { + "id": 2, + "cve": "CVE-2023-5678", + "severity": "MEDIUM", + "base_score": "5.0", + "component_name": "another-component", + "component_version": "2.0.0", + "vuln_exp_id": 123 + } + ] + return workbench + + @pytest.fixture + def mock_params(self): + """Create mock command line parameters.""" + params = argparse.Namespace() + params.command = "export-sarif" + params.project_name = "TestProject" + params.scan_name = "TestScan" + params.output = "test_output.sarif" + params.include_vex = True + params.severity_threshold = None + params.include_scan_metadata = True + params.enrich_nvd = True + params.enrich_epss = True + params.enrich_cisa_kev = True + params.external_timeout = 30 + params.skip_enrichment = False + params.suppress_vex_mitigated = True + params.suppress_accepted_risk = True + params.suppress_false_positives = True + params.group_by_component = True + params.quiet = False + params.validate = False + params.scan_number_of_tries = 960 + params.scan_wait_time = 30 + return params + + @patch('workbench_cli.handlers.export_sarif.save_vulns_to_sarif') + def test_successful_export(self, mock_save_sarif, mock_workbench, mock_params): + """Test successful SARIF export with vulnerabilities.""" + # Execute the handler + result = handle_export_sarif(mock_workbench, mock_params) + + # Verify result + assert result is True + + # Verify API calls + mock_workbench.resolve_project.assert_called_once_with("TestProject", create_if_missing=False) + mock_workbench.resolve_scan.assert_called_once_with( + scan_name="TestScan", + project_name="TestProject", + create_if_missing=False, + params=mock_params + ) + mock_workbench.ensure_scan_is_idle.assert_called_once_with("TEST_SCAN_456", mock_params, ["SCAN", "DEPENDENCY_ANALYSIS"]) + mock_workbench.list_vulnerabilities.assert_called_once_with("TEST_SCAN_456") + + # Verify SARIF export + mock_save_sarif.assert_called_once_with( + filepath="test_output.sarif", + vulnerabilities=mock_workbench.list_vulnerabilities.return_value, + scan_code="TEST_SCAN_456", + include_cve_descriptions=True, + include_epss_scores=True, + include_exploit_info=True, + api_timeout=30, + include_vex=True, + include_scan_metadata=True, + suppress_vex_mitigated=True, + suppress_accepted_risk=True, + suppress_false_positives=True, + group_by_component=True, + quiet=False + ) + + @patch('workbench_cli.handlers.export_sarif.save_vulns_to_sarif') + def test_export_with_no_vulnerabilities(self, mock_save_sarif, mock_workbench, mock_params): + """Test SARIF export when no vulnerabilities are found.""" + # Setup + mock_workbench.list_vulnerabilities.return_value = [] + + # Execute + result = handle_export_sarif(mock_workbench, mock_params) + + # Verify + assert result is True + mock_save_sarif.assert_called_once_with( + filepath="test_output.sarif", + vulnerabilities=[], + scan_code="TEST_SCAN_456", + include_cve_descriptions=True, + include_epss_scores=True, + include_exploit_info=True, + api_timeout=30, + include_vex=True, + include_scan_metadata=True, + suppress_vex_mitigated=True, + suppress_accepted_risk=True, + suppress_false_positives=True, + group_by_component=True, + quiet=False + ) + + @patch('workbench_cli.handlers.export_sarif.save_vulns_to_sarif') + def test_export_with_custom_options(self, mock_save_sarif, mock_workbench, mock_params): + """Test SARIF export with custom enrichment options.""" + # Modify params + mock_params.enrich_nvd = False + mock_params.enrich_epss = False + mock_params.enrich_cisa_kev = False + mock_params.external_timeout = 60 + mock_params.output = "custom_output.sarif" + + # Execute + result = handle_export_sarif(mock_workbench, mock_params) + + # Verify + assert result is True + mock_save_sarif.assert_called_once_with( + filepath="custom_output.sarif", + vulnerabilities=mock_workbench.list_vulnerabilities.return_value, + scan_code="TEST_SCAN_456", + include_cve_descriptions=False, + include_epss_scores=False, + include_exploit_info=False, + api_timeout=60, + include_vex=True, + include_scan_metadata=True, + suppress_vex_mitigated=True, + suppress_accepted_risk=True, + suppress_false_positives=True, + group_by_component=True, + quiet=False + ) + + def test_project_not_found_error(self, mock_workbench, mock_params): + """Test handling of project not found error.""" + mock_workbench.resolve_project.side_effect = ProjectNotFoundError("Project not found") + + with pytest.raises(ProjectNotFoundError): + handle_export_sarif(mock_workbench, mock_params) + + def test_scan_not_found_error(self, mock_workbench, mock_params): + """Test handling of scan not found error.""" + mock_workbench.resolve_scan.side_effect = ScanNotFoundError("Scan not found") + + with pytest.raises(ScanNotFoundError): + handle_export_sarif(mock_workbench, mock_params) + + def test_api_error_during_fetch(self, mock_workbench, mock_params): + """Test handling of API error during vulnerability fetch.""" + mock_workbench.list_vulnerabilities.side_effect = ApiError("API Error") + + with pytest.raises(ApiError): + handle_export_sarif(mock_workbench, mock_params) + + def test_network_error_during_fetch(self, mock_workbench, mock_params): + """Test handling of network error during vulnerability fetch.""" + mock_workbench.list_vulnerabilities.side_effect = NetworkError("Network Error") + + with pytest.raises(NetworkError): + handle_export_sarif(mock_workbench, mock_params) + + @patch('workbench_cli.handlers.export_sarif.save_vulns_to_sarif') + def test_generic_error_during_export(self, mock_save_sarif, mock_workbench, mock_params): + """Test handling of generic error during SARIF export.""" + mock_save_sarif.side_effect = Exception("Generic export error") + + with pytest.raises(ProcessError) as exc_info: + handle_export_sarif(mock_workbench, mock_params) + + assert "Failed to export vulnerability data to SARIF format" in str(exc_info.value) + + @patch('workbench_cli.handlers.export_sarif.save_vulns_to_sarif') + def test_vulnerability_summary_display(self, mock_save_sarif, mock_workbench, mock_params, capsys): + """Test that vulnerability summary is properly displayed.""" + # Setup vulnerabilities with different severities and VEX status + mock_workbench.list_vulnerabilities.return_value = [ + {"id": 1, "cve": "CVE-2023-1", "severity": "HIGH", "vuln_exp_id": None}, + {"id": 2, "cve": "CVE-2023-2", "severity": "HIGH", "vuln_exp_id": 123}, + {"id": 3, "cve": "CVE-2023-3", "severity": "MEDIUM", "vuln_exp_id": None}, + {"id": 4, "cve": "CVE-2023-4", "severity": "LOW", "vuln_exp_id": 456} + ] + + # Execute + result = handle_export_sarif(mock_workbench, mock_params) + + # Verify + assert result is True + captured = capsys.readouterr() + assert "Found 4 vulnerabilities to export" in captured.out + assert "HIGH: 2" in captured.out + assert "MEDIUM: 1" in captured.out + assert "LOW: 1" in captured.out + assert "With VEX assessments: 2" in captured.out + assert "Without VEX assessments: 2" in captured.out + + @patch('workbench_cli.handlers.export_sarif.save_vulns_to_sarif') + def test_configuration_display(self, mock_save_sarif, mock_workbench, mock_params, capsys): + """Test that export configuration is properly displayed.""" + # Execute + result = handle_export_sarif(mock_workbench, mock_params) + + # Verify + assert result is True + captured = capsys.readouterr() + assert "SARIF Export Configuration:" in captured.out + assert "Output file: test_output.sarif" in captured.out + assert "Include CVE descriptions: True" in captured.out + assert "Include EPSS scores: True" in captured.out + assert "Include exploit information: True" in captured.out + assert "Apply VEX suppression: True" in captured.out + assert "API timeout: 30s" in captured.out + + @patch('workbench_cli.handlers.export_sarif.save_vulns_to_sarif') + def test_integration_tips_display(self, mock_save_sarif, mock_workbench, mock_params, capsys): + """Test that integration tips are displayed after successful export.""" + # Execute + result = handle_export_sarif(mock_workbench, mock_params) + + # Verify + assert result is True + captured = capsys.readouterr() + assert "Integration Tips:" in captured.out + assert "Upload to GitHub" in captured.out + assert "CI/CD Integration" in captured.out + assert "Security Tools" in captured.out + + @patch('workbench_cli.handlers.export_sarif.save_vulns_to_sarif') + def test_default_output_file(self, mock_save_sarif, mock_workbench): + """Test that default output file is used when not specified.""" + # Create params without output specified + params = argparse.Namespace() + params.command = "export-sarif" + params.project_name = "TestProject" + params.scan_name = "TestScan" + params.output = "vulns.sarif" # This would be the default from CLI + params.include_vex = True + params.severity_threshold = None + params.include_scan_metadata = True + params.enrich_nvd = True + params.enrich_epss = True + params.enrich_cisa_kev = True + params.external_timeout = 30 + params.skip_enrichment = False + params.suppress_vex_mitigated = True + params.suppress_accepted_risk = True + params.suppress_false_positives = True + params.group_by_component = True + params.quiet = False + params.validate = False + params.scan_number_of_tries = 960 + params.scan_wait_time = 30 + + # Execute + result = handle_export_sarif(mock_workbench, params) + + # Verify + assert result is True + mock_save_sarif.assert_called_once() + # Check that filepath was passed correctly + mock_save_sarif.assert_called_with( + filepath="vulns.sarif", + vulnerabilities=mock_workbench.list_vulnerabilities.return_value, + scan_code="TEST_SCAN_456", + include_cve_descriptions=True, + include_epss_scores=True, + include_exploit_info=True, + api_timeout=30, + include_vex=True, + include_scan_metadata=True, + suppress_vex_mitigated=True, + suppress_accepted_risk=True, + suppress_false_positives=True, + group_by_component=True, + quiet=False + ) \ No newline at end of file diff --git a/tests/unit/handlers/test_show_results.py b/tests/unit/handlers/test_show_results.py index 9ec0a64..d959f95 100644 --- a/tests/unit/handlers/test_show_results.py +++ b/tests/unit/handlers/test_show_results.py @@ -217,6 +217,7 @@ def test_handle_show_results_multiple_show_flags(self, mock_fetch, mock_workbenc mock_params.show_scan_metrics = True mock_params.show_policy_warnings = True mock_params.show_vulnerabilities = True + mock_params.sarif_result_path = None # Mock the resolution functions mock_workbench.resolve_project.return_value = "PROJ_A_CODE" @@ -228,4 +229,76 @@ def test_handle_show_results_multiple_show_flags(self, mock_fetch, mock_workbenc # Verify assert result is True - mock_fetch.assert_called_once() \ No newline at end of file + mock_fetch.assert_called_once() + + def test_validation_error_sarif_without_vulnerabilities(self, mock_workbench, mock_params): + """Tests show-results when SARIF output is requested without --show-vulnerabilities.""" + # Setup mocks + mock_params.command = 'show-results' + mock_params.project_name = "ProjA" + mock_params.scan_name = "Scan1" + mock_params.show_licenses = True + mock_params.show_components = False + mock_params.show_dependencies = False + mock_params.show_scan_metrics = False + mock_params.show_policy_warnings = False + mock_params.show_vulnerabilities = False # This is False + mock_params.sarif_result_path = "output.sarif" # But SARIF is requested + + # Execute and verify + with pytest.raises(ValidationError, match="--sarif-result-path requires --show-vulnerabilities flag"): + handle_show_results(mock_workbench, mock_params) + + @patch('workbench_cli.handlers.show_results.fetch_display_save_results') + def test_handle_show_results_with_sarif_and_vulnerabilities(self, mock_fetch, mock_workbench, mock_params): + """Tests show-results with SARIF output and vulnerabilities enabled.""" + # Setup mocks + mock_params.command = 'show-results' + mock_params.project_name = "ProjA" + mock_params.scan_name = "Scan1" + mock_params.show_licenses = False + mock_params.show_components = False + mock_params.show_dependencies = False + mock_params.show_scan_metrics = False + mock_params.show_policy_warnings = False + mock_params.show_vulnerabilities = True # This is True + mock_params.sarif_result_path = "output.sarif" # SARIF is requested + + # Mock the resolution functions + mock_workbench.resolve_project.return_value = "PROJ_A_CODE" + mock_workbench.resolve_scan.return_value = ("SCAN_1_CODE", 123) + mock_workbench.get_scan_status.return_value = {"status": "FINISHED"} + + # Execute + result = handle_show_results(mock_workbench, mock_params) + + # Verify - should succeed since both SARIF and vulnerabilities are enabled + assert result is True + mock_fetch.assert_called_once_with(mock_workbench, mock_params, "SCAN_1_CODE") + + @patch('workbench_cli.handlers.show_results.fetch_display_save_results') + def test_handle_show_results_sarif_none_allowed(self, mock_fetch, mock_workbench, mock_params): + """Tests show-results when SARIF path is None (should be allowed).""" + # Setup mocks + mock_params.command = 'show-results' + mock_params.project_name = "ProjA" + mock_params.scan_name = "Scan1" + mock_params.show_licenses = True + mock_params.show_components = False + mock_params.show_dependencies = False + mock_params.show_scan_metrics = False + mock_params.show_policy_warnings = False + mock_params.show_vulnerabilities = False + mock_params.sarif_result_path = None # No SARIF requested + + # Mock the resolution functions + mock_workbench.resolve_project.return_value = "PROJ_A_CODE" + mock_workbench.resolve_scan.return_value = ("SCAN_1_CODE", 123) + mock_workbench.get_scan_status.return_value = {"status": "FINISHED"} + + # Execute + result = handle_show_results(mock_workbench, mock_params) + + # Verify - should succeed since no SARIF is requested + assert result is True + mock_fetch.assert_called_once_with(mock_workbench, mock_params, "SCAN_1_CODE") \ No newline at end of file diff --git a/tests/unit/utilities/test_sarif_converter.py b/tests/unit/utilities/test_sarif_converter.py new file mode 100644 index 0000000..d89a8da --- /dev/null +++ b/tests/unit/utilities/test_sarif_converter.py @@ -0,0 +1,628 @@ +""" +Test suite for SARIF conversion utilities. + +This module contains comprehensive tests for the SARIF converter functionality +including conversion of vulnerability data to SARIF v2.1.0 format. +""" + +import pytest +import json +import tempfile +import os +import time +from unittest.mock import patch, mock_open +from typing import Dict, List, Any + +from workbench_cli.utilities.sarif_converter import ( + convert_vulns_to_sarif, + save_vulns_to_sarif, + _map_severity_to_sarif_level, + _generate_enhanced_rules, + _generate_enhanced_results, + _create_empty_sarif_report, + # Legacy functions for backward compatibility + _generate_rules, + _generate_results +) + +from workbench_cli.utilities.vulnerability_enricher import ( + enrich_vulnerabilities, + _fetch_epss_scores, + _fetch_cisa_kev_data, + _fetch_nvd_data_enhanced, + _fetch_single_cve_nvd, + _parse_nvd_vulnerability, + _fetch_vulners_data, + RateLimiter +) + + +class TestSarifConverter: + """Test cases for SARIF conversion functionality.""" + + def test_convert_vulns_to_sarif_with_data(self): + """Test conversion of vulnerability data to SARIF format.""" + sample_vulns = [ + { + "id": 1, + "cve": "CVE-2022-12345", + "cvss_version": "3.1", + "base_score": "9.8", + "severity": "CRITICAL", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "component_id": 123, + "component_name": "test-package", + "component_version": "1.0.0", + "scan_id": 456, + "rejected": 0 + }, + { + "id": 2, + "cve": "CVE-2022-67890", + "cvss_version": "3.1", + "base_score": "5.5", + "severity": "MEDIUM", + "attack_vector": "LOCAL", + "attack_complexity": "LOW", + "availability_impact": "NONE", + "component_id": 124, + "component_name": "another-package", + "component_version": "2.1.0", + "scan_id": 456, + "rejected": 0 + } + ] + + # Mock the vulnerability enricher to avoid external API calls + with patch('workbench_cli.utilities.sarif_converter.enrich_vulnerabilities') as mock_enrich: + mock_enrich.return_value = {} + + sarif_data = convert_vulns_to_sarif(sample_vulns, "TEST_SCAN_123") + + # Validate SARIF structure + assert sarif_data["version"] == "2.1.0" + assert "$schema" in sarif_data + assert len(sarif_data["runs"]) == 1 + + run = sarif_data["runs"][0] + assert run["tool"]["driver"]["name"] == "FossID Workbench" + assert run["properties"]["scan_code"] == "TEST_SCAN_123" + assert "generated_at" in run["properties"] + + # Validate rules + assert len(run["tool"]["driver"]["rules"]) == 2 + rule_ids = [rule["id"] for rule in run["tool"]["driver"]["rules"]] + assert "CVE-2022-12345" in rule_ids + assert "CVE-2022-67890" in rule_ids + + # Validate results + assert len(run["results"]) == 2 + result_rule_ids = [result["ruleId"] for result in run["results"]] + assert "CVE-2022-12345" in result_rule_ids + assert "CVE-2022-67890" in result_rule_ids + + # Validate severity mapping + critical_result = next(r for r in run["results"] if r["ruleId"] == "CVE-2022-12345") + medium_result = next(r for r in run["results"] if r["ruleId"] == "CVE-2022-67890") + assert critical_result["level"] == "error" + assert medium_result["level"] == "warning" + + def test_convert_vulns_to_sarif_empty_data(self): + """Test conversion with empty vulnerability data.""" + sarif_data = convert_vulns_to_sarif([], "TEST_SCAN_EMPTY") + + assert sarif_data["version"] == "2.1.0" + assert len(sarif_data["runs"]) == 1 + + run = sarif_data["runs"][0] + assert run["tool"]["driver"]["name"] == "FossID Workbench" + assert run["properties"]["scan_code"] == "TEST_SCAN_EMPTY" + assert len(run["tool"]["driver"]["rules"]) == 0 + assert len(run["results"]) == 0 + + def test_convert_vulns_to_sarif_with_external_data(self): + """Test conversion with external vulnerability data.""" + sample_vulns = [ + { + "id": 1, + "cve": "CVE-2022-12345", + "cvss_version": "3.1", + "base_score": "9.8", + "severity": "CRITICAL", + "component_name": "test-package", + "component_version": "1.0.0" + } + ] + + # Mock external data + mock_external_data = { + "CVE-2022-12345": { + "epss_score": 0.85, + "epss_percentile": 0.95, + "cisa_kev": True, + "nvd_description": "Test vulnerability description", + "nvd_cwe": ["CWE-79"] + } + } + + with patch('workbench_cli.utilities.sarif_converter.enrich_vulnerabilities') as mock_enrich: + mock_enrich.return_value = mock_external_data + + sarif_data = convert_vulns_to_sarif(sample_vulns, "TEST_SCAN_ENHANCED") + + # Validate external data integration + run = sarif_data["runs"][0] + rule = run["tool"]["driver"]["rules"][0] + + assert rule["properties"]["epss_score"] == 0.85 + assert rule["properties"]["cisa_known_exploited"] == True + assert rule["properties"]["cwe_ids"] == ["CWE-79"] + + # Validate enhanced description + assert "Test vulnerability description" in rule["fullDescription"]["text"] + assert "CISA" in rule["fullDescription"]["text"] + + def test_map_severity_to_sarif_level(self): + """Test mapping of severity levels to SARIF levels.""" + assert _map_severity_to_sarif_level("CRITICAL") == "error" + assert _map_severity_to_sarif_level("HIGH") == "error" + assert _map_severity_to_sarif_level("MEDIUM") == "warning" + assert _map_severity_to_sarif_level("LOW") == "note" + assert _map_severity_to_sarif_level("UNKNOWN") == "warning" + assert _map_severity_to_sarif_level("INVALID") == "warning" + assert _map_severity_to_sarif_level("") == "warning" + assert _map_severity_to_sarif_level(None) == "warning" + + def test_generate_enhanced_rules(self): + """Test generation of enhanced SARIF rules from vulnerability data.""" + sample_vulns = [ + { + "cve": "CVE-2022-12345", + "cvss_version": "3.1", + "base_score": "9.8", + "severity": "CRITICAL", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH" + }, + { + "cve": "CVE-2022-12345", # Duplicate CVE should only create one rule + "cvss_version": "3.1", + "base_score": "9.8", + "severity": "CRITICAL", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH" + }, + { + "cve": "CVE-2022-67890", + "cvss_version": "3.0", + "base_score": "5.5", + "severity": "MEDIUM", + "attack_vector": "LOCAL", + "attack_complexity": "LOW", + "availability_impact": "NONE" + } + ] + + external_data = {} + rules = _generate_enhanced_rules(sample_vulns, external_data) + + assert len(rules) == 2 # Should deduplicate CVE-2022-12345 + rule_ids = [rule["id"] for rule in rules] + assert "CVE-2022-12345" in rule_ids + assert "CVE-2022-67890" in rule_ids + + # Validate rule structure + critical_rule = next(r for r in rules if r["id"] == "CVE-2022-12345") + assert critical_rule["name"] == "Vulnerability CVE-2022-12345" + assert critical_rule["defaultConfiguration"]["level"] == "error" + assert critical_rule["properties"]["cvss_version"] == "3.1" + assert critical_rule["properties"]["base_score"] == "9.8" + + def test_generate_enhanced_results(self): + """Test generation of enhanced SARIF results from vulnerability data.""" + sample_vulns = [ + { + "id": 1, + "cve": "CVE-2022-12345", + "cvss_version": "3.1", + "base_score": "9.8", + "severity": "CRITICAL", + "component_id": 123, + "component_name": "test-package", + "component_version": "1.0.0", + "scan_id": 456, + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0 + } + ] + + external_data = {} + results = _generate_enhanced_results(sample_vulns, external_data) + + assert len(results) == 1 + result = results[0] + + assert result["ruleId"] == "CVE-2022-12345" + assert result["level"] == "error" + assert "CVE-2022-12345" in result["message"]["text"] + assert "test-package" in result["message"]["text"] + assert result["locations"][0]["physicalLocation"]["artifactLocation"]["uri"] == "pkg:generic/test-package@1.0.0" + + # Validate properties + assert result["properties"]["component_id"] == 123 + assert result["properties"]["scan_id"] == 456 + assert result["properties"]["vulnerability_id"] == 1 + assert result["properties"]["base_score"] == "9.8" + + def test_create_empty_sarif_report(self): + """Test creation of empty SARIF report.""" + sarif_data = _create_empty_sarif_report("EMPTY_SCAN") + + assert sarif_data["version"] == "2.1.0" + assert len(sarif_data["runs"]) == 1 + + run = sarif_data["runs"][0] + assert run["tool"]["driver"]["name"] == "FossID Workbench" + assert run["properties"]["scan_code"] == "EMPTY_SCAN" + assert len(run["tool"]["driver"]["rules"]) == 0 + assert len(run["results"]) == 0 + + def test_save_vulns_to_sarif_success(self): + """Test successful saving of vulnerabilities to SARIF file.""" + sample_vulns = [ + { + "id": 1, + "cve": "CVE-2022-12345", + "cvss_version": "3.1", + "base_score": "9.8", + "severity": "CRITICAL", + "component_name": "test-package", + "component_version": "1.0.0", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH" + } + ] + + with tempfile.NamedTemporaryFile(mode='w', delete=False, suffix='.sarif') as temp_file: + temp_path = temp_file.name + + try: + # Mock the enricher to avoid external API calls + with patch('workbench_cli.utilities.sarif_converter.enrich_vulnerabilities') as mock_enrich: + mock_enrich.return_value = {} + + save_vulns_to_sarif(temp_path, sample_vulns, "TEST_SCAN") + + # Verify file was created and contains valid SARIF + assert os.path.exists(temp_path) + with open(temp_path, 'r') as f: + saved_data = json.load(f) + + assert saved_data["version"] == "2.1.0" + assert len(saved_data["runs"]) == 1 + assert saved_data["runs"][0]["properties"]["scan_code"] == "TEST_SCAN" + + finally: + if os.path.exists(temp_path): + os.unlink(temp_path) + + def test_save_vulns_to_sarif_creates_directory(self): + """Test that save_vulns_to_sarif creates output directory if it doesn't exist.""" + sample_vulns = [ + { + "id": 1, + "cve": "CVE-2022-12345", + "severity": "HIGH", + "component_name": "test-package", + "component_version": "1.0.0" + } + ] + + with tempfile.TemporaryDirectory() as temp_dir: + nested_path = os.path.join(temp_dir, "nested", "subdir", "results.sarif") + + # Mock the enricher to avoid external API calls + with patch('workbench_cli.utilities.sarif_converter.enrich_vulnerabilities') as mock_enrich: + mock_enrich.return_value = {} + + save_vulns_to_sarif(nested_path, sample_vulns, "TEST_SCAN") + + assert os.path.exists(nested_path) + with open(nested_path, 'r') as f: + saved_data = json.load(f) + + assert saved_data["version"] == "2.1.0" + + def test_save_vulns_to_sarif_io_error(self): + """Test handling of IO errors during SARIF file saving.""" + sample_vulns = [ + { + "id": 1, + "cve": "CVE-2022-12345", + "severity": "HIGH", + "component_name": "test-package", + "component_version": "1.0.0" + } + ] + + # Use an invalid path that should cause an error + invalid_path = "/invalid/path/that/should/not/exist/results.sarif" + + with pytest.raises((IOError, OSError)): + with patch('workbench_cli.utilities.sarif_converter.enrich_vulnerabilities') as mock_enrich: + mock_enrich.return_value = {} + save_vulns_to_sarif(invalid_path, sample_vulns, "TEST_SCAN") + + def test_handle_missing_vulnerability_fields(self): + """Test handling of vulnerabilities with missing fields.""" + incomplete_vulns = [ + { + "id": 1, + # Missing cve field + "severity": "HIGH", + "component_name": "test-package", + # Missing component_version + }, + { + "id": 2, + "cve": "CVE-2022-67890", + # Missing severity + # Missing component_name and component_version + } + ] + + with patch('workbench_cli.utilities.sarif_converter.enrich_vulnerabilities') as mock_enrich: + mock_enrich.return_value = {} + + sarif_data = convert_vulns_to_sarif(incomplete_vulns, "TEST_SCAN") + + # Should still create valid SARIF even with missing fields + assert sarif_data["version"] == "2.1.0" + assert len(sarif_data["runs"]) == 1 + + run = sarif_data["runs"][0] + assert len(run["results"]) == 2 + + # Verify default values are used for missing fields + results = run["results"] + first_result = results[0] + assert first_result["ruleId"] == "UNKNOWN" # Default for missing CVE + + second_result = results[1] + assert second_result["ruleId"] == "CVE-2022-67890" + assert "Unknown" in second_result["message"]["text"] # Default for missing component info + + def test_sarif_schema_compliance(self): + """Test that generated SARIF complies with the expected schema structure.""" + sample_vulns = [ + { + "id": 1, + "cve": "CVE-2022-12345", + "cvss_version": "3.1", + "base_score": "9.8", + "severity": "CRITICAL", + "component_name": "test-package", + "component_version": "1.0.0", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH" + } + ] + + with patch('workbench_cli.utilities.sarif_converter.enrich_vulnerabilities') as mock_enrich: + mock_enrich.return_value = {} + + sarif_data = convert_vulns_to_sarif(sample_vulns, "TEST_SCAN") + + # Validate required SARIF fields + assert "$schema" in sarif_data + assert sarif_data["$schema"] == "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json" + assert sarif_data["version"] == "2.1.0" + assert "runs" in sarif_data + assert len(sarif_data["runs"]) == 1 + + run = sarif_data["runs"][0] + assert "tool" in run + assert "driver" in run["tool"] + assert "results" in run + + driver = run["tool"]["driver"] + assert "name" in driver + assert "rules" in driver + + # Validate rule structure + for rule in driver["rules"]: + assert "id" in rule + assert "name" in rule + assert "defaultConfiguration" in rule + assert "level" in rule["defaultConfiguration"] + + # Validate result structure + for result in run["results"]: + assert "ruleId" in result + assert "level" in result + assert "message" in result + assert "text" in result["message"] + assert "locations" in result + assert len(result["locations"]) > 0 + + location = result["locations"][0] + assert "physicalLocation" in location + assert "artifactLocation" in location["physicalLocation"] + assert "uri" in location["physicalLocation"]["artifactLocation"] + + def test_legacy_function_compatibility(self): + """Test that legacy functions still work for backward compatibility.""" + sample_vulns = [ + { + "cve": "CVE-2022-12345", + "cvss_version": "3.1", + "base_score": "9.8", + "severity": "CRITICAL", + "component_name": "test-package", + "component_version": "1.0.0" + } + ] + + # Test legacy _generate_rules function + rules = _generate_rules(sample_vulns) + assert len(rules) == 1 + assert rules[0]["id"] == "CVE-2022-12345" + + # Test legacy _generate_results function + results = _generate_results(sample_vulns) + assert len(results) == 1 + assert results[0]["ruleId"] == "CVE-2022-12345" + + +class TestVulnerabilityEnricher: + """Test cases for vulnerability enrichment functionality.""" + + def test_enrich_vulnerabilities_empty_list(self): + """Test enrichment with empty CVE list.""" + result = enrich_vulnerabilities([]) + assert result == {} + + @patch('workbench_cli.utilities.vulnerability_enricher.requests.get') + def test_fetch_epss_scores_success(self, mock_get): + """Test successful EPSS score fetching.""" + mock_response = { + "status": "OK", + "data": [ + { + "cve": "CVE-2022-12345", + "epss": "0.85000", + "percentile": "0.95000" + } + ] + } + mock_get.return_value.json.return_value = mock_response + mock_get.return_value.raise_for_status.return_value = None + + result = _fetch_epss_scores(["CVE-2022-12345"]) + + assert "CVE-2022-12345" in result + assert result["CVE-2022-12345"]["epss_score"] == 0.85 + assert result["CVE-2022-12345"]["epss_percentile"] == 0.95 + + @patch('workbench_cli.utilities.vulnerability_enricher.requests.get') + def test_fetch_cisa_kev_data_success(self, mock_get): + """Test successful CISA KEV data fetching.""" + mock_response = { + "vulnerabilities": [ + { + "cveID": "CVE-2022-12345", + "vendorProject": "Test Vendor", + "product": "Test Product" + } + ] + } + mock_get.return_value.json.return_value = mock_response + mock_get.return_value.raise_for_status.return_value = None + + result = _fetch_cisa_kev_data(["CVE-2022-12345", "CVE-2022-99999"]) + + assert "CVE-2022-12345" in result + assert "CVE-2022-99999" not in result + + def test_rate_limiter_functionality(self): + """Test rate limiter functionality.""" + limiter = RateLimiter(max_workers=2, delay=0.1) + + start_time = time.time() + + # Should allow first two requests immediately + limiter.wait() + limiter.wait() + + # Third request should be delayed + limiter.wait() + + elapsed = time.time() - start_time + assert elapsed >= 0.1 # Should have waited at least 0.1 seconds + + @patch('workbench_cli.utilities.vulnerability_enricher.requests.get') + def test_parse_nvd_vulnerability(self, mock_get): + """Test parsing of NVD vulnerability data.""" + nvd_vuln_data = { + "descriptions": [ + { + "lang": "en", + "value": "Test vulnerability description" + } + ], + "weaknesses": [ + { + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-79" + } + ] + } + ], + "references": [ + { + "url": "https://example.com/vuln", + "source": "test", + "tags": ["Exploit"] + } + ], + "metrics": { + "cvssMetricV31": [ + { + "cvssData": { + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", + "baseScore": 6.1 + } + } + ] + } + } + + result = _parse_nvd_vulnerability(nvd_vuln_data) + + assert result["nvd_description"] == "Test vulnerability description" + assert result["nvd_cwe"] == ["CWE-79"] + assert len(result["nvd_references"]) == 1 + assert result["nvd_references"][0]["url"] == "https://example.com/vuln" + assert result["full_cvss_vector"] == "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + assert result["cvss_score"] == 6.1 + + @patch('workbench_cli.utilities.vulnerability_enricher.requests.post') + def test_fetch_vulners_data_success(self, mock_post): + """Test successful Vulners API data fetching.""" + mock_response = { + "result": "OK", + "data": { + "documents": [ + { + "description": "Test vulnerability from Vulners", + "cwe": ["CWE-79"], + "references": ["https://example.com/ref1"], + "cvss": { + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", + "score": 6.1 + } + } + ] + } + } + mock_post.return_value.status_code = 200 + mock_post.return_value.json.return_value = mock_response + + result = _fetch_vulners_data("CVE-2022-12345") + + assert result["nvd_description"] == "Test vulnerability from Vulners" + assert result["nvd_cwe"] == ["CWE-79"] + assert result["source"] == "vulners" + assert result["full_cvss_vector"] == "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + assert result["cvss_score"] == 6.1 \ No newline at end of file diff --git a/tests/unit/utilities/test_scan_workflows.py b/tests/unit/utilities/test_scan_workflows.py index ba374ec..8da81a4 100644 --- a/tests/unit/utilities/test_scan_workflows.py +++ b/tests/unit/utilities/test_scan_workflows.py @@ -455,9 +455,11 @@ class TestFetchDisplaySaveResults: @patch('workbench_cli.utilities.scan_workflows.fetch_results') @patch('workbench_cli.utilities.scan_workflows.display_results') @patch('workbench_cli.utilities.scan_workflows.save_results_to_file') - def test_complete_workflow(self, mock_save, mock_display, mock_fetch, mock_workbench, mock_params): - """Test complete fetch, display, and save workflow.""" + def test_complete_workflow_legacy(self, mock_save, mock_display, mock_fetch, mock_workbench, mock_params): + """Test complete fetch, display, and save workflow with legacy path_result.""" mock_params.path_result = "output.json" + mock_params.json_result_path = None + mock_params.sarif_result_path = None mock_params.show_licenses = True mock_fetch.return_value = {"test": "data"} mock_display.return_value = True @@ -468,11 +470,113 @@ def test_complete_workflow(self, mock_save, mock_display, mock_fetch, mock_workb mock_display.assert_called_once_with({"test": "data"}, mock_params) mock_save.assert_called_once_with("output.json", {"test": "data"}, TEST_SCAN_CODE) + @patch('workbench_cli.utilities.scan_workflows.fetch_results') + @patch('workbench_cli.utilities.scan_workflows.display_results') + @patch('workbench_cli.utilities.scan_workflows.save_results_to_file') + def test_json_result_path_workflow(self, mock_save, mock_display, mock_fetch, mock_workbench, mock_params): + """Test fetch, display, and save workflow with JSON result path.""" + mock_params.path_result = None + mock_params.json_result_path = "output.json" + mock_params.sarif_result_path = None + mock_params.show_licenses = True + mock_fetch.return_value = {"test": "data"} + mock_display.return_value = True + + fetch_display_save_results(mock_workbench, mock_params, TEST_SCAN_CODE) + + mock_fetch.assert_called_once_with(mock_workbench, mock_params, TEST_SCAN_CODE) + mock_display.assert_called_once_with({"test": "data"}, mock_params) + mock_save.assert_called_once_with("output.json", {"test": "data"}, TEST_SCAN_CODE) + + @patch('workbench_cli.utilities.scan_workflows.fetch_results') + @patch('workbench_cli.utilities.scan_workflows.display_results') + @patch('workbench_cli.utilities.sarif_converter.save_vulns_to_sarif') + def test_sarif_result_path_workflow(self, mock_save_sarif, mock_display, mock_fetch, mock_workbench, mock_params): + """Test fetch, display, and save workflow with SARIF result path.""" + mock_params.path_result = None + mock_params.json_result_path = None + mock_params.sarif_result_path = "output.sarif" + mock_params.show_vulnerabilities = True + mock_params.show_licenses = False + + sample_vulns = [{"id": 1, "cve": "CVE-2022-12345", "severity": "HIGH"}] + mock_fetch.return_value = {"vulnerabilities": sample_vulns} + mock_display.return_value = True + + fetch_display_save_results(mock_workbench, mock_params, TEST_SCAN_CODE) + + mock_fetch.assert_called_once_with(mock_workbench, mock_params, TEST_SCAN_CODE) + mock_display.assert_called_once_with({"vulnerabilities": sample_vulns}, mock_params) + mock_save_sarif.assert_called_once_with("output.sarif", sample_vulns, TEST_SCAN_CODE, True, True, True, 30) + + @patch('workbench_cli.utilities.scan_workflows.fetch_results') + @patch('workbench_cli.utilities.scan_workflows.display_results') + def test_sarif_without_show_vulnerabilities(self, mock_display, mock_fetch, mock_workbench, mock_params): + """Test SARIF output warning when --show-vulnerabilities is not set.""" + mock_params.path_result = None + mock_params.json_result_path = None + mock_params.sarif_result_path = "output.sarif" + mock_params.show_vulnerabilities = False + mock_params.show_licenses = True + + mock_fetch.return_value = {"licenses": ["MIT"]} + mock_display.return_value = True + + fetch_display_save_results(mock_workbench, mock_params, TEST_SCAN_CODE) + + mock_fetch.assert_called_once_with(mock_workbench, mock_params, TEST_SCAN_CODE) + mock_display.assert_called_once_with({"licenses": ["MIT"]}, mock_params) + # Should not attempt to save SARIF since show_vulnerabilities is False + + @patch('workbench_cli.utilities.scan_workflows.fetch_results') + @patch('workbench_cli.utilities.scan_workflows.display_results') + def test_sarif_with_no_vulnerabilities(self, mock_display, mock_fetch, mock_workbench, mock_params): + """Test SARIF output when no vulnerabilities are found.""" + mock_params.path_result = None + mock_params.json_result_path = None + mock_params.sarif_result_path = "output.sarif" + mock_params.show_vulnerabilities = True + + mock_fetch.return_value = {"vulnerabilities": []} # Empty vulnerabilities + mock_display.return_value = True + + fetch_display_save_results(mock_workbench, mock_params, TEST_SCAN_CODE) + + mock_fetch.assert_called_once_with(mock_workbench, mock_params, TEST_SCAN_CODE) + mock_display.assert_called_once_with({"vulnerabilities": []}, mock_params) + # Should not attempt to save SARIF since no vulnerabilities found + + @patch('workbench_cli.utilities.scan_workflows.fetch_results') + @patch('workbench_cli.utilities.scan_workflows.display_results') + @patch('workbench_cli.utilities.scan_workflows.save_results_to_file') + @patch('workbench_cli.utilities.sarif_converter.save_vulns_to_sarif') + def test_both_json_and_sarif_output(self, mock_save_sarif, mock_save_json, mock_display, mock_fetch, mock_workbench, mock_params): + """Test saving both JSON and SARIF outputs simultaneously.""" + mock_params.path_result = None + mock_params.json_result_path = "output.json" + mock_params.sarif_result_path = "output.sarif" + mock_params.show_vulnerabilities = True + mock_params.show_licenses = True + + sample_vulns = [{"id": 1, "cve": "CVE-2022-12345", "severity": "HIGH"}] + results = {"vulnerabilities": sample_vulns, "licenses": ["MIT"]} + mock_fetch.return_value = results + mock_display.return_value = True + + fetch_display_save_results(mock_workbench, mock_params, TEST_SCAN_CODE) + + mock_fetch.assert_called_once_with(mock_workbench, mock_params, TEST_SCAN_CODE) + mock_display.assert_called_once_with(results, mock_params) + mock_save_json.assert_called_once_with("output.json", results, TEST_SCAN_CODE) + mock_save_sarif.assert_called_once_with("output.sarif", sample_vulns, TEST_SCAN_CODE, True, True, True, 30) + @patch('workbench_cli.utilities.scan_workflows.fetch_results') @patch('workbench_cli.utilities.scan_workflows.display_results') def test_no_save_specified(self, mock_display, mock_fetch, mock_workbench, mock_params): """Test fetch and display without saving.""" mock_params.path_result = None + mock_params.json_result_path = None + mock_params.sarif_result_path = None mock_params.show_licenses = True mock_fetch.return_value = {"test": "data"} mock_display.return_value = True diff --git a/tests/unit/utilities/test_vulnerability_enricher.py b/tests/unit/utilities/test_vulnerability_enricher.py new file mode 100644 index 0000000..e79b8be --- /dev/null +++ b/tests/unit/utilities/test_vulnerability_enricher.py @@ -0,0 +1,596 @@ +""" +Test suite for vulnerability enrichment utilities. + +This module contains comprehensive tests for the vulnerability enricher functionality +including external API integration for EPSS scores, CISA KEV data, and NVD details. +""" + +import pytest +import json +import time +import os +from unittest.mock import patch, Mock +from typing import Dict, List, Any + +from workbench_cli.utilities.vulnerability_enricher import ( + enrich_vulnerabilities, + _fetch_external_vulnerability_data, + _fetch_epss_scores, + _fetch_cisa_kev_data, + _fetch_nvd_data, + _fetch_nvd_data_enhanced, + _fetch_single_cve_nvd, + _parse_nvd_vulnerability, + _fetch_alternative_vulnerability_data, + _fetch_vulners_data, + RateLimiter +) + + +class TestVulnerabilityEnricher: + """Test cases for main vulnerability enrichment functionality.""" + + def test_enrich_vulnerabilities_empty_list(self): + """Test enrichment with empty CVE list.""" + result = enrich_vulnerabilities([]) + assert result == {} + + @patch('workbench_cli.utilities.vulnerability_enricher._fetch_external_vulnerability_data') + def test_enrich_vulnerabilities_with_cves(self, mock_fetch): + """Test enrichment with CVE list.""" + mock_fetch.return_value = { + "CVE-2022-12345": { + "epss_score": 0.85, + "cisa_kev": True + } + } + + result = enrich_vulnerabilities(["CVE-2022-12345"]) + + assert "CVE-2022-12345" in result + assert result["CVE-2022-12345"]["epss_score"] == 0.85 + mock_fetch.assert_called_once() + + @patch('workbench_cli.utilities.vulnerability_enricher._fetch_epss_scores') + @patch('workbench_cli.utilities.vulnerability_enricher._fetch_cisa_kev_data') + @patch('workbench_cli.utilities.vulnerability_enricher._fetch_nvd_data') + def test_fetch_external_vulnerability_data_all_sources(self, mock_nvd, mock_kev, mock_epss): + """Test fetching from all external data sources.""" + cve_list = ["CVE-2022-12345"] + + mock_epss.return_value = { + "CVE-2022-12345": {"epss_score": 0.85, "epss_percentile": 0.95} + } + mock_kev.return_value = ["CVE-2022-12345"] + mock_nvd.return_value = { + "CVE-2022-12345": {"nvd_description": "Test description"} + } + + result = _fetch_external_vulnerability_data(cve_list) + + assert "CVE-2022-12345" in result + assert result["CVE-2022-12345"]["epss_score"] == 0.85 + assert result["CVE-2022-12345"]["cisa_kev"] == True + assert result["CVE-2022-12345"]["nvd_description"] == "Test description" + + @patch('workbench_cli.utilities.vulnerability_enricher._fetch_epss_scores') + def test_fetch_external_vulnerability_data_epss_only(self, mock_epss): + """Test fetching EPSS data only.""" + cve_list = ["CVE-2022-12345"] + + mock_epss.return_value = { + "CVE-2022-12345": {"epss_score": 0.75} + } + + result = _fetch_external_vulnerability_data( + cve_list, + include_descriptions=False, + include_epss=True, + include_exploits=False + ) + + assert "CVE-2022-12345" in result + assert result["CVE-2022-12345"]["epss_score"] == 0.75 + assert result["CVE-2022-12345"]["cisa_kev"] == False + assert result["CVE-2022-12345"]["nvd_description"] is None + + @patch('workbench_cli.utilities.vulnerability_enricher._fetch_epss_scores') + def test_fetch_external_vulnerability_data_with_exceptions(self, mock_epss): + """Test handling of exceptions during external data fetching.""" + cve_list = ["CVE-2022-12345"] + + mock_epss.side_effect = Exception("EPSS API failed") + + # Should not raise exception, should return initialized data structure + result = _fetch_external_vulnerability_data(cve_list) + + assert "CVE-2022-12345" in result + assert result["CVE-2022-12345"]["epss_score"] is None + assert result["CVE-2022-12345"]["cisa_kev"] == False + + +class TestEpssDataFetching: + """Test cases for EPSS score fetching.""" + + @patch('workbench_cli.utilities.vulnerability_enricher.requests.get') + def test_fetch_epss_scores_success(self, mock_get): + """Test successful EPSS score fetching.""" + mock_response = { + "status": "OK", + "data": [ + { + "cve": "CVE-2022-12345", + "epss": "0.85000", + "percentile": "0.95000" + }, + { + "cve": "CVE-2022-67890", + "epss": "0.15000", + "percentile": "0.25000" + } + ] + } + mock_get.return_value.json.return_value = mock_response + mock_get.return_value.raise_for_status.return_value = None + + result = _fetch_epss_scores(["CVE-2022-12345", "CVE-2022-67890"]) + + assert len(result) == 2 + assert result["CVE-2022-12345"]["epss_score"] == 0.85 + assert result["CVE-2022-12345"]["epss_percentile"] == 0.95 + assert result["CVE-2022-67890"]["epss_score"] == 0.15 + + @patch('workbench_cli.utilities.vulnerability_enricher.requests.get') + def test_fetch_epss_scores_batch_processing(self, mock_get): + """Test EPSS batch processing with large CVE lists.""" + # Create a list larger than batch size (100) + cve_list = [f"CVE-2022-{i:05d}" for i in range(150)] + + # Mock responses for two batches + mock_response = { + "status": "OK", + "data": [{"cve": cve, "epss": "0.5", "percentile": "0.5"} for cve in cve_list[:100]] + } + mock_get.return_value.json.return_value = mock_response + mock_get.return_value.raise_for_status.return_value = None + + with patch('workbench_cli.utilities.vulnerability_enricher.time.sleep'): + result = _fetch_epss_scores(cve_list) + + # Should be called twice for two batches + assert mock_get.call_count == 2 + assert len(result) == 100 # Only first batch in mock response + + @patch('workbench_cli.utilities.vulnerability_enricher.requests.get') + def test_fetch_epss_scores_api_error(self, mock_get): + """Test handling of EPSS API errors.""" + mock_get.side_effect = Exception("API Error") + + result = _fetch_epss_scores(["CVE-2022-12345"]) + + assert result == {} + + @patch('workbench_cli.utilities.vulnerability_enricher.requests.get') + def test_fetch_epss_scores_invalid_response(self, mock_get): + """Test handling of invalid EPSS API response.""" + mock_response = {"status": "ERROR", "message": "Invalid request"} + mock_get.return_value.json.return_value = mock_response + mock_get.return_value.raise_for_status.return_value = None + + result = _fetch_epss_scores(["CVE-2022-12345"]) + + assert result == {} + + +class TestCisaKevDataFetching: + """Test cases for CISA KEV data fetching.""" + + @patch('workbench_cli.utilities.vulnerability_enricher.requests.get') + def test_fetch_cisa_kev_data_success(self, mock_get): + """Test successful CISA KEV data fetching.""" + mock_response = { + "vulnerabilities": [ + { + "cveID": "CVE-2022-12345", + "vendorProject": "Test Vendor", + "product": "Test Product" + }, + { + "cveID": "CVE-2022-67890", + "vendorProject": "Another Vendor", + "product": "Another Product" + } + ] + } + mock_get.return_value.json.return_value = mock_response + mock_get.return_value.raise_for_status.return_value = None + + result = _fetch_cisa_kev_data(["CVE-2022-12345", "CVE-2022-99999"]) + + assert len(result) == 1 + assert "CVE-2022-12345" in result + assert "CVE-2022-99999" not in result + + @patch('workbench_cli.utilities.vulnerability_enricher.requests.get') + def test_fetch_cisa_kev_data_no_vulnerabilities(self, mock_get): + """Test CISA KEV response with no vulnerabilities section.""" + mock_response = {"other_data": "value"} + mock_get.return_value.json.return_value = mock_response + mock_get.return_value.raise_for_status.return_value = None + + result = _fetch_cisa_kev_data(["CVE-2022-12345"]) + + assert result == [] + + @patch('workbench_cli.utilities.vulnerability_enricher.requests.get') + def test_fetch_cisa_kev_data_api_error(self, mock_get): + """Test handling of CISA KEV API errors.""" + mock_get.side_effect = Exception("API Error") + + result = _fetch_cisa_kev_data(["CVE-2022-12345"]) + + assert result == [] + + +class TestNvdDataFetching: + """Test cases for NVD data fetching.""" + + def test_fetch_nvd_data_calls_enhanced(self): + """Test that fetch_nvd_data calls the enhanced version.""" + with patch('workbench_cli.utilities.vulnerability_enricher._fetch_nvd_data_enhanced') as mock_enhanced: + mock_enhanced.return_value = {"test": "data"} + + result = _fetch_nvd_data(["CVE-2022-12345"]) + + assert result == {"test": "data"} + mock_enhanced.assert_called_once_with(["CVE-2022-12345"], 30) + + @patch.dict(os.environ, {"NVD_API_KEY": "test-key"}) + @patch('workbench_cli.utilities.vulnerability_enricher.ThreadPoolExecutor') + def test_fetch_nvd_data_enhanced_with_api_key(self, mock_executor): + """Test enhanced NVD data fetching with API key.""" + # Mock the executor and its methods + mock_executor_instance = mock_executor.return_value.__enter__.return_value + mock_future = mock_executor_instance.submit.return_value + mock_future.result.return_value = { + "nvd_description": "Test description", + "nvd_cwe": ["CWE-79"] + } + + from concurrent.futures import as_completed + with patch('workbench_cli.utilities.vulnerability_enricher.as_completed') as mock_as_completed: + mock_as_completed.return_value = [mock_future] + + result = _fetch_nvd_data_enhanced(["CVE-2022-12345"]) + + assert "CVE-2022-12345" in result + # Verify executor was called with higher max_workers for API key + mock_executor.assert_called_once_with(max_workers=5) + + @patch.dict(os.environ, {}, clear=True) + @patch('workbench_cli.utilities.vulnerability_enricher.ThreadPoolExecutor') + def test_fetch_nvd_data_enhanced_without_api_key(self, mock_executor): + """Test enhanced NVD data fetching without API key.""" + # Mock the executor + mock_executor_instance = mock_executor.return_value.__enter__.return_value + mock_future = mock_executor_instance.submit.return_value + mock_future.result.return_value = { + "nvd_description": "Test description" + } + + from concurrent.futures import as_completed + with patch('workbench_cli.utilities.vulnerability_enricher.as_completed') as mock_as_completed: + mock_as_completed.return_value = [mock_future] + + result = _fetch_nvd_data_enhanced(["CVE-2022-12345"]) + + assert "CVE-2022-12345" in result + # Verify executor was called with lower max_workers for no API key + mock_executor.assert_called_once_with(max_workers=2) + + @patch('workbench_cli.utilities.vulnerability_enricher.requests.get') + def test_fetch_single_cve_nvd_success(self, mock_get): + """Test successful fetching of a single CVE from NVD.""" + mock_response = { + "vulnerabilities": [{ + "cve": { + "descriptions": [{"lang": "en", "value": "Test vulnerability description"}], + "weaknesses": [{ + "type": "Primary", + "description": [{"lang": "en", "value": "CWE-79"}] + }], + "references": [ + {"url": "https://example.com/ref1", "source": "test-source", "tags": ["Vendor Advisory"]} + ], + "metrics": { + "cvssMetricV31": [{ + "cvssData": { + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", + "baseScore": 6.1 + } + }] + } + } + }] + } + mock_get.return_value.status_code = 200 + mock_get.return_value.json.return_value = mock_response + + rate_limiter = RateLimiter(2, 1.0) + result = _fetch_single_cve_nvd("CVE-2022-12345", None, rate_limiter, 30) + + assert result is not None + assert result["nvd_description"] == "Test vulnerability description" + assert result["nvd_cwe"] == ["CWE-79"] + assert len(result["nvd_references"]) == 1 + assert result["full_cvss_vector"] == "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + assert result["cvss_score"] == 6.1 + + @patch('workbench_cli.utilities.vulnerability_enricher.requests.get') + def test_fetch_single_cve_nvd_rate_limited(self, mock_get): + """Test handling of rate limiting when fetching CVE data.""" + # Create separate mock responses + rate_limited_response = Mock() + rate_limited_response.status_code = 429 + rate_limited_response.headers = {'Retry-After': '1'} + + success_response = Mock() + success_response.status_code = 200 + success_response.json.return_value = { + "vulnerabilities": [{ + "cve": { + "descriptions": [{"lang": "en", "value": "Test description"}], + "weaknesses": [], + "references": [], + "metrics": {} + } + }] + } + + # Configure mock to return rate limited response first, then success + mock_get.side_effect = [rate_limited_response, success_response] + + rate_limiter = RateLimiter(2, 1.0) + + with patch('workbench_cli.utilities.vulnerability_enricher.time.sleep') as mock_sleep: + result = _fetch_single_cve_nvd("CVE-2022-12345", None, rate_limiter, 30) + + assert result is not None + assert result["nvd_description"] == "Test description" + mock_sleep.assert_called_once_with(1) # Should wait for retry-after + + @patch('workbench_cli.utilities.vulnerability_enricher.requests.get') + def test_fetch_single_cve_nvd_with_api_key(self, mock_get): + """Test fetching CVE data with API key.""" + mock_response = { + "vulnerabilities": [{ + "cve": { + "descriptions": [{"lang": "en", "value": "Test description"}], + "weaknesses": [], + "references": [], + "metrics": {} + } + }] + } + mock_get.return_value.status_code = 200 + mock_get.return_value.json.return_value = mock_response + + rate_limiter = RateLimiter(5, 0.6) + result = _fetch_single_cve_nvd("CVE-2022-12345", "test-api-key", rate_limiter, 30) + + assert result is not None + # Verify API key was included in headers + call_args = mock_get.call_args + assert "apiKey" in call_args[1]["headers"] + assert call_args[1]["headers"]["apiKey"] == "test-api-key" + + def test_parse_nvd_vulnerability_complete_data(self): + """Test parsing of complete NVD vulnerability data.""" + nvd_data = { + "descriptions": [ + {"lang": "en", "value": "Critical vulnerability in test component"} + ], + "weaknesses": [ + { + "type": "Primary", + "description": [{"lang": "en", "value": "CWE-79"}] + }, + { + "type": "Secondary", + "description": [{"lang": "en", "value": "CWE-20"}] + } + ], + "references": [ + {"url": "https://example.com/ref1", "source": "vendor", "tags": ["Vendor Advisory"]}, + {"url": "https://example.com/ref2", "source": "mitre", "tags": ["Third Party Advisory"]} + ], + "metrics": { + "cvssMetricV31": [{ + "cvssData": { + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", + "baseScore": 6.1 + } + }] + } + } + + result = _parse_nvd_vulnerability(nvd_data) + + assert result["nvd_description"] == "Critical vulnerability in test component" + assert result["nvd_cwe"] == ["CWE-79"] # Should only include Primary type + assert len(result["nvd_references"]) == 2 + assert result["full_cvss_vector"] == "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + assert result["cvss_score"] == 6.1 + + def test_parse_nvd_vulnerability_minimal_data(self): + """Test parsing of minimal NVD vulnerability data.""" + nvd_data = {} + + result = _parse_nvd_vulnerability(nvd_data) + + assert result["nvd_description"] == "No description available" + assert result["nvd_cwe"] == [] + assert result["nvd_references"] == [] + assert result["full_cvss_vector"] is None + assert result["cvss_score"] is None + + +class TestAlternativeDataSources: + """Test cases for alternative vulnerability data sources.""" + + @patch('workbench_cli.utilities.vulnerability_enricher._fetch_vulners_data') + def test_fetch_alternative_vulnerability_data_vulners_success(self, mock_vulners): + """Test successful fetching from Vulners API.""" + mock_vulners.return_value = { + "nvd_description": "Description from Vulners", + "source": "vulners" + } + + result = _fetch_alternative_vulnerability_data("CVE-2022-12345") + + assert result["nvd_description"] == "Description from Vulners" + assert result["source"] == "vulners" + + @patch('workbench_cli.utilities.vulnerability_enricher._fetch_vulners_data') + def test_fetch_alternative_vulnerability_data_vulners_failure(self, mock_vulners): + """Test handling of Vulners API failure.""" + mock_vulners.side_effect = Exception("Vulners API failed") + + result = _fetch_alternative_vulnerability_data("CVE-2022-12345") + + assert result is None + + @patch('workbench_cli.utilities.vulnerability_enricher.requests.post') + def test_fetch_vulners_data_success(self, mock_post): + """Test successful fetching of data from Vulners API.""" + mock_response = { + "result": "OK", + "data": { + "documents": [{ + "description": "Vulnerability description from Vulners", + "cwe": ["CWE-79", "CWE-20"], + "references": [ + "https://vulners.com/cve/CVE-2022-12345", + "https://example.com/vuln-info" + ], + "cvss": { + "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", + "score": 6.1 + } + }] + } + } + mock_post.return_value.status_code = 200 + mock_post.return_value.json.return_value = mock_response + + result = _fetch_vulners_data("CVE-2022-12345") + + assert result is not None + assert result["nvd_description"] == "Vulnerability description from Vulners" + assert result["nvd_cwe"] == ["CWE-79", "CWE-20"] + assert len(result["nvd_references"]) == 2 + assert result["full_cvss_vector"] == "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + assert result["cvss_score"] == 6.1 + assert result["source"] == "vulners" + + @patch('workbench_cli.utilities.vulnerability_enricher.requests.post') + def test_fetch_vulners_data_failure(self, mock_post): + """Test handling of Vulners API failures.""" + mock_post.return_value.status_code = 500 + + result = _fetch_vulners_data("CVE-2022-12345") + + assert result is None + + @patch('workbench_cli.utilities.vulnerability_enricher.requests.post') + def test_fetch_vulners_data_invalid_response(self, mock_post): + """Test handling of invalid Vulners API response.""" + mock_response = {"result": "ERROR", "message": "Invalid CVE"} + mock_post.return_value.status_code = 200 + mock_post.return_value.json.return_value = mock_response + + result = _fetch_vulners_data("CVE-2022-12345") + + assert result is None + + +class TestRateLimiter: + """Test cases for rate limiter functionality.""" + + def test_rate_limiter_basic_functionality(self): + """Test basic rate limiter functionality.""" + rate_limiter = RateLimiter(max_workers=2, delay=1.0) + + # First call should not wait + start_time = time.time() + rate_limiter.wait() + end_time = time.time() + + assert end_time - start_time < 0.1 # Should be immediate + + # Second call should not wait (within token limit) + start_time = time.time() + rate_limiter.wait() + end_time = time.time() + + assert end_time - start_time < 0.1 # Should be immediate + + def test_rate_limiter_token_exhaustion(self): + """Test rate limiter behavior when tokens are exhausted.""" + rate_limiter = RateLimiter(max_workers=1, delay=0.1) + + # First call should not wait + rate_limiter.wait() + + # Second call should wait since tokens are exhausted + start_time = time.time() + rate_limiter.wait() + end_time = time.time() + + assert end_time - start_time >= 0.09 # Should wait for token replenishment + + def test_rate_limiter_token_replenishment(self): + """Test that tokens are replenished over time.""" + rate_limiter = RateLimiter(max_workers=2, delay=0.1) + + # Exhaust tokens + rate_limiter.wait() + rate_limiter.wait() + + # Wait for token replenishment + time.sleep(0.11) + + # Should be able to make another call without delay + start_time = time.time() + rate_limiter.wait() + end_time = time.time() + + assert end_time - start_time < 0.05 # Should be quick + + def test_rate_limiter_thread_safety(self): + """Test rate limiter thread safety.""" + import threading + + rate_limiter = RateLimiter(max_workers=2, delay=0.1) + results = [] + + def worker(): + start_time = time.time() + rate_limiter.wait() + end_time = time.time() + results.append(end_time - start_time) + + # Start multiple threads + threads = [threading.Thread(target=worker) for _ in range(5)] + for thread in threads: + thread.start() + for thread in threads: + thread.join() + + # Some calls should be immediate, others should wait + assert len(results) == 5 + immediate_calls = sum(1 for r in results if r < 0.05) + delayed_calls = sum(1 for r in results if r >= 0.05) + + assert immediate_calls >= 2 # At least max_workers should be immediate + assert delayed_calls >= 1 # At least one should be delayed \ No newline at end of file diff --git a/vulns-basic.sarif b/vulns-basic.sarif new file mode 100644 index 0000000..3d6a688 --- /dev/null +++ b/vulns-basic.sarif @@ -0,0 +1,4578 @@ +{ + "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", + "version": "2.1.0", + "runs": [ + { + "tool": { + "driver": { + "name": "FossID Workbench", + "version": "1.0.0", + "informationUri": "https://fossid.com/products/workbench/", + "rules": [ + { + "id": "CVE-2017-7375", + "name": "Vulnerability CVE-2017-7375", + "shortDescription": { + "text": "Security vulnerability CVE-2017-7375 (CVSS 9.8)" + }, + "fullDescription": { + "text": "A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).\n\nThis is a n/a severity vulnerability with n/a attack vector and n/a attack complexity. Associated with CWE-611." + }, + "defaultConfiguration": { + "level": "warning" + }, + "properties": { + "security-severity": "9.8", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "base_score": "9.8", + "attack_vector": "N/A", + "attack_complexity": "N/A", + "availability_impact": "N/A", + "severity": "N/A", + "tags": [ + "security", + "vulnerability", + "severity-n/a", + "attack-vector-n/a", + "ecosystem-generic", + "cwe-611" + ], + "epss_score": 0.00393, + "epss_percentile": 0.59617, + "cwe_ids": [ + "CWE-611" + ] + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2017-7375", + "help": { + "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2017-7375. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2017-7375 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** N/A (9.8) \n**EPSS Score:** 0.004 (percentile: 0.59617) \n**CWE:** CWE-611\n\n### Description\nA flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).\n\n### Risk Assessment\n- **Severity:** N/A (9.8)\n- **Exploitation Risk:** Low (EPSS: 0.004)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2017-7375)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7375)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](http://www.securityfocus.com/bid/98877)\n - [cve@mitre.org](http://www.securitytracker.com/id/1038623)\n - [cve@mitre.org](https://android.googlesource.com/platform/external/libxml2/+/308396a55280f69ad4112d4f9892f4cbeff042aa)" + } + }, + { + "id": "CVE-2017-7376", + "name": "Vulnerability CVE-2017-7376", + "shortDescription": { + "text": "Security vulnerability CVE-2017-7376 (CVSS 9.8) [EPSS: 0.395, VEX: exploitable]" + }, + "fullDescription": { + "text": "Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.\n\nThis is a n/a severity vulnerability with n/a attack vector and n/a attack complexity. EPSS score of 0.395 indicates elevated risk of exploitation. Associated with CWE-119. VEX Status: exploitable - requires_environment Response: can_not_fix" + }, + "defaultConfiguration": { + "level": "warning" + }, + "properties": { + "security-severity": "9.8", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "base_score": "9.8", + "attack_vector": "N/A", + "attack_complexity": "N/A", + "availability_impact": "N/A", + "severity": "N/A", + "tags": [ + "security", + "vulnerability", + "severity-n/a", + "attack-vector-n/a", + "ecosystem-generic", + "high-epss", + "cwe-119", + "vex-exploitable" + ], + "epss_score": 0.39544, + "epss_percentile": 0.97149, + "cwe_ids": [ + "CWE-119" + ], + "vex_status": "exploitable", + "vex_justification": "requires_environment", + "vex_response": "can_not_fix", + "vex_details": "unfixable", + "vex_created": "2025-07-03 13:41:07", + "vex_updated": "2025-07-03 15:41:38", + "vex_created_by": "tomas.gonzalez@fossid.com", + "vex_updated_by": "tomas.gonzalez@fossid.com" + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2017-7376", + "help": { + "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2017-7376. HIGH RISK: EPSS score of 0.395 indicates elevated exploitation risk. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2017-7376 (**HIGH RISK**)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** N/A (9.8) \n**EPSS Score:** 0.395 (percentile: 0.97149) \n**CWE:** CWE-119\n\n### VEX Assessment \n**Status:** exploitable \n**Justification:** requires_environment \n**Response:** can_not_fix \n**Details:** unfixable \n**Last Updated:** 2025-07-03 15:41:38 by tomas.gonzalez@fossid.com\n\n### Description\nBuffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.\n\n### Risk Assessment\n- **Severity:** N/A (9.8)\n- **Exploitation Risk:** HIGH (EPSS: 0.395)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2017-7376)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7376)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](http://www.securityfocus.com/bid/98877)\n - [cve@mitre.org](http://www.securitytracker.com/id/1038623)\n - [cve@mitre.org](https://android.googlesource.com/platform/external/libxml2/+/51e0cb2e5ec18eaf6fb331bc573ff27b743898f4)" + } + }, + { + "id": "CVE-2017-15412", + "name": "Vulnerability CVE-2017-15412", + "shortDescription": { + "text": "Security vulnerability CVE-2017-15412 (CVSS 8.8)" + }, + "fullDescription": { + "text": "Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.\n\nThis is a high severity vulnerability with n/a attack vector and n/a attack complexity. Associated with CWE-416." + }, + "defaultConfiguration": { + "level": "error" + }, + "properties": { + "security-severity": "8.8", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "base_score": "8.8", + "attack_vector": "N/A", + "attack_complexity": "N/A", + "availability_impact": "N/A", + "severity": "HIGH", + "tags": [ + "security", + "vulnerability", + "severity-high", + "attack-vector-n/a", + "ecosystem-generic", + "cwe-416" + ], + "epss_score": 0.03481, + "epss_percentile": 0.87129, + "cwe_ids": [ + "CWE-416" + ] + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2017-15412", + "help": { + "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2017-15412. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2017-15412 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** HIGH (8.8) \n**EPSS Score:** 0.035 (percentile: 0.87129) \n**CWE:** CWE-416\n\n### Description\nUse after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.\n\n### Risk Assessment\n- **Severity:** HIGH (8.8)\n- **Exploitation Risk:** Low (EPSS: 0.035)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2017-15412)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15412)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [chrome-cve-admin@google.com](http://www.securitytracker.com/id/1040348)\n - [chrome-cve-admin@google.com](https://access.redhat.com/errata/RHSA-2017:3401)\n - [chrome-cve-admin@google.com](https://access.redhat.com/errata/RHSA-2018:0287)" + } + }, + { + "id": "CVE-2021-3518", + "name": "Vulnerability CVE-2021-3518", + "shortDescription": { + "text": "Security vulnerability CVE-2021-3518 (CVSS 8.8)" + }, + "fullDescription": { + "text": "There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.\n\nThis is a high severity vulnerability with network attack vector and low attack complexity. Associated with CWE-416." + }, + "defaultConfiguration": { + "level": "error" + }, + "properties": { + "security-severity": "8.8", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "base_score": "8.8", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "severity": "HIGH", + "tags": [ + "security", + "vulnerability", + "severity-high", + "attack-vector-network", + "ecosystem-generic", + "cwe-416" + ], + "epss_score": 0.00173, + "epss_percentile": 0.39534, + "cwe_ids": [ + "CWE-416" + ] + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2021-3518", + "help": { + "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2021-3518. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2021-3518 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** HIGH (8.8) \n**EPSS Score:** 0.002 (percentile: 0.39534) \n**CWE:** CWE-416\n\n### Description\nThere's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.\n\n### Risk Assessment\n- **Severity:** HIGH (8.8)\n- **Exploitation Risk:** Low (EPSS: 0.002)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2021-3518)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3518)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [secalert@redhat.com](http://seclists.org/fulldisclosure/2021/Jul/54)\n - [secalert@redhat.com](http://seclists.org/fulldisclosure/2021/Jul/55)\n - [secalert@redhat.com](http://seclists.org/fulldisclosure/2021/Jul/58)" + } + }, + { + "id": "CVE-2017-5130", + "name": "Vulnerability CVE-2017-5130", + "shortDescription": { + "text": "Security vulnerability CVE-2017-5130 (CVSS 8.8)" + }, + "fullDescription": { + "text": "An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted XML file.\n\nThis is a high severity vulnerability with n/a attack vector and n/a attack complexity. Associated with CWE-787." + }, + "defaultConfiguration": { + "level": "error" + }, + "properties": { + "security-severity": "8.8", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "base_score": "8.8", + "attack_vector": "N/A", + "attack_complexity": "N/A", + "availability_impact": "N/A", + "severity": "HIGH", + "tags": [ + "security", + "vulnerability", + "severity-high", + "attack-vector-n/a", + "ecosystem-generic", + "cwe-787" + ], + "epss_score": 0.00905, + "epss_percentile": 0.74841, + "cwe_ids": [ + "CWE-787" + ] + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2017-5130", + "help": { + "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2017-5130. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2017-5130 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** HIGH (8.8) \n**EPSS Score:** 0.009 (percentile: 0.74841) \n**CWE:** CWE-787\n\n### Description\nAn integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted XML file.\n\n### Risk Assessment\n- **Severity:** HIGH (8.8)\n- **Exploitation Risk:** Low (EPSS: 0.009)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2017-5130)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5130)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [chrome-cve-admin@google.com](http://bugzilla.gnome.org/show_bug.cgi?id=783026)\n - [chrome-cve-admin@google.com](http://www.securityfocus.com/bid/101482)\n - [chrome-cve-admin@google.com](https://access.redhat.com/errata/RHSA-2017:2997)" + } + }, + { + "id": "CVE-2021-3517", + "name": "Vulnerability CVE-2021-3517", + "shortDescription": { + "text": "Security vulnerability CVE-2021-3517 (CVSS 8.6)" + }, + "fullDescription": { + "text": "There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.\n\nThis is a high severity vulnerability with network attack vector and low attack complexity. Associated with CWE-787." + }, + "defaultConfiguration": { + "level": "error" + }, + "properties": { + "security-severity": "8.6", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", + "base_score": "8.6", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "severity": "HIGH", + "tags": [ + "security", + "vulnerability", + "severity-high", + "attack-vector-network", + "ecosystem-generic", + "cwe-787" + ], + "epss_score": 0.00071, + "epss_percentile": 0.22309, + "cwe_ids": [ + "CWE-787" + ] + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2021-3517", + "help": { + "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2021-3517. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2021-3517 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** HIGH (8.6) \n**EPSS Score:** 0.001 (percentile: 0.22309) \n**CWE:** CWE-787\n\n### Description\nThere is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.\n\n### Risk Assessment\n- **Severity:** HIGH (8.6)\n- **Exploitation Risk:** Low (EPSS: 0.001)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2021-3517)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3517)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=1954232)\n - [secalert@redhat.com](https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E)\n - [secalert@redhat.com](https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E)" + } + }, + { + "id": "CVE-2022-40304", + "name": "Vulnerability CVE-2022-40304", + "shortDescription": { + "text": "Security vulnerability CVE-2022-40304 (CVSS 7.8)" + }, + "fullDescription": { + "text": "An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.\n\nThis is a high severity vulnerability with local attack vector and low attack complexity. Associated with CWE-415." + }, + "defaultConfiguration": { + "level": "error" + }, + "properties": { + "security-severity": "7.8", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "base_score": "7.8", + "attack_vector": "LOCAL", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "severity": "HIGH", + "tags": [ + "security", + "vulnerability", + "severity-high", + "attack-vector-local", + "ecosystem-generic", + "cwe-415" + ], + "epss_score": 0.00067, + "epss_percentile": 0.21253, + "cwe_ids": [ + "CWE-415" + ] + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2022-40304", + "help": { + "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2022-40304. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2022-40304 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** HIGH (7.8) \n**EPSS Score:** 0.001 (percentile: 0.21253) \n**CWE:** CWE-415\n\n### Description\nAn issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.\n\n### Risk Assessment\n- **Severity:** HIGH (7.8)\n- **Exploitation Risk:** Low (EPSS: 0.001)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2022-40304)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40304)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](http://seclists.org/fulldisclosure/2022/Dec/21)\n - [cve@mitre.org](http://seclists.org/fulldisclosure/2022/Dec/24)\n - [cve@mitre.org](http://seclists.org/fulldisclosure/2022/Dec/25)" + } + }, + { + "id": "CVE-2025-27113", + "name": "Vulnerability CVE-2025-27113", + "shortDescription": { + "text": "Security vulnerability CVE-2025-27113 (CVSS 7.5)" + }, + "fullDescription": { + "text": "libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.\n\nThis is a high severity vulnerability with network attack vector and low attack complexity. Associated with CWE-476." + }, + "defaultConfiguration": { + "level": "error" + }, + "properties": { + "security-severity": "7.5", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", + "base_score": "7.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "severity": "HIGH", + "tags": [ + "security", + "vulnerability", + "severity-high", + "attack-vector-network", + "ecosystem-generic", + "cwe-476" + ], + "epss_score": 0.00069, + "epss_percentile": 0.21588, + "cwe_ids": [ + "CWE-476" + ] + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2025-27113", + "help": { + "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2025-27113. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2025-27113 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** HIGH (7.5) \n**EPSS Score:** 0.001 (percentile: 0.21588) \n**CWE:** CWE-476\n\n### Description\nlibxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.\n\n### Risk Assessment\n- **Severity:** HIGH (7.5)\n- **Exploitation Risk:** Low (EPSS: 0.001)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2025-27113)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27113)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/issues/861)\n - [af854a3a-2127-422b-91ae-364da2661108](https://security.netapp.com/advisory/ntap-20250306-0004/)" + } + }, + { + "id": "CVE-2022-24771", + "name": "Vulnerability CVE-2022-24771", + "shortDescription": { + "text": "Security vulnerability CVE-2022-24771 (CVSS 7.5)" + }, + "fullDescription": { + "text": "Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.\n\nThis is a high severity vulnerability with network attack vector and low attack complexity. Associated with CWE-347." + }, + "defaultConfiguration": { + "level": "error" + }, + "properties": { + "security-severity": "7.5", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", + "base_score": "7.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "NONE", + "severity": "HIGH", + "tags": [ + "security", + "vulnerability", + "severity-high", + "attack-vector-network", + "ecosystem-generic", + "cwe-347" + ], + "epss_score": 0.00106, + "epss_percentile": 0.29681, + "cwe_ids": [ + "CWE-347" + ] + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2022-24771", + "help": { + "text": "The component node-forge version 1.0.0 contains vulnerability CVE-2022-24771. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2022-24771 (Standard)\n\n**Component:** `node-forge` \n**Version:** `1.0.0` \n**Severity:** HIGH (7.5) \n**EPSS Score:** 0.001 (percentile: 0.29681) \n**CWE:** CWE-347\n\n### Description\nForge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.\n\n### Risk Assessment\n- **Severity:** HIGH (7.5)\n- **Exploitation Risk:** Low (EPSS: 0.001)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2022-24771)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24771)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [security-advisories@github.com](https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1)\n - [security-advisories@github.com](https://github.com/digitalbazaar/forge/security/advisories/GHSA-cfm4-qjh2-4765)\n - [af854a3a-2127-422b-91ae-364da2661108](https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1)" + } + }, + { + "id": "CVE-2025-32415", + "name": "Vulnerability CVE-2025-32415", + "shortDescription": { + "text": "Security vulnerability CVE-2025-32415 (CVSS 7.5)" + }, + "fullDescription": { + "text": "In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.\n\nThis is a high severity vulnerability with network attack vector and low attack complexity. Associated with CWE-125." + }, + "defaultConfiguration": { + "level": "error" + }, + "properties": { + "security-severity": "7.5", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", + "base_score": "7.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "severity": "HIGH", + "tags": [ + "security", + "vulnerability", + "severity-high", + "attack-vector-network", + "ecosystem-generic", + "cwe-125" + ], + "epss_score": 0.00027, + "epss_percentile": 0.05708, + "cwe_ids": [ + "CWE-125" + ] + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2025-32415", + "help": { + "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2025-32415. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2025-32415 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** HIGH (7.5) \n**EPSS Score:** 0.000 (percentile: 0.05708) \n**CWE:** CWE-125\n\n### Description\nIn libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.\n\n### Risk Assessment\n- **Severity:** HIGH (7.5)\n- **Exploitation Risk:** Low (EPSS: 0.000)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2025-32415)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32415)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/issues/890)\n - [134c704f-9b21-4f2e-91b3-4a467353bcc0](https://gitlab.gnome.org/GNOME/libxml2/-/issues/890)" + } + }, + { + "id": "CVE-2025-32414", + "name": "Vulnerability CVE-2025-32414", + "shortDescription": { + "text": "Security vulnerability CVE-2025-32414 (CVSS 7.5)" + }, + "fullDescription": { + "text": "In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.\n\nThis is a high severity vulnerability with network attack vector and low attack complexity. Associated with CWE-252." + }, + "defaultConfiguration": { + "level": "error" + }, + "properties": { + "security-severity": "7.5", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L", + "base_score": "7.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "severity": "HIGH", + "tags": [ + "security", + "vulnerability", + "severity-high", + "attack-vector-network", + "ecosystem-generic", + "cwe-252" + ], + "epss_score": 0.00017, + "epss_percentile": 0.02763, + "cwe_ids": [ + "CWE-252" + ] + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2025-32414", + "help": { + "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2025-32414. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2025-32414 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** HIGH (7.5) \n**EPSS Score:** 0.000 (percentile: 0.02763) \n**CWE:** CWE-252\n\n### Description\nIn libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.\n\n### Risk Assessment\n- **Severity:** HIGH (7.5)\n- **Exploitation Risk:** Low (EPSS: 0.000)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2025-32414)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32414)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/issues/889)\n - [134c704f-9b21-4f2e-91b3-4a467353bcc0](https://gitlab.gnome.org/GNOME/libxml2/-/issues/889)" + } + }, + { + "id": "CVE-2024-25062", + "name": "Vulnerability CVE-2024-25062", + "shortDescription": { + "text": "Security vulnerability CVE-2024-25062 (CVSS 7.5)" + }, + "fullDescription": { + "text": "An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.\n\nThis is a high severity vulnerability with network attack vector and low attack complexity. Associated with CWE-416." + }, + "defaultConfiguration": { + "level": "error" + }, + "properties": { + "security-severity": "7.5", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "base_score": "7.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "severity": "HIGH", + "tags": [ + "security", + "vulnerability", + "severity-high", + "attack-vector-network", + "ecosystem-generic", + "cwe-416" + ], + "epss_score": 0.0015, + "epss_percentile": 0.3668, + "cwe_ids": [ + "CWE-416" + ] + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2024-25062", + "help": { + "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2024-25062. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2024-25062 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** HIGH (7.5) \n**EPSS Score:** 0.002 (percentile: 0.3668) \n**CWE:** CWE-416\n\n### Description\nAn issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.\n\n### Risk Assessment\n- **Severity:** HIGH (7.5)\n- **Exploitation Risk:** Low (EPSS: 0.002)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2024-25062)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25062)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/issues/604)\n - [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/tags)\n - [af854a3a-2127-422b-91ae-364da2661108](https://gitlab.gnome.org/GNOME/libxml2/-/issues/604)" + } + }, + { + "id": "CVE-2022-40303", + "name": "Vulnerability CVE-2022-40303", + "shortDescription": { + "text": "Security vulnerability CVE-2022-40303 (CVSS 7.5)" + }, + "fullDescription": { + "text": "An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.\n\nThis is a high severity vulnerability with network attack vector and low attack complexity. Associated with CWE-190." + }, + "defaultConfiguration": { + "level": "error" + }, + "properties": { + "security-severity": "7.5", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "base_score": "7.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "severity": "HIGH", + "tags": [ + "security", + "vulnerability", + "severity-high", + "attack-vector-network", + "ecosystem-generic", + "cwe-190" + ], + "epss_score": 0.00137, + "epss_percentile": 0.34634, + "cwe_ids": [ + "CWE-190" + ] + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2022-40303", + "help": { + "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2022-40303. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2022-40303 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** HIGH (7.5) \n**EPSS Score:** 0.001 (percentile: 0.34634) \n**CWE:** CWE-190\n\n### Description\nAn issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.\n\n### Risk Assessment\n- **Severity:** HIGH (7.5)\n- **Exploitation Risk:** Low (EPSS: 0.001)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2022-40303)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40303)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](http://seclists.org/fulldisclosure/2022/Dec/21)\n - [cve@mitre.org](http://seclists.org/fulldisclosure/2022/Dec/24)\n - [cve@mitre.org](http://seclists.org/fulldisclosure/2022/Dec/25)" + } + }, + { + "id": "CVE-2022-23308", + "name": "Vulnerability CVE-2022-23308", + "shortDescription": { + "text": "Security vulnerability CVE-2022-23308 (CVSS 7.5)" + }, + "fullDescription": { + "text": "valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.\n\nThis is a high severity vulnerability with network attack vector and low attack complexity. Associated with CWE-416." + }, + "defaultConfiguration": { + "level": "error" + }, + "properties": { + "security-severity": "7.5", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "base_score": "7.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "severity": "HIGH", + "tags": [ + "security", + "vulnerability", + "severity-high", + "attack-vector-network", + "ecosystem-generic", + "cwe-416" + ], + "epss_score": 0.00024, + "epss_percentile": 0.04919, + "cwe_ids": [ + "CWE-416" + ] + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2022-23308", + "help": { + "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2022-23308. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2022-23308 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** HIGH (7.5) \n**EPSS Score:** 0.000 (percentile: 0.04919) \n**CWE:** CWE-416\n\n### Description\nvalid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.\n\n### Risk Assessment\n- **Severity:** HIGH (7.5)\n- **Exploitation Risk:** Low (EPSS: 0.000)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2022-23308)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23308)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](http://seclists.org/fulldisclosure/2022/May/33)\n - [cve@mitre.org](http://seclists.org/fulldisclosure/2022/May/34)\n - [cve@mitre.org](http://seclists.org/fulldisclosure/2022/May/35)" + } + }, + { + "id": "CVE-2019-19956", + "name": "Vulnerability CVE-2019-19956", + "shortDescription": { + "text": "Security vulnerability CVE-2019-19956 (CVSS 7.5)" + }, + "fullDescription": { + "text": "xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.\n\nThis is a high severity vulnerability with network attack vector and low attack complexity. Associated with CWE-401." + }, + "defaultConfiguration": { + "level": "error" + }, + "properties": { + "security-severity": "7.5", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "base_score": "7.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "severity": "HIGH", + "tags": [ + "security", + "vulnerability", + "severity-high", + "attack-vector-network", + "ecosystem-generic", + "cwe-401" + ], + "epss_score": 0.00212, + "epss_percentile": 0.44118, + "cwe_ids": [ + "CWE-401" + ] + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2019-19956", + "help": { + "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2019-19956. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2019-19956 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** HIGH (7.5) \n**EPSS Score:** 0.002 (percentile: 0.44118) \n**CWE:** CWE-401\n\n### Description\nxmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.\n\n### Risk Assessment\n- **Severity:** HIGH (7.5)\n- **Exploitation Risk:** Low (EPSS: 0.002)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2019-19956)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19956)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html)\n - [cve@mitre.org](http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00005.html)\n - [cve@mitre.org](https://cert-portal.siemens.com/productcert/pdf/ssa-292794.pdf)" + } + }, + { + "id": "CVE-2018-14404", + "name": "Vulnerability CVE-2018-14404", + "shortDescription": { + "text": "Security vulnerability CVE-2018-14404 (CVSS 7.5) [EPSS: 0.236]" + }, + "fullDescription": { + "text": "A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.\n\nThis is a high severity vulnerability with n/a attack vector and n/a attack complexity. EPSS score of 0.236 indicates elevated risk of exploitation. Associated with CWE-476." + }, + "defaultConfiguration": { + "level": "error" + }, + "properties": { + "security-severity": "7.5", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "base_score": "7.5", + "attack_vector": "N/A", + "attack_complexity": "N/A", + "availability_impact": "N/A", + "severity": "HIGH", + "tags": [ + "security", + "vulnerability", + "severity-high", + "attack-vector-n/a", + "ecosystem-generic", + "high-epss", + "cwe-476" + ], + "epss_score": 0.2363, + "epss_percentile": 0.95747, + "cwe_ids": [ + "CWE-476" + ] + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2018-14404", + "help": { + "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2018-14404. HIGH RISK: EPSS score of 0.236 indicates elevated exploitation risk. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2018-14404 (**HIGH RISK**)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** HIGH (7.5) \n**EPSS Score:** 0.236 (percentile: 0.95747) \n**CWE:** CWE-476\n\n### Description\nA NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.\n\n### Risk Assessment\n- **Severity:** HIGH (7.5)\n- **Exploitation Risk:** HIGH (EPSS: 0.236)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2018-14404)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14404)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](https://access.redhat.com/errata/RHSA-2019:1543)\n - [cve@mitre.org](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817)\n - [cve@mitre.org](https://bugzilla.redhat.com/show_bug.cgi?id=1595985)" + } + }, + { + "id": "CVE-2022-24772", + "name": "Vulnerability CVE-2022-24772", + "shortDescription": { + "text": "Security vulnerability CVE-2022-24772 (CVSS 7.5)" + }, + "fullDescription": { + "text": "Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.\n\nThis is a high severity vulnerability with network attack vector and low attack complexity. Associated with CWE-347." + }, + "defaultConfiguration": { + "level": "error" + }, + "properties": { + "security-severity": "7.5", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", + "base_score": "7.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "NONE", + "severity": "HIGH", + "tags": [ + "security", + "vulnerability", + "severity-high", + "attack-vector-network", + "ecosystem-generic", + "cwe-347" + ], + "epss_score": 0.00116, + "epss_percentile": 0.31427, + "cwe_ids": [ + "CWE-347" + ] + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2022-24772", + "help": { + "text": "The component node-forge version 1.0.0 contains vulnerability CVE-2022-24772. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2022-24772 (Standard)\n\n**Component:** `node-forge` \n**Version:** `1.0.0` \n**Severity:** HIGH (7.5) \n**EPSS Score:** 0.001 (percentile: 0.31427) \n**CWE:** CWE-347\n\n### Description\nForge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.\n\n### Risk Assessment\n- **Severity:** HIGH (7.5)\n- **Exploitation Risk:** Low (EPSS: 0.001)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2022-24772)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24772)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [security-advisories@github.com](https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1)\n - [security-advisories@github.com](https://github.com/digitalbazaar/forge/commit/bb822c02df0b61211836472e29b9790cc541cdb2)\n - [security-advisories@github.com](https://github.com/digitalbazaar/forge/security/advisories/GHSA-x4jg-mjrx-434g)" + } + }, + { + "id": "CVE-2022-48285", + "name": "Vulnerability CVE-2022-48285", + "shortDescription": { + "text": "Security vulnerability CVE-2022-48285 (CVSS 7.3)" + }, + "fullDescription": { + "text": "loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.\n\nThis is a high severity vulnerability with network attack vector and low attack complexity. Associated with CWE-22." + }, + "defaultConfiguration": { + "level": "error" + }, + "properties": { + "security-severity": "7.3", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", + "base_score": "7.3", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "LOW", + "severity": "HIGH", + "tags": [ + "security", + "vulnerability", + "severity-high", + "attack-vector-network", + "ecosystem-generic", + "cwe-22" + ], + "epss_score": 0.00419, + "epss_percentile": 0.61148, + "cwe_ids": [ + "CWE-22" + ] + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2022-48285", + "help": { + "text": "The component jszip version 2.6.0 contains vulnerability CVE-2022-48285. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2022-48285 (Standard)\n\n**Component:** `jszip` \n**Version:** `2.6.0` \n**Severity:** HIGH (7.3) \n**EPSS Score:** 0.004 (percentile: 0.61148) \n**CWE:** CWE-22\n\n### Description\nloadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.\n\n### Risk Assessment\n- **Severity:** HIGH (7.3)\n- **Exploitation Risk:** Low (EPSS: 0.004)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2022-48285)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48285)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](https://exchange.xforce.ibmcloud.com/vulnerabilities/244499)\n - [cve@mitre.org](https://github.com/Stuk/jszip/commit/2edab366119c9ee948357c02f1206c28566cdf15)\n - [cve@mitre.org](https://github.com/Stuk/jszip/compare/v3.7.1...v3.8.0)" + } + }, + { + "id": "CVE-2017-18258", + "name": "Vulnerability CVE-2017-18258", + "shortDescription": { + "text": "Security vulnerability CVE-2017-18258 (CVSS 6.5)" + }, + "fullDescription": { + "text": "The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.\n\nThis is a medium severity vulnerability with n/a attack vector and n/a attack complexity. Associated with CWE-770." + }, + "defaultConfiguration": { + "level": "warning" + }, + "properties": { + "security-severity": "6.5", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "base_score": "6.5", + "attack_vector": "N/A", + "attack_complexity": "N/A", + "availability_impact": "N/A", + "severity": "MEDIUM", + "tags": [ + "security", + "vulnerability", + "severity-medium", + "attack-vector-n/a", + "ecosystem-generic", + "cwe-770" + ], + "epss_score": 0.00724, + "epss_percentile": 0.71711, + "cwe_ids": [ + "CWE-770" + ] + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2017-18258", + "help": { + "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2017-18258. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2017-18258 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** MEDIUM (6.5) \n**EPSS Score:** 0.007 (percentile: 0.71711) \n**CWE:** CWE-770\n\n### Description\nThe xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.\n\n### Risk Assessment\n- **Severity:** MEDIUM (6.5)\n- **Exploitation Risk:** Low (EPSS: 0.007)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2017-18258)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18258)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](https://git.gnome.org/browse/libxml2/commit/?id=e2a9122b8dde53d320750451e9907a7dcb2ca8bb)\n - [cve@mitre.org](https://kc.mcafee.com/corporate/index?page=content&id=SB10284)\n - [cve@mitre.org](https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html)" + } + }, + { + "id": "CVE-2021-3541", + "name": "Vulnerability CVE-2021-3541", + "shortDescription": { + "text": "Security vulnerability CVE-2021-3541 (CVSS 6.5)" + }, + "fullDescription": { + "text": "A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.\n\nThis is a medium severity vulnerability with network attack vector and low attack complexity. Associated with CWE-776." + }, + "defaultConfiguration": { + "level": "warning" + }, + "properties": { + "security-severity": "6.5", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", + "base_score": "6.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "severity": "MEDIUM", + "tags": [ + "security", + "vulnerability", + "severity-medium", + "attack-vector-network", + "ecosystem-generic", + "cwe-776" + ], + "epss_score": 0.0006, + "epss_percentile": 0.18929, + "cwe_ids": [ + "CWE-776" + ] + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2021-3541", + "help": { + "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2021-3541. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2021-3541 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** MEDIUM (6.5) \n**EPSS Score:** 0.001 (percentile: 0.18929) \n**CWE:** CWE-776\n\n### Description\nA flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.\n\n### Risk Assessment\n- **Severity:** MEDIUM (6.5)\n- **Exploitation Risk:** Low (EPSS: 0.001)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2021-3541)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3541)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=1950515)\n - [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20210805-0007/)\n - [secalert@redhat.com](https://www.oracle.com/security-alerts/cpujan2022.html)" + } + }, + { + "id": "CVE-2016-9598", + "name": "Vulnerability CVE-2016-9598", + "shortDescription": { + "text": "Security vulnerability CVE-2016-9598 (CVSS 6.5)" + }, + "fullDescription": { + "text": "libxml2, as used in Red Hat JBoss Core Services, allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted XML document. NOTE: this vulnerability exists because of a missing fix for CVE-2016-4483.\n\nThis is a medium severity vulnerability with network attack vector and low attack complexity. Associated with CWE-125." + }, + "defaultConfiguration": { + "level": "warning" + }, + "properties": { + "security-severity": "6.5", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "base_score": "6.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "severity": "MEDIUM", + "tags": [ + "security", + "vulnerability", + "severity-medium", + "attack-vector-network", + "ecosystem-generic", + "cwe-125" + ], + "epss_score": 0.00673, + "epss_percentile": 0.70578, + "cwe_ids": [ + "CWE-125" + ] + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2016-9598", + "help": { + "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2016-9598. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2016-9598 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** MEDIUM (6.5) \n**EPSS Score:** 0.007 (percentile: 0.70578) \n**CWE:** CWE-125\n\n### Description\nlibxml2, as used in Red Hat JBoss Core Services, allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted XML document. NOTE: this vulnerability exists because of a missing fix for CVE-2016-4483.\n\n### Risk Assessment\n- **Severity:** MEDIUM (6.5)\n- **Exploitation Risk:** Low (EPSS: 0.007)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2016-9598)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9598)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [secalert@redhat.com](https://access.redhat.com/errata/RHSA-2018:2486)\n - [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=1408306)\n - [af854a3a-2127-422b-91ae-364da2661108](https://access.redhat.com/errata/RHSA-2018:2486)" + } + }, + { + "id": "CVE-2022-29824", + "name": "Vulnerability CVE-2022-29824", + "shortDescription": { + "text": "Security vulnerability CVE-2022-29824 (CVSS 6.5)" + }, + "fullDescription": { + "text": "In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.\n\nThis is a medium severity vulnerability with network attack vector and low attack complexity. Associated with CWE-190." + }, + "defaultConfiguration": { + "level": "warning" + }, + "properties": { + "security-severity": "6.5", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "base_score": "6.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "severity": "MEDIUM", + "tags": [ + "security", + "vulnerability", + "severity-medium", + "attack-vector-network", + "ecosystem-generic", + "cwe-190" + ], + "epss_score": 0.00041, + "epss_percentile": 0.11669, + "cwe_ids": [ + "CWE-190" + ] + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2022-29824", + "help": { + "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2022-29824. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2022-29824 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** MEDIUM (6.5) \n**EPSS Score:** 0.000 (percentile: 0.11669) \n**CWE:** CWE-190\n\n### Description\nIn libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.\n\n### Risk Assessment\n- **Severity:** MEDIUM (6.5)\n- **Exploitation Risk:** Low (EPSS: 0.000)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2022-29824)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29824)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](http://packetstormsecurity.com/files/167345/libxml2-xmlBufAdd-Heap-Buffer-Overflow.html)\n - [cve@mitre.org](http://packetstormsecurity.com/files/169825/libxml2-xmlParseNameComplex-Integer-Overflow.html)\n - [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/commit/2554a2408e09f13652049e5ffb0d26196b02ebab)" + } + }, + { + "id": "CVE-2016-9596", + "name": "Vulnerability CVE-2016-9596", + "shortDescription": { + "text": "Security vulnerability CVE-2016-9596 (CVSS 6.5)" + }, + "fullDescription": { + "text": "libxml2, as used in Red Hat JBoss Core Services and when in recovery mode, allows context-dependent attackers to cause a denial of service (stack consumption) via a crafted XML document. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-3627.\n\nThis is a medium severity vulnerability with network attack vector and low attack complexity. Associated with CWE-400." + }, + "defaultConfiguration": { + "level": "warning" + }, + "properties": { + "security-severity": "6.5", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "base_score": "6.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "severity": "MEDIUM", + "tags": [ + "security", + "vulnerability", + "severity-medium", + "attack-vector-network", + "ecosystem-generic", + "cwe-400" + ], + "epss_score": 0.00673, + "epss_percentile": 0.70578, + "cwe_ids": [ + "CWE-400" + ] + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2016-9596", + "help": { + "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2016-9596. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2016-9596 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** MEDIUM (6.5) \n**EPSS Score:** 0.007 (percentile: 0.70578) \n**CWE:** CWE-400\n\n### Description\nlibxml2, as used in Red Hat JBoss Core Services and when in recovery mode, allows context-dependent attackers to cause a denial of service (stack consumption) via a crafted XML document. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-3627.\n\n### Risk Assessment\n- **Severity:** MEDIUM (6.5)\n- **Exploitation Risk:** Low (EPSS: 0.007)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2016-9596)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9596)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=1408302)\n - [af854a3a-2127-422b-91ae-364da2661108](https://bugzilla.redhat.com/show_bug.cgi?id=1408302)" + } + }, + { + "id": "CVE-2023-28484", + "name": "Vulnerability CVE-2023-28484", + "shortDescription": { + "text": "Security vulnerability CVE-2023-28484 (CVSS 6.5)" + }, + "fullDescription": { + "text": "In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c.\n\nThis is a medium severity vulnerability with network attack vector and low attack complexity. Associated with CWE-476." + }, + "defaultConfiguration": { + "level": "warning" + }, + "properties": { + "security-severity": "6.5", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "base_score": "6.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "severity": "MEDIUM", + "tags": [ + "security", + "vulnerability", + "severity-medium", + "attack-vector-network", + "ecosystem-generic", + "cwe-476" + ], + "epss_score": 0.00263, + "epss_percentile": 0.49636, + "cwe_ids": [ + "CWE-476" + ] + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2023-28484", + "help": { + "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2023-28484. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2023-28484 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** MEDIUM (6.5) \n**EPSS Score:** 0.003 (percentile: 0.49636) \n**CWE:** CWE-476\n\n### Description\nIn libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c.\n\n### Risk Assessment\n- **Severity:** MEDIUM (6.5)\n- **Exploitation Risk:** Low (EPSS: 0.003)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2023-28484)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28484)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/issues/491)\n - [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4)\n - [cve@mitre.org](https://lists.debian.org/debian-lts-announce/2023/04/msg00031.html)" + } + }, + { + "id": "CVE-2023-29469", + "name": "Vulnerability CVE-2023-29469", + "shortDescription": { + "text": "Security vulnerability CVE-2023-29469 (CVSS 6.5) [VEX: not_affected]" + }, + "fullDescription": { + "text": "An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\\0' value).\n\nThis is a medium severity vulnerability with network attack vector and low attack complexity. Associated with CWE-415. VEX Status: not_affected - protected_at_runtime Response: will_not_fix" + }, + "defaultConfiguration": { + "level": "warning" + }, + "properties": { + "security-severity": "6.5", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "base_score": "6.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "severity": "MEDIUM", + "tags": [ + "security", + "vulnerability", + "severity-medium", + "attack-vector-network", + "ecosystem-generic", + "cwe-415", + "vex-not_affected", + "vex-resolved" + ], + "epss_score": 0.00054, + "epss_percentile": 0.16808, + "cwe_ids": [ + "CWE-415" + ], + "vex_status": "not_affected", + "vex_justification": "protected_at_runtime", + "vex_response": "will_not_fix", + "vex_created": "2025-07-03 13:50:08", + "vex_updated": "2025-07-03 15:50:16", + "vex_created_by": "tomas.gonzalez@fossid.com", + "vex_updated_by": "tomas.gonzalez@fossid.com" + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2023-29469", + "help": { + "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2023-29469. VEX Assessment: Component is not affected by this vulnerability. Verify that the VEX assessment is current and accurate. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2023-29469 (**MITIGATED**)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** MEDIUM (6.5) \n**EPSS Score:** 0.001 (percentile: 0.16808) \n**CWE:** CWE-415\n\n### VEX Assessment \n**Status:** not_affected \n**Justification:** protected_at_runtime \n**Response:** will_not_fix \n**Last Updated:** 2025-07-03 15:50:16 by tomas.gonzalez@fossid.com\n\n### Description\nAn issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\\0' value).\n\n### Risk Assessment\n- **Severity:** MEDIUM (6.5)\n- **Exploitation Risk:** Low (EPSS: 0.001)\n- **VEX Assessment:** NOT AFFECTED - This component is not impacted by this vulnerability\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n**Note:** VEX assessment indicates this vulnerability is not affected. Verify that assessment is current and accurate.\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2023-29469)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29469)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/issues/510)\n - [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4)\n - [cve@mitre.org](https://lists.debian.org/debian-lts-announce/2023/04/msg00031.html)" + } + }, + { + "id": "CVE-2023-45322", + "name": "Vulnerability CVE-2023-45322", + "shortDescription": { + "text": "Security vulnerability CVE-2023-45322 (CVSS 6.5) [VEX: false_positive]" + }, + "fullDescription": { + "text": "libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is \"I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail.\"\n\nThis is a medium severity vulnerability with network attack vector and low attack complexity. Associated with CWE-416. VEX Status: false_positive - code_not_present Response: will_not_fix" + }, + "defaultConfiguration": { + "level": "warning" + }, + "properties": { + "security-severity": "6.5", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "base_score": "6.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "severity": "MEDIUM", + "tags": [ + "security", + "vulnerability", + "severity-medium", + "attack-vector-network", + "ecosystem-generic", + "cwe-416", + "vex-false_positive", + "vex-false-positive" + ], + "epss_score": 0.00076, + "epss_percentile": 0.23725, + "cwe_ids": [ + "CWE-416" + ], + "vex_status": "false_positive", + "vex_justification": "code_not_present", + "vex_response": "will_not_fix", + "vex_created": "2025-07-03 13:49:53", + "vex_updated": "2025-07-03 15:50:05", + "vex_created_by": "tomas.gonzalez@fossid.com", + "vex_updated_by": "tomas.gonzalez@fossid.com" + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2023-45322", + "help": { + "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2023-45322. VEX Assessment: This vulnerability is a false positive. Verify that the false positive assessment is accurate and documented. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2023-45322 (**FALSE POSITIVE**)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** MEDIUM (6.5) \n**EPSS Score:** 0.001 (percentile: 0.23725) \n**CWE:** CWE-416\n\n### VEX Assessment \n**Status:** false_positive \n**Justification:** code_not_present \n**Response:** will_not_fix \n**Last Updated:** 2025-07-03 15:50:05 by tomas.gonzalez@fossid.com\n\n### Description\nlibxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is \"I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail.\"\n\n### Risk Assessment\n- **Severity:** MEDIUM (6.5)\n- **Exploitation Risk:** Low (EPSS: 0.001)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2023-45322)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45322)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](http://www.openwall.com/lists/oss-security/2023/10/06/5)\n - [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/issues/344)\n - [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/issues/583)" + } + }, + { + "id": "CVE-2016-3709", + "name": "Vulnerability CVE-2016-3709", + "shortDescription": { + "text": "Security vulnerability CVE-2016-3709 (CVSS 6.1) [VEX: in_triage]" + }, + "fullDescription": { + "text": "Possible cross-site scripting vulnerability in libxml after commit 960f0e2.\n\nThis is a medium severity vulnerability with network attack vector and low attack complexity. Associated with CWE-79. VEX Status: in_triage" + }, + "defaultConfiguration": { + "level": "warning" + }, + "properties": { + "security-severity": "6.1", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", + "base_score": "6.1", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "NONE", + "severity": "MEDIUM", + "tags": [ + "security", + "vulnerability", + "severity-medium", + "attack-vector-network", + "ecosystem-generic", + "cwe-79", + "vex-in_triage", + "vex-investigating" + ], + "epss_score": 0.00098, + "epss_percentile": 0.28367, + "cwe_ids": [ + "CWE-79" + ], + "vex_status": "in_triage", + "vex_created": "2025-07-03 13:49:47", + "vex_updated": "2025-07-03 15:49:47", + "vex_created_by": "tomas.gonzalez@fossid.com", + "vex_updated_by": "tomas.gonzalez@fossid.com" + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2016-3709", + "help": { + "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2016-3709. VEX Assessment: Impact is currently being evaluated. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2016-3709 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** MEDIUM (6.1) \n**EPSS Score:** 0.001 (percentile: 0.28367) \n**CWE:** CWE-79\n\n### VEX Assessment \n**Status:** in_triage \n**Last Updated:** 2025-07-03 15:49:47 by tomas.gonzalez@fossid.com\n\n### Description\nPossible cross-site scripting vulnerability in libxml after commit 960f0e2.\n\n### Risk Assessment\n- **Severity:** MEDIUM (6.1)\n- **Exploitation Risk:** Low (EPSS: 0.001)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2016-3709)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3709)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [secalert@redhat.com](https://mail.gnome.org/archives/xml/2018-January/msg00010.html)\n - [af854a3a-2127-422b-91ae-364da2661108](https://mail.gnome.org/archives/xml/2018-January/msg00010.html)" + } + }, + { + "id": "CVE-2021-3537", + "name": "Vulnerability CVE-2021-3537", + "shortDescription": { + "text": "Security vulnerability CVE-2021-3537 (CVSS 5.9) [VEX: resolved]" + }, + "fullDescription": { + "text": "A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.\n\nThis is a medium severity vulnerability with network attack vector and high attack complexity. Associated with CWE-476. VEX Status: resolved - code_not_present Response: update,will_not_fix" + }, + "defaultConfiguration": { + "level": "warning" + }, + "properties": { + "security-severity": "5.9", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", + "base_score": "5.9", + "attack_vector": "NETWORK", + "attack_complexity": "HIGH", + "availability_impact": "HIGH", + "severity": "MEDIUM", + "tags": [ + "security", + "vulnerability", + "severity-medium", + "attack-vector-network", + "ecosystem-generic", + "cwe-476", + "vex-resolved", + "vex-resolved" + ], + "epss_score": 0.00127, + "epss_percentile": 0.33184, + "cwe_ids": [ + "CWE-476" + ], + "vex_status": "resolved", + "vex_justification": "code_not_present", + "vex_response": "update,will_not_fix", + "vex_created": "2025-07-03 13:49:22", + "vex_updated": "2025-07-03 15:49:44", + "vex_created_by": "tomas.gonzalez@fossid.com", + "vex_updated_by": "tomas.gonzalez@fossid.com" + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2021-3537", + "help": { + "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2021-3537. VEX Assessment: This vulnerability has been resolved. Verify that the resolution is complete and effective. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2021-3537 (**MITIGATED**)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** MEDIUM (5.9) \n**EPSS Score:** 0.001 (percentile: 0.33184) \n**CWE:** CWE-476\n\n### VEX Assessment \n**Status:** resolved \n**Justification:** code_not_present \n**Response:** update,will_not_fix \n**Last Updated:** 2025-07-03 15:49:44 by tomas.gonzalez@fossid.com\n\n### Description\nA vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.\n\n### Risk Assessment\n- **Severity:** MEDIUM (5.9)\n- **Exploitation Risk:** Low (EPSS: 0.001)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2021-3537)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3537)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=1956522)\n - [secalert@redhat.com](https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html)\n - [secalert@redhat.com](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/)" + } + }, + { + "id": "CVE-2021-23413", + "name": "Vulnerability CVE-2021-23413", + "shortDescription": { + "text": "Security vulnerability CVE-2021-23413 (CVSS 5.3) [VEX: in_triage]" + }, + "fullDescription": { + "text": "This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance.\n\nThis is a medium severity vulnerability with network attack vector and low attack complexity. Associated with NVD-CWE-noinfo. VEX Status: in_triage" + }, + "defaultConfiguration": { + "level": "warning" + }, + "properties": { + "security-severity": "5.3", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", + "base_score": "5.3", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "LOW", + "severity": "MEDIUM", + "tags": [ + "security", + "vulnerability", + "severity-medium", + "attack-vector-network", + "ecosystem-generic", + "vex-in_triage", + "vex-investigating" + ], + "epss_score": 0.00079, + "epss_percentile": 0.24344, + "cwe_ids": [ + "NVD-CWE-noinfo" + ], + "vex_status": "in_triage", + "vex_created": "2025-07-03 13:49:13", + "vex_updated": "2025-07-03 15:49:13", + "vex_created_by": "tomas.gonzalez@fossid.com", + "vex_updated_by": "tomas.gonzalez@fossid.com" + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2021-23413", + "help": { + "text": "The component jszip version 2.6.0 contains vulnerability CVE-2021-23413. VEX Assessment: Impact is currently being evaluated. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2021-23413 (Standard)\n\n**Component:** `jszip` \n**Version:** `2.6.0` \n**Severity:** MEDIUM (5.3) \n**EPSS Score:** 0.001 (percentile: 0.24344) \n**CWE:** NVD-CWE-noinfo\n\n### VEX Assessment \n**Status:** in_triage \n**Last Updated:** 2025-07-03 15:49:13 by tomas.gonzalez@fossid.com\n\n### Description\nThis affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance.\n\n### Risk Assessment\n- **Severity:** MEDIUM (5.3)\n- **Exploitation Risk:** Low (EPSS: 0.001)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2021-23413)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23413)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [report@snyk.io](https://github.com/Stuk/jszip/blob/master/lib/object.js%23L88)\n - [report@snyk.io](https://github.com/Stuk/jszip/commit/22357494f424178cb416cdb7d93b26dd4f824b36)\n - [report@snyk.io](https://github.com/Stuk/jszip/pull/766)" + } + }, + { + "id": "CVE-2022-24773", + "name": "Vulnerability CVE-2022-24773", + "shortDescription": { + "text": "Security vulnerability CVE-2022-24773 (CVSS 5.3)" + }, + "fullDescription": { + "text": "Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check `DigestInfo` for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.\n\nThis is a medium severity vulnerability with network attack vector and low attack complexity. Associated with CWE-347." + }, + "defaultConfiguration": { + "level": "warning" + }, + "properties": { + "security-severity": "5.3", + "cvss_version": "3.1", + "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", + "base_score": "5.3", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "NONE", + "severity": "MEDIUM", + "tags": [ + "security", + "vulnerability", + "severity-medium", + "attack-vector-network", + "ecosystem-generic", + "cwe-347" + ], + "epss_score": 0.0006, + "epss_percentile": 0.19137, + "cwe_ids": [ + "CWE-347" + ] + }, + "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2022-24773", + "help": { + "text": "The component node-forge version 1.0.0 contains vulnerability CVE-2022-24773. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", + "markdown": "## Vulnerability: CVE-2022-24773 (Standard)\n\n**Component:** `node-forge` \n**Version:** `1.0.0` \n**Severity:** MEDIUM (5.3) \n**EPSS Score:** 0.001 (percentile: 0.19137) \n**CWE:** CWE-347\n\n### Description\nForge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check `DigestInfo` for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.\n\n### Risk Assessment\n- **Severity:** MEDIUM (5.3)\n- **Exploitation Risk:** Low (EPSS: 0.001)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2022-24773)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24773)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [security-advisories@github.com](https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1)\n - [security-advisories@github.com](https://github.com/digitalbazaar/forge/commit/bb822c02df0b61211836472e29b9790cc541cdb2)\n - [security-advisories@github.com](https://github.com/digitalbazaar/forge/security/advisories/GHSA-2r2c-g63r-vccr)" + } + } + ], + "notifications": [ + { + "level": "warning", + "message": { + "text": "🔍 HIGH RISK: 2 vulnerabilities have elevated EPSS exploitation probability scores (>0.1)" + }, + "properties": { + "high_epss_count": 2, + "category": "security", + "priority": "high" + } + }, + { + "level": "note", + "message": { + "text": "✅ VEX ASSESSMENTS: 3 vulnerabilities have been assessed and suppressed based on organizational VEX statements" + }, + "properties": { + "vex_suppressed_count": 3, + "category": "assessment", + "priority": "info" + } + } + ] + } + }, + "results": [ + { + "ruleId": "CVE-2017-7375", + "level": "warning", + "message": { + "text": "Found n/a severity vulnerability CVE-2017-7375 (CVSS 9.8) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Vulnerable component: libxml2 version 2.9.2-rc1" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "libxml2@2.9.2-rc1" + } + } + }, + "logicalLocations": [ + { + "name": "libxml2", + "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 14352, + "cvss_version": "3.1", + "base_score": "9.8", + "attack_vector": "N/A", + "attack_complexity": "N/A", + "availability_impact": "N/A", + "rejected": 0, + "component_id": 12, + "ecosystem": "generic", + "package_url": "pkg:generic/libxml2@2.9.2-rc1", + "scan_id": 772, + "original_level": "warning", + "security-severity": "9.8", + "precision": "medium", + "kind": "review", + "rank": 98.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2017-7375" + ], + "component": [ + "libxml2@2.9.2-rc1" + ], + "severity": [ + "n/a" + ] + }, + "epss_score": 0.00393, + "epss_percentile": 0.59617, + "cwe_ids": [ + "CWE-611" + ] + }, + "fixes": [ + { + "description": { + "text": "Update libxml2 to a version that fixes CVE-2017-7375 - STANDARD priority" + }, + "properties": { + "urgency": "standard", + "guidance": "Check for newer versions of this component that address the vulnerability", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.00393 + } + } + ], + "fingerprints": { + "workbench/component": "libxml2@2.9.2-rc1", + "workbench/vulnerability": "CVE-2017-7375#14352", + "primary": "libxml2@2.9.2-rc1#CVE-2017-7375", + "stable": "CVE-2017-7375" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Component manifest for libxml2" + } + } + }, + "message": { + "text": "Component libxml2 version 2.9.2-rc1" + } + } + ] + }, + { + "ruleId": "CVE-2017-7376", + "level": "warning", + "message": { + "text": "Found n/a severity vulnerability CVE-2017-7376 (CVSS 9.8) in component libxml2 version 2.9.2-rc1. ⚠️ High EPSS score: 0.395. VEX Status: exploitable. Justification: requires_environment This vulnerability should be addressed by updating to a patched version." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Vulnerable component: libxml2 version 2.9.2-rc1" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "libxml2@2.9.2-rc1" + } + } + }, + "logicalLocations": [ + { + "name": "libxml2", + "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 14353, + "cvss_version": "3.1", + "base_score": "9.8", + "attack_vector": "N/A", + "attack_complexity": "N/A", + "availability_impact": "N/A", + "rejected": 0, + "component_id": 12, + "ecosystem": "generic", + "package_url": "pkg:generic/libxml2@2.9.2-rc1", + "scan_id": 772, + "original_level": "warning", + "security-severity": "9.8", + "precision": "high", + "kind": "review", + "rank": 100.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2017-7376" + ], + "component": [ + "libxml2@2.9.2-rc1" + ], + "severity": [ + "n/a" + ] + }, + "epss_score": 0.39544, + "epss_percentile": 0.97149, + "cwe_ids": [ + "CWE-119" + ], + "vex_status": "exploitable", + "vex_justification": "requires_environment", + "vex_response": "can_not_fix", + "vex_details": "unfixable", + "vex_created": "2025-07-03 13:41:07", + "vex_updated": "2025-07-03 15:41:38", + "vex_created_by": "tomas.gonzalez@fossid.com", + "vex_updated_by": "tomas.gonzalez@fossid.com" + }, + "fixes": [ + { + "description": { + "text": "Update libxml2 to a version that fixes CVE-2017-7376 - HIGH priority" + }, + "properties": { + "urgency": "high", + "guidance": "Check for newer versions of this component that address the vulnerability", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.39544, + "vex_status": "exploitable", + "vex_justification": "requires_environment", + "vex_response": "can_not_fix", + "vex_details": "unfixable", + "vex_created": "2025-07-03 13:41:07", + "vex_updated": "2025-07-03 15:41:38", + "vex_created_by": "tomas.gonzalez@fossid.com", + "vex_updated_by": "tomas.gonzalez@fossid.com" + } + } + ], + "fingerprints": { + "workbench/component": "libxml2@2.9.2-rc1", + "workbench/vulnerability": "CVE-2017-7376#14353", + "primary": "libxml2@2.9.2-rc1#CVE-2017-7376", + "stable": "CVE-2017-7376" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Component manifest for libxml2" + } + } + }, + "message": { + "text": "Component libxml2 version 2.9.2-rc1" + } + } + ] + }, + { + "ruleId": "CVE-2017-15412", + "level": "error", + "message": { + "text": "Found high severity vulnerability CVE-2017-15412 (CVSS 8.8) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Vulnerable component: libxml2 version 2.9.2-rc1" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "libxml2@2.9.2-rc1" + } + } + }, + "logicalLocations": [ + { + "name": "libxml2", + "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 14349, + "cvss_version": "3.1", + "base_score": "8.8", + "attack_vector": "N/A", + "attack_complexity": "N/A", + "availability_impact": "N/A", + "rejected": 0, + "component_id": 12, + "ecosystem": "generic", + "package_url": "pkg:generic/libxml2@2.9.2-rc1", + "scan_id": 772, + "original_level": "error", + "security-severity": "8.8", + "precision": "medium", + "kind": "review", + "rank": 93.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2017-15412" + ], + "component": [ + "libxml2@2.9.2-rc1" + ], + "severity": [ + "high" + ] + }, + "epss_score": 0.03481, + "epss_percentile": 0.87129, + "cwe_ids": [ + "CWE-416" + ] + }, + "fixes": [ + { + "description": { + "text": "Update libxml2 to a version that fixes CVE-2017-15412 - STANDARD priority" + }, + "properties": { + "urgency": "standard", + "guidance": "Check for newer versions of this component that address the vulnerability", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.03481 + } + } + ], + "fingerprints": { + "workbench/component": "libxml2@2.9.2-rc1", + "workbench/vulnerability": "CVE-2017-15412#14349", + "primary": "libxml2@2.9.2-rc1#CVE-2017-15412", + "stable": "CVE-2017-15412" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Component manifest for libxml2" + } + } + }, + "message": { + "text": "Component libxml2 version 2.9.2-rc1" + } + } + ] + }, + { + "ruleId": "CVE-2021-3518", + "level": "error", + "message": { + "text": "Found high severity vulnerability CVE-2021-3518 (CVSS 8.8) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Vulnerable component: libxml2 version 2.9.2-rc1" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "libxml2@2.9.2-rc1" + } + } + }, + "logicalLocations": [ + { + "name": "libxml2", + "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 48, + "cvss_version": "3.1", + "base_score": "8.8", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "ecosystem": "generic", + "package_url": "pkg:generic/libxml2@2.9.2-rc1", + "scan_id": 772, + "original_level": "error", + "security-severity": "8.8", + "precision": "medium", + "kind": "review", + "rank": 88.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2021-3518" + ], + "component": [ + "libxml2@2.9.2-rc1" + ], + "severity": [ + "high" + ] + }, + "epss_score": 0.00173, + "epss_percentile": 0.39534, + "cwe_ids": [ + "CWE-416" + ] + }, + "fixes": [ + { + "description": { + "text": "Update libxml2 to a version that fixes CVE-2021-3518 - STANDARD priority" + }, + "properties": { + "urgency": "standard", + "guidance": "Check for newer versions of this component that address the vulnerability", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.00173 + } + } + ], + "fingerprints": { + "workbench/component": "libxml2@2.9.2-rc1", + "workbench/vulnerability": "CVE-2021-3518#48", + "primary": "libxml2@2.9.2-rc1#CVE-2021-3518", + "stable": "CVE-2021-3518" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Component manifest for libxml2" + } + } + }, + "message": { + "text": "Component libxml2 version 2.9.2-rc1" + } + } + ] + }, + { + "ruleId": "CVE-2017-5130", + "level": "error", + "message": { + "text": "Found high severity vulnerability CVE-2017-5130 (CVSS 8.8) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Vulnerable component: libxml2 version 2.9.2-rc1" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "libxml2@2.9.2-rc1" + } + } + }, + "logicalLocations": [ + { + "name": "libxml2", + "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 14351, + "cvss_version": "3.1", + "base_score": "8.8", + "attack_vector": "N/A", + "attack_complexity": "N/A", + "availability_impact": "N/A", + "rejected": 0, + "component_id": 12, + "ecosystem": "generic", + "package_url": "pkg:generic/libxml2@2.9.2-rc1", + "scan_id": 772, + "original_level": "error", + "security-severity": "8.8", + "precision": "medium", + "kind": "review", + "rank": 88.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2017-5130" + ], + "component": [ + "libxml2@2.9.2-rc1" + ], + "severity": [ + "high" + ] + }, + "epss_score": 0.00905, + "epss_percentile": 0.74841, + "cwe_ids": [ + "CWE-787" + ] + }, + "fixes": [ + { + "description": { + "text": "Update libxml2 to a version that fixes CVE-2017-5130 - STANDARD priority" + }, + "properties": { + "urgency": "standard", + "guidance": "Check for newer versions of this component that address the vulnerability", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.00905 + } + } + ], + "fingerprints": { + "workbench/component": "libxml2@2.9.2-rc1", + "workbench/vulnerability": "CVE-2017-5130#14351", + "primary": "libxml2@2.9.2-rc1#CVE-2017-5130", + "stable": "CVE-2017-5130" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Component manifest for libxml2" + } + } + }, + "message": { + "text": "Component libxml2 version 2.9.2-rc1" + } + } + ] + }, + { + "ruleId": "CVE-2021-3517", + "level": "error", + "message": { + "text": "Found high severity vulnerability CVE-2021-3517 (CVSS 8.6) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Vulnerable component: libxml2 version 2.9.2-rc1" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "libxml2@2.9.2-rc1" + } + } + }, + "logicalLocations": [ + { + "name": "libxml2", + "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 47, + "cvss_version": "3.1", + "base_score": "8.6", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "ecosystem": "generic", + "package_url": "pkg:generic/libxml2@2.9.2-rc1", + "scan_id": 772, + "original_level": "error", + "security-severity": "8.6", + "precision": "medium", + "kind": "review", + "rank": 86.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2021-3517" + ], + "component": [ + "libxml2@2.9.2-rc1" + ], + "severity": [ + "high" + ] + }, + "epss_score": 0.00071, + "epss_percentile": 0.22309, + "cwe_ids": [ + "CWE-787" + ] + }, + "fixes": [ + { + "description": { + "text": "Update libxml2 to a version that fixes CVE-2021-3517 - STANDARD priority" + }, + "properties": { + "urgency": "standard", + "guidance": "Check for newer versions of this component that address the vulnerability", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.00071 + } + } + ], + "fingerprints": { + "workbench/component": "libxml2@2.9.2-rc1", + "workbench/vulnerability": "CVE-2021-3517#47", + "primary": "libxml2@2.9.2-rc1#CVE-2021-3517", + "stable": "CVE-2021-3517" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Component manifest for libxml2" + } + } + }, + "message": { + "text": "Component libxml2 version 2.9.2-rc1" + } + } + ] + }, + { + "ruleId": "CVE-2022-40304", + "level": "error", + "message": { + "text": "Found high severity vulnerability CVE-2022-40304 (CVSS 7.8) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Vulnerable component: libxml2 version 2.9.2-rc1" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "libxml2@2.9.2-rc1" + } + } + }, + "logicalLocations": [ + { + "name": "libxml2", + "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 54, + "cvss_version": "3.1", + "base_score": "7.8", + "attack_vector": "LOCAL", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "ecosystem": "generic", + "package_url": "pkg:generic/libxml2@2.9.2-rc1", + "scan_id": 772, + "original_level": "error", + "security-severity": "7.8", + "precision": "medium", + "kind": "review", + "rank": 78.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2022-40304" + ], + "component": [ + "libxml2@2.9.2-rc1" + ], + "severity": [ + "high" + ] + }, + "epss_score": 0.00067, + "epss_percentile": 0.21253, + "cwe_ids": [ + "CWE-415" + ] + }, + "fixes": [ + { + "description": { + "text": "Update libxml2 to a version that fixes CVE-2022-40304 - STANDARD priority" + }, + "properties": { + "urgency": "standard", + "guidance": "Check for newer versions of this component that address the vulnerability", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.00067 + } + } + ], + "fingerprints": { + "workbench/component": "libxml2@2.9.2-rc1", + "workbench/vulnerability": "CVE-2022-40304#54", + "primary": "libxml2@2.9.2-rc1#CVE-2022-40304", + "stable": "CVE-2022-40304" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Component manifest for libxml2" + } + } + }, + "message": { + "text": "Component libxml2 version 2.9.2-rc1" + } + } + ] + }, + { + "ruleId": "CVE-2025-27113", + "level": "error", + "message": { + "text": "Found high severity vulnerability CVE-2025-27113 (CVSS 7.5) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Vulnerable component: libxml2 version 2.9.2-rc1" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "libxml2@2.9.2-rc1" + } + } + }, + "logicalLocations": [ + { + "name": "libxml2", + "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 7327, + "cvss_version": "3.1", + "base_score": "7.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "ecosystem": "generic", + "package_url": "pkg:generic/libxml2@2.9.2-rc1", + "scan_id": 772, + "original_level": "error", + "security-severity": "7.5", + "precision": "medium", + "kind": "review", + "rank": 75.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2025-27113" + ], + "component": [ + "libxml2@2.9.2-rc1" + ], + "severity": [ + "high" + ] + }, + "epss_score": 0.00069, + "epss_percentile": 0.21588, + "cwe_ids": [ + "CWE-476" + ] + }, + "fixes": [ + { + "description": { + "text": "Update libxml2 to a version that fixes CVE-2025-27113 - STANDARD priority" + }, + "properties": { + "urgency": "standard", + "guidance": "Check for newer versions of this component that address the vulnerability", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.00069 + } + } + ], + "fingerprints": { + "workbench/component": "libxml2@2.9.2-rc1", + "workbench/vulnerability": "CVE-2025-27113#7327", + "primary": "libxml2@2.9.2-rc1#CVE-2025-27113", + "stable": "CVE-2025-27113" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Component manifest for libxml2" + } + } + }, + "message": { + "text": "Component libxml2 version 2.9.2-rc1" + } + } + ] + }, + { + "ruleId": "CVE-2022-24771", + "level": "error", + "message": { + "text": "Found high severity vulnerability CVE-2022-24771 (CVSS 7.5) in component node-forge version 1.0.0. This vulnerability should be addressed by updating to a patched version." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/node-forge@1.0.0", + "description": { + "text": "Vulnerable component: node-forge version 1.0.0" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "node-forge@1.0.0" + } + } + }, + "logicalLocations": [ + { + "name": "node-forge", + "fullyQualifiedName": "pkg:generic/node-forge@1.0.0", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 3, + "cvss_version": "3.1", + "base_score": "7.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "NONE", + "rejected": 0, + "component_id": 7, + "ecosystem": "generic", + "package_url": "pkg:generic/node-forge@1.0.0", + "scan_id": 772, + "original_level": "error", + "security-severity": "7.5", + "precision": "medium", + "kind": "review", + "rank": 75.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2022-24771" + ], + "component": [ + "node-forge@1.0.0" + ], + "severity": [ + "high" + ] + }, + "epss_score": 0.00106, + "epss_percentile": 0.29681, + "cwe_ids": [ + "CWE-347" + ] + }, + "fixes": [ + { + "description": { + "text": "Update node-forge to a version that fixes CVE-2022-24771 - STANDARD priority" + }, + "properties": { + "urgency": "standard", + "guidance": "Check for newer versions of this component that address the vulnerability", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.00106 + } + } + ], + "fingerprints": { + "workbench/component": "node-forge@1.0.0", + "workbench/vulnerability": "CVE-2022-24771#3", + "primary": "node-forge@1.0.0#CVE-2022-24771", + "stable": "CVE-2022-24771" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/node-forge@1.0.0", + "description": { + "text": "Component manifest for node-forge" + } + } + }, + "message": { + "text": "Component node-forge version 1.0.0" + } + } + ] + }, + { + "ruleId": "CVE-2025-32415", + "level": "error", + "message": { + "text": "Found high severity vulnerability CVE-2025-32415 (CVSS 7.5) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Vulnerable component: libxml2 version 2.9.2-rc1" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "libxml2@2.9.2-rc1" + } + } + }, + "logicalLocations": [ + { + "name": "libxml2", + "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 7321, + "cvss_version": "3.1", + "base_score": "7.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "ecosystem": "generic", + "package_url": "pkg:generic/libxml2@2.9.2-rc1", + "scan_id": 772, + "original_level": "error", + "security-severity": "7.5", + "precision": "medium", + "kind": "review", + "rank": 75.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2025-32415" + ], + "component": [ + "libxml2@2.9.2-rc1" + ], + "severity": [ + "high" + ] + }, + "epss_score": 0.00027, + "epss_percentile": 0.05708, + "cwe_ids": [ + "CWE-125" + ] + }, + "fixes": [ + { + "description": { + "text": "Update libxml2 to a version that fixes CVE-2025-32415 - STANDARD priority" + }, + "properties": { + "urgency": "standard", + "guidance": "Check for newer versions of this component that address the vulnerability", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.00027 + } + } + ], + "fingerprints": { + "workbench/component": "libxml2@2.9.2-rc1", + "workbench/vulnerability": "CVE-2025-32415#7321", + "primary": "libxml2@2.9.2-rc1#CVE-2025-32415", + "stable": "CVE-2025-32415" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Component manifest for libxml2" + } + } + }, + "message": { + "text": "Component libxml2 version 2.9.2-rc1" + } + } + ] + }, + { + "ruleId": "CVE-2025-32414", + "level": "error", + "message": { + "text": "Found high severity vulnerability CVE-2025-32414 (CVSS 7.5) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Vulnerable component: libxml2 version 2.9.2-rc1" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "libxml2@2.9.2-rc1" + } + } + }, + "logicalLocations": [ + { + "name": "libxml2", + "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 7320, + "cvss_version": "3.1", + "base_score": "7.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "ecosystem": "generic", + "package_url": "pkg:generic/libxml2@2.9.2-rc1", + "scan_id": 772, + "original_level": "error", + "security-severity": "7.5", + "precision": "medium", + "kind": "review", + "rank": 75.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2025-32414" + ], + "component": [ + "libxml2@2.9.2-rc1" + ], + "severity": [ + "high" + ] + }, + "epss_score": 0.00017, + "epss_percentile": 0.02763, + "cwe_ids": [ + "CWE-252" + ] + }, + "fixes": [ + { + "description": { + "text": "Update libxml2 to a version that fixes CVE-2025-32414 - STANDARD priority" + }, + "properties": { + "urgency": "standard", + "guidance": "Check for newer versions of this component that address the vulnerability", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.00017 + } + } + ], + "fingerprints": { + "workbench/component": "libxml2@2.9.2-rc1", + "workbench/vulnerability": "CVE-2025-32414#7320", + "primary": "libxml2@2.9.2-rc1#CVE-2025-32414", + "stable": "CVE-2025-32414" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Component manifest for libxml2" + } + } + }, + "message": { + "text": "Component libxml2 version 2.9.2-rc1" + } + } + ] + }, + { + "ruleId": "CVE-2024-25062", + "level": "error", + "message": { + "text": "Found high severity vulnerability CVE-2024-25062 (CVSS 7.5) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Vulnerable component: libxml2 version 2.9.2-rc1" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "libxml2@2.9.2-rc1" + } + } + }, + "logicalLocations": [ + { + "name": "libxml2", + "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 58, + "cvss_version": "3.1", + "base_score": "7.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "ecosystem": "generic", + "package_url": "pkg:generic/libxml2@2.9.2-rc1", + "scan_id": 772, + "original_level": "error", + "security-severity": "7.5", + "precision": "medium", + "kind": "review", + "rank": 75.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2024-25062" + ], + "component": [ + "libxml2@2.9.2-rc1" + ], + "severity": [ + "high" + ] + }, + "epss_score": 0.0015, + "epss_percentile": 0.3668, + "cwe_ids": [ + "CWE-416" + ] + }, + "fixes": [ + { + "description": { + "text": "Update libxml2 to a version that fixes CVE-2024-25062 - STANDARD priority" + }, + "properties": { + "urgency": "standard", + "guidance": "Check for newer versions of this component that address the vulnerability", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.0015 + } + } + ], + "fingerprints": { + "workbench/component": "libxml2@2.9.2-rc1", + "workbench/vulnerability": "CVE-2024-25062#58", + "primary": "libxml2@2.9.2-rc1#CVE-2024-25062", + "stable": "CVE-2024-25062" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Component manifest for libxml2" + } + } + }, + "message": { + "text": "Component libxml2 version 2.9.2-rc1" + } + } + ] + }, + { + "ruleId": "CVE-2022-40303", + "level": "error", + "message": { + "text": "Found high severity vulnerability CVE-2022-40303 (CVSS 7.5) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Vulnerable component: libxml2 version 2.9.2-rc1" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "libxml2@2.9.2-rc1" + } + } + }, + "logicalLocations": [ + { + "name": "libxml2", + "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 53, + "cvss_version": "3.1", + "base_score": "7.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "ecosystem": "generic", + "package_url": "pkg:generic/libxml2@2.9.2-rc1", + "scan_id": 772, + "original_level": "error", + "security-severity": "7.5", + "precision": "medium", + "kind": "review", + "rank": 75.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2022-40303" + ], + "component": [ + "libxml2@2.9.2-rc1" + ], + "severity": [ + "high" + ] + }, + "epss_score": 0.00137, + "epss_percentile": 0.34634, + "cwe_ids": [ + "CWE-190" + ] + }, + "fixes": [ + { + "description": { + "text": "Update libxml2 to a version that fixes CVE-2022-40303 - STANDARD priority" + }, + "properties": { + "urgency": "standard", + "guidance": "Check for newer versions of this component that address the vulnerability", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.00137 + } + } + ], + "fingerprints": { + "workbench/component": "libxml2@2.9.2-rc1", + "workbench/vulnerability": "CVE-2022-40303#53", + "primary": "libxml2@2.9.2-rc1#CVE-2022-40303", + "stable": "CVE-2022-40303" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Component manifest for libxml2" + } + } + }, + "message": { + "text": "Component libxml2 version 2.9.2-rc1" + } + } + ] + }, + { + "ruleId": "CVE-2022-23308", + "level": "error", + "message": { + "text": "Found high severity vulnerability CVE-2022-23308 (CVSS 7.5) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Vulnerable component: libxml2 version 2.9.2-rc1" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "libxml2@2.9.2-rc1" + } + } + }, + "logicalLocations": [ + { + "name": "libxml2", + "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 51, + "cvss_version": "3.1", + "base_score": "7.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "ecosystem": "generic", + "package_url": "pkg:generic/libxml2@2.9.2-rc1", + "scan_id": 772, + "original_level": "error", + "security-severity": "7.5", + "precision": "medium", + "kind": "review", + "rank": 75.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2022-23308" + ], + "component": [ + "libxml2@2.9.2-rc1" + ], + "severity": [ + "high" + ] + }, + "epss_score": 0.00024, + "epss_percentile": 0.04919, + "cwe_ids": [ + "CWE-416" + ] + }, + "fixes": [ + { + "description": { + "text": "Update libxml2 to a version that fixes CVE-2022-23308 - STANDARD priority" + }, + "properties": { + "urgency": "standard", + "guidance": "Check for newer versions of this component that address the vulnerability", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.00024 + } + } + ], + "fingerprints": { + "workbench/component": "libxml2@2.9.2-rc1", + "workbench/vulnerability": "CVE-2022-23308#51", + "primary": "libxml2@2.9.2-rc1#CVE-2022-23308", + "stable": "CVE-2022-23308" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Component manifest for libxml2" + } + } + }, + "message": { + "text": "Component libxml2 version 2.9.2-rc1" + } + } + ] + }, + { + "ruleId": "CVE-2019-19956", + "level": "error", + "message": { + "text": "Found high severity vulnerability CVE-2019-19956 (CVSS 7.5) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Vulnerable component: libxml2 version 2.9.2-rc1" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "libxml2@2.9.2-rc1" + } + } + }, + "logicalLocations": [ + { + "name": "libxml2", + "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 46, + "cvss_version": "3.1", + "base_score": "7.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "ecosystem": "generic", + "package_url": "pkg:generic/libxml2@2.9.2-rc1", + "scan_id": 772, + "original_level": "error", + "security-severity": "7.5", + "precision": "medium", + "kind": "review", + "rank": 75.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2019-19956" + ], + "component": [ + "libxml2@2.9.2-rc1" + ], + "severity": [ + "high" + ] + }, + "epss_score": 0.00212, + "epss_percentile": 0.44118, + "cwe_ids": [ + "CWE-401" + ] + }, + "fixes": [ + { + "description": { + "text": "Update libxml2 to a version that fixes CVE-2019-19956 - STANDARD priority" + }, + "properties": { + "urgency": "standard", + "guidance": "Check for newer versions of this component that address the vulnerability", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.00212 + } + } + ], + "fingerprints": { + "workbench/component": "libxml2@2.9.2-rc1", + "workbench/vulnerability": "CVE-2019-19956#46", + "primary": "libxml2@2.9.2-rc1#CVE-2019-19956", + "stable": "CVE-2019-19956" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Component manifest for libxml2" + } + } + }, + "message": { + "text": "Component libxml2 version 2.9.2-rc1" + } + } + ] + }, + { + "ruleId": "CVE-2018-14404", + "level": "error", + "message": { + "text": "Found high severity vulnerability CVE-2018-14404 (CVSS 7.5) in component libxml2 version 2.9.2-rc1. ⚠️ High EPSS score: 0.236. This vulnerability should be addressed by updating to a patched version." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Vulnerable component: libxml2 version 2.9.2-rc1" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "libxml2@2.9.2-rc1" + } + } + }, + "logicalLocations": [ + { + "name": "libxml2", + "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 14354, + "cvss_version": "3.1", + "base_score": "7.5", + "attack_vector": "N/A", + "attack_complexity": "N/A", + "availability_impact": "N/A", + "rejected": 0, + "component_id": 12, + "ecosystem": "generic", + "package_url": "pkg:generic/libxml2@2.9.2-rc1", + "scan_id": 772, + "original_level": "error", + "security-severity": "7.5", + "precision": "medium", + "kind": "review", + "rank": 90.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2018-14404" + ], + "component": [ + "libxml2@2.9.2-rc1" + ], + "severity": [ + "high" + ] + }, + "epss_score": 0.2363, + "epss_percentile": 0.95747, + "cwe_ids": [ + "CWE-476" + ] + }, + "fixes": [ + { + "description": { + "text": "Update libxml2 to a version that fixes CVE-2018-14404 - HIGH priority" + }, + "properties": { + "urgency": "high", + "guidance": "Check for newer versions of this component that address the vulnerability", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.2363 + } + } + ], + "fingerprints": { + "workbench/component": "libxml2@2.9.2-rc1", + "workbench/vulnerability": "CVE-2018-14404#14354", + "primary": "libxml2@2.9.2-rc1#CVE-2018-14404", + "stable": "CVE-2018-14404" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Component manifest for libxml2" + } + } + }, + "message": { + "text": "Component libxml2 version 2.9.2-rc1" + } + } + ] + }, + { + "ruleId": "CVE-2022-24772", + "level": "error", + "message": { + "text": "Found high severity vulnerability CVE-2022-24772 (CVSS 7.5) in component node-forge version 1.0.0. This vulnerability should be addressed by updating to a patched version." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/node-forge@1.0.0", + "description": { + "text": "Vulnerable component: node-forge version 1.0.0" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "node-forge@1.0.0" + } + } + }, + "logicalLocations": [ + { + "name": "node-forge", + "fullyQualifiedName": "pkg:generic/node-forge@1.0.0", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 4, + "cvss_version": "3.1", + "base_score": "7.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "NONE", + "rejected": 0, + "component_id": 7, + "ecosystem": "generic", + "package_url": "pkg:generic/node-forge@1.0.0", + "scan_id": 772, + "original_level": "error", + "security-severity": "7.5", + "precision": "medium", + "kind": "review", + "rank": 75.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2022-24772" + ], + "component": [ + "node-forge@1.0.0" + ], + "severity": [ + "high" + ] + }, + "epss_score": 0.00116, + "epss_percentile": 0.31427, + "cwe_ids": [ + "CWE-347" + ] + }, + "fixes": [ + { + "description": { + "text": "Update node-forge to a version that fixes CVE-2022-24772 - STANDARD priority" + }, + "properties": { + "urgency": "standard", + "guidance": "Check for newer versions of this component that address the vulnerability", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.00116 + } + } + ], + "fingerprints": { + "workbench/component": "node-forge@1.0.0", + "workbench/vulnerability": "CVE-2022-24772#4", + "primary": "node-forge@1.0.0#CVE-2022-24772", + "stable": "CVE-2022-24772" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/node-forge@1.0.0", + "description": { + "text": "Component manifest for node-forge" + } + } + }, + "message": { + "text": "Component node-forge version 1.0.0" + } + } + ] + }, + { + "ruleId": "CVE-2022-48285", + "level": "error", + "message": { + "text": "Found high severity vulnerability CVE-2022-48285 (CVSS 7.3) in component jszip version 2.6.0. This vulnerability should be addressed by updating to a patched version." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/jszip@2.6.0", + "description": { + "text": "Vulnerable component: jszip version 2.6.0" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "jszip@2.6.0" + } + } + }, + "logicalLocations": [ + { + "name": "jszip", + "fullyQualifiedName": "pkg:generic/jszip@2.6.0", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 2, + "cvss_version": "3.1", + "base_score": "7.3", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "LOW", + "rejected": 0, + "component_id": 6, + "ecosystem": "generic", + "package_url": "pkg:generic/jszip@2.6.0", + "scan_id": 772, + "original_level": "error", + "security-severity": "7.3", + "precision": "medium", + "kind": "review", + "rank": 73.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2022-48285" + ], + "component": [ + "jszip@2.6.0" + ], + "severity": [ + "high" + ] + }, + "epss_score": 0.00419, + "epss_percentile": 0.61148, + "cwe_ids": [ + "CWE-22" + ] + }, + "fixes": [ + { + "description": { + "text": "Update jszip to a version that fixes CVE-2022-48285 - STANDARD priority" + }, + "properties": { + "urgency": "standard", + "guidance": "Check for newer versions of this component that address the vulnerability", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.00419 + } + } + ], + "fingerprints": { + "workbench/component": "jszip@2.6.0", + "workbench/vulnerability": "CVE-2022-48285#2", + "primary": "jszip@2.6.0#CVE-2022-48285", + "stable": "CVE-2022-48285" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/jszip@2.6.0", + "description": { + "text": "Component manifest for jszip" + } + } + }, + "message": { + "text": "Component jszip version 2.6.0" + } + } + ] + }, + { + "ruleId": "CVE-2017-18258", + "level": "warning", + "message": { + "text": "Found medium severity vulnerability CVE-2017-18258 (CVSS 6.5) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Vulnerable component: libxml2 version 2.9.2-rc1" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "libxml2@2.9.2-rc1" + } + } + }, + "logicalLocations": [ + { + "name": "libxml2", + "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 14350, + "cvss_version": "3.1", + "base_score": "6.5", + "attack_vector": "N/A", + "attack_complexity": "N/A", + "availability_impact": "N/A", + "rejected": 0, + "component_id": 12, + "ecosystem": "generic", + "package_url": "pkg:generic/libxml2@2.9.2-rc1", + "scan_id": 772, + "original_level": "warning", + "security-severity": "6.5", + "precision": "medium", + "kind": "review", + "rank": 65.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2017-18258" + ], + "component": [ + "libxml2@2.9.2-rc1" + ], + "severity": [ + "medium" + ] + }, + "epss_score": 0.00724, + "epss_percentile": 0.71711, + "cwe_ids": [ + "CWE-770" + ] + }, + "fixes": [ + { + "description": { + "text": "Update libxml2 to a version that fixes CVE-2017-18258 - STANDARD priority" + }, + "properties": { + "urgency": "standard", + "guidance": "Check for newer versions of this component that address the vulnerability", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.00724 + } + } + ], + "fingerprints": { + "workbench/component": "libxml2@2.9.2-rc1", + "workbench/vulnerability": "CVE-2017-18258#14350", + "primary": "libxml2@2.9.2-rc1#CVE-2017-18258", + "stable": "CVE-2017-18258" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Component manifest for libxml2" + } + } + }, + "message": { + "text": "Component libxml2 version 2.9.2-rc1" + } + } + ] + }, + { + "ruleId": "CVE-2021-3541", + "level": "warning", + "message": { + "text": "Found medium severity vulnerability CVE-2021-3541 (CVSS 6.5) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Vulnerable component: libxml2 version 2.9.2-rc1" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "libxml2@2.9.2-rc1" + } + } + }, + "logicalLocations": [ + { + "name": "libxml2", + "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 50, + "cvss_version": "3.1", + "base_score": "6.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "ecosystem": "generic", + "package_url": "pkg:generic/libxml2@2.9.2-rc1", + "scan_id": 772, + "original_level": "warning", + "security-severity": "6.5", + "precision": "medium", + "kind": "review", + "rank": 65.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2021-3541" + ], + "component": [ + "libxml2@2.9.2-rc1" + ], + "severity": [ + "medium" + ] + }, + "epss_score": 0.0006, + "epss_percentile": 0.18929, + "cwe_ids": [ + "CWE-776" + ] + }, + "fixes": [ + { + "description": { + "text": "Update libxml2 to a version that fixes CVE-2021-3541 - STANDARD priority" + }, + "properties": { + "urgency": "standard", + "guidance": "Check for newer versions of this component that address the vulnerability", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.0006 + } + } + ], + "fingerprints": { + "workbench/component": "libxml2@2.9.2-rc1", + "workbench/vulnerability": "CVE-2021-3541#50", + "primary": "libxml2@2.9.2-rc1#CVE-2021-3541", + "stable": "CVE-2021-3541" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Component manifest for libxml2" + } + } + }, + "message": { + "text": "Component libxml2 version 2.9.2-rc1" + } + } + ] + }, + { + "ruleId": "CVE-2016-9598", + "level": "warning", + "message": { + "text": "Found medium severity vulnerability CVE-2016-9598 (CVSS 6.5) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Vulnerable component: libxml2 version 2.9.2-rc1" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "libxml2@2.9.2-rc1" + } + } + }, + "logicalLocations": [ + { + "name": "libxml2", + "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 37, + "cvss_version": "3.1", + "base_score": "6.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "ecosystem": "generic", + "package_url": "pkg:generic/libxml2@2.9.2-rc1", + "scan_id": 772, + "original_level": "warning", + "security-severity": "6.5", + "precision": "medium", + "kind": "review", + "rank": 65.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2016-9598" + ], + "component": [ + "libxml2@2.9.2-rc1" + ], + "severity": [ + "medium" + ] + }, + "epss_score": 0.00673, + "epss_percentile": 0.70578, + "cwe_ids": [ + "CWE-125" + ] + }, + "fixes": [ + { + "description": { + "text": "Update libxml2 to a version that fixes CVE-2016-9598 - STANDARD priority" + }, + "properties": { + "urgency": "standard", + "guidance": "Check for newer versions of this component that address the vulnerability", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.00673 + } + } + ], + "fingerprints": { + "workbench/component": "libxml2@2.9.2-rc1", + "workbench/vulnerability": "CVE-2016-9598#37", + "primary": "libxml2@2.9.2-rc1#CVE-2016-9598", + "stable": "CVE-2016-9598" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Component manifest for libxml2" + } + } + }, + "message": { + "text": "Component libxml2 version 2.9.2-rc1" + } + } + ] + }, + { + "ruleId": "CVE-2022-29824", + "level": "warning", + "message": { + "text": "Found medium severity vulnerability CVE-2022-29824 (CVSS 6.5) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Vulnerable component: libxml2 version 2.9.2-rc1" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "libxml2@2.9.2-rc1" + } + } + }, + "logicalLocations": [ + { + "name": "libxml2", + "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 52, + "cvss_version": "3.1", + "base_score": "6.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "ecosystem": "generic", + "package_url": "pkg:generic/libxml2@2.9.2-rc1", + "scan_id": 772, + "original_level": "warning", + "security-severity": "6.5", + "precision": "medium", + "kind": "review", + "rank": 65.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2022-29824" + ], + "component": [ + "libxml2@2.9.2-rc1" + ], + "severity": [ + "medium" + ] + }, + "epss_score": 0.00041, + "epss_percentile": 0.11669, + "cwe_ids": [ + "CWE-190" + ] + }, + "fixes": [ + { + "description": { + "text": "Update libxml2 to a version that fixes CVE-2022-29824 - STANDARD priority" + }, + "properties": { + "urgency": "standard", + "guidance": "Check for newer versions of this component that address the vulnerability", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.00041 + } + } + ], + "fingerprints": { + "workbench/component": "libxml2@2.9.2-rc1", + "workbench/vulnerability": "CVE-2022-29824#52", + "primary": "libxml2@2.9.2-rc1#CVE-2022-29824", + "stable": "CVE-2022-29824" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Component manifest for libxml2" + } + } + }, + "message": { + "text": "Component libxml2 version 2.9.2-rc1" + } + } + ] + }, + { + "ruleId": "CVE-2016-9596", + "level": "warning", + "message": { + "text": "Found medium severity vulnerability CVE-2016-9596 (CVSS 6.5) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Vulnerable component: libxml2 version 2.9.2-rc1" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "libxml2@2.9.2-rc1" + } + } + }, + "logicalLocations": [ + { + "name": "libxml2", + "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 36, + "cvss_version": "3.1", + "base_score": "6.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "ecosystem": "generic", + "package_url": "pkg:generic/libxml2@2.9.2-rc1", + "scan_id": 772, + "original_level": "warning", + "security-severity": "6.5", + "precision": "medium", + "kind": "review", + "rank": 65.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2016-9596" + ], + "component": [ + "libxml2@2.9.2-rc1" + ], + "severity": [ + "medium" + ] + }, + "epss_score": 0.00673, + "epss_percentile": 0.70578, + "cwe_ids": [ + "CWE-400" + ] + }, + "fixes": [ + { + "description": { + "text": "Update libxml2 to a version that fixes CVE-2016-9596 - STANDARD priority" + }, + "properties": { + "urgency": "standard", + "guidance": "Check for newer versions of this component that address the vulnerability", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.00673 + } + } + ], + "fingerprints": { + "workbench/component": "libxml2@2.9.2-rc1", + "workbench/vulnerability": "CVE-2016-9596#36", + "primary": "libxml2@2.9.2-rc1#CVE-2016-9596", + "stable": "CVE-2016-9596" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Component manifest for libxml2" + } + } + }, + "message": { + "text": "Component libxml2 version 2.9.2-rc1" + } + } + ] + }, + { + "ruleId": "CVE-2023-28484", + "level": "warning", + "message": { + "text": "Found medium severity vulnerability CVE-2023-28484 (CVSS 6.5) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Vulnerable component: libxml2 version 2.9.2-rc1" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "libxml2@2.9.2-rc1" + } + } + }, + "logicalLocations": [ + { + "name": "libxml2", + "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 55, + "cvss_version": "3.1", + "base_score": "6.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "ecosystem": "generic", + "package_url": "pkg:generic/libxml2@2.9.2-rc1", + "scan_id": 772, + "original_level": "warning", + "security-severity": "6.5", + "precision": "medium", + "kind": "review", + "rank": 65.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2023-28484" + ], + "component": [ + "libxml2@2.9.2-rc1" + ], + "severity": [ + "medium" + ] + }, + "epss_score": 0.00263, + "epss_percentile": 0.49636, + "cwe_ids": [ + "CWE-476" + ] + }, + "fixes": [ + { + "description": { + "text": "Update libxml2 to a version that fixes CVE-2023-28484 - STANDARD priority" + }, + "properties": { + "urgency": "standard", + "guidance": "Check for newer versions of this component that address the vulnerability", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.00263 + } + } + ], + "fingerprints": { + "workbench/component": "libxml2@2.9.2-rc1", + "workbench/vulnerability": "CVE-2023-28484#55", + "primary": "libxml2@2.9.2-rc1#CVE-2023-28484", + "stable": "CVE-2023-28484" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Component manifest for libxml2" + } + } + }, + "message": { + "text": "Component libxml2 version 2.9.2-rc1" + } + } + ] + }, + { + "ruleId": "CVE-2023-29469", + "level": "note", + "message": { + "text": "Found medium severity vulnerability CVE-2023-29469 (CVSS 6.5) in component libxml2 version 2.9.2-rc1. VEX Status: not_affected. Justification: protected_at_runtime Verify VEX assessment is current and accurate." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Vulnerable component: libxml2 version 2.9.2-rc1" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "libxml2@2.9.2-rc1" + } + } + }, + "logicalLocations": [ + { + "name": "libxml2", + "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 56, + "cvss_version": "3.1", + "base_score": "6.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "ecosystem": "generic", + "package_url": "pkg:generic/libxml2@2.9.2-rc1", + "scan_id": 772, + "original_level": "warning", + "security-severity": "6.5", + "precision": "high", + "kind": "review", + "rank": 6.5, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2023-29469" + ], + "component": [ + "libxml2@2.9.2-rc1" + ], + "severity": [ + "medium" + ] + }, + "epss_score": 0.00054, + "epss_percentile": 0.16808, + "cwe_ids": [ + "CWE-415" + ], + "vex_status": "not_affected", + "vex_justification": "protected_at_runtime", + "vex_response": "will_not_fix", + "vex_created": "2025-07-03 13:50:08", + "vex_updated": "2025-07-03 15:50:16", + "vex_created_by": "tomas.gonzalez@fossid.com", + "vex_updated_by": "tomas.gonzalez@fossid.com" + }, + "fixes": [ + { + "description": { + "text": "Verify VEX assessment for libxml2 CVE-2023-29469 - Component reported as not_affected" + }, + "properties": { + "urgency": "standard", + "guidance": "Validate that VEX assessment is current and accurate", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.00054, + "vex_status": "not_affected", + "vex_justification": "protected_at_runtime", + "vex_response": "will_not_fix", + "vex_created": "2025-07-03 13:50:08", + "vex_updated": "2025-07-03 15:50:16", + "vex_created_by": "tomas.gonzalez@fossid.com", + "vex_updated_by": "tomas.gonzalez@fossid.com" + } + } + ], + "fingerprints": { + "workbench/component": "libxml2@2.9.2-rc1", + "workbench/vulnerability": "CVE-2023-29469#56", + "primary": "libxml2@2.9.2-rc1#CVE-2023-29469", + "stable": "CVE-2023-29469" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Component manifest for libxml2" + } + } + }, + "message": { + "text": "Component libxml2 version 2.9.2-rc1" + } + } + ], + "suppressions": [ + { + "kind": "inSource", + "status": "accepted", + "justification": "protected_at_runtime" + } + ] + }, + { + "ruleId": "CVE-2023-45322", + "level": "note", + "message": { + "text": "Found medium severity vulnerability CVE-2023-45322 (CVSS 6.5) in component libxml2 version 2.9.2-rc1. VEX Status: false_positive. Justification: code_not_present Verify false positive assessment is accurate." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Vulnerable component: libxml2 version 2.9.2-rc1" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "libxml2@2.9.2-rc1" + } + } + }, + "logicalLocations": [ + { + "name": "libxml2", + "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 57, + "cvss_version": "3.1", + "base_score": "6.5", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "ecosystem": "generic", + "package_url": "pkg:generic/libxml2@2.9.2-rc1", + "scan_id": 772, + "original_level": "warning", + "security-severity": "6.5", + "precision": "high", + "kind": "review", + "rank": 13.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2023-45322" + ], + "component": [ + "libxml2@2.9.2-rc1" + ], + "severity": [ + "medium" + ] + }, + "epss_score": 0.00076, + "epss_percentile": 0.23725, + "cwe_ids": [ + "CWE-416" + ], + "vex_status": "false_positive", + "vex_justification": "code_not_present", + "vex_response": "will_not_fix", + "vex_created": "2025-07-03 13:49:53", + "vex_updated": "2025-07-03 15:50:05", + "vex_created_by": "tomas.gonzalez@fossid.com", + "vex_updated_by": "tomas.gonzalez@fossid.com" + }, + "fixes": [ + { + "description": { + "text": "Verify false positive assessment for libxml2 CVE-2023-45322 - FALSE POSITIVE status" + }, + "properties": { + "urgency": "standard", + "guidance": "Validate that false positive assessment is accurate and documented", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.00076, + "vex_status": "false_positive", + "vex_justification": "code_not_present", + "vex_response": "will_not_fix", + "vex_created": "2025-07-03 13:49:53", + "vex_updated": "2025-07-03 15:50:05", + "vex_created_by": "tomas.gonzalez@fossid.com", + "vex_updated_by": "tomas.gonzalez@fossid.com" + } + } + ], + "fingerprints": { + "workbench/component": "libxml2@2.9.2-rc1", + "workbench/vulnerability": "CVE-2023-45322#57", + "primary": "libxml2@2.9.2-rc1#CVE-2023-45322", + "stable": "CVE-2023-45322" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Component manifest for libxml2" + } + } + }, + "message": { + "text": "Component libxml2 version 2.9.2-rc1" + } + } + ], + "suppressions": [ + { + "kind": "inSource", + "status": "accepted", + "justification": "code_not_present" + } + ] + }, + { + "ruleId": "CVE-2016-3709", + "level": "warning", + "message": { + "text": "Found medium severity vulnerability CVE-2016-3709 (CVSS 6.1) in component libxml2 version 2.9.2-rc1. VEX Status: in_triage. This vulnerability should be addressed by updating to a patched version." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Vulnerable component: libxml2 version 2.9.2-rc1" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "libxml2@2.9.2-rc1" + } + } + }, + "logicalLocations": [ + { + "name": "libxml2", + "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 28, + "cvss_version": "3.1", + "base_score": "6.1", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "NONE", + "rejected": 0, + "component_id": 12, + "ecosystem": "generic", + "package_url": "pkg:generic/libxml2@2.9.2-rc1", + "scan_id": 772, + "original_level": "warning", + "security-severity": "6.1", + "precision": "high", + "kind": "review", + "rank": 61.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2016-3709" + ], + "component": [ + "libxml2@2.9.2-rc1" + ], + "severity": [ + "medium" + ] + }, + "epss_score": 0.00098, + "epss_percentile": 0.28367, + "cwe_ids": [ + "CWE-79" + ], + "vex_status": "in_triage", + "vex_created": "2025-07-03 13:49:47", + "vex_updated": "2025-07-03 15:49:47", + "vex_created_by": "tomas.gonzalez@fossid.com", + "vex_updated_by": "tomas.gonzalez@fossid.com" + }, + "fixes": [ + { + "description": { + "text": "Monitor investigation progress for libxml2 CVE-2016-3709 - IN TRIAGE" + }, + "properties": { + "urgency": "standard", + "guidance": "Follow up on investigation status and prepare for potential remediation", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.00098, + "vex_status": "in_triage", + "vex_created": "2025-07-03 13:49:47", + "vex_updated": "2025-07-03 15:49:47", + "vex_created_by": "tomas.gonzalez@fossid.com", + "vex_updated_by": "tomas.gonzalez@fossid.com" + } + } + ], + "fingerprints": { + "workbench/component": "libxml2@2.9.2-rc1", + "workbench/vulnerability": "CVE-2016-3709#28", + "primary": "libxml2@2.9.2-rc1#CVE-2016-3709", + "stable": "CVE-2016-3709" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Component manifest for libxml2" + } + } + }, + "message": { + "text": "Component libxml2 version 2.9.2-rc1" + } + } + ] + }, + { + "ruleId": "CVE-2021-3537", + "level": "note", + "message": { + "text": "Found medium severity vulnerability CVE-2021-3537 (CVSS 5.9) in component libxml2 version 2.9.2-rc1. VEX Status: resolved. Justification: code_not_present Verify resolution is complete and effective." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Vulnerable component: libxml2 version 2.9.2-rc1" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "libxml2@2.9.2-rc1" + } + } + }, + "logicalLocations": [ + { + "name": "libxml2", + "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 49, + "cvss_version": "3.1", + "base_score": "5.9", + "attack_vector": "NETWORK", + "attack_complexity": "HIGH", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "ecosystem": "generic", + "package_url": "pkg:generic/libxml2@2.9.2-rc1", + "scan_id": 772, + "original_level": "warning", + "security-severity": "5.9", + "precision": "high", + "kind": "review", + "rank": 5.9, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2021-3537" + ], + "component": [ + "libxml2@2.9.2-rc1" + ], + "severity": [ + "medium" + ] + }, + "epss_score": 0.00127, + "epss_percentile": 0.33184, + "cwe_ids": [ + "CWE-476" + ], + "vex_status": "resolved", + "vex_justification": "code_not_present", + "vex_response": "update,will_not_fix", + "vex_created": "2025-07-03 13:49:22", + "vex_updated": "2025-07-03 15:49:44", + "vex_created_by": "tomas.gonzalez@fossid.com", + "vex_updated_by": "tomas.gonzalez@fossid.com" + }, + "fixes": [ + { + "description": { + "text": "Verify resolution for libxml2 CVE-2021-3537 - RESOLVED status" + }, + "properties": { + "urgency": "standard", + "guidance": "Confirm that resolution is complete and effective", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.00127, + "vex_status": "resolved", + "vex_justification": "code_not_present", + "vex_response": "update,will_not_fix", + "vex_created": "2025-07-03 13:49:22", + "vex_updated": "2025-07-03 15:49:44", + "vex_created_by": "tomas.gonzalez@fossid.com", + "vex_updated_by": "tomas.gonzalez@fossid.com" + } + } + ], + "fingerprints": { + "workbench/component": "libxml2@2.9.2-rc1", + "workbench/vulnerability": "CVE-2021-3537#49", + "primary": "libxml2@2.9.2-rc1#CVE-2021-3537", + "stable": "CVE-2021-3537" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/libxml2@2.9.2-rc1", + "description": { + "text": "Component manifest for libxml2" + } + } + }, + "message": { + "text": "Component libxml2 version 2.9.2-rc1" + } + } + ], + "suppressions": [ + { + "kind": "inSource", + "status": "accepted", + "justification": "code_not_present" + } + ] + }, + { + "ruleId": "CVE-2021-23413", + "level": "warning", + "message": { + "text": "Found medium severity vulnerability CVE-2021-23413 (CVSS 5.3) in component jszip version 2.6.0. VEX Status: in_triage. This vulnerability should be addressed by updating to a patched version." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/jszip@2.6.0", + "description": { + "text": "Vulnerable component: jszip version 2.6.0" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "jszip@2.6.0" + } + } + }, + "logicalLocations": [ + { + "name": "jszip", + "fullyQualifiedName": "pkg:generic/jszip@2.6.0", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 1, + "cvss_version": "3.1", + "base_score": "5.3", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "LOW", + "rejected": 0, + "component_id": 6, + "ecosystem": "generic", + "package_url": "pkg:generic/jszip@2.6.0", + "scan_id": 772, + "original_level": "warning", + "security-severity": "5.3", + "precision": "high", + "kind": "review", + "rank": 53.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2021-23413" + ], + "component": [ + "jszip@2.6.0" + ], + "severity": [ + "medium" + ] + }, + "epss_score": 0.00079, + "epss_percentile": 0.24344, + "cwe_ids": [ + "NVD-CWE-noinfo" + ], + "vex_status": "in_triage", + "vex_created": "2025-07-03 13:49:13", + "vex_updated": "2025-07-03 15:49:13", + "vex_created_by": "tomas.gonzalez@fossid.com", + "vex_updated_by": "tomas.gonzalez@fossid.com" + }, + "fixes": [ + { + "description": { + "text": "Monitor investigation progress for jszip CVE-2021-23413 - IN TRIAGE" + }, + "properties": { + "urgency": "standard", + "guidance": "Follow up on investigation status and prepare for potential remediation", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.00079, + "vex_status": "in_triage", + "vex_created": "2025-07-03 13:49:13", + "vex_updated": "2025-07-03 15:49:13", + "vex_created_by": "tomas.gonzalez@fossid.com", + "vex_updated_by": "tomas.gonzalez@fossid.com" + } + } + ], + "fingerprints": { + "workbench/component": "jszip@2.6.0", + "workbench/vulnerability": "CVE-2021-23413#1", + "primary": "jszip@2.6.0#CVE-2021-23413", + "stable": "CVE-2021-23413" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/jszip@2.6.0", + "description": { + "text": "Component manifest for jszip" + } + } + }, + "message": { + "text": "Component jszip version 2.6.0" + } + } + ] + }, + { + "ruleId": "CVE-2022-24773", + "level": "warning", + "message": { + "text": "Found medium severity vulnerability CVE-2022-24773 (CVSS 5.3) in component node-forge version 1.0.0. This vulnerability should be addressed by updating to a patched version." + }, + "locations": [ + { + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/node-forge@1.0.0", + "description": { + "text": "Vulnerable component: node-forge version 1.0.0" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": "node-forge@1.0.0" + } + } + }, + "logicalLocations": [ + { + "name": "node-forge", + "fullyQualifiedName": "pkg:generic/node-forge@1.0.0", + "kind": "package" + } + ] + } + ], + "properties": { + "vulnerability_id": 5, + "cvss_version": "3.1", + "base_score": "5.3", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "NONE", + "rejected": 0, + "component_id": 7, + "ecosystem": "generic", + "package_url": "pkg:generic/node-forge@1.0.0", + "scan_id": 772, + "original_level": "warning", + "security-severity": "5.3", + "precision": "medium", + "kind": "review", + "rank": 53.0, + "baseline": "unchanged", + "tags": { + "vulnerability": [ + "CVE-2022-24773" + ], + "component": [ + "node-forge@1.0.0" + ], + "severity": [ + "medium" + ] + }, + "epss_score": 0.0006, + "epss_percentile": 0.19137, + "cwe_ids": [ + "CWE-347" + ] + }, + "fixes": [ + { + "description": { + "text": "Update node-forge to a version that fixes CVE-2022-24773 - STANDARD priority" + }, + "properties": { + "urgency": "standard", + "guidance": "Check for newer versions of this component that address the vulnerability", + "automation": "Consider using automated dependency update tools", + "cisa_kev": false, + "epss_score": 0.0006 + } + } + ], + "fingerprints": { + "workbench/component": "node-forge@1.0.0", + "workbench/vulnerability": "CVE-2022-24773#5", + "primary": "node-forge@1.0.0#CVE-2022-24773", + "stable": "CVE-2022-24773" + }, + "relatedLocations": [ + { + "id": 0, + "physicalLocation": { + "artifactLocation": { + "uri": "pkg:generic/node-forge@1.0.0", + "description": { + "text": "Component manifest for node-forge" + } + } + }, + "message": { + "text": "Component node-forge version 1.0.0" + } + } + ] + } + ], + "properties": { + "scan_code": "ScanZIPwithShinobiAutoID_772", + "generated_at": "2025-07-03T18:10:55.703803Z", + "total_vulnerabilities": 30, + "severity_distribution": { + "CRITICAL": 0, + "HIGH": 16, + "MEDIUM": 12, + "LOW": 0, + "UNKNOWN": 2 + }, + "external_data_sources": [ + "FIRST EPSS", + "NVD" + ], + "high_risk_vulnerabilities": { + "cisa_kev": 0, + "high_epss": 2, + "critical_severity": 0, + "total_high_risk": 2 + }, + "vex_statements": { + "total_with_vex": 6, + "status_distribution": { + "exploitable": 1, + "not_affected": 1, + "false_positive": 1, + "in_triage": 2, + "resolved": 1 + }, + "with_justification": 4, + "with_response": 4, + "with_details": 1 + } + } + } + ] +} \ No newline at end of file diff --git a/vulns.json b/vulns.json new file mode 100644 index 0000000..144c74d --- /dev/null +++ b/vulns.json @@ -0,0 +1,814 @@ +{ + "vulnerabilities": [ + { + "id": 14352, + "cve": "CVE-2017-7375", + "cvss_version": "3.1", + "base_score": "9.8", + "severity": "N/A", + "attack_vector": "N/A", + "attack_complexity": "N/A", + "availability_impact": "N/A", + "rejected": 0, + "component_id": 12, + "component_name": "libxml2", + "component_version": "2.9.2-rc1", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": null, + "vuln_exp_status": null, + "vuln_exp_justification": null, + "vuln_exp_response": null, + "vuln_exp_details": null, + "vuln_exp_created": null, + "vuln_exp_updated": null, + "vuln_exp_created_by": null, + "vuln_exp_updated_by": null, + "vuln_exp_created_by_username": null, + "vuln_exp_updated_by_username": null + }, + { + "id": 14353, + "cve": "CVE-2017-7376", + "cvss_version": "3.1", + "base_score": "9.8", + "severity": "N/A", + "attack_vector": "N/A", + "attack_complexity": "N/A", + "availability_impact": "N/A", + "rejected": 0, + "component_id": 12, + "component_name": "libxml2", + "component_version": "2.9.2-rc1", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": 27, + "vuln_exp_status": "exploitable", + "vuln_exp_justification": "requires_environment", + "vuln_exp_response": "can_not_fix", + "vuln_exp_details": "unfixable", + "vuln_exp_created": "2025-07-03 13:41:07", + "vuln_exp_updated": "2025-07-03 15:41:38", + "vuln_exp_created_by": 3, + "vuln_exp_updated_by": 3, + "vuln_exp_created_by_username": "tomas.gonzalez@fossid.com", + "vuln_exp_updated_by_username": "tomas.gonzalez@fossid.com" + }, + { + "id": 14349, + "cve": "CVE-2017-15412", + "cvss_version": "3.1", + "base_score": "8.8", + "severity": "HIGH", + "attack_vector": "N/A", + "attack_complexity": "N/A", + "availability_impact": "N/A", + "rejected": 0, + "component_id": 12, + "component_name": "libxml2", + "component_version": "2.9.2-rc1", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": null, + "vuln_exp_status": null, + "vuln_exp_justification": null, + "vuln_exp_response": null, + "vuln_exp_details": null, + "vuln_exp_created": null, + "vuln_exp_updated": null, + "vuln_exp_created_by": null, + "vuln_exp_updated_by": null, + "vuln_exp_created_by_username": null, + "vuln_exp_updated_by_username": null + }, + { + "id": 48, + "cve": "CVE-2021-3518", + "cvss_version": "3.1", + "base_score": "8.8", + "severity": "HIGH", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "component_name": "libxml2", + "component_version": "2.9.2-rc1", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": null, + "vuln_exp_status": null, + "vuln_exp_justification": null, + "vuln_exp_response": null, + "vuln_exp_details": null, + "vuln_exp_created": null, + "vuln_exp_updated": null, + "vuln_exp_created_by": null, + "vuln_exp_updated_by": null, + "vuln_exp_created_by_username": null, + "vuln_exp_updated_by_username": null + }, + { + "id": 14351, + "cve": "CVE-2017-5130", + "cvss_version": "3.1", + "base_score": "8.8", + "severity": "HIGH", + "attack_vector": "N/A", + "attack_complexity": "N/A", + "availability_impact": "N/A", + "rejected": 0, + "component_id": 12, + "component_name": "libxml2", + "component_version": "2.9.2-rc1", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": null, + "vuln_exp_status": null, + "vuln_exp_justification": null, + "vuln_exp_response": null, + "vuln_exp_details": null, + "vuln_exp_created": null, + "vuln_exp_updated": null, + "vuln_exp_created_by": null, + "vuln_exp_updated_by": null, + "vuln_exp_created_by_username": null, + "vuln_exp_updated_by_username": null + }, + { + "id": 47, + "cve": "CVE-2021-3517", + "cvss_version": "3.1", + "base_score": "8.6", + "severity": "HIGH", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "component_name": "libxml2", + "component_version": "2.9.2-rc1", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": null, + "vuln_exp_status": null, + "vuln_exp_justification": null, + "vuln_exp_response": null, + "vuln_exp_details": null, + "vuln_exp_created": null, + "vuln_exp_updated": null, + "vuln_exp_created_by": null, + "vuln_exp_updated_by": null, + "vuln_exp_created_by_username": null, + "vuln_exp_updated_by_username": null + }, + { + "id": 54, + "cve": "CVE-2022-40304", + "cvss_version": "3.1", + "base_score": "7.8", + "severity": "HIGH", + "attack_vector": "LOCAL", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "component_name": "libxml2", + "component_version": "2.9.2-rc1", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": null, + "vuln_exp_status": null, + "vuln_exp_justification": null, + "vuln_exp_response": null, + "vuln_exp_details": null, + "vuln_exp_created": null, + "vuln_exp_updated": null, + "vuln_exp_created_by": null, + "vuln_exp_updated_by": null, + "vuln_exp_created_by_username": null, + "vuln_exp_updated_by_username": null + }, + { + "id": 7327, + "cve": "CVE-2025-27113", + "cvss_version": "3.1", + "base_score": "7.5", + "severity": "HIGH", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "component_name": "libxml2", + "component_version": "2.9.2-rc1", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": null, + "vuln_exp_status": null, + "vuln_exp_justification": null, + "vuln_exp_response": null, + "vuln_exp_details": null, + "vuln_exp_created": null, + "vuln_exp_updated": null, + "vuln_exp_created_by": null, + "vuln_exp_updated_by": null, + "vuln_exp_created_by_username": null, + "vuln_exp_updated_by_username": null + }, + { + "id": 3, + "cve": "CVE-2022-24771", + "cvss_version": "3.1", + "base_score": "7.5", + "severity": "HIGH", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "NONE", + "rejected": 0, + "component_id": 7, + "component_name": "node-forge", + "component_version": "1.0.0", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": null, + "vuln_exp_status": null, + "vuln_exp_justification": null, + "vuln_exp_response": null, + "vuln_exp_details": null, + "vuln_exp_created": null, + "vuln_exp_updated": null, + "vuln_exp_created_by": null, + "vuln_exp_updated_by": null, + "vuln_exp_created_by_username": null, + "vuln_exp_updated_by_username": null + }, + { + "id": 7321, + "cve": "CVE-2025-32415", + "cvss_version": "3.1", + "base_score": "7.5", + "severity": "HIGH", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "component_name": "libxml2", + "component_version": "2.9.2-rc1", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": null, + "vuln_exp_status": null, + "vuln_exp_justification": null, + "vuln_exp_response": null, + "vuln_exp_details": null, + "vuln_exp_created": null, + "vuln_exp_updated": null, + "vuln_exp_created_by": null, + "vuln_exp_updated_by": null, + "vuln_exp_created_by_username": null, + "vuln_exp_updated_by_username": null + }, + { + "id": 7320, + "cve": "CVE-2025-32414", + "cvss_version": "3.1", + "base_score": "7.5", + "severity": "HIGH", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "component_name": "libxml2", + "component_version": "2.9.2-rc1", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": null, + "vuln_exp_status": null, + "vuln_exp_justification": null, + "vuln_exp_response": null, + "vuln_exp_details": null, + "vuln_exp_created": null, + "vuln_exp_updated": null, + "vuln_exp_created_by": null, + "vuln_exp_updated_by": null, + "vuln_exp_created_by_username": null, + "vuln_exp_updated_by_username": null + }, + { + "id": 58, + "cve": "CVE-2024-25062", + "cvss_version": "3.1", + "base_score": "7.5", + "severity": "HIGH", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "component_name": "libxml2", + "component_version": "2.9.2-rc1", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": null, + "vuln_exp_status": null, + "vuln_exp_justification": null, + "vuln_exp_response": null, + "vuln_exp_details": null, + "vuln_exp_created": null, + "vuln_exp_updated": null, + "vuln_exp_created_by": null, + "vuln_exp_updated_by": null, + "vuln_exp_created_by_username": null, + "vuln_exp_updated_by_username": null + }, + { + "id": 53, + "cve": "CVE-2022-40303", + "cvss_version": "3.1", + "base_score": "7.5", + "severity": "HIGH", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "component_name": "libxml2", + "component_version": "2.9.2-rc1", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": null, + "vuln_exp_status": null, + "vuln_exp_justification": null, + "vuln_exp_response": null, + "vuln_exp_details": null, + "vuln_exp_created": null, + "vuln_exp_updated": null, + "vuln_exp_created_by": null, + "vuln_exp_updated_by": null, + "vuln_exp_created_by_username": null, + "vuln_exp_updated_by_username": null + }, + { + "id": 51, + "cve": "CVE-2022-23308", + "cvss_version": "3.1", + "base_score": "7.5", + "severity": "HIGH", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "component_name": "libxml2", + "component_version": "2.9.2-rc1", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": null, + "vuln_exp_status": null, + "vuln_exp_justification": null, + "vuln_exp_response": null, + "vuln_exp_details": null, + "vuln_exp_created": null, + "vuln_exp_updated": null, + "vuln_exp_created_by": null, + "vuln_exp_updated_by": null, + "vuln_exp_created_by_username": null, + "vuln_exp_updated_by_username": null + }, + { + "id": 46, + "cve": "CVE-2019-19956", + "cvss_version": "3.1", + "base_score": "7.5", + "severity": "HIGH", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "component_name": "libxml2", + "component_version": "2.9.2-rc1", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": null, + "vuln_exp_status": null, + "vuln_exp_justification": null, + "vuln_exp_response": null, + "vuln_exp_details": null, + "vuln_exp_created": null, + "vuln_exp_updated": null, + "vuln_exp_created_by": null, + "vuln_exp_updated_by": null, + "vuln_exp_created_by_username": null, + "vuln_exp_updated_by_username": null + }, + { + "id": 14354, + "cve": "CVE-2018-14404", + "cvss_version": "3.1", + "base_score": "7.5", + "severity": "HIGH", + "attack_vector": "N/A", + "attack_complexity": "N/A", + "availability_impact": "N/A", + "rejected": 0, + "component_id": 12, + "component_name": "libxml2", + "component_version": "2.9.2-rc1", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": null, + "vuln_exp_status": null, + "vuln_exp_justification": null, + "vuln_exp_response": null, + "vuln_exp_details": null, + "vuln_exp_created": null, + "vuln_exp_updated": null, + "vuln_exp_created_by": null, + "vuln_exp_updated_by": null, + "vuln_exp_created_by_username": null, + "vuln_exp_updated_by_username": null + }, + { + "id": 4, + "cve": "CVE-2022-24772", + "cvss_version": "3.1", + "base_score": "7.5", + "severity": "HIGH", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "NONE", + "rejected": 0, + "component_id": 7, + "component_name": "node-forge", + "component_version": "1.0.0", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": null, + "vuln_exp_status": null, + "vuln_exp_justification": null, + "vuln_exp_response": null, + "vuln_exp_details": null, + "vuln_exp_created": null, + "vuln_exp_updated": null, + "vuln_exp_created_by": null, + "vuln_exp_updated_by": null, + "vuln_exp_created_by_username": null, + "vuln_exp_updated_by_username": null + }, + { + "id": 2, + "cve": "CVE-2022-48285", + "cvss_version": "3.1", + "base_score": "7.3", + "severity": "HIGH", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "LOW", + "rejected": 0, + "component_id": 6, + "component_name": "jszip", + "component_version": "2.6.0", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": null, + "vuln_exp_status": null, + "vuln_exp_justification": null, + "vuln_exp_response": null, + "vuln_exp_details": null, + "vuln_exp_created": null, + "vuln_exp_updated": null, + "vuln_exp_created_by": null, + "vuln_exp_updated_by": null, + "vuln_exp_created_by_username": null, + "vuln_exp_updated_by_username": null + }, + { + "id": 14350, + "cve": "CVE-2017-18258", + "cvss_version": "3.1", + "base_score": "6.5", + "severity": "MEDIUM", + "attack_vector": "N/A", + "attack_complexity": "N/A", + "availability_impact": "N/A", + "rejected": 0, + "component_id": 12, + "component_name": "libxml2", + "component_version": "2.9.2-rc1", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": null, + "vuln_exp_status": null, + "vuln_exp_justification": null, + "vuln_exp_response": null, + "vuln_exp_details": null, + "vuln_exp_created": null, + "vuln_exp_updated": null, + "vuln_exp_created_by": null, + "vuln_exp_updated_by": null, + "vuln_exp_created_by_username": null, + "vuln_exp_updated_by_username": null + }, + { + "id": 50, + "cve": "CVE-2021-3541", + "cvss_version": "3.1", + "base_score": "6.5", + "severity": "MEDIUM", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "component_name": "libxml2", + "component_version": "2.9.2-rc1", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": null, + "vuln_exp_status": null, + "vuln_exp_justification": null, + "vuln_exp_response": null, + "vuln_exp_details": null, + "vuln_exp_created": null, + "vuln_exp_updated": null, + "vuln_exp_created_by": null, + "vuln_exp_updated_by": null, + "vuln_exp_created_by_username": null, + "vuln_exp_updated_by_username": null + }, + { + "id": 37, + "cve": "CVE-2016-9598", + "cvss_version": "3.1", + "base_score": "6.5", + "severity": "MEDIUM", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "component_name": "libxml2", + "component_version": "2.9.2-rc1", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": null, + "vuln_exp_status": null, + "vuln_exp_justification": null, + "vuln_exp_response": null, + "vuln_exp_details": null, + "vuln_exp_created": null, + "vuln_exp_updated": null, + "vuln_exp_created_by": null, + "vuln_exp_updated_by": null, + "vuln_exp_created_by_username": null, + "vuln_exp_updated_by_username": null + }, + { + "id": 52, + "cve": "CVE-2022-29824", + "cvss_version": "3.1", + "base_score": "6.5", + "severity": "MEDIUM", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "component_name": "libxml2", + "component_version": "2.9.2-rc1", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": null, + "vuln_exp_status": null, + "vuln_exp_justification": null, + "vuln_exp_response": null, + "vuln_exp_details": null, + "vuln_exp_created": null, + "vuln_exp_updated": null, + "vuln_exp_created_by": null, + "vuln_exp_updated_by": null, + "vuln_exp_created_by_username": null, + "vuln_exp_updated_by_username": null + }, + { + "id": 36, + "cve": "CVE-2016-9596", + "cvss_version": "3.1", + "base_score": "6.5", + "severity": "MEDIUM", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "component_name": "libxml2", + "component_version": "2.9.2-rc1", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": null, + "vuln_exp_status": null, + "vuln_exp_justification": null, + "vuln_exp_response": null, + "vuln_exp_details": null, + "vuln_exp_created": null, + "vuln_exp_updated": null, + "vuln_exp_created_by": null, + "vuln_exp_updated_by": null, + "vuln_exp_created_by_username": null, + "vuln_exp_updated_by_username": null + }, + { + "id": 55, + "cve": "CVE-2023-28484", + "cvss_version": "3.1", + "base_score": "6.5", + "severity": "MEDIUM", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "component_name": "libxml2", + "component_version": "2.9.2-rc1", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": null, + "vuln_exp_status": null, + "vuln_exp_justification": null, + "vuln_exp_response": null, + "vuln_exp_details": null, + "vuln_exp_created": null, + "vuln_exp_updated": null, + "vuln_exp_created_by": null, + "vuln_exp_updated_by": null, + "vuln_exp_created_by_username": null, + "vuln_exp_updated_by_username": null + }, + { + "id": 56, + "cve": "CVE-2023-29469", + "cvss_version": "3.1", + "base_score": "6.5", + "severity": "MEDIUM", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "component_name": "libxml2", + "component_version": "2.9.2-rc1", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": 32, + "vuln_exp_status": "not_affected", + "vuln_exp_justification": "protected_at_runtime", + "vuln_exp_response": "will_not_fix", + "vuln_exp_details": null, + "vuln_exp_created": "2025-07-03 13:50:08", + "vuln_exp_updated": "2025-07-03 15:50:16", + "vuln_exp_created_by": 3, + "vuln_exp_updated_by": 3, + "vuln_exp_created_by_username": "tomas.gonzalez@fossid.com", + "vuln_exp_updated_by_username": "tomas.gonzalez@fossid.com" + }, + { + "id": 57, + "cve": "CVE-2023-45322", + "cvss_version": "3.1", + "base_score": "6.5", + "severity": "MEDIUM", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "component_name": "libxml2", + "component_version": "2.9.2-rc1", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": 31, + "vuln_exp_status": "false_positive", + "vuln_exp_justification": "code_not_present", + "vuln_exp_response": "will_not_fix", + "vuln_exp_details": null, + "vuln_exp_created": "2025-07-03 13:49:53", + "vuln_exp_updated": "2025-07-03 15:50:05", + "vuln_exp_created_by": 3, + "vuln_exp_updated_by": 3, + "vuln_exp_created_by_username": "tomas.gonzalez@fossid.com", + "vuln_exp_updated_by_username": "tomas.gonzalez@fossid.com" + }, + { + "id": 28, + "cve": "CVE-2016-3709", + "cvss_version": "3.1", + "base_score": "6.1", + "severity": "MEDIUM", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "NONE", + "rejected": 0, + "component_id": 12, + "component_name": "libxml2", + "component_version": "2.9.2-rc1", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": 30, + "vuln_exp_status": "in_triage", + "vuln_exp_justification": null, + "vuln_exp_response": null, + "vuln_exp_details": null, + "vuln_exp_created": "2025-07-03 13:49:47", + "vuln_exp_updated": "2025-07-03 15:49:47", + "vuln_exp_created_by": 3, + "vuln_exp_updated_by": 3, + "vuln_exp_created_by_username": "tomas.gonzalez@fossid.com", + "vuln_exp_updated_by_username": "tomas.gonzalez@fossid.com" + }, + { + "id": 49, + "cve": "CVE-2021-3537", + "cvss_version": "3.1", + "base_score": "5.9", + "severity": "MEDIUM", + "attack_vector": "NETWORK", + "attack_complexity": "HIGH", + "availability_impact": "HIGH", + "rejected": 0, + "component_id": 12, + "component_name": "libxml2", + "component_version": "2.9.2-rc1", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": 29, + "vuln_exp_status": "resolved", + "vuln_exp_justification": "code_not_present", + "vuln_exp_response": "update,will_not_fix", + "vuln_exp_details": null, + "vuln_exp_created": "2025-07-03 13:49:22", + "vuln_exp_updated": "2025-07-03 15:49:44", + "vuln_exp_created_by": 3, + "vuln_exp_updated_by": 3, + "vuln_exp_created_by_username": "tomas.gonzalez@fossid.com", + "vuln_exp_updated_by_username": "tomas.gonzalez@fossid.com" + }, + { + "id": 1, + "cve": "CVE-2021-23413", + "cvss_version": "3.1", + "base_score": "5.3", + "severity": "MEDIUM", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "LOW", + "rejected": 0, + "component_id": 6, + "component_name": "jszip", + "component_version": "2.6.0", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": 28, + "vuln_exp_status": "in_triage", + "vuln_exp_justification": null, + "vuln_exp_response": null, + "vuln_exp_details": null, + "vuln_exp_created": "2025-07-03 13:49:13", + "vuln_exp_updated": "2025-07-03 15:49:13", + "vuln_exp_created_by": 3, + "vuln_exp_updated_by": 3, + "vuln_exp_created_by_username": "tomas.gonzalez@fossid.com", + "vuln_exp_updated_by_username": "tomas.gonzalez@fossid.com" + }, + { + "id": 5, + "cve": "CVE-2022-24773", + "cvss_version": "3.1", + "base_score": "5.3", + "severity": "MEDIUM", + "attack_vector": "NETWORK", + "attack_complexity": "LOW", + "availability_impact": "NONE", + "rejected": 0, + "component_id": 7, + "component_name": "node-forge", + "component_version": "1.0.0", + "scan_id": 772, + "scan_code": "ScanZIPwithShinobiAutoID_772", + "vuln_exp_id": null, + "vuln_exp_status": null, + "vuln_exp_justification": null, + "vuln_exp_response": null, + "vuln_exp_details": null, + "vuln_exp_created": null, + "vuln_exp_updated": null, + "vuln_exp_created_by": null, + "vuln_exp_updated_by": null, + "vuln_exp_created_by_username": null, + "vuln_exp_updated_by_username": null + } + ] +} \ No newline at end of file From 5adef369be7568ae6a3f2a271415df8a8e8f8109 Mon Sep 17 00:00:00 2001 From: Tomas Gonzalez Date: Fri, 4 Jul 2025 01:14:31 -0400 Subject: [PATCH 2/9] functional v1 of SARIF export yay! --- src/workbench_cli/api/components_api.py | 54 + .../api/helpers/component_info_normalizer.py | 46 + src/workbench_cli/api/workbench_api.py | 3 +- src/workbench_cli/cli.py | 36 +- src/workbench_cli/handlers/export_sarif.py | 257 +++- src/workbench_cli/handlers/show_results.py | 4 - .../utilities/component_enrichment.py | 228 +++ .../utilities/sarif_converter.py | 1238 ----------------- .../utilities/sarif_generation.py | 987 +++++++++++++ src/workbench_cli/utilities/scan_workflows.py | 38 +- .../utilities/vulnerability_enricher.py | 66 +- tests/unit/handlers/test_export_sarif.py | 144 +- tests/unit/handlers/test_show_results.py | 73 +- tests/unit/utilities/test_sarif_converter.py | 108 +- tests/unit/utilities/test_scan_workflows.py | 85 +- .../utilities/test_vulnerability_enricher.py | 44 +- 16 files changed, 1709 insertions(+), 1702 deletions(-) create mode 100644 src/workbench_cli/api/components_api.py create mode 100644 src/workbench_cli/api/helpers/component_info_normalizer.py create mode 100644 src/workbench_cli/utilities/component_enrichment.py delete mode 100644 src/workbench_cli/utilities/sarif_converter.py create mode 100644 src/workbench_cli/utilities/sarif_generation.py diff --git a/src/workbench_cli/api/components_api.py b/src/workbench_cli/api/components_api.py new file mode 100644 index 0000000..468bce1 --- /dev/null +++ b/src/workbench_cli/api/components_api.py @@ -0,0 +1,54 @@ +from typing import Dict, Any + +import logging + +from ..exceptions import ApiError +from .helpers.api_base import APIBase +from .helpers.component_info_normalizer import normalize_component_response + +logger = logging.getLogger("workbench-cli") + + +class ComponentsAPI(APIBase): + """Workbench API Component Operations.""" + + def get_component_information(self, component_name: str, component_version: str) -> Dict[str, Any]: + """Retrieve component metadata from Workbench. + + Args: + component_name: The component or package name (e.g. "ansi-regex"). + component_version: The component version (e.g. "1.1.1"). + + Returns: + Dictionary with the component information as returned by the API. + + Raises: + ApiError: If the component does not exist or the API request fails. + """ + logger.debug( + "Fetching information for component '%s' version '%s'...", + component_name, + component_version, + ) + + payload = { + "group": "components", + "action": "get_information", + "data": { + "component_name": component_name, + "component_version": component_version, + }, + } + + response = self._send_request(payload) + + # Successful response + if response.get("status") == "1" and "data" in response: + return normalize_component_response(response["data"]) + + # Something went wrong – build a helpful error message + error_msg = response.get("error", f"Unexpected response: {response}") + raise ApiError( + f"Failed to fetch information for component '{component_name}' version '{component_version}': {error_msg}", + details=response, + ) diff --git a/src/workbench_cli/api/helpers/component_info_normalizer.py b/src/workbench_cli/api/helpers/component_info_normalizer.py new file mode 100644 index 0000000..53fd5dc --- /dev/null +++ b/src/workbench_cli/api/helpers/component_info_normalizer.py @@ -0,0 +1,46 @@ +from typing import Any, Dict, List + +# Fields that callers actively use; expand if more become important. +_EXPECTED_FIELDS = { + "id", + "cpe", + "name", + "version", + "purl", + "purl_type", + "purl_namespace", + "purl_name", + "purl_version", + "supplier_name", + "supplier_url", + "license_identifier", + "license_name", + "comment", +} + + +def normalize_component_response(raw: Any) -> Dict[str, Any]: + """Return a stable dict from the Workbench *components/get_information* response. + + Workbench 25.x sometimes returns the *data* field as a single-element list, or + as a dict. Future versions may rename or add keys. This helper: + • Converts list→dict when length==1. + • Ignores unknown fields (passes through only those we care about). + • Returns an empty dict on unexpected structures. + """ + # 1. Normalise list ↔ dict + if isinstance(raw, list): + raw = raw[0] if raw else {} + if not isinstance(raw, dict): + return {} + + # 2. Map any known aliases between versions (none yet, but placeholder) + aliases = { + # "licenseId": "license_id", # example if it appears in another version + } + for old, new in aliases.items(): + if old in raw and new not in raw: + raw[new] = raw.pop(old) + + # 3. Return only expected fields (others are ignored to shield callers) + return {field: raw.get(field) for field in _EXPECTED_FIELDS if field in raw} \ No newline at end of file diff --git a/src/workbench_cli/api/workbench_api.py b/src/workbench_cli/api/workbench_api.py index d4d6c27..2428957 100644 --- a/src/workbench_cli/api/workbench_api.py +++ b/src/workbench_cli/api/workbench_api.py @@ -8,6 +8,7 @@ from .projects_api import ProjectsAPI from .scans_api import ScansAPI from .vulnerabilities_api import VulnerabilitiesAPI +from .components_api import ComponentsAPI from ..exceptions import ( WorkbenchCLIError, ApiError, @@ -35,7 +36,7 @@ # Assume logger is configured in main.py logger = logging.getLogger("workbench-cli") -class WorkbenchAPI(UploadAPI, ResolveWorkbenchProjectScan, ProjectsAPI, VulnerabilitiesAPI, ScansAPI): +class WorkbenchAPI(UploadAPI, ResolveWorkbenchProjectScan, ProjectsAPI, VulnerabilitiesAPI, ScansAPI, ComponentsAPI): """ Workbench API client class for interacting with the FossID Workbench API. This class composes all the individual API parts into a single client. diff --git a/src/workbench_cli/cli.py b/src/workbench_cli/cli.py index 92ca33b..b33f4a5 100644 --- a/src/workbench_cli/cli.py +++ b/src/workbench_cli/cli.py @@ -53,7 +53,6 @@ def add_common_result_options(subparser): results_display_args.add_argument("--show-policy-warnings", help="Shows Policy Warnings in identified components or dependencies.", action="store_true", default=False) results_display_args.add_argument("--show-vulnerabilities", help="Shows a summary of vulnerabilities found in the scan.", action="store_true", default=False) results_display_args.add_argument("--json-result-path", help="Saves the requested results to this file/directory (JSON format).", metavar="PATH") - results_display_args.add_argument("--sarif-result-path", help="Saves vulnerability results to this file in SARIF format (only works with --show-vulnerabilities).", metavar="PATH") # --- Main Parsing Function --- def parse_cmdline_args(): @@ -118,17 +117,17 @@ def parse_cmdline_args(): # Export vulnerability results in SARIF format for security tooling workbench-cli --api-url --api-user --api-token \\ - export-sarif --project-name MYPROJ --scan-name MYSCAN01 --output security-report.sarif + export-sarif --project-name MYPROJ --scan-name MYSCAN01 -o security-report.sarif - # Export SARIF with custom enrichment options + # Export SARIF with custom enrichment and filtering options workbench-cli --api-url --api-user --api-token \\ - export-sarif --project-name MYPROJ --scan-name MYSCAN01 --output vulns.sarif \\ - --no-enrich-epss --no-enrich-cisa-kev --external-timeout 60 --severity-threshold high + export-sarif --project-name MYPROJ --scan-name MYSCAN01 -o vulns.sarif \\ + --enrich-epss --enrich-cisa-kev --severity-threshold high --disable-vex-suppression - # Export SARIF in offline mode (no external enrichment) + # Export SARIF without external enrichment (default behavior) workbench-cli --api-url --api-user --api-token \\ - export-sarif --project-name MYPROJ --scan-name MYSCAN01 --output vulns.sarif \\ - --skip-enrichment --quiet + export-sarif --project-name MYPROJ --scan-name MYSCAN01 -o vulns.sarif \\ + --quiet """ ) @@ -324,28 +323,19 @@ def parse_cmdline_args(): required_args = export_sarif_parser.add_argument_group("Required") required_args.add_argument("--project-name", help="Project name containing the scan.", type=str, required=True, metavar="NAME") required_args.add_argument("--scan-name", help="Scan name to export vulnerability results from.", type=str, required=True, metavar="NAME") - required_args.add_argument("--output", help="Output file path for the SARIF report (Default: vulns.sarif).", type=str, default="vulns.sarif", metavar="PATH") - - # Workbench data sources - workbench_data_args = export_sarif_parser.add_argument_group("Workbench Data Sources") - workbench_data_args.add_argument("--include-vex", help="Include VEX assessments from Workbench (Default: True).", action=argparse.BooleanOptionalAction, default=True) - workbench_data_args.add_argument("--severity-threshold", help="Filter vulnerabilities by CVSS severity.", choices=["critical", "high", "medium", "low"], metavar="LEVEL") - workbench_data_args.add_argument("--include-scan-metadata", help="Include scan timing, settings, and other metadata (Default: True).", action=argparse.BooleanOptionalAction, default=True) + required_args.add_argument("-o", "--output", help="Output file path for the SARIF report (Default: vulns.sarif).", type=str, default="vulns.sarif", metavar="PATH") # External API enrichment external_api_args = export_sarif_parser.add_argument_group("External API Enrichment (Network Calls)") - external_api_args.add_argument("--enrich-nvd", help="Fetch CVE descriptions from NVD API (Default: True).", action=argparse.BooleanOptionalAction, default=True) - external_api_args.add_argument("--enrich-epss", help="Fetch EPSS scores from FIRST API (Default: True).", action=argparse.BooleanOptionalAction, default=True) - external_api_args.add_argument("--enrich-cisa-kev", help="Fetch CISA Known Exploited Vulnerabilities (Default: True).", action=argparse.BooleanOptionalAction, default=True) + external_api_args.add_argument("--enrich-nvd", help="Fetch CVE descriptions from NVD API (Default: False - opt-in).", action=argparse.BooleanOptionalAction, default=False) + external_api_args.add_argument("--enrich-epss", help="Fetch EPSS scores from FIRST API (Default: False - opt-in).", action=argparse.BooleanOptionalAction, default=False) + external_api_args.add_argument("--enrich-cisa-kev", help="Fetch CISA Known Exploited Vulnerabilities (Default: False - opt-in).", action=argparse.BooleanOptionalAction, default=False) external_api_args.add_argument("--external-timeout", help="Timeout for external API calls in seconds (Default: 30).", type=int, default=30, metavar="SECONDS") - external_api_args.add_argument("--skip-enrichment", help="Skip all external enrichment (offline mode).", action="store_true") # Output processing & suppression processing_args = export_sarif_parser.add_argument_group("Output Processing & Suppression") - processing_args.add_argument("--suppress-vex-mitigated", help="Suppress findings with VEX mitigation status (Default: True).", action=argparse.BooleanOptionalAction, default=True) - processing_args.add_argument("--suppress-accepted-risk", help="Suppress findings marked as accepted risk (Default: True).", action=argparse.BooleanOptionalAction, default=True) - processing_args.add_argument("--suppress-false-positives", help="Suppress findings marked as false positives (Default: True).", action=argparse.BooleanOptionalAction, default=True) - processing_args.add_argument("--group-by-component", help="Group findings by component in SARIF (Default: True).", action=argparse.BooleanOptionalAction, default=True) + processing_args.add_argument("--severity-threshold", help="Filter vulnerabilities by CVSS severity.", choices=["critical", "high", "medium", "low"], metavar="LEVEL") + processing_args.add_argument("--disable-vex-suppression", help="Disable automatic suppression of VEX-assessed findings (mitigated, accepted risk, false positives).", action="store_true") # Output control output_control_args = export_sarif_parser.add_argument_group("Output Control") diff --git a/src/workbench_cli/handlers/export_sarif.py b/src/workbench_cli/handlers/export_sarif.py index 6eb71d2..a7473da 100644 --- a/src/workbench_cli/handlers/export_sarif.py +++ b/src/workbench_cli/handlers/export_sarif.py @@ -2,14 +2,13 @@ import logging import argparse -from typing import TYPE_CHECKING +from typing import TYPE_CHECKING, List, Dict, Any from ..utilities.error_handling import handler_error_wrapper -from ..utilities.sarif_converter import save_vulns_to_sarif +from ..utilities.sarif_generation import save_vulns_to_sarif from ..exceptions import ( ApiError, NetworkError, - ValidationError, ProcessTimeoutError, ProcessError ) @@ -32,6 +31,7 @@ def handle_export_sarif(workbench: "WorkbenchAPI", params: argparse.Namespace) - Returns: bool: True if the operation was successful """ + print(f"\n--- Running {params.command.upper()} Command ---") # Resolve project and scan (find only) @@ -57,11 +57,12 @@ def handle_export_sarif(workbench: "WorkbenchAPI", params: argparse.Namespace) - # Fetch vulnerability data if not params.quiet: - print("\nFetching vulnerability data for SARIF export...") + print("\n🔍 Fetching data from Workbench...") try: vulnerabilities = workbench.list_vulnerabilities(scan_code) # Apply severity filtering if specified + severity_threshold_text = "" if getattr(params, 'severity_threshold', None): severity_order = {'critical': 4, 'high': 3, 'medium': 2, 'low': 1} min_severity = severity_order.get(params.severity_threshold.lower(), 0) @@ -70,63 +71,80 @@ def handle_export_sarif(workbench: "WorkbenchAPI", params: argparse.Namespace) - vuln for vuln in vulnerabilities if severity_order.get(vuln.get('severity', '').lower(), 0) >= min_severity ] - if not params.quiet and original_count != len(vulnerabilities): - print(f"Filtered {original_count - len(vulnerabilities)} vulnerabilities below {params.severity_threshold} severity") + severity_threshold_text = f" (Severity Threshold: {params.severity_threshold.upper()})" + else: + severity_threshold_text = "" + + # Extract configuration values from parameters + nvd_enrichment = getattr(params, 'enrich_nvd', False) + epss_enrichment = getattr(params, 'enrich_epss', False) + cisa_kev_enrichment = getattr(params, 'enrich_cisa_kev', False) + api_timeout = getattr(params, 'external_timeout', 30) + enable_vex_suppression = not getattr(params, 'disable_vex_suppression', False) + quiet = getattr(params, 'quiet', False) if not vulnerabilities: if not params.quiet: print("⚠️ No vulnerabilities found in the scan.") print("An empty SARIF report will be generated.") + external_data = {} else: if not params.quiet: - print(f"✅ Found {len(vulnerabilities)} vulnerabilities to export.") + # Step 1: Show vulnerability and VEX retrieval + print(f"\n📋 Retrieving Vulnerabilities and VEX...") - # Display summary of what will be included - severity_counts = {} - vex_counts = {"with_vex": 0, "without_vex": 0} + # Combine vulnerability count and severity breakdown in one line + from ..utilities.sarif_generation import _calculate_severity_distribution, _format_severity_breakdown_compact + severity_dist = _calculate_severity_distribution(vulnerabilities) + severity_breakdown = _format_severity_breakdown_compact(severity_dist) + print(f" • Retrieved {len(vulnerabilities)} Vulnerabilities{severity_threshold_text} {severity_breakdown}") + _display_vex_summary(vulnerabilities, indent=" ") - for vuln in vulnerabilities: - severity = vuln.get("severity", "UNKNOWN") - severity_counts[severity] = severity_counts.get(severity, 0) + 1 - - # Check for VEX information - if vuln.get("vuln_exp_id"): - vex_counts["with_vex"] += 1 - else: - vex_counts["without_vex"] += 1 + # Step 2: Pre-fetch component information + print(f"\n🔧 Retrieving Component Information...") + from ..utilities.component_enrichment import prefetch_component_info - print("\n📊 Vulnerability Summary:") - for severity, count in sorted(severity_counts.items()): - print(f" • {severity}: {count}") + # Count unique components before fetching + unique_components = list(set( + f"{vuln.get('component_name', 'Unknown')}@{vuln.get('component_version', 'Unknown')}" + for vuln in vulnerabilities + if vuln.get("component_name") and vuln.get("component_version") + )) + component_count = len(unique_components) - if vex_counts["with_vex"] > 0: - print(f"\n📋 VEX Information:") - print(f" • With VEX assessments: {vex_counts['with_vex']}") - print(f" • Without VEX assessments: {vex_counts['without_vex']}") - - # Display export configuration - if not params.quiet: - print(f"\n🔧 SARIF Export Configuration:") - print(f" • Output file: {params.output}") - print(f" • Include VEX assessments: {params.include_vex}") - if params.severity_threshold: - print(f" • Severity threshold: {params.severity_threshold}") - print(f" • Include scan metadata: {params.include_scan_metadata}") - - # External enrichment status - if params.skip_enrichment: - print(f" • External enrichment: DISABLED (offline mode)") + prefetch_component_info(vulnerabilities, quiet=True) # Always quiet to suppress progress messages + print(f" • Component information retrieved for {component_count} Components") + + # Step 3: Perform external enrichment and display status + external_data = _perform_external_enrichment( + vulnerabilities, + nvd_enrichment, + epss_enrichment, + cisa_kev_enrichment, + api_timeout + ) + + # Step 4: Show Dynamic Scoring section + _display_dynamic_scoring( + vulnerabilities, + enable_vex_suppression, + external_data + ) else: - print(f" • Enrich with NVD descriptions: {params.enrich_nvd}") - print(f" • Enrich with EPSS scores: {params.enrich_epss}") - print(f" • Enrich with CISA KEV: {params.enrich_cisa_kev}") - print(f" • External API timeout: {params.external_timeout}s") - - # Suppression settings - print(f" • Suppress VEX mitigated: {params.suppress_vex_mitigated}") - print(f" • Suppress accepted risk: {params.suppress_accepted_risk}") - print(f" • Suppress false positives: {params.suppress_false_positives}") - print(f" • Group by component: {params.group_by_component}") + # Still need to fetch external data for SARIF generation, but quietly + from ..utilities.sarif_generation import _fetch_external_enrichment_data + from ..utilities.component_enrichment import prefetch_component_info + + # Pre-fetch component information quietly (no progress messages) + prefetch_component_info(vulnerabilities, quiet=True) + + external_data = _fetch_external_enrichment_data( + vulnerabilities, + nvd_enrichment, + epss_enrichment, + cisa_kev_enrichment, + api_timeout + ) # Export to SARIF if not params.quiet: @@ -135,28 +153,18 @@ def handle_export_sarif(workbench: "WorkbenchAPI", params: argparse.Namespace) - filepath=params.output, vulnerabilities=vulnerabilities, scan_code=scan_code, - include_cve_descriptions=params.enrich_nvd if not params.skip_enrichment else False, - include_epss_scores=params.enrich_epss if not params.skip_enrichment else False, - include_exploit_info=params.enrich_cisa_kev if not params.skip_enrichment else False, - api_timeout=params.external_timeout, - include_vex=params.include_vex, - include_scan_metadata=params.include_scan_metadata, - suppress_vex_mitigated=params.suppress_vex_mitigated, - suppress_accepted_risk=params.suppress_accepted_risk, - suppress_false_positives=params.suppress_false_positives, - group_by_component=params.group_by_component, - quiet=params.quiet + external_data=external_data, + nvd_enrichment=nvd_enrichment, + epss_enrichment=epss_enrichment, + cisa_kev_enrichment=cisa_kev_enrichment, + api_timeout=api_timeout, + enable_vex_suppression=enable_vex_suppression, + quiet=quiet ) if not params.quiet: print(f"\n✅ SARIF export completed successfully!") print(f"📄 Report saved to: {params.output}") - - # Provide integration guidance - print(f"\n💡 Integration Tips:") - print(f" • Upload to GitHub: Add this file to your repository for GitHub Advanced Security integration") - print(f" • CI/CD Integration: Use this report in your security scanning pipeline") - print(f" • Security Tools: Import into SARIF-compatible security analysis tools") return True @@ -165,4 +173,119 @@ def handle_export_sarif(workbench: "WorkbenchAPI", params: argparse.Namespace) - if isinstance(e, (ApiError, NetworkError, ProcessTimeoutError, ProcessError)): raise else: - raise ProcessError(f"Failed to export vulnerability data to SARIF format: {str(e)}") \ No newline at end of file + raise ProcessError(f"Failed to export vulnerability data to SARIF format: {str(e)}") + + +# Configuration function removed - CLI arguments now used directly + + +def _perform_external_enrichment( + vulnerabilities: List[Dict[str, Any]], + nvd_enrichment: bool, + epss_enrichment: bool, + cisa_kev_enrichment: bool, + api_timeout: int +) -> Dict[str, Dict[str, Any]]: + """Perform external enrichment and display status messages.""" + import os + from ..utilities.sarif_generation import _fetch_external_enrichment_data + + # Show enrichment status + enrichment_sources = [] + if nvd_enrichment: + enrichment_sources.append("NVD") + if epss_enrichment: + enrichment_sources.append("EPSS") + if cisa_kev_enrichment: + enrichment_sources.append("CISA KEV") + + if enrichment_sources: + print(f"\n🔍 External Enrichment: {', '.join(enrichment_sources)}") + + # Get unique CVEs for display + from ..utilities.sarif_generation import _extract_unique_cves + unique_cves = _extract_unique_cves(vulnerabilities) + + # Show custom NVD message if NVD enrichment is enabled + if nvd_enrichment and unique_cves: + print(f" 📋 Fetching additional details for {len(unique_cves)} CVEs from NVD") + if not os.environ.get('NVD_API_KEY'): + print(f" 💡 For faster performance, set the 'NVD_API_KEY' environment variable") + + # Perform the actual enrichment with suppressed logging + # Temporarily increase logging level to suppress INFO messages + import logging + nvd_logger = logging.getLogger('workbench_cli.utilities.vulnerability_enricher') + original_level = nvd_logger.level + nvd_logger.setLevel(logging.WARNING) + + try: + external_data = _fetch_external_enrichment_data( + vulnerabilities, + nvd_enrichment, + epss_enrichment, + cisa_kev_enrichment, + api_timeout + ) + finally: + nvd_logger.setLevel(original_level) + + # Show EPSS results if EPSS enrichment was enabled + if epss_enrichment and external_data: + epss_count = sum(1 for cve_data in external_data.values() if cve_data.get('epss_score') is not None) + if epss_count > 0: + print(f" 📊 EPSS scores retrieved for {epss_count} CVEs") + + return external_data + else: + print(f"\n🔍 External Enrichment: DISABLED") + return {} + + + + + +def _display_vex_summary(vulnerabilities: List[Dict[str, Any]], indent: str = "") -> None: + """Display VEX assessment information in a concise format.""" + from ..utilities.sarif_generation import _count_vex_assessments + vex_counts = _count_vex_assessments(vulnerabilities) + + if vex_counts["total_with_vex"] > 0: + print(f"{indent}• Retrieved VEX for {vex_counts['total_with_vex']}/{len(vulnerabilities)} CVEs [Status: {vex_counts['with_status']}, Response: {vex_counts['with_response']}]") + + +def _display_dynamic_scoring( + vulnerabilities: List[Dict[str, Any]], + enable_vex_suppression: bool, + external_data: Dict[str, Dict[str, Any]] +) -> None: + """Display dynamic scoring information including both suppressions and promotions.""" + from ..utilities.sarif_generation import _count_high_risk_vulnerabilities, _count_vex_assessments + + print(f"\n🔧 Dynamic Scoring:") + + # Show VEX suppression + vex_counts = _count_vex_assessments(vulnerabilities) + if enable_vex_suppression and vex_counts["total_with_vex"] > 0: + if vex_counts["suppressed"] > 0: + print(f" • VEX Risk: {vex_counts['suppressed']} CVEs Suppressed") + else: + print(f" • VEX Suppression: Enabled (no CVEs Suppressed)") + else: + print(f" • VEX Suppression: {'Enabled' if enable_vex_suppression else 'Disabled'}") + + # Show high-risk vulnerability information with promotion details + if external_data: + high_risk_counts = _count_high_risk_vulnerabilities(vulnerabilities, external_data) + + # Show EPSS promotions + if high_risk_counts.get("high_epss", 0) > 0: + print(f" • EPSS Risk: {high_risk_counts['high_epss']} CVEs Escalated") + + # Show CISA KEV if present + if high_risk_counts.get("cisa_kev", 0) > 0: + print(f" • CISA KEV: {high_risk_counts['cisa_kev']} CVEs Escalated") + + # Show VEX-based promotions (exploitable CVEs get promoted to 'error' level) + if vex_counts["total_with_vex"] > 0 and vex_counts["exploitable"] > 0: + print(f" • VEX Risk: {vex_counts['exploitable']} CVEs Escalated") \ No newline at end of file diff --git a/src/workbench_cli/handlers/show_results.py b/src/workbench_cli/handlers/show_results.py index e5e9ef7..3d12e28 100644 --- a/src/workbench_cli/handlers/show_results.py +++ b/src/workbench_cli/handlers/show_results.py @@ -42,10 +42,6 @@ def handle_show_results(workbench: "WorkbenchAPI", params: argparse.Namespace) - if not any(show_flags): raise ValidationError("At least one '--show-*' flag must be provided to display results") - # Validate SARIF output requirements - if getattr(params, 'sarif_result_path', None) and not params.show_vulnerabilities: - raise ValidationError("--sarif-result-path requires --show-vulnerabilities flag") - # Resolve project and scan (find only) print("\nResolving scan for results display...") project_code = workbench.resolve_project(params.project_name, create_if_missing=False) diff --git a/src/workbench_cli/utilities/component_enrichment.py b/src/workbench_cli/utilities/component_enrichment.py new file mode 100644 index 0000000..268860f --- /dev/null +++ b/src/workbench_cli/utilities/component_enrichment.py @@ -0,0 +1,228 @@ +""" +Workbench‐specific component enrichment helpers. + +This module centralises all logic required to enrich vulnerability results with +component-level metadata that can be fetched from a Workbench instance. The +functions were previously implemented in utilities.sarif_converter but have +been moved here for better separation of concerns. +""" + +from __future__ import annotations + +import logging +import os +from typing import Dict, Any, Optional, Tuple, List +from concurrent.futures import ThreadPoolExecutor, as_completed + +from ..api.components_api import ComponentsAPI +from ..exceptions import ApiError, NetworkError + +logger = logging.getLogger(__name__) + +# Cache to avoid repeated API lookups per component-version +_COMPONENT_ECOSYSTEM_CACHE: Dict[Tuple[str, str], str] = {} +# Cache for full component records +_COMPONENT_INFO_CACHE: Dict[Tuple[str, str], Dict[str, Any]] = {} + + +def prefetch_component_info(vulnerabilities: List[Dict[str, Any]], quiet: bool = False) -> None: + """Pre-fetch component information for all unique components in parallel. + + This function identifies all unique component/version pairs from the vulnerabilities + and fetches their information from the Workbench API in parallel, populating the + cache so that subsequent calls to _get_component_info are instant. + + Args: + vulnerabilities: List of vulnerability dictionaries + quiet: If True, suppress progress messages + """ + if not vulnerabilities: + return + + # Extract unique component/version pairs + unique_components = set() + for vuln in vulnerabilities: + component_name = vuln.get("component_name") + component_version = vuln.get("component_version") + if component_name and component_version: + unique_components.add((component_name, component_version)) + + # Filter out already cached components + components_to_fetch = [ + (name, version) for name, version in unique_components + if (name, version) not in _COMPONENT_INFO_CACHE + ] + + if not components_to_fetch: + return # All components already cached + + # Check if we have API credentials + api_url = os.getenv("WORKBENCH_URL") + api_user = os.getenv("WORKBENCH_USER") + api_token = os.getenv("WORKBENCH_TOKEN") + + if not (api_url and api_user and api_token): + # No credentials, populate cache with empty dictionaries + for name, version in components_to_fetch: + _COMPONENT_INFO_CACHE[(name, version)] = {} + return + + if not quiet: + print(f" 🔧 Pre-fetching component information for {len(components_to_fetch)} components...") + + # Fetch component information in parallel + successful_fetches = 0 + with ThreadPoolExecutor(max_workers=5) as executor: + # Submit all fetch tasks + future_to_component = { + executor.submit(_fetch_single_component_info, name, version, api_url, api_user, api_token): (name, version) + for name, version in components_to_fetch + } + + # Process results as they complete + for future in as_completed(future_to_component): + name, version = future_to_component[future] + try: + info = future.result() + _COMPONENT_INFO_CACHE[(name, version)] = info + if info: # Only count non-empty results as successful + successful_fetches += 1 + except Exception as e: + logger.debug(f"Failed to fetch component info for {name}@{version}: {e}") + # Store empty dict to avoid re-fetching + _COMPONENT_INFO_CACHE[(name, version)] = {} + + if not quiet and successful_fetches > 0: + print(f" ✅ Component information retrieved for {successful_fetches} components") + + +def _fetch_single_component_info(component_name: str, component_version: str, + api_url: str, api_user: str, api_token: str) -> Dict[str, Any]: + """Fetch component information for a single component (used by prefetch_component_info).""" + try: + api_client = ComponentsAPI(api_url, api_user, api_token) + info = api_client.get_component_information(component_name, component_version) or {} + return info + except (ApiError, NetworkError, Exception): + # Best-effort enrichment – no hard failure + logger.debug(f"Component information lookup failed for {component_name}@{component_version}", exc_info=True) + return {} + + +def _get_component_info(component_name: str, component_version: Optional[str]) -> Dict[str, Any]: + """Return a cached Workbench component record. + + If the current process has not yet looked up this *(name, version)* pair it + will call the Components API and cache the result for the remainder of the + CLI execution. When credentials are not configured we simply return an + empty dict so SARIF generation can continue in *offline* mode. + + Note: This function now primarily serves as a fallback for cases where + prefetch_component_info hasn't been called. For best performance, use + prefetch_component_info before calling SARIF generation functions. + """ + if not component_name or not component_version: + return {} + + cache_key = (component_name, component_version) + if cache_key in _COMPONENT_INFO_CACHE: + return _COMPONENT_INFO_CACHE[cache_key] + + api_url = os.getenv("WORKBENCH_URL") + api_user = os.getenv("WORKBENCH_USER") + api_token = os.getenv("WORKBENCH_TOKEN") + + # CLI guarantees these are set, but this function may be imported in test + # contexts where they are missing. + if not (api_url and api_user and api_token): + return {} + + try: + api_client = ComponentsAPI(api_url, api_user, api_token) + info = api_client.get_component_information(component_name, component_version) or {} + _COMPONENT_INFO_CACHE[cache_key] = info + return info + except (ApiError, NetworkError, Exception): # pragma: no cover – network issues + # Best-effort enrichment – no hard failure. + logger.debug("Component information lookup failed", exc_info=True) + return {} + + +def _detect_package_ecosystem( + component_name: str, + component_version: Optional[str] = None, + purl: Optional[str] = None, +) -> str: + """Best-effort guess of the package ecosystem for *component_name*. + + Detection strategy (in order): + 1. If *purl* is supplied, parse its *type* segment. + 2. If *(name, version)* is available, query the Components API which + usually stores a canonical PURL. + 3. Fallback to heuristics on the component name. + """ + + # 1. Parse the provided PURL if present + if purl and purl.startswith("pkg:"): + try: + return purl[4:].split("/", 1)[0] + except Exception: + pass # Fall back to other methods + + # 2. Use cache or query Components API when we have a version + if component_version: + cache_key = (component_name, component_version) + if cache_key in _COMPONENT_ECOSYSTEM_CACHE: + return _COMPONENT_ECOSYSTEM_CACHE[cache_key] + + # Use cached component information if available (populated by prefetch_component_info) + info = _COMPONENT_INFO_CACHE.get(cache_key) + if not info: + # Fall back to direct API call if not cached (for backward compatibility) + info = _get_component_info(component_name, component_version) + + if info: + # Prefer full PURL if available + purl_from_api = info.get("purl") + if not purl_from_api and info.get("purl_type"): + p_type = info.get("purl_type") + p_namespace = info.get("purl_namespace") + p_name = info.get("purl_name") or component_name + p_ver = info.get("purl_version") or component_version + namespace_part = f"{p_namespace}/" if p_namespace else "" + purl_from_api = f"pkg:{p_type}/{namespace_part}{p_name}@{p_ver}" + + if purl_from_api and purl_from_api.startswith("pkg:"): + ecosystem = purl_from_api[4:].split("/", 1)[0] + _COMPONENT_ECOSYSTEM_CACHE[cache_key] = ecosystem + return ecosystem + elif info.get("purl_type"): + ecosystem = info["purl_type"] + _COMPONENT_ECOSYSTEM_CACHE[cache_key] = ecosystem + return ecosystem + + # 3. Heuristic fallback (legacy logic) + if "/" in component_name: + if component_name.startswith(("org.", "com.")): + return "maven" + elif "@" in component_name: + return "npm" + elif component_name.count(".") >= 2: # Likely a Java package + return "maven" + else: + return "generic" + elif any(component_name.startswith(prefix) for prefix in ["org.", "com.", "net.", "io."]): + return "maven" + elif component_name.count(".") >= 2: # Likely a Java package + return "maven" + else: + return "generic" + + +__all__ = [ + "_COMPONENT_ECOSYSTEM_CACHE", + "_COMPONENT_INFO_CACHE", + "_get_component_info", + "_detect_package_ecosystem", + "prefetch_component_info", # New function for pre-fetching +] \ No newline at end of file diff --git a/src/workbench_cli/utilities/sarif_converter.py b/src/workbench_cli/utilities/sarif_converter.py deleted file mode 100644 index 79c9373..0000000 --- a/src/workbench_cli/utilities/sarif_converter.py +++ /dev/null @@ -1,1238 +0,0 @@ -""" -SARIF conversion utilities for vulnerability data. - -This module provides functionality to convert vulnerability data from the Workbench API -into SARIF (Static Analysis Results Interchange Format) v2.1.0 format, which is -compatible with GitHub Advanced Security and other security tools. - -Enhanced with external API integration for EPSS scores, known exploits, CVE details, -and VEX (Vulnerability Exploitability eXchange) information. -""" - -import json -import logging -import os -from typing import Dict, List, Any, Optional -from datetime import datetime - -from .vulnerability_enricher import enrich_vulnerabilities - -logger = logging.getLogger(__name__) - - -def _apply_vex_suppression(vulnerabilities: List[Dict[str, Any]], - suppress_vex_mitigated: bool = True, - suppress_accepted_risk: bool = True, - suppress_false_positives: bool = True) -> List[Dict[str, Any]]: - """ - Apply VEX-based suppression to vulnerabilities. - - Args: - vulnerabilities: List of vulnerability dictionaries - suppress_vex_mitigated: Whether to suppress findings with VEX mitigation status - suppress_accepted_risk: Whether to suppress findings marked as accepted risk - suppress_false_positives: Whether to suppress findings marked as false positives - - Returns: - Filtered list of vulnerabilities after applying suppression rules - """ - filtered_vulns = [] - - for vuln in vulnerabilities: - should_suppress = False - - # Check VEX status for suppression - vex_status = (vuln.get("vuln_exp_status") or "").lower() - vex_justification = (vuln.get("vuln_exp_justification") or "").lower() - vex_response = (vuln.get("vuln_exp_response") or "").lower() - - # Suppress VEX mitigated findings - if suppress_vex_mitigated and vex_status in ["not_affected", "resolved"]: - should_suppress = True - - # Suppress accepted risk findings - if suppress_accepted_risk and vex_response in ["will_not_fix", "update", "can_not_fix"]: - should_suppress = True - - # Suppress false positives - if suppress_false_positives and vex_status == "false_positive": - should_suppress = True - - if not should_suppress: - filtered_vulns.append(vuln) - - return filtered_vulns - - -def convert_vulns_to_sarif(vulnerabilities: List[Dict[str, Any]], scan_code: str, - include_cve_descriptions: bool = True, - include_epss_scores: bool = True, - include_exploit_info: bool = True, - api_timeout: int = 30, - include_vex: bool = True, - include_scan_metadata: bool = True, - group_by_component: bool = True) -> Dict[str, Any]: - """ - Convert vulnerability data to SARIF v2.1.0 format with external enrichment and VEX information. - - Args: - vulnerabilities: List of vulnerability dictionaries from the Workbench API - scan_code: The scan code for reference - include_cve_descriptions: Whether to fetch CVE descriptions from NVD - include_epss_scores: Whether to fetch EPSS scores from FIRST - include_exploit_info: Whether to fetch known exploit information - api_timeout: Timeout for external API calls in seconds - - Returns: - Dict containing SARIF-formatted data compatible with GitHub Advanced Security, - enhanced with VEX (Vulnerability Exploitability eXchange) information - """ - if not vulnerabilities: - return _create_empty_sarif_report(scan_code) - - # Extract unique CVEs for batch processing - unique_cves = list(set(vuln.get("cve", "UNKNOWN") for vuln in vulnerabilities if vuln.get("cve") != "UNKNOWN")) - - # Fetch external data using the enricher module - external_data = {} - if unique_cves: - try: - external_data = enrich_vulnerabilities( - unique_cves, - include_cve_descriptions, - include_epss_scores, - include_exploit_info, - api_timeout - ) - except Exception as e: - logger.warning(f"Failed to fetch external vulnerability data: {e}") - - # Count VEX statements for reporting - vex_stats = _analyze_vex_statements(vulnerabilities) - - # Generate notifications for high-risk findings - notifications = [] - cisa_kev_count = sum(1 for vuln in vulnerabilities if external_data.get(vuln.get("cve", ""), {}).get("cisa_kev")) - high_epss_count = sum(1 for vuln in vulnerabilities if (external_data.get(vuln.get("cve", ""), {}).get("epss_score") or 0) > 0.1) - vex_suppressed_count = sum(1 for vuln in vulnerabilities if _get_vex_info(vuln) and _get_vex_info(vuln).get("vuln_exp_status") in ["not_affected", "fixed", "mitigated", "resolved", "false_positive"]) - - if cisa_kev_count > 0: - notifications.append({ - "level": "error", - "message": { - "text": f"⚠️ URGENT: {cisa_kev_count} vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog and require immediate attention" - }, - "properties": { - "cisa_kev_count": cisa_kev_count, - "category": "security", - "priority": "critical" - } - }) - - if high_epss_count > 0: - notifications.append({ - "level": "warning", - "message": { - "text": f"🔍 HIGH RISK: {high_epss_count} vulnerabilities have elevated EPSS exploitation probability scores (>0.1)" - }, - "properties": { - "high_epss_count": high_epss_count, - "category": "security", - "priority": "high" - } - }) - - if vex_suppressed_count > 0: - notifications.append({ - "level": "note", - "message": { - "text": f"✅ VEX ASSESSMENTS: {vex_suppressed_count} vulnerabilities have been assessed and suppressed based on organizational VEX statements" - }, - "properties": { - "vex_suppressed_count": vex_suppressed_count, - "category": "assessment", - "priority": "info" - } - }) - - return { - "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", - "version": "2.1.0", - "runs": [{ - "tool": { - "driver": { - "name": "FossID Workbench", - "version": "1.0.0", - "informationUri": "https://fossid.com/products/workbench/", - "rules": _generate_enhanced_rules(vulnerabilities, external_data), - "notifications": notifications - } - }, - "results": _generate_enhanced_results(vulnerabilities, external_data), - "properties": { - "scan_code": scan_code, - "generated_at": datetime.utcnow().isoformat() + "Z", - "total_vulnerabilities": len(vulnerabilities), - "severity_distribution": _calculate_severity_distribution(vulnerabilities), - "external_data_sources": _get_data_sources_used(external_data), - "high_risk_vulnerabilities": _count_high_risk_vulnerabilities(vulnerabilities, external_data), - "vex_statements": vex_stats - } - }] - } - - -def _generate_enhanced_rules(vulnerabilities: List[Dict[str, Any]], - external_data: Dict[str, Dict[str, Any]]) -> List[Dict[str, Any]]: - """ - Generate enhanced SARIF rules from vulnerability data with external enrichment and VEX information. - """ - rules = {} - - for vuln in vulnerabilities: - cve = vuln.get("cve", "UNKNOWN") - if cve not in rules: - # Get external data for this CVE - ext_data = external_data.get(cve, {}) - - # Get VEX information for this vulnerability - vex_info = _get_vex_info(vuln) - - # Build enhanced CVSS vector - cvss_vector = ext_data.get("full_cvss_vector") or _build_cvss_vector(vuln) - - # Enhanced rule with external data and VEX information - rule = { - "id": cve, - "name": f"Vulnerability {cve}", - "shortDescription": { - "text": _generate_enhanced_short_description(cve, vuln, ext_data, vex_info) - }, - "fullDescription": { - "text": _generate_enhanced_full_description(cve, vuln, ext_data, vex_info) - }, - "defaultConfiguration": { - "level": _map_severity_to_sarif_level(vuln.get("severity", "UNKNOWN")) - }, - "properties": { - "security-severity": str(vuln.get("base_score", "0.0")), - "cvss_version": vuln.get("cvss_version", "N/A"), - "cvss_vector": cvss_vector, - "base_score": vuln.get("base_score", "N/A"), - "attack_vector": vuln.get("attack_vector", "N/A"), - "attack_complexity": vuln.get("attack_complexity", "N/A"), - "availability_impact": vuln.get("availability_impact", "N/A"), - "severity": vuln.get("severity", "UNKNOWN"), - "tags": _generate_enhanced_vulnerability_tags(vuln, ext_data, vex_info) - }, - "helpUri": f"https://nvd.nist.gov/vuln/detail/{cve}" if cve != "UNKNOWN" else None - } - - # Add external data properties - if ext_data.get("epss_score") is not None: - rule["properties"]["epss_score"] = ext_data["epss_score"] - rule["properties"]["epss_percentile"] = ext_data["epss_percentile"] - - if ext_data.get("cisa_kev"): - rule["properties"]["cisa_known_exploited"] = True - - if ext_data.get("nvd_cwe"): - rule["properties"]["cwe_ids"] = ext_data["nvd_cwe"] - - # Add VEX properties - if vex_info: - vex_properties = _generate_vex_properties(vex_info) - rule["properties"].update(vex_properties) - - # Enhanced help text - rule["help"] = { - "text": _generate_enhanced_help_text(cve, vuln, ext_data, vex_info), - "markdown": _generate_enhanced_help_markdown(cve, vuln, ext_data, vex_info) - } - - rules[cve] = rule - - return list(rules.values()) - - -def _generate_enhanced_short_description(cve: str, vuln: Dict[str, Any], ext_data: Dict[str, Any], vex_info: Optional[Dict[str, Any]] = None) -> str: - """Generate enhanced short description with risk indicators and VEX status.""" - base_desc = f"Security vulnerability {cve} (CVSS {vuln.get('base_score', 'N/A')})" - - risk_indicators = [] - if ext_data.get("cisa_kev"): - risk_indicators.append("CISA KEV") - epss_score = ext_data.get("epss_score") - if epss_score is not None and epss_score > 0.1: # High EPSS score - risk_indicators.append(f"EPSS: {epss_score:.3f}") - - # Add VEX status indicator - if vex_info and vex_info.get("vuln_exp_status"): - vex_status = vex_info["vuln_exp_status"] - risk_indicators.append(f"VEX: {vex_status}") - - if risk_indicators: - base_desc += f" [{', '.join(risk_indicators)}]" - - return base_desc - - -def _generate_enhanced_full_description(cve: str, vuln: Dict[str, Any], ext_data: Dict[str, Any], vex_info: Optional[Dict[str, Any]] = None) -> str: - """Generate comprehensive description with external data and VEX information.""" - # Start with NVD description if available, adding a blank line afterwards for clarity - if ext_data.get("nvd_description"): - base_desc = ext_data["nvd_description"].rstrip() - separator = "\n\n" # Paragraph break after canonical description - else: - base_desc = f"Security vulnerability {cve} with CVSS score {vuln.get('base_score', 'N/A')}" - separator = " " # Continue in same paragraph if no NVD text - - # Add risk context - severity = vuln.get("severity", "UNKNOWN") - attack_vector = vuln.get("attack_vector", "") - attack_complexity = vuln.get("attack_complexity", "") - - if attack_vector and attack_complexity: - base_desc += f"{separator}This is a {severity.lower()} severity vulnerability with {attack_vector.lower()} attack vector and {attack_complexity.lower()} attack complexity." - - # Add exploit information - if ext_data.get("cisa_kev"): - base_desc += " This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild." - - epss_score = ext_data.get("epss_score") - if epss_score is not None and epss_score > 0.1: - base_desc += f" EPSS score of {epss_score:.3f} indicates elevated risk of exploitation." - - # Add CWE information - if ext_data.get("nvd_cwe"): - cwe_list = ", ".join(ext_data["nvd_cwe"]) - base_desc += f" Associated with {cwe_list}." - - # Add VEX information - if vex_info: - vex_status = vex_info.get("vuln_exp_status") - if vex_status: - base_desc += f" VEX Status: {vex_status}" - - # Add VEX justification if available - if vex_info.get("vuln_exp_justification"): - base_desc += f" - {vex_info['vuln_exp_justification']}" - - # Add VEX response if available - if vex_info.get("vuln_exp_response"): - base_desc += f" Response: {vex_info['vuln_exp_response']}" - - return base_desc - - -def _generate_enhanced_help_markdown(cve: str, vuln: Dict[str, Any], ext_data: Dict[str, Any], vex_info: Optional[Dict[str, Any]] = None) -> str: - """Generate enhanced help text in Markdown format with external data and VEX information.""" - component = vuln.get("component_name", "Unknown") - version = vuln.get("component_version", "Unknown") - severity = vuln.get("severity", "UNKNOWN") - score = vuln.get("base_score", "N/A") - - # Risk assessment with VEX consideration - risk_level = "Standard" - epss_score = ext_data.get("epss_score") - if ext_data.get("cisa_kev") or (epss_score is not None and epss_score > 0.1): - risk_level = "**HIGH RISK**" - - # Adjust risk level based on VEX status - if vex_info and vex_info.get("vuln_exp_status"): - vex_status = vex_info["vuln_exp_status"].lower() - if vex_status in ["not_affected", "fixed", "mitigated", "resolved"]: - risk_level = "**MITIGATED**" - elif vex_status in ["accepted_risk"]: - risk_level = "**ACCEPTED RISK**" - elif vex_status in ["false_positive"]: - risk_level = "**FALSE POSITIVE**" - - markdown = f"""## Vulnerability: {cve} ({risk_level}) - -**Component:** `{component}` -**Version:** `{version}` -**Severity:** {severity} ({score})""" - - # Add external data - if ext_data.get("epss_score") is not None: - markdown += f" \n**EPSS Score:** {ext_data['epss_score']:.3f} (percentile: {ext_data.get('epss_percentile', 'N/A')})" - - if ext_data.get("cisa_kev"): - markdown += f" \n**⚠️ CISA KEV:** Listed in Known Exploited Vulnerabilities" - - if ext_data.get("nvd_cwe"): - markdown += f" \n**CWE:** {', '.join(ext_data['nvd_cwe'])}" - - # Add VEX information - if vex_info: - markdown += f"\n\n### VEX Assessment" - if vex_info.get("vuln_exp_status"): - markdown += f" \n**Status:** {vex_info['vuln_exp_status']}" - - if vex_info.get("vuln_exp_justification"): - markdown += f" \n**Justification:** {vex_info['vuln_exp_justification']}" - - if vex_info.get("vuln_exp_response"): - markdown += f" \n**Response:** {vex_info['vuln_exp_response']}" - - if vex_info.get("vuln_exp_details"): - markdown += f" \n**Details:** {vex_info['vuln_exp_details']}" - - if vex_info.get("vuln_exp_updated"): - markdown += f" \n**Last Updated:** {vex_info['vuln_exp_updated']}" - if vex_info.get("vuln_exp_updated_by_username"): - markdown += f" by {vex_info['vuln_exp_updated_by_username']}" - - markdown += f""" - -### Description -{ext_data.get('nvd_description', f'This vulnerability affects {component} version {version}.')} - -### Risk Assessment -- **Severity:** {severity} ({score})""" - - epss_score = ext_data.get("epss_score") - if epss_score is not None: - if epss_score > 0.1: - markdown += f"\n- **Exploitation Risk:** HIGH (EPSS: {epss_score:.3f})" - else: - markdown += f"\n- **Exploitation Risk:** Low (EPSS: {epss_score:.3f})" - - if ext_data.get("cisa_kev"): - markdown += f"\n- **Known Exploits:** YES - Active exploitation detected" - - # Add VEX risk assessment - if vex_info and vex_info.get("vuln_exp_status"): - vex_status = vex_info["vuln_exp_status"].lower() - if vex_status in ["not_affected"]: - markdown += f"\n- **VEX Assessment:** NOT AFFECTED - This component is not impacted by this vulnerability" - elif vex_status in ["fixed"]: - markdown += f"\n- **VEX Assessment:** FIXED - This vulnerability has been resolved" - elif vex_status in ["mitigated"]: - markdown += f"\n- **VEX Assessment:** MITIGATED - Controls are in place to reduce risk" - elif vex_status in ["accepted_risk"]: - markdown += f"\n- **VEX Assessment:** ACCEPTED RISK - Organization has accepted this risk" - elif vex_status in ["under_investigation"]: - markdown += f"\n- **VEX Assessment:** UNDER INVESTIGATION - Impact is being evaluated" - - markdown += f""" - -### Remediation -1. **PRIORITY:** {'CRITICAL - Patch immediately' if ext_data.get('cisa_kev') else 'Update the component'} to the latest version that fixes this vulnerability -2. **Monitor:** Check for security advisories and patches -3. **Automate:** Implement automated dependency scanning and updates -4. **Validate:** Test patches in a staging environment before production deployment""" - - if ext_data.get("cisa_kev"): - markdown += f"\n5. **URGENT:** This vulnerability has known exploits - prioritize patching" - - # Adjust remediation based on VEX status - if vex_info and vex_info.get("vuln_exp_status"): - vex_status = vex_info["vuln_exp_status"].lower() - if vex_status in ["not_affected", "fixed"]: - markdown += f"\n\n**Note:** VEX assessment indicates this vulnerability is {vex_status.replace('_', ' ')}. Verify that assessment is current and accurate." - elif vex_status in ["mitigated"]: - markdown += f"\n\n**Note:** VEX assessment indicates mitigations are in place. Ensure mitigations remain effective and consider patching for defense in depth." - - markdown += f""" - -### References -- [NVD Details](https://nvd.nist.gov/vuln/detail/{cve}) -- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name={cve})""" - - if ext_data.get("epss_score") is not None: - markdown += f"\n- [EPSS Details](https://www.first.org/epss/model)" - - if ext_data.get("cisa_kev"): - markdown += f"\n- [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)" - - # Add additional references from NVD - if ext_data.get("nvd_references"): - markdown += f"\n- Additional References:" - for ref in ext_data["nvd_references"][:3]: # Limit to 3 additional refs - if ref.get("url"): - markdown += f"\n - [{ref.get('source', 'Reference')}]({ref['url']})" - - return markdown - - -def _generate_enhanced_vulnerability_tags(vuln: Dict[str, Any], ext_data: Dict[str, Any], vex_info: Optional[Dict[str, Any]] = None) -> List[str]: - """Generate enhanced tags including external data indicators and VEX status.""" - tags = ["security", "vulnerability"] - - severity = vuln.get("severity", "").lower() - if severity: - tags.append(f"severity-{severity}") - - attack_vector = vuln.get("attack_vector", "").lower() - if attack_vector: - tags.append(f"attack-vector-{attack_vector}") - - # Add ecosystem-specific tags - component_name = vuln.get("component_name", "") - ecosystem = _detect_package_ecosystem(component_name) - tags.append(f"ecosystem-{ecosystem}") - - # Add external data tags - if ext_data.get("cisa_kev"): - tags.append("cisa-kev") - tags.append("known-exploited") - - epss_score = ext_data.get("epss_score") - if epss_score is not None and epss_score > 0.1: - tags.append("high-epss") - - if ext_data.get("nvd_cwe"): - for cwe in ext_data["nvd_cwe"][:2]: # Limit to 2 CWE tags - if cwe.startswith("CWE-"): - tags.append(f"cwe-{cwe[4:]}") - - # Add VEX tags - if vex_info and vex_info.get("vuln_exp_status"): - vex_status = vex_info["vuln_exp_status"].lower() - tags.append(f"vex-{vex_status}") - - # Add semantic VEX tags - if vex_status in ["not_affected", "fixed", "resolved"]: - tags.append("vex-resolved") - elif vex_status in ["mitigated"]: - tags.append("vex-mitigated") - elif vex_status in ["accepted_risk"]: - tags.append("vex-accepted") - elif vex_status in ["false_positive"]: - tags.append("vex-false-positive") - elif vex_status in ["under_investigation", "in_triage"]: - tags.append("vex-investigating") - - return tags - - -def _count_high_risk_vulnerabilities(vulnerabilities: List[Dict[str, Any]], - external_data: Dict[str, Dict[str, Any]]) -> Dict[str, int]: - """Count high-risk vulnerabilities based on external data.""" - counts = { - "cisa_kev": 0, - "high_epss": 0, - "critical_severity": 0, - "total_high_risk": 0 - } - - high_risk_cves = set() - - for vuln in vulnerabilities: - cve = vuln.get("cve", "UNKNOWN") - ext_data = external_data.get(cve, {}) - - is_high_risk = False - - if ext_data.get("cisa_kev"): - counts["cisa_kev"] += 1 - is_high_risk = True - - epss_score = ext_data.get("epss_score") - if epss_score is not None and epss_score > 0.1: - counts["high_epss"] += 1 - is_high_risk = True - - if vuln.get("severity", "").upper() == "CRITICAL": - counts["critical_severity"] += 1 - is_high_risk = True - - if is_high_risk: - high_risk_cves.add(cve) - - counts["total_high_risk"] = len(high_risk_cves) - return counts - - -def _get_data_sources_used(external_data: Dict[str, Dict[str, Any]]) -> List[str]: - """Get list of external data sources that were successfully used.""" - sources = [] - - for cve_data in external_data.values(): - if cve_data.get("epss_score") is not None and "FIRST EPSS" not in sources: - sources.append("FIRST EPSS") - if cve_data.get("cisa_kev") and "CISA KEV" not in sources: - sources.append("CISA KEV") - if cve_data.get("nvd_description") and "NVD" not in sources: - sources.append("NVD") - - return sources - - -def _generate_enhanced_help_text(cve: str, vuln: Dict[str, Any], ext_data: Dict[str, Any], vex_info: Optional[Dict[str, Any]] = None) -> str: - """Generate enhanced help text with external data and VEX information.""" - component = vuln.get("component_name", "Unknown") - version = vuln.get("component_version", "Unknown") - - help_text = f"The component {component} version {version} contains vulnerability {cve}. " - - # Add VEX status context first - if vex_info and vex_info.get("vuln_exp_status"): - vex_status = vex_info["vuln_exp_status"].lower() - if vex_status in ["not_affected"]: - help_text += "VEX Assessment: Component is not affected by this vulnerability. " - elif vex_status in ["fixed"]: - help_text += "VEX Assessment: This vulnerability has been fixed. " - elif vex_status in ["mitigated"]: - help_text += "VEX Assessment: Mitigations are in place to reduce risk. " - elif vex_status in ["accepted_risk"]: - help_text += "VEX Assessment: Organization has accepted this risk. " - elif vex_status in ["false_positive"]: - help_text += "VEX Assessment: This vulnerability is a false positive. " - elif vex_status in ["resolved"]: - help_text += "VEX Assessment: This vulnerability has been resolved. " - elif vex_status in ["under_investigation", "in_triage"]: - help_text += "VEX Assessment: Impact is currently being evaluated. " - - # Add urgency based on external data - if ext_data.get("cisa_kev"): - help_text += "⚠️ URGENT: This vulnerability is actively exploited in the wild according to CISA. " - else: - epss_score = ext_data.get("epss_score") - if epss_score is not None and epss_score > 0.1: - help_text += f"HIGH RISK: EPSS score of {epss_score:.3f} indicates elevated exploitation risk. " - - # Adjust recommendations based on VEX status - if vex_info and vex_info.get("vuln_exp_status"): - vex_status = vex_info["vuln_exp_status"].lower() - if vex_status in ["not_affected", "fixed"]: - help_text += "Verify that the VEX assessment is current and accurate. " - elif vex_status in ["mitigated"]: - help_text += "Ensure mitigations remain effective and consider patching for defense in depth. " - elif vex_status in ["accepted_risk"]: - help_text += "Review accepted risk decision periodically and monitor for changes in threat landscape. " - elif vex_status in ["false_positive"]: - help_text += "Verify that the false positive assessment is accurate and documented. " - elif vex_status in ["resolved"]: - help_text += "Verify that the resolution is complete and effective. " - else: - help_text += "Consider upgrading to a newer version that addresses this vulnerability. " - else: - help_text += "Consider upgrading to a newer version that addresses this vulnerability. " - - help_text += "Review your dependency management and consider using tools like Dependabot or Renovate for automated updates." - - return help_text - - -def _generate_enhanced_results(vulnerabilities: List[Dict[str, Any]], - external_data: Dict[str, Dict[str, Any]]) -> List[Dict[str, Any]]: - """Generate enhanced SARIF results with external data and VEX information.""" - results = [] - - for vuln in vulnerabilities: - cve = vuln.get("cve", "UNKNOWN") - component_name = vuln.get("component_name", "Unknown") - component_version = vuln.get("component_version", "Unknown") - severity = vuln.get("severity", "UNKNOWN") - base_score = vuln.get("base_score", "N/A") - - # Get external data and VEX information - ext_data = external_data.get(cve, {}) - vex_info = _get_vex_info(vuln) - - # Create enhanced package URL with ecosystem detection - ecosystem = _detect_package_ecosystem(component_name) - artifact_uri = f"pkg:{ecosystem}/{component_name}@{component_version}" - - # Enhanced message with risk context and VEX information - message_text = _generate_enhanced_result_message(cve, component_name, component_version, severity, base_score, ext_data, vex_info) - - # Map severity to SARIF level with VEX consideration - original_level = _map_severity_to_sarif_level(severity) - vex_status = vex_info.get("vuln_exp_status") if vex_info else None - final_level = _map_vex_status_to_sarif_level(vex_status, original_level) - - result = { - "ruleId": cve, - "level": final_level, - "message": { - "text": message_text - }, - "locations": [{ - "physicalLocation": { - "artifactLocation": { - "uri": artifact_uri, - "description": { - "text": f"Vulnerable component: {component_name} version {component_version}" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": f"{component_name}@{component_version}" - } - } - }, - "logicalLocations": [{ - "name": component_name, - "fullyQualifiedName": artifact_uri, - "kind": "package" - }] - }], - "properties": { - # Core vulnerability metadata - "vulnerability_id": vuln.get("id"), - "cvss_version": vuln.get("cvss_version"), - "base_score": base_score, - "attack_vector": vuln.get("attack_vector"), - "attack_complexity": vuln.get("attack_complexity"), - "availability_impact": vuln.get("availability_impact"), - "rejected": vuln.get("rejected", 0), - - # Component information - "component_id": vuln.get("component_id"), - "ecosystem": ecosystem, - "package_url": artifact_uri, - - # Scan metadata - "scan_id": vuln.get("scan_id"), - "original_level": original_level, - - # Standard taxonomies for better tool interoperability - "security-severity": base_score, - "precision": "high" if vex_info else "medium", - "kind": "review", - "rank": _calculate_risk_rank(vuln, ext_data, vex_info), - "baseline": "unchanged", - "tags": { - "vulnerability": [cve], - "component": [f"{component_name}@{component_version}"], - "severity": [severity.lower() if severity != "UNKNOWN" else "unknown"] - } - } - } - - # Add external data properties - if ext_data.get("epss_score") is not None: - result["properties"]["epss_score"] = ext_data["epss_score"] - result["properties"]["epss_percentile"] = ext_data["epss_percentile"] - - if ext_data.get("cisa_kev"): - result["properties"]["cisa_known_exploited"] = True - - if ext_data.get("nvd_cwe"): - result["properties"]["cwe_ids"] = ext_data["nvd_cwe"] - - # Add VEX properties - if vex_info: - vex_properties = _generate_vex_properties(vex_info) - result["properties"].update(vex_properties) - - # Enhanced remediation information with VEX consideration - remediation = _generate_enhanced_remediation_info(component_name, component_version, cve, ext_data, vex_info) - if remediation: - result["fixes"] = [remediation] - - # Add fingerprints for deduplication - result["fingerprints"] = { - "workbench/component": f"{component_name}@{component_version}", - "workbench/vulnerability": f"{cve}#{vuln.get('id', 'unknown')}", - "primary": f"{component_name}@{component_version}#{cve}", - "stable": f"{cve}" - } - - # Add relationships to group vulnerabilities by component - result["relatedLocations"] = [{ - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": f"pkg:{ecosystem}/{component_name}@{component_version}", - "description": { - "text": f"Component manifest for {component_name}" - } - } - }, - "message": { - "text": f"Component {component_name} version {component_version}" - } - }] - - # Add suppression information if VEX status indicates resolved/mitigated - if vex_info and vex_info.get("vuln_exp_status"): - vex_status = vex_info["vuln_exp_status"].lower() - if vex_status in ["not_affected", "fixed", "mitigated", "accepted_risk", "false_positive", "resolved"]: - result["suppressions"] = [{ - "kind": "inSource", - "status": "accepted", - "justification": vex_info.get("vuln_exp_justification", f"VEX status: {vex_status}") - }] - - results.append(result) - - return results - - -def _generate_enhanced_result_message(cve: str, component: str, version: str, severity: str, - score: str, ext_data: Dict[str, Any], vex_info: Optional[Dict[str, Any]] = None) -> str: - """Generate an enhanced message with risk indicators and VEX information.""" - base_message = f"Found {severity.lower()} severity vulnerability {cve} (CVSS {score}) in component {component} version {version}." - - # Add risk indicators - risk_indicators = [] - if ext_data.get("cisa_kev"): - risk_indicators.append("CISA KEV - Active exploitation detected") - epss_score = ext_data.get("epss_score") - if epss_score is not None and epss_score > 0.1: - risk_indicators.append(f"High EPSS score: {epss_score:.3f}") - - if risk_indicators: - base_message += f" ⚠️ {' | '.join(risk_indicators)}." - - # Add VEX status information - if vex_info and vex_info.get("vuln_exp_status"): - vex_status = vex_info["vuln_exp_status"] - base_message += f" VEX Status: {vex_status}." - - if vex_info.get("vuln_exp_justification"): - base_message += f" Justification: {vex_info['vuln_exp_justification']}" - - # Adjust recommendation based on VEX status - if vex_info and vex_info.get("vuln_exp_status"): - vex_status = vex_info["vuln_exp_status"].lower() - if vex_status in ["not_affected", "fixed"]: - base_message += " Verify VEX assessment is current and accurate." - elif vex_status in ["mitigated"]: - base_message += " Ensure mitigations remain effective." - elif vex_status in ["accepted_risk"]: - base_message += " Review accepted risk periodically." - elif vex_status in ["false_positive"]: - base_message += " Verify false positive assessment is accurate." - elif vex_status in ["resolved"]: - base_message += " Verify resolution is complete and effective." - else: - base_message += " This vulnerability should be addressed by updating to a patched version." - else: - base_message += " This vulnerability should be addressed by updating to a patched version." - - return base_message - - -def _generate_enhanced_remediation_info(component: str, version: str, cve: str, - ext_data: Dict[str, Any], vex_info: Optional[Dict[str, Any]] = None) -> Optional[Dict[str, Any]]: - """Generate enhanced remediation information with urgency indicators and VEX context.""" - urgency = "standard" - if ext_data.get("cisa_kev"): - urgency = "critical" - else: - epss_score = ext_data.get("epss_score") - if epss_score is not None and epss_score > 0.1: - urgency = "high" - - # Adjust urgency based on VEX status - description_text = f"Update {component} to a version that fixes {cve} - {urgency.upper()} priority" - guidance_text = "Check for newer versions of this component that address the vulnerability" - - if vex_info and vex_info.get("vuln_exp_status"): - vex_status = vex_info["vuln_exp_status"].lower() - if vex_status in ["not_affected", "fixed"]: - description_text = f"Verify VEX assessment for {component} {cve} - Component reported as {vex_status}" - guidance_text = "Validate that VEX assessment is current and accurate" - elif vex_status in ["mitigated"]: - description_text = f"Monitor mitigation effectiveness for {component} {cve} - MITIGATED status" - guidance_text = "Ensure mitigations remain effective and consider patching for defense in depth" - elif vex_status in ["accepted_risk"]: - description_text = f"Review accepted risk for {component} {cve} - ACCEPTED RISK status" - guidance_text = "Periodically review risk acceptance and monitor for changes in threat landscape" - elif vex_status in ["false_positive"]: - description_text = f"Verify false positive assessment for {component} {cve} - FALSE POSITIVE status" - guidance_text = "Validate that false positive assessment is accurate and documented" - elif vex_status in ["resolved"]: - description_text = f"Verify resolution for {component} {cve} - RESOLVED status" - guidance_text = "Confirm that resolution is complete and effective" - elif vex_status in ["under_investigation", "in_triage"]: - description_text = f"Monitor investigation progress for {component} {cve} - {vex_status.upper().replace('_', ' ')}" - guidance_text = "Follow up on investigation status and prepare for potential remediation" - - remediation_info = { - "description": { - "text": description_text - }, - "properties": { - "urgency": urgency, - "guidance": guidance_text, - "automation": "Consider using automated dependency update tools", - "cisa_kev": ext_data.get("cisa_kev", False), - "epss_score": ext_data.get("epss_score") - } - } - - # Add VEX properties - if vex_info: - vex_properties = _generate_vex_properties(vex_info) - remediation_info["properties"].update(vex_properties) - - return remediation_info - - -def _create_empty_sarif_report(scan_code: str) -> Dict[str, Any]: - """Create an empty SARIF report when no vulnerabilities are found.""" - return { - "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", - "version": "2.1.0", - "runs": [{ - "tool": { - "driver": { - "name": "FossID Workbench", - "version": "1.0.0", - "informationUri": "https://fossid.com/products/workbench/", - "rules": [] - } - }, - "results": [], - "properties": { - "scan_code": scan_code, - "generated_at": datetime.utcnow().isoformat() + "Z", - "total_vulnerabilities": 0, - "severity_distribution": {"CRITICAL": 0, "HIGH": 0, "MEDIUM": 0, "LOW": 0, "UNKNOWN": 0}, - "external_data_sources": [], - "high_risk_vulnerabilities": {"cisa_kev": 0, "high_epss": 0, "critical_severity": 0, "total_high_risk": 0} - } - }] - } - - -def _build_cvss_vector(vuln: Dict[str, Any]) -> str: - """Build a CVSS vector string from available vulnerability data.""" - version = vuln.get("cvss_version", "3.1") - - # Build vector components that we have data for - vector_parts = [f"CVSS:{version}"] - - # Attack Vector - av = vuln.get("attack_vector", "") - if av: - av_map = {"NETWORK": "N", "ADJACENT_NETWORK": "A", "LOCAL": "L", "PHYSICAL": "P"} - vector_parts.append(f"AV:{av_map.get(av, av[0] if av else 'N')}") - - # Attack Complexity - ac = vuln.get("attack_complexity", "") - if ac: - ac_map = {"LOW": "L", "HIGH": "H"} - vector_parts.append(f"AC:{ac_map.get(ac, ac[0] if ac else 'L')}") - - # Availability Impact - a = vuln.get("availability_impact", "") - if a: - a_map = {"NONE": "N", "LOW": "L", "HIGH": "H"} - vector_parts.append(f"A:{a_map.get(a, a[0] if a else 'N')}") - - return "/".join(vector_parts) if len(vector_parts) > 1 else "CVSS vector not available" - - -def _detect_package_ecosystem(component_name: str) -> str: - """Detect the package ecosystem based on component name patterns.""" - if "/" in component_name: - if component_name.startswith("org.") or component_name.startswith("com."): - return "maven" - elif "@" in component_name: - return "npm" - else: - return "generic" - elif "." in component_name and any(component_name.startswith(prefix) for prefix in ["org.", "com.", "net.", "io."]): - return "maven" - elif component_name.count(".") >= 2: # Likely a Java package - return "maven" - else: - return "generic" - - -def _calculate_severity_distribution(vulnerabilities: List[Dict[str, Any]]) -> Dict[str, int]: - """Calculate the distribution of vulnerabilities by severity.""" - distribution = {"CRITICAL": 0, "HIGH": 0, "MEDIUM": 0, "LOW": 0, "UNKNOWN": 0} - - for vuln in vulnerabilities: - severity = vuln.get("severity", "UNKNOWN").upper() - if severity in distribution: - distribution[severity] += 1 - else: - distribution["UNKNOWN"] += 1 - - return distribution - - -def _map_severity_to_sarif_level(severity: str) -> str: - """ - Map Workbench severity levels to SARIF levels. - - SARIF levels: error, warning, note, none - Workbench severities: CRITICAL, HIGH, MEDIUM, LOW, UNKNOWN - """ - severity_upper = severity.upper() if severity else "UNKNOWN" - - mapping = { - "CRITICAL": "error", - "HIGH": "error", - "MEDIUM": "warning", - "LOW": "note", - "UNKNOWN": "warning" - } - - return mapping.get(severity_upper, "warning") - - -def save_vulns_to_sarif(filepath: str, vulnerabilities: List[Dict[str, Any]], scan_code: str, - include_cve_descriptions: bool = True, - include_epss_scores: bool = True, - include_exploit_info: bool = True, - api_timeout: int = 30, - include_vex: bool = True, - include_scan_metadata: bool = True, - suppress_vex_mitigated: bool = True, - suppress_accepted_risk: bool = True, - suppress_false_positives: bool = True, - group_by_component: bool = True, - quiet: bool = False) -> None: - """ - Save vulnerability results in SARIF format to a file with external enrichment. - - Args: - filepath: Path where the SARIF file should be saved - vulnerabilities: List of vulnerability dictionaries from the API - scan_code: The scan code for reference - include_cve_descriptions: Whether to include enhanced CVE descriptions from NVD - include_epss_scores: Whether to include EPSS scores from FIRST - include_exploit_info: Whether to include known exploit information - api_timeout: Timeout for external API calls in seconds - include_vex: Whether to include VEX assessments from Workbench - include_scan_metadata: Whether to include scan timing and metadata - suppress_vex_mitigated: Whether to suppress findings with VEX mitigation status - suppress_accepted_risk: Whether to suppress findings marked as accepted risk - suppress_false_positives: Whether to suppress findings marked as false positives - group_by_component: Whether to group findings by component in SARIF - quiet: Whether to suppress progress output - - Raises: - IOError: If the file cannot be written - OSError: If the directory cannot be created - """ - output_dir = os.path.dirname(filepath) or "." - - try: - os.makedirs(output_dir, exist_ok=True) - - # Calculate how many findings would be suppressed by VEX without actually removing them. - # The demotion to "note" level happens later in _generate_enhanced_results via _map_vex_status_to_sarif_level. - original_count = len(vulnerabilities) - suppressed_count = 0 - if include_vex and (suppress_vex_mitigated or suppress_accepted_risk or suppress_false_positives): - suppressed_count = original_count - len(_apply_vex_suppression( - vulnerabilities, - suppress_vex_mitigated, - suppress_accepted_risk, - suppress_false_positives - )) - if not quiet and suppressed_count > 0: - print( - f"Suppressed {suppressed_count} vulnerabilities based on VEX assessments (demoted to 'note' level)" - ) - - sarif_data = convert_vulns_to_sarif( - vulnerabilities, - scan_code, - include_cve_descriptions, - include_epss_scores, - include_exploit_info, - api_timeout, - include_vex, - include_scan_metadata, - group_by_component - ) - - with open(filepath, 'w', encoding='utf-8') as f: - json.dump(sarif_data, f, indent=2, ensure_ascii=False) - - if not quiet: - print(f"Saved enhanced SARIF results to: {filepath}") - - # Print summary of external data - props = sarif_data["runs"][0]["properties"] - if props.get("external_data_sources"): - print(f"External data sources used: {', '.join(props['external_data_sources'])}") - - high_risk = props.get("high_risk_vulnerabilities", {}) - if high_risk.get("total_high_risk", 0) > 0: - print(f"High-risk vulnerabilities found: {high_risk['total_high_risk']}") - if high_risk.get("cisa_kev", 0) > 0: - print(f" - CISA KEV: {high_risk['cisa_kev']}") - if high_risk.get("high_epss", 0) > 0: - print(f" - High EPSS: {high_risk['high_epss']}") - - # Print VEX summary - vex_stats = props.get("vex_statements", {}) - if vex_stats.get("total_with_vex", 0) > 0: - print(f"VEX statements found: {vex_stats['total_with_vex']}") - if vex_stats.get("status_distribution"): - print(" VEX status distribution:") - for status, count in vex_stats["status_distribution"].items(): - print(f" - {status}: {count}") - if vex_stats.get("with_justification", 0) > 0: - print(f" - With justification: {vex_stats['with_justification']}") - if vex_stats.get("with_response", 0) > 0: - print(f" - With response: {vex_stats['with_response']}") - if vex_stats.get("with_details", 0) > 0: - print(f" - With details: {vex_stats['with_details']}") - - except (IOError, OSError) as e: - if not quiet: - print(f"\nWarning: Failed to save SARIF results to {filepath}: {e}") - raise - - -# Legacy function names for backward compatibility -def _generate_rules(vulnerabilities: List[Dict[str, Any]]) -> List[Dict[str, Any]]: - """Legacy function for backward compatibility.""" - return _generate_enhanced_rules(vulnerabilities, {}) - - -def _generate_results(vulnerabilities: List[Dict[str, Any]]) -> List[Dict[str, Any]]: - """Legacy function for backward compatibility.""" - return _generate_enhanced_results(vulnerabilities, {}) - - -def _analyze_vex_statements(vulnerabilities: List[Dict[str, Any]]) -> Dict[str, int]: - """Analyze VEX statements in vulnerability data.""" - vex_stats = { - "total_with_vex": 0, - "status_distribution": {}, - "with_justification": 0, - "with_response": 0, - "with_details": 0 - } - - for vuln in vulnerabilities: - # Check if vulnerability has VEX information - has_vex = any([ - vuln.get("vuln_exp_status"), - vuln.get("vuln_exp_justification"), - vuln.get("vuln_exp_response"), - vuln.get("vuln_exp_details") - ]) - - if has_vex: - vex_stats["total_with_vex"] += 1 - - # Count status distribution - status = vuln.get("vuln_exp_status") - if status: - vex_stats["status_distribution"][status] = vex_stats["status_distribution"].get(status, 0) + 1 - - # Count fields with content - if vuln.get("vuln_exp_justification"): - vex_stats["with_justification"] += 1 - if vuln.get("vuln_exp_response"): - vex_stats["with_response"] += 1 - if vuln.get("vuln_exp_details"): - vex_stats["with_details"] += 1 - - return vex_stats - - -def _get_vex_info(vuln: Dict[str, Any]) -> Optional[Dict[str, Any]]: - """Extract VEX information from vulnerability data.""" - vex_fields = [ - "vuln_exp_id", "vuln_exp_status", "vuln_exp_justification", - "vuln_exp_response", "vuln_exp_details", "vuln_exp_created", - "vuln_exp_updated", "vuln_exp_created_by", "vuln_exp_updated_by", - "vuln_exp_created_by_username", "vuln_exp_updated_by_username" - ] - - vex_info = {} - has_vex_data = False - - for field in vex_fields: - value = vuln.get(field) - if value is not None: - vex_info[field] = value - has_vex_data = True - - return vex_info if has_vex_data else None - - -def _map_vex_status_to_sarif_level(vex_status: str, original_level: str) -> str: - """Map VEX status to appropriate SARIF level, potentially suppressing findings.""" - if not vex_status: - return original_level - - # VEX status mapping to SARIF levels - vex_status_lower = vex_status.lower() - - # Standard VEX statuses - if vex_status_lower in ["not_affected", "fixed"]: - return "note" # Demote to informational - elif vex_status_lower in ["under_investigation", "in_triage"]: - return original_level # Keep original level - elif vex_status_lower in ["affected", "exploitable"]: - return original_level # Keep original level, but add VEX context - - # Custom statuses (organization-specific) - elif vex_status_lower in ["accepted_risk", "mitigated", "false_positive", "resolved"]: - return "note" # Demote to informational - elif vex_status_lower in ["workaround_available"]: - return "warning" # Reduce severity slightly - - return original_level - - -def _generate_vex_properties(vex_info: Dict[str, Any]) -> Dict[str, Any]: - """Generate VEX-related properties for SARIF output.""" - properties = {} - - if vex_info.get("vuln_exp_status"): - properties["vex_status"] = vex_info["vuln_exp_status"] - - if vex_info.get("vuln_exp_justification"): - properties["vex_justification"] = vex_info["vuln_exp_justification"] - - if vex_info.get("vuln_exp_response"): - properties["vex_response"] = vex_info["vuln_exp_response"] - - if vex_info.get("vuln_exp_details"): - properties["vex_details"] = vex_info["vuln_exp_details"] - - if vex_info.get("vuln_exp_created"): - properties["vex_created"] = vex_info["vuln_exp_created"] - - if vex_info.get("vuln_exp_updated"): - properties["vex_updated"] = vex_info["vuln_exp_updated"] - - if vex_info.get("vuln_exp_created_by_username"): - properties["vex_created_by"] = vex_info["vuln_exp_created_by_username"] - - if vex_info.get("vuln_exp_updated_by_username"): - properties["vex_updated_by"] = vex_info["vuln_exp_updated_by_username"] - - return properties - - -def _calculate_risk_rank(vuln: Dict[str, Any], ext_data: Dict[str, Any], vex_info: Optional[Dict[str, Any]] = None) -> float: - """Calculate a numerical risk ranking for prioritization (0-100, higher = more risk).""" - base_score = float(vuln.get("base_score", 0)) - rank = base_score * 10 # Start with CVSS score * 10 (max 100) - - # CISA KEV adds significant risk - if ext_data.get("cisa_kev"): - rank += 20 - - # High EPSS score adds risk - epss_score = ext_data.get("epss_score") or 0 - if epss_score > 0.1: - rank += 15 - elif epss_score > 0.01: - rank += 5 - - # VEX status can reduce risk - if vex_info and vex_info.get("vuln_exp_status"): - vex_status = vex_info["vuln_exp_status"].lower() - if vex_status in ["not_affected", "fixed", "resolved"]: - rank *= 0.1 # Greatly reduce risk - elif vex_status in ["mitigated", "false_positive"]: - rank *= 0.2 # Significantly reduce risk - elif vex_status in ["accepted_risk"]: - rank *= 0.5 # Moderately reduce risk - - # Cap at 100 - return min(100.0, max(0.0, rank)) \ No newline at end of file diff --git a/src/workbench_cli/utilities/sarif_generation.py b/src/workbench_cli/utilities/sarif_generation.py new file mode 100644 index 0000000..9a6e6be --- /dev/null +++ b/src/workbench_cli/utilities/sarif_generation.py @@ -0,0 +1,987 @@ +"""workbench_cli.utilities.sarif_generation +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +SARIF generation utilities for vulnerability data. + +This module provides functionality to convert vulnerability data from the Workbench API +into SARIF (Static Analysis Results Interchange Format) v2.1.0 format, which is +compatible with GitHub Advanced Security and other security tools. + +Enhanced with external API integration for EPSS scores, known exploits, CVE details, +and VEX (Vulnerability Exploitability eXchange) information. +""" +from __future__ import annotations + +import json +import logging +import os +from typing import Dict, List, Any, Optional +from datetime import datetime +from dataclasses import dataclass + +from .vulnerability_enricher import enrich_vulnerabilities +from .component_enrichment import ( + _detect_package_ecosystem, +) + +logger = logging.getLogger(__name__) + + +# Configuration removed - CLI arguments now drive behavior directly + + +__all__ = [ + # Public API + "convert_vulns_to_sarif", + "save_vulns_to_sarif", + # Selected VEX helpers exposed for risk-guidance logic + "apply_vex_suppression", + "get_vex_info", + "map_vex_status_to_sarif_level", + "generate_vex_properties", + "analyze_vex_statements", + # Internal functions exposed for export_sarif handler + "_fetch_external_enrichment_data", + "_count_high_risk_vulnerabilities", + "_calculate_severity_distribution", + "_format_severity_breakdown_compact", + "_extract_unique_cves", + "_count_vex_assessments", +] + + +def apply_vex_suppression(vulnerabilities: List[Dict[str, Any]]) -> List[Dict[str, Any]]: + """ + Apply VEX-based suppression to vulnerabilities. + + Suppresses findings that have been assessed through VEX as: + - Mitigated/not affected/resolved + - Accepted risk + - False positives + + Args: + vulnerabilities: List of vulnerability dictionaries + + Returns: + Filtered list of vulnerabilities after applying VEX suppression rules + """ + filtered_vulns = [] + + for vuln in vulnerabilities: + should_suppress = False + + # Check VEX status for suppression + vex_status = (vuln.get("vuln_exp_status") or "").lower() + vex_response = (vuln.get("vuln_exp_response") or "").lower() + + # Suppress VEX mitigated findings + if vex_status in ["not_affected", "resolved", "false_positive"]: + should_suppress = True + + # Suppress accepted risk findings + if vex_response in ["will_not_fix", "update", "can_not_fix"]: + should_suppress = True + + if not should_suppress: + filtered_vulns.append(vuln) + + return filtered_vulns + +def convert_vulns_to_sarif( + vulnerabilities: List[Dict[str, Any]], + scan_code: str, + external_data: Optional[Dict[str, Dict[str, Any]]] = None, + *, + nvd_enrichment: bool = False, + epss_enrichment: bool = False, + cisa_kev_enrichment: bool = False, + api_timeout: int = 30, + enable_vex_suppression: bool = True, + quiet: bool = False, +) -> Dict[str, Any]: + """ + Convert vulnerability data to SARIF v2.1.0 format with sensible defaults. + + VEX assessments, component grouping, and metadata inclusion are always enabled. + External enrichment is OFF by default - users must opt-in for better performance and privacy. + + Args: + vulnerabilities: List of vulnerability dictionaries from the Workbench API + scan_code: The scan code for reference + external_data: Pre-fetched external enrichment data (optional) + include_cve_descriptions: Fetch CVE descriptions from NVD (default: False) + include_epss_scores: Fetch EPSS scores from FIRST (default: False) + include_exploit_info: Fetch exploit info from CISA KEV (default: False) + api_timeout: Timeout for external API calls in seconds (default: 30) + enable_vex_suppression: Apply VEX-based suppression (default: True) + quiet: Suppress progress messages (default: False) + + Returns: + Dict containing SARIF-formatted data compatible with GitHub Advanced Security, + enhanced with VEX (Vulnerability Exploitability eXchange) information + + Examples: + # Simple usage with defaults (VEX assessments enabled, no external enrichment) + sarif_data = convert_vulns_to_sarif(vulnerabilities, scan_code) + + # Full enrichment with external API calls + sarif_data = convert_vulns_to_sarif( + vulnerabilities, scan_code, + nvd_enrichment=True, + epss_enrichment=True, + cisa_kev_enrichment=True + ) + + # With pre-fetched external data (avoids duplicate enrichment) + external_data = _fetch_external_enrichment_data(vulnerabilities, True, True, True, 30) + sarif_data = convert_vulns_to_sarif(vulnerabilities, scan_code, external_data) + """ + if not vulnerabilities: + return _create_empty_sarif_report(scan_code) + + # Use pre-fetched external data if provided, otherwise fetch it + if external_data is None: + external_data = _fetch_external_enrichment_data( + vulnerabilities, + nvd_enrichment, + epss_enrichment, + cisa_kev_enrichment, + api_timeout + ) + + # Build SARIF structure + sarif_data = _build_sarif_structure( + vulnerabilities, scan_code, external_data, + nvd_enrichment=nvd_enrichment, + epss_enrichment=epss_enrichment, + cisa_kev_enrichment=cisa_kev_enrichment, + enable_vex_suppression=enable_vex_suppression, + quiet=quiet + ) + + return sarif_data + + +def _fetch_external_enrichment_data( + vulnerabilities: List[Dict[str, Any]], + nvd_enrichment: bool, + epss_enrichment: bool, + cisa_kev_enrichment: bool, + api_timeout: int +) -> Dict[str, Dict[str, Any]]: + """Fetch external enrichment data for vulnerabilities.""" + unique_cves = _extract_unique_cves(vulnerabilities) + + external_data = {} + if unique_cves: + try: + external_data = enrich_vulnerabilities( + unique_cves, + nvd_enrichment, + epss_enrichment, + cisa_kev_enrichment, + api_timeout + ) + except Exception as e: + logger.warning(f"Failed to fetch external vulnerability data: {e}") + + return external_data + + +def _build_sarif_structure( + vulnerabilities: List[Dict[str, Any]], + scan_code: str, + external_data: Dict[str, Dict[str, Any]], + nvd_enrichment: bool, + epss_enrichment: bool, + cisa_kev_enrichment: bool, + enable_vex_suppression: bool, + quiet: bool +) -> Dict[str, Any]: + """Build the main SARIF structure with notifications and metadata.""" + # Count VEX statements for reporting + vex_stats = analyze_vex_statements(vulnerabilities) + + # Generate notifications for high-risk findings + notifications = _generate_risk_notifications(vulnerabilities, external_data) + + # Build concise run-level summary + generated_at_utc = datetime.utcnow().isoformat() + "Z" + vex_counts = _count_vex_assessments(vulnerabilities) + summary = { + "scanCode": scan_code, + "generated": generated_at_utc, + "totalFindings": len(vulnerabilities), + "severityBreakdown": _calculate_severity_distribution(vulnerabilities), + "withVEX": vex_counts["total_with_vex"], + "suppressedByVEX": vex_counts["suppressed"] + } + + return { + "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", + "version": "2.1.0", + "runs": [{ + "tool": { + "driver": { + "name": "FossID Workbench", + "version": "1.0.0", + "informationUri": "https://fossid.com/products/workbench/", + "rules": _generate_enhanced_rules(vulnerabilities, external_data), + "notifications": notifications + } + }, + "results": _generate_enhanced_results(vulnerabilities, external_data), + "properties": { + "scan_code": scan_code, + "generated_at": generated_at_utc, + "total_vulnerabilities": len(vulnerabilities), + "severity_distribution": _calculate_severity_distribution(vulnerabilities), + "external_data_sources": _get_data_sources_used(external_data), + "high_risk_vulnerabilities": _count_high_risk_vulnerabilities(vulnerabilities, external_data), + "vex_statements": vex_stats, + "summary": summary + } + }] + } + + +def _generate_risk_notifications(vulnerabilities: List[Dict[str, Any]], + external_data: Dict[str, Dict[str, Any]]) -> List[Dict[str, Any]]: + """Generate notifications for high-risk findings.""" + notifications = [] + + cisa_kev_count = sum(1 for vuln in vulnerabilities if external_data.get(vuln.get("cve", ""), {}).get("cisa_kev")) + high_epss_count = sum(1 for vuln in vulnerabilities if (external_data.get(vuln.get("cve", ""), {}).get("epss_score") or 0) > 0.1) + vex_counts = _count_vex_assessments(vulnerabilities) + vex_suppressed_count = vex_counts["suppressed"] + + if cisa_kev_count > 0: + notifications.append({ + "level": "error", + "message": { + "text": f"⚠️ URGENT: {cisa_kev_count} vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog and require immediate attention" + }, + "properties": { + "cisa_kev_count": cisa_kev_count, + "category": "security", + "priority": "critical" + } + }) + + if high_epss_count > 0: + notifications.append({ + "level": "warning", + "message": { + "text": f"🔍 HIGH RISK: {high_epss_count} vulnerabilities have elevated EPSS exploitation probability scores (>0.1)" + }, + "properties": { + "high_epss_count": high_epss_count, + "category": "security", + "priority": "high" + } + }) + + if vex_suppressed_count > 0: + notifications.append({ + "level": "note", + "message": { + "text": f"✅ VEX ASSESSMENTS: {vex_suppressed_count} vulnerabilities have been assessed and suppressed based on organizational VEX statements" + }, + "properties": { + "vex_suppressed_count": vex_suppressed_count, + "category": "assessment", + "priority": "info" + } + }) + + return notifications + + +def save_vulns_to_sarif( + filepath: str, + vulnerabilities: List[Dict[str, Any]], + scan_code: str, + external_data: Optional[Dict[str, Dict[str, Any]]] = None, + *, + nvd_enrichment: bool = False, + epss_enrichment: bool = False, + cisa_kev_enrichment: bool = False, + api_timeout: int = 30, + enable_vex_suppression: bool = True, + quiet: bool = False, +) -> None: + """ + Save vulnerability results in SARIF format with sensible defaults. + + VEX assessments, component grouping, and metadata inclusion are always enabled. + External enrichment is OFF by default - users must opt-in for better performance and privacy. + + Args: + filepath: Path where the SARIF file should be saved + vulnerabilities: List of vulnerability dictionaries from the API + scan_code: The scan code for reference + external_data: Pre-fetched external enrichment data (optional) + nvd_enrichment: Fetch CVE descriptions from NVD (default: False) + epss_enrichment: Fetch EPSS scores from FIRST (default: False) + cisa_kev_enrichment: Fetch exploit info from CISA KEV (default: False) + api_timeout: Timeout for external API calls in seconds (default: 30) + enable_vex_suppression: Apply VEX-based suppression (default: True) + quiet: Suppress progress messages (default: False) + + Examples: + # Simple usage with defaults (VEX assessments enabled, no external enrichment) + save_vulns_to_sarif("vulns.sarif", vulnerabilities, scan_code) + + # Full enrichment with external API calls + save_vulns_to_sarif( + "vulns.sarif", vulnerabilities, scan_code, + nvd_enrichment=True, + epss_enrichment=True, + cisa_kev_enrichment=True + ) + + # With pre-fetched external data (avoids duplicate enrichment) + external_data = _fetch_external_enrichment_data(vulnerabilities, True, True, True, 30) + save_vulns_to_sarif("vulns.sarif", vulnerabilities, scan_code, external_data) + + Raises: + IOError: If the file cannot be written + OSError: If the directory cannot be created + """ + output_dir = os.path.dirname(filepath) or "." + + try: + os.makedirs(output_dir, exist_ok=True) + + # Calculate how many findings would be suppressed by VEX + original_count = len(vulnerabilities) + suppressed_count = 0 + if enable_vex_suppression: + suppressed_count = original_count - len(apply_vex_suppression(vulnerabilities)) + + sarif_data = convert_vulns_to_sarif( + vulnerabilities, scan_code, external_data, + nvd_enrichment=nvd_enrichment, + epss_enrichment=epss_enrichment, + cisa_kev_enrichment=cisa_kev_enrichment, + api_timeout=api_timeout, + enable_vex_suppression=enable_vex_suppression, + quiet=quiet + ) + + with open(filepath, 'w', encoding='utf-8') as f: + json.dump(sarif_data, f, indent=2, ensure_ascii=False) + + # Only print messages if not quiet and external_data wasn't pre-provided + # (indicating the handler is managing output) + if not quiet and external_data is None: + print(f"Saved enhanced SARIF results to: {filepath}") + + # Print summary of external data sources used + props = sarif_data["runs"][0]["properties"] + if props.get("external_data_sources"): + print(f"External data sources used: {', '.join(props['external_data_sources'])}") + + except (IOError, OSError) as e: + if not quiet: + print(f"\nWarning: Failed to save SARIF results to {filepath}: {e}") + raise + + +# --------------------------------------------------------------------------- +# VEX Helper Functions +# --------------------------------------------------------------------------- + +def get_vex_info(vuln: Dict[str, Any]) -> Optional[Dict[str, Any]]: + """Extract VEX information from vulnerability data.""" + vex_fields = [ + "vuln_exp_id", "vuln_exp_status", "vuln_exp_justification", + "vuln_exp_response", "vuln_exp_details", "vuln_exp_created", + "vuln_exp_updated", "vuln_exp_created_by", "vuln_exp_updated_by", + "vuln_exp_created_by_username", "vuln_exp_updated_by_username" + ] + + vex_info = {} + has_vex_data = False + + for field in vex_fields: + value = vuln.get(field) + if value is not None: + vex_info[field] = value + has_vex_data = True + + return vex_info if has_vex_data else None + + + + + +def generate_vex_properties(vex_info: Dict[str, Any]) -> Dict[str, Any]: + """Generate VEX-related properties for SARIF output.""" + properties = {} + + if vex_info.get("vuln_exp_status"): + properties["vex_status"] = vex_info["vuln_exp_status"] + + if vex_info.get("vuln_exp_justification"): + properties["vex_justification"] = vex_info["vuln_exp_justification"] + + if vex_info.get("vuln_exp_response"): + properties["vex_response"] = vex_info["vuln_exp_response"] + + if vex_info.get("vuln_exp_details"): + properties["vex_details"] = vex_info["vuln_exp_details"] + + if vex_info.get("vuln_exp_created"): + properties["vex_created"] = vex_info["vuln_exp_created"] + + if vex_info.get("vuln_exp_updated"): + properties["vex_updated"] = vex_info["vuln_exp_updated"] + + if vex_info.get("vuln_exp_created_by_username"): + properties["vex_created_by"] = vex_info["vuln_exp_created_by_username"] + + if vex_info.get("vuln_exp_updated_by_username"): + properties["vex_updated_by"] = vex_info["vuln_exp_updated_by_username"] + + return properties + + +def analyze_vex_statements(vulnerabilities: List[Dict[str, Any]]) -> Dict[str, int]: + """Analyze VEX statements in vulnerability data.""" + vex_stats = { + "total_with_vex": 0, + "status_distribution": {}, + "with_justification": 0, + "with_response": 0, + "with_details": 0 + } + + for vuln in vulnerabilities: + # Check if vulnerability has VEX information + has_vex = any([ + vuln.get("vuln_exp_status"), + vuln.get("vuln_exp_justification"), + vuln.get("vuln_exp_response"), + vuln.get("vuln_exp_details") + ]) + + if has_vex: + vex_stats["total_with_vex"] += 1 + + # Count status distribution + status = vuln.get("vuln_exp_status") + if status: + vex_stats["status_distribution"][status] = vex_stats["status_distribution"].get(status, 0) + 1 + else: + # Count VEX entries without an explicit status + vex_stats["status_distribution"]["no status"] = vex_stats["status_distribution"].get("no status", 0) + 1 + + # Count fields with content + if vuln.get("vuln_exp_justification"): + vex_stats["with_justification"] += 1 + if vuln.get("vuln_exp_response"): + vex_stats["with_response"] += 1 + if vuln.get("vuln_exp_details"): + vex_stats["with_details"] += 1 + + return vex_stats + + +# --------------------------------------------------------------------------- +# Internal Helper Functions +# --------------------------------------------------------------------------- + +def _create_empty_sarif_report(scan_code: str) -> Dict[str, Any]: + """Create an empty SARIF report when no vulnerabilities are found.""" + return { + "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", + "version": "2.1.0", + "runs": [{ + "tool": { + "driver": { + "name": "FossID Workbench", + "version": "1.0.0", + "informationUri": "https://fossid.com/products/workbench/", + "rules": [] + } + }, + "results": [], + "properties": { + "scan_code": scan_code, + "generated_at": datetime.utcnow().isoformat() + "Z", + "total_vulnerabilities": 0, + "severity_distribution": {"CRITICAL": 0, "HIGH": 0, "MEDIUM": 0, "LOW": 0, "UNKNOWN": 0}, + "external_data_sources": [], + "high_risk_vulnerabilities": {"cisa_kev": 0, "high_epss": 0, "critical_severity": 0, "total_high_risk": 0} + } + }] + } + + +def _calculate_severity_distribution(vulnerabilities: List[Dict[str, Any]]) -> Dict[str, int]: + """Calculate the distribution of vulnerabilities by severity.""" + distribution = {"CRITICAL": 0, "HIGH": 0, "MEDIUM": 0, "LOW": 0, "UNKNOWN": 0} + + for vuln in vulnerabilities: + severity = vuln.get("severity", "UNKNOWN").upper() + if severity in distribution: + distribution[severity] += 1 + else: + distribution["UNKNOWN"] += 1 + + return distribution + + +def _format_severity_breakdown_compact(severity_dist: Dict[str, int]) -> str: + """Format severity distribution as compact text for CLI display.""" + breakdown_parts = [] + abbreviations = {'CRITICAL': 'C', 'HIGH': 'H', 'MEDIUM': 'M', 'LOW': 'L', 'UNKNOWN': 'U'} + for severity in ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW', 'UNKNOWN']: + if severity_dist.get(severity, 0) > 0: + abbrev = abbreviations.get(severity, severity) + breakdown_parts.append(f"{abbrev}: {severity_dist[severity]}") + + return f"[{', '.join(breakdown_parts)}]" if breakdown_parts else "" + + +def _extract_unique_cves(vulnerabilities: List[Dict[str, Any]]) -> List[str]: + """Extract unique CVEs from vulnerability data, excluding UNKNOWN values.""" + return list(set( + vuln.get("cve", "UNKNOWN") + for vuln in vulnerabilities + if vuln.get("cve") != "UNKNOWN" + )) + + +def _count_vex_assessments(vulnerabilities: List[Dict[str, Any]]) -> Dict[str, int]: + """Count various VEX assessment metrics.""" + return { + "total_with_vex": sum(1 for vuln in vulnerabilities if vuln.get("vuln_exp_id")), + "with_status": sum(1 for vuln in vulnerabilities if vuln.get("vuln_exp_status")), + "with_response": sum(1 for vuln in vulnerabilities if vuln.get("vuln_exp_response")), + "exploitable": sum(1 for vuln in vulnerabilities if vuln.get("vuln_exp_status") == "exploitable"), + "suppressed": sum(1 for vuln in vulnerabilities if get_vex_info(vuln) and get_vex_info(vuln).get("vuln_exp_status") in ["not_affected", "fixed", "mitigated", "resolved", "false_positive"]) + } + + +def _get_data_sources_used(external_data: Dict[str, Dict[str, Any]]) -> List[str]: + """Get list of external data sources that were successfully used.""" + sources = [] + + for cve_data in external_data.values(): + if cve_data.get("epss_score") is not None and "FIRST EPSS" not in sources: + sources.append("FIRST EPSS") + if cve_data.get("cisa_kev") and "CISA KEV" not in sources: + sources.append("CISA KEV") + if cve_data.get("nvd_description") and "NVD" not in sources: + sources.append("NVD") + + return sources + + +def _count_high_risk_vulnerabilities(vulnerabilities: List[Dict[str, Any]], + external_data: Dict[str, Dict[str, Any]]) -> Dict[str, int]: + """Count high-risk vulnerabilities based on external data.""" + counts = { + "cisa_kev": 0, + "high_epss": 0, + "critical_severity": 0, + "total_high_risk": 0 + } + + high_risk_cves = set() + + for vuln in vulnerabilities: + cve = vuln.get("cve", "UNKNOWN") + ext_data = external_data.get(cve, {}) + + is_high_risk = False + + if ext_data.get("cisa_kev"): + counts["cisa_kev"] += 1 + is_high_risk = True + + epss_score = ext_data.get("epss_score") + if epss_score is not None and epss_score > 0.1: + counts["high_epss"] += 1 + is_high_risk = True + + if vuln.get("severity", "").upper() == "CRITICAL": + counts["critical_severity"] += 1 + is_high_risk = True + + if is_high_risk: + high_risk_cves.add(cve) + + counts["total_high_risk"] = len(high_risk_cves) + return counts + + +def _map_severity_to_sarif_level(severity: str) -> str: + """Map Workbench severity levels to SARIF levels - defaults to WARNING for intelligent promotion/demotion.""" + # Default to WARNING - will be intelligently promoted/demoted based on external intelligence + return "warning" + + +def map_vex_status_to_sarif_level(vex_status: str, original_level: str, external_data: Dict[str, Any] = None) -> str: + """ + Map VEX status and external intelligence to appropriate SARIF level. + + New intelligent prioritization logic: + - Default: WARNING (from _map_severity_to_sarif_level) + - Promote to ERROR if: + - High EPSS score (>0.1) + - VEX status is "exploitable" with response "can_not_fix" + - CISA KEV vulnerability + - Demote to NOTE if: + - VEX status indicates resolved/mitigated/not_affected/false_positive + - VEX response indicates will_not_fix/update (accepted risk) + """ + if external_data is None: + external_data = {} + + # Check for promotion to ERROR level + + # Promote if high EPSS score + epss_score = external_data.get("epss_score", 0) + if epss_score and epss_score > 0.1: + return "error" + + # Promote if CISA KEV + if external_data.get("cisa_kev"): + return "error" + + # Promote if VEX status indicates exploitable and can't fix + if vex_status: + vex_status_lower = vex_status.lower() + + # For now, we'll handle the "exploitable + can_not_fix" case + # This would require also checking the VEX response, but for now we'll focus on the status + if vex_status_lower in ["exploitable", "affected"]: + return "error" # Promote exploitable/affected vulnerabilities + + # Check for demotion to NOTE level + + if vex_status: + vex_status_lower = vex_status.lower() + + # Demote VEX assessed vulnerabilities that are resolved or mitigated + if vex_status_lower in ["not_affected", "fixed", "mitigated", "resolved", "false_positive"]: + return "note" + + # Default to WARNING for everything else + return "warning" + + +def _build_cvss_vector(vuln: Dict[str, Any]) -> str: + """Build a CVSS vector string from available vulnerability data.""" + version = vuln.get("cvss_version", "3.1") + + vector_parts = [f"CVSS:{version}"] + + # Attack Vector + av = vuln.get("attack_vector", "") + if av: + av_map = {"NETWORK": "N", "ADJACENT_NETWORK": "A", "LOCAL": "L", "PHYSICAL": "P"} + vector_parts.append(f"AV:{av_map.get(av, av[0] if av else 'N')}") + + # Attack Complexity + ac = vuln.get("attack_complexity", "") + if ac: + ac_map = {"LOW": "L", "HIGH": "H"} + vector_parts.append(f"AC:{ac_map.get(ac, ac[0] if ac else 'L')}") + + # Availability Impact + a = vuln.get("availability_impact", "") + if a: + a_map = {"NONE": "N", "LOW": "L", "HIGH": "H"} + vector_parts.append(f"A:{a_map.get(a, a[0] if a else 'N')}") + + return "/".join(vector_parts) if len(vector_parts) > 1 else "CVSS vector not available" + + +def _extract_version_ranges(references: List[Dict[str, Any]]) -> str: + """Extract version information from NVD references where possible.""" + version_patterns = [] + + for ref in references: + url = ref.get("url", "").lower() + tags = [tag.lower() for tag in ref.get("tags", [])] + + # Look for vendor advisory URLs that often contain version info + if any(tag in ["vendor advisory", "patch", "mitigation"] for tag in tags): + # Common patterns in vendor URLs + if "github.com" in url and "/releases/" in url: + # GitHub release pages often have version info + version_patterns.append("See GitHub releases for affected versions") + elif any(vendor in url for vendor in ["apache.org", "nodejs.org", "golang.org", "python.org"]): + version_patterns.append("Check vendor advisory for version details") + + if version_patterns: + return "; ".join(set(version_patterns)) # Remove duplicates + + return "" + + +def _generate_enhanced_rules(vulnerabilities: List[Dict[str, Any]], + external_data: Dict[str, Dict[str, Any]]) -> List[Dict[str, Any]]: + """Generate enhanced SARIF rules from vulnerability data with external enrichment and VEX information.""" + rules = {} + + for vuln in vulnerabilities: + cve = vuln.get("cve", "UNKNOWN") + component_name = vuln.get("component_name", "Unknown") + component_version = vuln.get("component_version", "Unknown") + + # Create unique rule ID combining CVE, component, and version + rule_id = f"{cve}:{component_name}@{component_version}" if cve != "UNKNOWN" else f"UNKNOWN:{component_name}@{component_version}" + + if rule_id not in rules: + # Get external data and VEX information + ext_data = external_data.get(cve, {}) + vex_info = get_vex_info(vuln) + + # Use intelligent prioritization for default configuration level + original_level = _map_severity_to_sarif_level(vuln.get("severity", "UNKNOWN")) + vex_status = vex_info.get("vuln_exp_status") if vex_info else None + intelligent_level = map_vex_status_to_sarif_level(vex_status, original_level, ext_data) + + # Create enhanced descriptions using NVD data + short_desc = f"{cve} in {component_name}@{component_version} (CVSS {vuln.get('base_score', 'N/A')})" + if ext_data.get("nvd_cwe"): + cwe_list = ext_data["nvd_cwe"][:2] # Show first 2 CWEs to keep it concise + cwe_text = ", ".join(cwe_list) + short_desc += f" - {cwe_text}" + + # Use NVD description if available, otherwise fall back to generic description + nvd_desc = ext_data.get("nvd_description") + if nvd_desc and nvd_desc.strip() and nvd_desc != "No description available": + full_desc = nvd_desc + else: + full_desc = f"Security vulnerability {cve} affecting {component_name} with CVSS score {vuln.get('base_score', 'N/A')}" + + # Add component context to NVD description + if ext_data.get("nvd_description") and ext_data["nvd_description"] != "No description available": + full_desc += f"\n\nAffected Component: {component_name} version {component_version}" + + # Add affected version ranges if we can extract them from references + version_info = _extract_version_ranges(ext_data.get("nvd_references", [])) + if version_info: + full_desc += f"\nKnown Affected Versions: {version_info}" + + rule = { + "id": rule_id, + "name": f"{cve} in {component_name}@{component_version}", + "shortDescription": { + "text": short_desc + }, + "fullDescription": { + "text": full_desc + }, + "defaultConfiguration": { + "level": intelligent_level + }, + "properties": { + "security-severity": str(vuln.get("base_score", "0.0")), + "cvss_version": vuln.get("cvss_version", "N/A"), + "cvss_vector": ext_data.get("full_cvss_vector") or _build_cvss_vector(vuln), + "base_score": ext_data.get("cvss_score") or vuln.get("base_score", "N/A"), + "attack_vector": vuln.get("attack_vector", "N/A"), + "attack_complexity": vuln.get("attack_complexity", "N/A"), + "availability_impact": vuln.get("availability_impact", "N/A"), + "severity": vuln.get("severity", "UNKNOWN"), + "component_name": component_name, + "tags": ["security", "vulnerability"], + "nvd_enriched": bool(ext_data.get("nvd_description")) + }, + "helpUri": f"https://nvd.nist.gov/vuln/detail/{cve}" if cve != "UNKNOWN" else None + } + + # Add external data properties + if ext_data.get("epss_score") is not None: + rule["properties"]["epss_score"] = ext_data["epss_score"] + rule["properties"]["epss_percentile"] = ext_data["epss_percentile"] + + if ext_data.get("cisa_kev"): + rule["properties"]["cisa_known_exploited"] = True + + if ext_data.get("nvd_cwe"): + rule["properties"]["cwe_ids"] = ext_data["nvd_cwe"] + + # Add NVD references for additional context + if ext_data.get("nvd_references"): + # Include up to 5 most relevant references + relevant_refs = [] + for ref in ext_data["nvd_references"][:5]: + ref_info = { + "url": ref.get("url", ""), + "source": ref.get("source", "Unknown") + } + if ref.get("tags"): + ref_info["tags"] = ref["tags"] + relevant_refs.append(ref_info) + rule["properties"]["nvd_references"] = relevant_refs + + # Add VEX properties + if vex_info: + vex_properties = generate_vex_properties(vex_info) + rule["properties"].update(vex_properties) + + rules[rule_id] = rule + + return list(rules.values()) + + +def _generate_enhanced_results(vulnerabilities: List[Dict[str, Any]], + external_data: Dict[str, Dict[str, Any]]) -> List[Dict[str, Any]]: + """Generate enhanced SARIF results with external data and VEX information.""" + results = [] + + for vuln in vulnerabilities: + cve = vuln.get("cve", "UNKNOWN") + component_name = vuln.get("component_name", "Unknown") + component_version = vuln.get("component_version", "Unknown") + severity = vuln.get("severity", "UNKNOWN") + base_score = vuln.get("base_score", "N/A") + + # Get external data and VEX info + ext_data = external_data.get(cve, {}) + vex_info = get_vex_info(vuln) + + # Create enhanced package URL with ecosystem detection + ecosystem = _detect_package_ecosystem(component_name, component_version, ext_data.get("purl")) + artifact_uri = f"pkg:{ecosystem}/{component_name}@{component_version}" + + # Create unique rule ID combining CVE, component, and version + rule_id = f"{cve}:{component_name}@{component_version}" if cve != "UNKNOWN" else f"UNKNOWN:{component_name}@{component_version}" + + # Map severity to SARIF level with VEX consideration + original_level = _map_severity_to_sarif_level(severity) + vex_status = vex_info.get("vuln_exp_status") if vex_info else None + final_level = map_vex_status_to_sarif_level(vex_status, original_level, ext_data) + + # Determine prioritization context based on promotion/demotion logic + priority_context = "" + + # Check if promoted to ERROR by external intelligence + if final_level == "error" and original_level == "warning": + # Check promotion reasons in order of priority + if ext_data.get("cisa_kev"): + priority_context = "[CISA KEV] " + elif (ext_data.get("epss_score") or 0) > 0.1: + priority_context = f"[EPSS: {ext_data['epss_score']:.3f}] " + elif vex_status and vex_status.lower() in ["exploitable", "affected"]: + priority_context = f"[VEX: {vex_status.upper()}] " + + # Check if demoted to NOTE by VEX + elif final_level == "note" and original_level == "warning": + if vex_status: + priority_context = f"[VEX: {vex_status.upper()}] " + + # Create clean message without component details (since grouped by component) + message_text = f"{priority_context}[CVSS: {base_score}] {cve}" + + + result = { + "ruleId": rule_id, + "level": final_level, + "message": { + "text": message_text + }, + "locations": [{ + "physicalLocation": { + "artifactLocation": { + "uri": artifact_uri, + "description": { + "text": f"Vulnerable component: {component_name} version {component_version}" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": f"{component_name}@{component_version}" + } + } + }, + "logicalLocations": [{ + "name": component_name, + "fullyQualifiedName": artifact_uri, + "kind": "package" + }] + }], + "properties": { + "vulnerability_id": vuln.get("id"), + "cvss_version": vuln.get("cvss_version"), + "security-severity": str(base_score), # SARIF standard property for security findings + "attack_vector": vuln.get("attack_vector"), + "attack_complexity": vuln.get("attack_complexity"), + "availability_impact": vuln.get("availability_impact"), + "component_id": vuln.get("component_id"), + "component_name": component_name, + "component_version": component_version, + "ecosystem": ecosystem, + "package_url": artifact_uri, + "baselineState": "unchanged", + "tags": { + "vulnerability": [cve], + "component": [f"{component_name}@{component_version}"], + "severity": [severity.lower() if severity != "UNKNOWN" else "unknown"] + } + } + } + + # Add external data properties + if ext_data.get("epss_score") is not None: + result["properties"]["epss_score"] = ext_data["epss_score"] + result["properties"]["epss_percentile"] = ext_data["epss_percentile"] + + if ext_data.get("cisa_kev"): + result["properties"]["cisa_known_exploited"] = True + + if ext_data.get("nvd_cwe"): + result["properties"]["cwe_ids"] = ext_data["nvd_cwe"] + + if ext_data.get("nvd_description"): + result["properties"]["nvd_description"] = ext_data["nvd_description"] + + if ext_data.get("full_cvss_vector"): + result["properties"]["full_cvss_vector"] = ext_data["full_cvss_vector"] + + if ext_data.get("nvd_references"): + # Store key references for analysis tools + result["properties"]["nvd_reference_count"] = len(ext_data["nvd_references"]) + result["properties"]["nvd_vendor_advisories"] = len([ + ref for ref in ext_data["nvd_references"] + if "vendor advisory" in [tag.lower() for tag in ref.get("tags", [])] + ]) + + # Add VEX properties + if vex_info: + vex_properties = generate_vex_properties(vex_info) + result["properties"].update(vex_properties) + + # Add fingerprints for deduplication + wid = str(vuln.get("id", "unknown")) + result["fingerprints"] = { + "workbench/component": f"{component_name}@{component_version}", + "workbench/vulnerability": f"{cve}#{wid}", + "workbench/id": wid, + "primary": f"{wid}", + "stable": f"{cve}" + } + + # Add suppression information if VEX status indicates resolved/mitigated + if vex_info and vex_info.get("vuln_exp_status"): + vex_status = vex_info["vuln_exp_status"].lower() + if vex_status in ["not_affected", "fixed", "mitigated", "accepted_risk", "false_positive", "resolved"]: + result["suppressions"] = [{ + "kind": "externalTriage", + "status": "accepted", + "justification": vex_info.get("vuln_exp_justification", f"VEX status: {vex_status}") + }] + + results.append(result) + + return results \ No newline at end of file diff --git a/src/workbench_cli/utilities/scan_workflows.py b/src/workbench_cli/utilities/scan_workflows.py index 5e95097..0361d4d 100644 --- a/src/workbench_cli/utilities/scan_workflows.py +++ b/src/workbench_cli/utilities/scan_workflows.py @@ -444,43 +444,7 @@ def fetch_display_save_results(workbench: 'WorkbenchAPI', params: argparse.Names save_results_to_file(json_path, collected_results, scan_code) else: print("\nNo results were successfully collected, skipping JSON save.") - - # Handle SARIF output for vulnerabilities - sarif_path = getattr(params, 'sarif_result_path', None) - if sarif_path: - if not getattr(params, 'show_vulnerabilities', False): - print("\nWarning: --sarif-result-path requires --show-vulnerabilities flag") - elif not collected_results.get('vulnerabilities'): - print("\nNo vulnerability results to save in SARIF format") - else: - from .sarif_converter import save_vulns_to_sarif - print(f"\nSaving enhanced vulnerability results in SARIF format to '{sarif_path}'...") - try: - # Configure external data fetching (can be extended with CLI options later) - include_descriptions = True # Fetch CVE descriptions from NVD - include_epss = True # Fetch EPSS scores from FIRST - include_exploits = True # Fetch CISA KEV data - api_timeout = 30 # API timeout in seconds - - save_vulns_to_sarif( - sarif_path, - collected_results['vulnerabilities'], - scan_code, - include_descriptions, - include_epss, - include_exploits, - api_timeout, - include_vex=True, - include_scan_metadata=True, - suppress_vex_mitigated=True, - suppress_accepted_risk=True, - suppress_false_positives=True, - group_by_component=True, - quiet=False - ) - except Exception as e: - print(f"Error saving SARIF results: {e}") - + # Legacy support for --path-result (deprecated, use --json-result-path instead) legacy_path = getattr(params, 'path_result', None) if legacy_path: diff --git a/src/workbench_cli/utilities/vulnerability_enricher.py b/src/workbench_cli/utilities/vulnerability_enricher.py index b0fd22d..a775aeb 100644 --- a/src/workbench_cli/utilities/vulnerability_enricher.py +++ b/src/workbench_cli/utilities/vulnerability_enricher.py @@ -20,12 +20,9 @@ EPSS_API_URL = "https://api.first.org/data/v1/epss" NVD_API_URL = "https://services.nvd.nist.gov/rest/json/cves/2.0" CISA_KEV_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" -EXPLOITDB_SEARCH_URL = "https://www.exploit-db.com/api/v1/search/" # Alternative vulnerability data sources VULNERS_API_URL = "https://vulners.com/api/v3/search/id" -VULNCHECK_NVD_URL = "https://api.vulncheck.com/v3/index/nvd2-cves" -OSV_API_URL = "https://api.osv.dev/v1/query" # Rate limiting settings NVD_RATE_LIMIT_NO_KEY = 5 # requests per 30 seconds without API key @@ -33,20 +30,23 @@ EPSS_RATE_LIMIT = 100 # requests per minute REQUEST_TIMEOUT = 30 # seconds +# Module-level cache for NVD data to persist across function calls +_NVD_CACHE: Dict[str, Dict[str, Any]] = {} + def enrich_vulnerabilities(cve_list: List[str], - include_descriptions: bool = True, - include_epss_scores: bool = True, - include_exploit_info: bool = True, + nvd_enrichment: bool = True, + epss_enrichment: bool = True, + cisa_kev_enrichment: bool = True, api_timeout: int = 30) -> Dict[str, Dict[str, Any]]: """ Enrich vulnerability data with external sources. Args: cve_list: List of CVE IDs to enrich - include_descriptions: Whether to fetch CVE descriptions from NVD - include_epss_scores: Whether to fetch EPSS scores from FIRST - include_exploit_info: Whether to fetch known exploit information + nvd_enrichment: Whether to fetch CVE descriptions from NVD + epss_enrichment: Whether to fetch EPSS scores from FIRST + cisa_kev_enrichment: Whether to fetch known exploit information api_timeout: Timeout for external API calls in seconds Returns: @@ -57,17 +57,17 @@ def enrich_vulnerabilities(cve_list: List[str], return _fetch_external_vulnerability_data( cve_list, - include_descriptions, - include_epss_scores, - include_exploit_info, + nvd_enrichment, + epss_enrichment, + cisa_kev_enrichment, api_timeout ) def _fetch_external_vulnerability_data(cve_list: List[str], - include_descriptions: bool = True, - include_epss: bool = True, - include_exploits: bool = True, + nvd_enrichment: bool = True, + epss_enrichment: bool = True, + cisa_kev_enrichment: bool = True, timeout: int = 30) -> Dict[str, Dict[str, Any]]: """ Fetch external vulnerability data from multiple sources. @@ -93,7 +93,7 @@ def _fetch_external_vulnerability_data(cve_list: List[str], # Fetch data from different sources try: - if include_epss: + if epss_enrichment: epss_data = _fetch_epss_scores(cve_list, timeout) for cve, data in epss_data.items(): if cve in external_data: @@ -102,7 +102,7 @@ def _fetch_external_vulnerability_data(cve_list: List[str], logger.warning(f"Failed to fetch EPSS data: {e}") try: - if include_exploits: + if cisa_kev_enrichment: kev_data = _fetch_cisa_kev_data(cve_list, timeout) for cve in kev_data: if cve in external_data: @@ -111,7 +111,7 @@ def _fetch_external_vulnerability_data(cve_list: List[str], logger.warning(f"Failed to fetch CISA KEV data: {e}") try: - if include_descriptions: + if nvd_enrichment: nvd_data = _fetch_nvd_data(cve_list, timeout) for cve, data in nvd_data.items(): if cve in external_data: @@ -136,7 +136,7 @@ def _fetch_epss_scores(cve_list: List[str], timeout: int = 30) -> Dict[str, Dict response = requests.get( f"{EPSS_API_URL}?cve={cve_param}", timeout=timeout, - headers={"User-Agent": "FossID-Workbench-CLI/1.0"} + headers={"User-Agent": "Workbench-CLI/1.0"} ) response.raise_for_status() @@ -165,7 +165,7 @@ def _fetch_cisa_kev_data(cve_list: List[str], timeout: int = 30) -> List[str]: response = requests.get( CISA_KEV_URL, timeout=timeout, - headers={"User-Agent": "FossID-Workbench-CLI/1.0"} + headers={"User-Agent": "Workbench-CLI/1.0"} ) response.raise_for_status() @@ -192,16 +192,11 @@ def _fetch_nvd_data(cve_list: List[str], timeout: int = 30) -> Dict[str, Dict[st Improvements: - Concurrent processing with rate limiting - Exponential backoff retry logic - - In-memory caching for duplicate requests + - Persistent module-level caching for duplicate requests - API key support for higher rate limits - Progress tracking for large CVE lists - Alternative data source fallback """ - return _fetch_nvd_data_enhanced(cve_list, timeout) - - -def _fetch_nvd_data_enhanced(cve_list: List[str], timeout: int = 30) -> Dict[str, Dict[str, Any]]: - """Enhanced NVD data fetching with concurrent processing and intelligent rate limiting.""" nvd_data = {} if not cve_list: @@ -215,17 +210,14 @@ def _fetch_nvd_data_enhanced(cve_list: List[str], timeout: int = 30) -> Dict[str # Initialize rate limiter rate_limiter = RateLimiter(max_workers, rate_limit_delay) - # Initialize cache - cache = {} - logger.info(f"Fetching NVD data for {len(cve_list)} CVEs using {'API key' if api_key else 'public rate limits'}") # Filter out already cached CVEs - cves_to_fetch = [cve for cve in cve_list if cve not in cache] + cves_to_fetch = [cve for cve in cve_list if cve not in _NVD_CACHE] if not cves_to_fetch: logger.info("All CVEs found in cache") - return {cve: cache[cve] for cve in cve_list} + return {cve: _NVD_CACHE[cve] for cve in cve_list if cve in _NVD_CACHE} # Process CVEs concurrently with ThreadPoolExecutor(max_workers=max_workers) as executor: @@ -245,7 +237,7 @@ def _fetch_nvd_data_enhanced(cve_list: List[str], timeout: int = 30) -> Dict[str result = future.result() if result: nvd_data[cve] = result - cache[cve] = result # Cache successful results + _NVD_CACHE[cve] = result # Cache successful results if completed % 10 == 0 or completed == len(cves_to_fetch): logger.info(f"Processed {completed}/{len(cves_to_fetch)} CVEs") @@ -261,6 +253,11 @@ def _fetch_nvd_data_enhanced(cve_list: List[str], timeout: int = 30) -> Dict[str except Exception as alt_e: logger.warning(f"Alternative data source also failed for {cve}: {alt_e}") + # Include cached results in the return data + for cve in cve_list: + if cve in _NVD_CACHE and cve not in nvd_data: + nvd_data[cve] = _NVD_CACHE[cve] + return nvd_data @@ -442,6 +439,7 @@ def wait(self): return # Need to wait - wait_time = self.delay - (elapsed % self.delay) - time.sleep(wait_time) + wait_time = max(0, self.delay - (elapsed % self.delay)) + if wait_time > 0: + time.sleep(wait_time) self.tokens = max(0, self.tokens - 1) \ No newline at end of file diff --git a/tests/unit/handlers/test_export_sarif.py b/tests/unit/handlers/test_export_sarif.py index b3af010..0ebc4c6 100644 --- a/tests/unit/handlers/test_export_sarif.py +++ b/tests/unit/handlers/test_export_sarif.py @@ -95,23 +95,18 @@ def test_successful_export(self, mock_save_sarif, mock_workbench, mock_params): mock_workbench.ensure_scan_is_idle.assert_called_once_with("TEST_SCAN_456", mock_params, ["SCAN", "DEPENDENCY_ANALYSIS"]) mock_workbench.list_vulnerabilities.assert_called_once_with("TEST_SCAN_456") - # Verify SARIF export - mock_save_sarif.assert_called_once_with( - filepath="test_output.sarif", - vulnerabilities=mock_workbench.list_vulnerabilities.return_value, - scan_code="TEST_SCAN_456", - include_cve_descriptions=True, - include_epss_scores=True, - include_exploit_info=True, - api_timeout=30, - include_vex=True, - include_scan_metadata=True, - suppress_vex_mitigated=True, - suppress_accepted_risk=True, - suppress_false_positives=True, - group_by_component=True, - quiet=False - ) + # Verify SARIF export using new parameter format + mock_save_sarif.assert_called_once() + call_args = mock_save_sarif.call_args + assert call_args.kwargs['filepath'] == "test_output.sarif" + assert call_args.kwargs['scan_code'] == "TEST_SCAN_456" + assert call_args.kwargs['nvd_enrichment'] is True + assert call_args.kwargs['epss_enrichment'] is True + assert call_args.kwargs['cisa_kev_enrichment'] is True + assert call_args.kwargs['api_timeout'] == 30 + assert call_args.kwargs['enable_vex_suppression'] is True + assert call_args.kwargs['quiet'] is False + assert 'external_data' in call_args.kwargs @patch('workbench_cli.handlers.export_sarif.save_vulns_to_sarif') def test_export_with_no_vulnerabilities(self, mock_save_sarif, mock_workbench, mock_params): @@ -124,22 +119,19 @@ def test_export_with_no_vulnerabilities(self, mock_save_sarif, mock_workbench, m # Verify assert result is True - mock_save_sarif.assert_called_once_with( - filepath="test_output.sarif", - vulnerabilities=[], - scan_code="TEST_SCAN_456", - include_cve_descriptions=True, - include_epss_scores=True, - include_exploit_info=True, - api_timeout=30, - include_vex=True, - include_scan_metadata=True, - suppress_vex_mitigated=True, - suppress_accepted_risk=True, - suppress_false_positives=True, - group_by_component=True, - quiet=False - ) + # Check that save_vulns_to_sarif was called with the new parameter format + mock_save_sarif.assert_called_once() + call_args = mock_save_sarif.call_args + assert call_args.kwargs['filepath'] == "test_output.sarif" + assert call_args.kwargs['vulnerabilities'] == [] + assert call_args.kwargs['scan_code'] == "TEST_SCAN_456" + assert call_args.kwargs['nvd_enrichment'] is True + assert call_args.kwargs['epss_enrichment'] is True + assert call_args.kwargs['cisa_kev_enrichment'] is True + assert call_args.kwargs['api_timeout'] == 30 + assert call_args.kwargs['enable_vex_suppression'] is True + assert call_args.kwargs['quiet'] is False + assert 'external_data' in call_args.kwargs @patch('workbench_cli.handlers.export_sarif.save_vulns_to_sarif') def test_export_with_custom_options(self, mock_save_sarif, mock_workbench, mock_params): @@ -156,22 +148,18 @@ def test_export_with_custom_options(self, mock_save_sarif, mock_workbench, mock_ # Verify assert result is True - mock_save_sarif.assert_called_once_with( - filepath="custom_output.sarif", - vulnerabilities=mock_workbench.list_vulnerabilities.return_value, - scan_code="TEST_SCAN_456", - include_cve_descriptions=False, - include_epss_scores=False, - include_exploit_info=False, - api_timeout=60, - include_vex=True, - include_scan_metadata=True, - suppress_vex_mitigated=True, - suppress_accepted_risk=True, - suppress_false_positives=True, - group_by_component=True, - quiet=False - ) + # Check that save_vulns_to_sarif was called with the new parameter format + mock_save_sarif.assert_called_once() + call_args = mock_save_sarif.call_args + assert call_args.kwargs['filepath'] == "custom_output.sarif" + assert call_args.kwargs['scan_code'] == "TEST_SCAN_456" + assert call_args.kwargs['nvd_enrichment'] is False + assert call_args.kwargs['epss_enrichment'] is False + assert call_args.kwargs['cisa_kev_enrichment'] is False + assert call_args.kwargs['api_timeout'] == 60 + assert call_args.kwargs['enable_vex_suppression'] is True + assert call_args.kwargs['quiet'] is False + assert 'external_data' in call_args.kwargs def test_project_not_found_error(self, mock_workbench, mock_params): """Test handling of project not found error.""" @@ -228,12 +216,11 @@ def test_vulnerability_summary_display(self, mock_save_sarif, mock_workbench, mo # Verify assert result is True captured = capsys.readouterr() - assert "Found 4 vulnerabilities to export" in captured.out - assert "HIGH: 2" in captured.out - assert "MEDIUM: 1" in captured.out - assert "LOW: 1" in captured.out - assert "With VEX assessments: 2" in captured.out - assert "Without VEX assessments: 2" in captured.out + assert "Retrieved 4 Vulnerabilities" in captured.out + assert "H: 2" in captured.out + assert "M: 1" in captured.out + assert "L: 1" in captured.out + assert "Retrieved VEX for 2/4 CVEs" in captured.out @patch('workbench_cli.handlers.export_sarif.save_vulns_to_sarif') def test_configuration_display(self, mock_save_sarif, mock_workbench, mock_params, capsys): @@ -244,13 +231,11 @@ def test_configuration_display(self, mock_save_sarif, mock_workbench, mock_param # Verify assert result is True captured = capsys.readouterr() - assert "SARIF Export Configuration:" in captured.out - assert "Output file: test_output.sarif" in captured.out - assert "Include CVE descriptions: True" in captured.out - assert "Include EPSS scores: True" in captured.out - assert "Include exploit information: True" in captured.out - assert "Apply VEX suppression: True" in captured.out - assert "API timeout: 30s" in captured.out + # The current handler doesn't display a configuration section + # Instead it shows the enrichment sources being used + assert "External Enrichment: NVD, EPSS, CISA KEV" in captured.out + assert "Dynamic Scoring:" in captured.out + assert "VEX Suppression: Enabled" in captured.out @patch('workbench_cli.handlers.export_sarif.save_vulns_to_sarif') def test_integration_tips_display(self, mock_save_sarif, mock_workbench, mock_params, capsys): @@ -261,10 +246,10 @@ def test_integration_tips_display(self, mock_save_sarif, mock_workbench, mock_pa # Verify assert result is True captured = capsys.readouterr() - assert "Integration Tips:" in captured.out - assert "Upload to GitHub" in captured.out - assert "CI/CD Integration" in captured.out - assert "Security Tools" in captured.out + # The current handler doesn't display integration tips + # Instead it shows a simple success message + assert "SARIF export completed successfully!" in captured.out + assert "Report saved to: test_output.sarif" in captured.out @patch('workbench_cli.handlers.export_sarif.save_vulns_to_sarif') def test_default_output_file(self, mock_save_sarif, mock_workbench): @@ -299,19 +284,14 @@ def test_default_output_file(self, mock_save_sarif, mock_workbench): assert result is True mock_save_sarif.assert_called_once() # Check that filepath was passed correctly - mock_save_sarif.assert_called_with( - filepath="vulns.sarif", - vulnerabilities=mock_workbench.list_vulnerabilities.return_value, - scan_code="TEST_SCAN_456", - include_cve_descriptions=True, - include_epss_scores=True, - include_exploit_info=True, - api_timeout=30, - include_vex=True, - include_scan_metadata=True, - suppress_vex_mitigated=True, - suppress_accepted_risk=True, - suppress_false_positives=True, - group_by_component=True, - quiet=False - ) \ No newline at end of file + # Check that save_vulns_to_sarif was called with the new parameter format + call_args = mock_save_sarif.call_args + assert call_args.kwargs['filepath'] == "vulns.sarif" + assert call_args.kwargs['scan_code'] == "TEST_SCAN_456" + assert call_args.kwargs['nvd_enrichment'] is True + assert call_args.kwargs['epss_enrichment'] is True + assert call_args.kwargs['cisa_kev_enrichment'] is True + assert call_args.kwargs['api_timeout'] == 30 + assert call_args.kwargs['enable_vex_suppression'] is True + assert call_args.kwargs['quiet'] is False + assert 'external_data' in call_args.kwargs \ No newline at end of file diff --git a/tests/unit/handlers/test_show_results.py b/tests/unit/handlers/test_show_results.py index d959f95..16e7adf 100644 --- a/tests/unit/handlers/test_show_results.py +++ b/tests/unit/handlers/test_show_results.py @@ -217,7 +217,6 @@ def test_handle_show_results_multiple_show_flags(self, mock_fetch, mock_workbenc mock_params.show_scan_metrics = True mock_params.show_policy_warnings = True mock_params.show_vulnerabilities = True - mock_params.sarif_result_path = None # Mock the resolution functions mock_workbench.resolve_project.return_value = "PROJ_A_CODE" @@ -231,74 +230,4 @@ def test_handle_show_results_multiple_show_flags(self, mock_fetch, mock_workbenc assert result is True mock_fetch.assert_called_once() - def test_validation_error_sarif_without_vulnerabilities(self, mock_workbench, mock_params): - """Tests show-results when SARIF output is requested without --show-vulnerabilities.""" - # Setup mocks - mock_params.command = 'show-results' - mock_params.project_name = "ProjA" - mock_params.scan_name = "Scan1" - mock_params.show_licenses = True - mock_params.show_components = False - mock_params.show_dependencies = False - mock_params.show_scan_metrics = False - mock_params.show_policy_warnings = False - mock_params.show_vulnerabilities = False # This is False - mock_params.sarif_result_path = "output.sarif" # But SARIF is requested - - # Execute and verify - with pytest.raises(ValidationError, match="--sarif-result-path requires --show-vulnerabilities flag"): - handle_show_results(mock_workbench, mock_params) - - @patch('workbench_cli.handlers.show_results.fetch_display_save_results') - def test_handle_show_results_with_sarif_and_vulnerabilities(self, mock_fetch, mock_workbench, mock_params): - """Tests show-results with SARIF output and vulnerabilities enabled.""" - # Setup mocks - mock_params.command = 'show-results' - mock_params.project_name = "ProjA" - mock_params.scan_name = "Scan1" - mock_params.show_licenses = False - mock_params.show_components = False - mock_params.show_dependencies = False - mock_params.show_scan_metrics = False - mock_params.show_policy_warnings = False - mock_params.show_vulnerabilities = True # This is True - mock_params.sarif_result_path = "output.sarif" # SARIF is requested - - # Mock the resolution functions - mock_workbench.resolve_project.return_value = "PROJ_A_CODE" - mock_workbench.resolve_scan.return_value = ("SCAN_1_CODE", 123) - mock_workbench.get_scan_status.return_value = {"status": "FINISHED"} - - # Execute - result = handle_show_results(mock_workbench, mock_params) - - # Verify - should succeed since both SARIF and vulnerabilities are enabled - assert result is True - mock_fetch.assert_called_once_with(mock_workbench, mock_params, "SCAN_1_CODE") - - @patch('workbench_cli.handlers.show_results.fetch_display_save_results') - def test_handle_show_results_sarif_none_allowed(self, mock_fetch, mock_workbench, mock_params): - """Tests show-results when SARIF path is None (should be allowed).""" - # Setup mocks - mock_params.command = 'show-results' - mock_params.project_name = "ProjA" - mock_params.scan_name = "Scan1" - mock_params.show_licenses = True - mock_params.show_components = False - mock_params.show_dependencies = False - mock_params.show_scan_metrics = False - mock_params.show_policy_warnings = False - mock_params.show_vulnerabilities = False - mock_params.sarif_result_path = None # No SARIF requested - - # Mock the resolution functions - mock_workbench.resolve_project.return_value = "PROJ_A_CODE" - mock_workbench.resolve_scan.return_value = ("SCAN_1_CODE", 123) - mock_workbench.get_scan_status.return_value = {"status": "FINISHED"} - - # Execute - result = handle_show_results(mock_workbench, mock_params) - - # Verify - should succeed since no SARIF is requested - assert result is True - mock_fetch.assert_called_once_with(mock_workbench, mock_params, "SCAN_1_CODE") \ No newline at end of file + \ No newline at end of file diff --git a/tests/unit/utilities/test_sarif_converter.py b/tests/unit/utilities/test_sarif_converter.py index d89a8da..fa208bc 100644 --- a/tests/unit/utilities/test_sarif_converter.py +++ b/tests/unit/utilities/test_sarif_converter.py @@ -13,23 +13,20 @@ from unittest.mock import patch, mock_open from typing import Dict, List, Any -from workbench_cli.utilities.sarif_converter import ( +from workbench_cli.utilities.sarif_generation import ( convert_vulns_to_sarif, save_vulns_to_sarif, _map_severity_to_sarif_level, _generate_enhanced_rules, _generate_enhanced_results, - _create_empty_sarif_report, - # Legacy functions for backward compatibility - _generate_rules, - _generate_results + _create_empty_sarif_report ) from workbench_cli.utilities.vulnerability_enricher import ( enrich_vulnerabilities, _fetch_epss_scores, _fetch_cisa_kev_data, - _fetch_nvd_data_enhanced, + _fetch_nvd_data, _fetch_single_cve_nvd, _parse_nvd_vulnerability, _fetch_vulners_data, @@ -76,7 +73,7 @@ def test_convert_vulns_to_sarif_with_data(self): ] # Mock the vulnerability enricher to avoid external API calls - with patch('workbench_cli.utilities.sarif_converter.enrich_vulnerabilities') as mock_enrich: + with patch('workbench_cli.utilities.sarif_generation.enrich_vulnerabilities') as mock_enrich: mock_enrich.return_value = {} sarif_data = convert_vulns_to_sarif(sample_vulns, "TEST_SCAN_123") @@ -94,19 +91,19 @@ def test_convert_vulns_to_sarif_with_data(self): # Validate rules assert len(run["tool"]["driver"]["rules"]) == 2 rule_ids = [rule["id"] for rule in run["tool"]["driver"]["rules"]] - assert "CVE-2022-12345" in rule_ids - assert "CVE-2022-67890" in rule_ids + assert "CVE-2022-12345:test-package@1.0.0" in rule_ids + assert "CVE-2022-67890:another-package@2.1.0" in rule_ids # Validate results assert len(run["results"]) == 2 result_rule_ids = [result["ruleId"] for result in run["results"]] - assert "CVE-2022-12345" in result_rule_ids - assert "CVE-2022-67890" in result_rule_ids + assert "CVE-2022-12345:test-package@1.0.0" in result_rule_ids + assert "CVE-2022-67890:another-package@2.1.0" in result_rule_ids # Validate severity mapping - critical_result = next(r for r in run["results"] if r["ruleId"] == "CVE-2022-12345") - medium_result = next(r for r in run["results"] if r["ruleId"] == "CVE-2022-67890") - assert critical_result["level"] == "error" + critical_result = next(r for r in run["results"] if r["ruleId"] == "CVE-2022-12345:test-package@1.0.0") + medium_result = next(r for r in run["results"] if r["ruleId"] == "CVE-2022-67890:another-package@2.1.0") + assert critical_result["level"] == "warning" assert medium_result["level"] == "warning" def test_convert_vulns_to_sarif_empty_data(self): @@ -147,7 +144,7 @@ def test_convert_vulns_to_sarif_with_external_data(self): } } - with patch('workbench_cli.utilities.sarif_converter.enrich_vulnerabilities') as mock_enrich: + with patch('workbench_cli.utilities.sarif_generation.enrich_vulnerabilities') as mock_enrich: mock_enrich.return_value = mock_external_data sarif_data = convert_vulns_to_sarif(sample_vulns, "TEST_SCAN_ENHANCED") @@ -160,16 +157,18 @@ def test_convert_vulns_to_sarif_with_external_data(self): assert rule["properties"]["cisa_known_exploited"] == True assert rule["properties"]["cwe_ids"] == ["CWE-79"] - # Validate enhanced description + # External data should be in properties, not in description + # The fullDescription should contain the NVD description when available assert "Test vulnerability description" in rule["fullDescription"]["text"] - assert "CISA" in rule["fullDescription"]["text"] + assert "test-package" in rule["fullDescription"]["text"] def test_map_severity_to_sarif_level(self): """Test mapping of severity levels to SARIF levels.""" - assert _map_severity_to_sarif_level("CRITICAL") == "error" - assert _map_severity_to_sarif_level("HIGH") == "error" + # New intelligent approach: defaults to WARNING for promotion/demotion logic + assert _map_severity_to_sarif_level("CRITICAL") == "warning" + assert _map_severity_to_sarif_level("HIGH") == "warning" assert _map_severity_to_sarif_level("MEDIUM") == "warning" - assert _map_severity_to_sarif_level("LOW") == "note" + assert _map_severity_to_sarif_level("LOW") == "warning" assert _map_severity_to_sarif_level("UNKNOWN") == "warning" assert _map_severity_to_sarif_level("INVALID") == "warning" assert _map_severity_to_sarif_level("") == "warning" @@ -212,13 +211,13 @@ def test_generate_enhanced_rules(self): assert len(rules) == 2 # Should deduplicate CVE-2022-12345 rule_ids = [rule["id"] for rule in rules] - assert "CVE-2022-12345" in rule_ids - assert "CVE-2022-67890" in rule_ids + assert "CVE-2022-12345:Unknown@Unknown" in rule_ids + assert "CVE-2022-67890:Unknown@Unknown" in rule_ids # Validate rule structure - critical_rule = next(r for r in rules if r["id"] == "CVE-2022-12345") - assert critical_rule["name"] == "Vulnerability CVE-2022-12345" - assert critical_rule["defaultConfiguration"]["level"] == "error" + critical_rule = next(r for r in rules if r["id"] == "CVE-2022-12345:Unknown@Unknown") + assert critical_rule["name"] == "CVE-2022-12345 in Unknown@Unknown" + assert critical_rule["defaultConfiguration"]["level"] == "warning" assert critical_rule["properties"]["cvss_version"] == "3.1" assert critical_rule["properties"]["base_score"] == "9.8" @@ -248,17 +247,15 @@ def test_generate_enhanced_results(self): assert len(results) == 1 result = results[0] - assert result["ruleId"] == "CVE-2022-12345" - assert result["level"] == "error" + assert result["ruleId"] == "CVE-2022-12345:test-package@1.0.0" + assert result["level"] == "warning" assert "CVE-2022-12345" in result["message"]["text"] - assert "test-package" in result["message"]["text"] assert result["locations"][0]["physicalLocation"]["artifactLocation"]["uri"] == "pkg:generic/test-package@1.0.0" # Validate properties assert result["properties"]["component_id"] == 123 - assert result["properties"]["scan_id"] == 456 assert result["properties"]["vulnerability_id"] == 1 - assert result["properties"]["base_score"] == "9.8" + assert result["properties"]["security-severity"] == "9.8" def test_create_empty_sarif_report(self): """Test creation of empty SARIF report.""" @@ -295,7 +292,7 @@ def test_save_vulns_to_sarif_success(self): try: # Mock the enricher to avoid external API calls - with patch('workbench_cli.utilities.sarif_converter.enrich_vulnerabilities') as mock_enrich: + with patch('workbench_cli.utilities.sarif_generation.enrich_vulnerabilities') as mock_enrich: mock_enrich.return_value = {} save_vulns_to_sarif(temp_path, sample_vulns, "TEST_SCAN") @@ -329,7 +326,7 @@ def test_save_vulns_to_sarif_creates_directory(self): nested_path = os.path.join(temp_dir, "nested", "subdir", "results.sarif") # Mock the enricher to avoid external API calls - with patch('workbench_cli.utilities.sarif_converter.enrich_vulnerabilities') as mock_enrich: + with patch('workbench_cli.utilities.sarif_generation.enrich_vulnerabilities') as mock_enrich: mock_enrich.return_value = {} save_vulns_to_sarif(nested_path, sample_vulns, "TEST_SCAN") @@ -356,7 +353,7 @@ def test_save_vulns_to_sarif_io_error(self): invalid_path = "/invalid/path/that/should/not/exist/results.sarif" with pytest.raises((IOError, OSError)): - with patch('workbench_cli.utilities.sarif_converter.enrich_vulnerabilities') as mock_enrich: + with patch('workbench_cli.utilities.sarif_generation.enrich_vulnerabilities') as mock_enrich: mock_enrich.return_value = {} save_vulns_to_sarif(invalid_path, sample_vulns, "TEST_SCAN") @@ -378,7 +375,7 @@ def test_handle_missing_vulnerability_fields(self): } ] - with patch('workbench_cli.utilities.sarif_converter.enrich_vulnerabilities') as mock_enrich: + with patch('workbench_cli.utilities.sarif_generation.enrich_vulnerabilities') as mock_enrich: mock_enrich.return_value = {} sarif_data = convert_vulns_to_sarif(incomplete_vulns, "TEST_SCAN") @@ -393,11 +390,11 @@ def test_handle_missing_vulnerability_fields(self): # Verify default values are used for missing fields results = run["results"] first_result = results[0] - assert first_result["ruleId"] == "UNKNOWN" # Default for missing CVE + assert first_result["ruleId"] == "UNKNOWN:test-package@Unknown" # Default for missing CVE second_result = results[1] - assert second_result["ruleId"] == "CVE-2022-67890" - assert "Unknown" in second_result["message"]["text"] # Default for missing component info + assert second_result["ruleId"] == "CVE-2022-67890:Unknown@Unknown" + assert "CVE-2022-67890" in second_result["message"]["text"] # CVE should be in message def test_sarif_schema_compliance(self): """Test that generated SARIF complies with the expected schema structure.""" @@ -416,7 +413,7 @@ def test_sarif_schema_compliance(self): } ] - with patch('workbench_cli.utilities.sarif_converter.enrich_vulnerabilities') as mock_enrich: + with patch('workbench_cli.utilities.sarif_generation.enrich_vulnerabilities') as mock_enrich: mock_enrich.return_value = {} sarif_data = convert_vulns_to_sarif(sample_vulns, "TEST_SCAN") @@ -458,8 +455,8 @@ def test_sarif_schema_compliance(self): assert "artifactLocation" in location["physicalLocation"] assert "uri" in location["physicalLocation"]["artifactLocation"] - def test_legacy_function_compatibility(self): - """Test that legacy functions still work for backward compatibility.""" + def test_enhanced_functions_compatibility(self): + """Test that enhanced functions work correctly with and without external data.""" sample_vulns = [ { "cve": "CVE-2022-12345", @@ -471,15 +468,34 @@ def test_legacy_function_compatibility(self): } ] - # Test legacy _generate_rules function - rules = _generate_rules(sample_vulns) + # Test _generate_enhanced_rules function without external data + rules = _generate_enhanced_rules(sample_vulns, {}) assert len(rules) == 1 - assert rules[0]["id"] == "CVE-2022-12345" + assert rules[0]["id"] == "CVE-2022-12345:test-package@1.0.0" - # Test legacy _generate_results function - results = _generate_results(sample_vulns) + # Test _generate_enhanced_results function without external data + results = _generate_enhanced_results(sample_vulns, {}) assert len(results) == 1 - assert results[0]["ruleId"] == "CVE-2022-12345" + assert results[0]["ruleId"] == "CVE-2022-12345:test-package@1.0.0" + + # Test with external data + external_data = { + "CVE-2022-12345": { + "epss_score": 0.85, + "epss_percentile": 0.95, + "cisa_kev": True + } + } + + rules_with_external = _generate_enhanced_rules(sample_vulns, external_data) + assert len(rules_with_external) == 1 + assert rules_with_external[0]["properties"]["epss_score"] == 0.85 + assert rules_with_external[0]["properties"]["cisa_known_exploited"] == True + + results_with_external = _generate_enhanced_results(sample_vulns, external_data) + assert len(results_with_external) == 1 + assert results_with_external[0]["properties"]["epss_score"] == 0.85 + assert results_with_external[0]["properties"]["cisa_known_exploited"] == True class TestVulnerabilityEnricher: diff --git a/tests/unit/utilities/test_scan_workflows.py b/tests/unit/utilities/test_scan_workflows.py index 8da81a4..d0793d2 100644 --- a/tests/unit/utilities/test_scan_workflows.py +++ b/tests/unit/utilities/test_scan_workflows.py @@ -459,7 +459,6 @@ def test_complete_workflow_legacy(self, mock_save, mock_display, mock_fetch, moc """Test complete fetch, display, and save workflow with legacy path_result.""" mock_params.path_result = "output.json" mock_params.json_result_path = None - mock_params.sarif_result_path = None mock_params.show_licenses = True mock_fetch.return_value = {"test": "data"} mock_display.return_value = True @@ -477,7 +476,6 @@ def test_json_result_path_workflow(self, mock_save, mock_display, mock_fetch, mo """Test fetch, display, and save workflow with JSON result path.""" mock_params.path_result = None mock_params.json_result_path = "output.json" - mock_params.sarif_result_path = None mock_params.show_licenses = True mock_fetch.return_value = {"test": "data"} mock_display.return_value = True @@ -488,87 +486,7 @@ def test_json_result_path_workflow(self, mock_save, mock_display, mock_fetch, mo mock_display.assert_called_once_with({"test": "data"}, mock_params) mock_save.assert_called_once_with("output.json", {"test": "data"}, TEST_SCAN_CODE) - @patch('workbench_cli.utilities.scan_workflows.fetch_results') - @patch('workbench_cli.utilities.scan_workflows.display_results') - @patch('workbench_cli.utilities.sarif_converter.save_vulns_to_sarif') - def test_sarif_result_path_workflow(self, mock_save_sarif, mock_display, mock_fetch, mock_workbench, mock_params): - """Test fetch, display, and save workflow with SARIF result path.""" - mock_params.path_result = None - mock_params.json_result_path = None - mock_params.sarif_result_path = "output.sarif" - mock_params.show_vulnerabilities = True - mock_params.show_licenses = False - - sample_vulns = [{"id": 1, "cve": "CVE-2022-12345", "severity": "HIGH"}] - mock_fetch.return_value = {"vulnerabilities": sample_vulns} - mock_display.return_value = True - - fetch_display_save_results(mock_workbench, mock_params, TEST_SCAN_CODE) - - mock_fetch.assert_called_once_with(mock_workbench, mock_params, TEST_SCAN_CODE) - mock_display.assert_called_once_with({"vulnerabilities": sample_vulns}, mock_params) - mock_save_sarif.assert_called_once_with("output.sarif", sample_vulns, TEST_SCAN_CODE, True, True, True, 30) - - @patch('workbench_cli.utilities.scan_workflows.fetch_results') - @patch('workbench_cli.utilities.scan_workflows.display_results') - def test_sarif_without_show_vulnerabilities(self, mock_display, mock_fetch, mock_workbench, mock_params): - """Test SARIF output warning when --show-vulnerabilities is not set.""" - mock_params.path_result = None - mock_params.json_result_path = None - mock_params.sarif_result_path = "output.sarif" - mock_params.show_vulnerabilities = False - mock_params.show_licenses = True - - mock_fetch.return_value = {"licenses": ["MIT"]} - mock_display.return_value = True - - fetch_display_save_results(mock_workbench, mock_params, TEST_SCAN_CODE) - - mock_fetch.assert_called_once_with(mock_workbench, mock_params, TEST_SCAN_CODE) - mock_display.assert_called_once_with({"licenses": ["MIT"]}, mock_params) - # Should not attempt to save SARIF since show_vulnerabilities is False - - @patch('workbench_cli.utilities.scan_workflows.fetch_results') - @patch('workbench_cli.utilities.scan_workflows.display_results') - def test_sarif_with_no_vulnerabilities(self, mock_display, mock_fetch, mock_workbench, mock_params): - """Test SARIF output when no vulnerabilities are found.""" - mock_params.path_result = None - mock_params.json_result_path = None - mock_params.sarif_result_path = "output.sarif" - mock_params.show_vulnerabilities = True - - mock_fetch.return_value = {"vulnerabilities": []} # Empty vulnerabilities - mock_display.return_value = True - - fetch_display_save_results(mock_workbench, mock_params, TEST_SCAN_CODE) - - mock_fetch.assert_called_once_with(mock_workbench, mock_params, TEST_SCAN_CODE) - mock_display.assert_called_once_with({"vulnerabilities": []}, mock_params) - # Should not attempt to save SARIF since no vulnerabilities found - - @patch('workbench_cli.utilities.scan_workflows.fetch_results') - @patch('workbench_cli.utilities.scan_workflows.display_results') - @patch('workbench_cli.utilities.scan_workflows.save_results_to_file') - @patch('workbench_cli.utilities.sarif_converter.save_vulns_to_sarif') - def test_both_json_and_sarif_output(self, mock_save_sarif, mock_save_json, mock_display, mock_fetch, mock_workbench, mock_params): - """Test saving both JSON and SARIF outputs simultaneously.""" - mock_params.path_result = None - mock_params.json_result_path = "output.json" - mock_params.sarif_result_path = "output.sarif" - mock_params.show_vulnerabilities = True - mock_params.show_licenses = True - - sample_vulns = [{"id": 1, "cve": "CVE-2022-12345", "severity": "HIGH"}] - results = {"vulnerabilities": sample_vulns, "licenses": ["MIT"]} - mock_fetch.return_value = results - mock_display.return_value = True - - fetch_display_save_results(mock_workbench, mock_params, TEST_SCAN_CODE) - - mock_fetch.assert_called_once_with(mock_workbench, mock_params, TEST_SCAN_CODE) - mock_display.assert_called_once_with(results, mock_params) - mock_save_json.assert_called_once_with("output.json", results, TEST_SCAN_CODE) - mock_save_sarif.assert_called_once_with("output.sarif", sample_vulns, TEST_SCAN_CODE, True, True, True, 30) + @patch('workbench_cli.utilities.scan_workflows.fetch_results') @patch('workbench_cli.utilities.scan_workflows.display_results') @@ -576,7 +494,6 @@ def test_no_save_specified(self, mock_display, mock_fetch, mock_workbench, mock_ """Test fetch and display without saving.""" mock_params.path_result = None mock_params.json_result_path = None - mock_params.sarif_result_path = None mock_params.show_licenses = True mock_fetch.return_value = {"test": "data"} mock_display.return_value = True diff --git a/tests/unit/utilities/test_vulnerability_enricher.py b/tests/unit/utilities/test_vulnerability_enricher.py index e79b8be..6f8bf63 100644 --- a/tests/unit/utilities/test_vulnerability_enricher.py +++ b/tests/unit/utilities/test_vulnerability_enricher.py @@ -18,7 +18,6 @@ _fetch_epss_scores, _fetch_cisa_kev_data, _fetch_nvd_data, - _fetch_nvd_data_enhanced, _fetch_single_cve_nvd, _parse_nvd_vulnerability, _fetch_alternative_vulnerability_data, @@ -235,20 +234,33 @@ def test_fetch_cisa_kev_data_api_error(self, mock_get): class TestNvdDataFetching: """Test cases for NVD data fetching.""" - def test_fetch_nvd_data_calls_enhanced(self): - """Test that fetch_nvd_data calls the enhanced version.""" - with patch('workbench_cli.utilities.vulnerability_enricher._fetch_nvd_data_enhanced') as mock_enhanced: - mock_enhanced.return_value = {"test": "data"} + def test_fetch_nvd_data_caching(self): + """Test that fetch_nvd_data uses module-level caching.""" + # Clear any existing cache + from workbench_cli.utilities.vulnerability_enricher import _NVD_CACHE + _NVD_CACHE.clear() + + # First call should fetch data + with patch('workbench_cli.utilities.vulnerability_enricher._fetch_single_cve_nvd') as mock_fetch: + mock_fetch.return_value = {"nvd_description": "Test description"} - result = _fetch_nvd_data(["CVE-2022-12345"]) + result1 = _fetch_nvd_data(["CVE-2022-12345"]) - assert result == {"test": "data"} - mock_enhanced.assert_called_once_with(["CVE-2022-12345"], 30) + # Second call should use cache + result2 = _fetch_nvd_data(["CVE-2022-12345"]) + + # Should have fetched only once + assert mock_fetch.call_count == 1 + assert result1 == result2 @patch.dict(os.environ, {"NVD_API_KEY": "test-key"}) @patch('workbench_cli.utilities.vulnerability_enricher.ThreadPoolExecutor') - def test_fetch_nvd_data_enhanced_with_api_key(self, mock_executor): - """Test enhanced NVD data fetching with API key.""" + def test_fetch_nvd_data_with_api_key(self, mock_executor): + """Test NVD data fetching with API key.""" + # Clear cache to ensure fresh fetch + from workbench_cli.utilities.vulnerability_enricher import _NVD_CACHE + _NVD_CACHE.clear() + # Mock the executor and its methods mock_executor_instance = mock_executor.return_value.__enter__.return_value mock_future = mock_executor_instance.submit.return_value @@ -261,7 +273,7 @@ def test_fetch_nvd_data_enhanced_with_api_key(self, mock_executor): with patch('workbench_cli.utilities.vulnerability_enricher.as_completed') as mock_as_completed: mock_as_completed.return_value = [mock_future] - result = _fetch_nvd_data_enhanced(["CVE-2022-12345"]) + result = _fetch_nvd_data(["CVE-2022-12345"]) assert "CVE-2022-12345" in result # Verify executor was called with higher max_workers for API key @@ -269,8 +281,12 @@ def test_fetch_nvd_data_enhanced_with_api_key(self, mock_executor): @patch.dict(os.environ, {}, clear=True) @patch('workbench_cli.utilities.vulnerability_enricher.ThreadPoolExecutor') - def test_fetch_nvd_data_enhanced_without_api_key(self, mock_executor): - """Test enhanced NVD data fetching without API key.""" + def test_fetch_nvd_data_without_api_key(self, mock_executor): + """Test NVD data fetching without API key.""" + # Clear cache to ensure fresh fetch + from workbench_cli.utilities.vulnerability_enricher import _NVD_CACHE + _NVD_CACHE.clear() + # Mock the executor mock_executor_instance = mock_executor.return_value.__enter__.return_value mock_future = mock_executor_instance.submit.return_value @@ -282,7 +298,7 @@ def test_fetch_nvd_data_enhanced_without_api_key(self, mock_executor): with patch('workbench_cli.utilities.vulnerability_enricher.as_completed') as mock_as_completed: mock_as_completed.return_value = [mock_future] - result = _fetch_nvd_data_enhanced(["CVE-2022-12345"]) + result = _fetch_nvd_data(["CVE-2022-12345"]) assert "CVE-2022-12345" in result # Verify executor was called with lower max_workers for no API key From 56132bc5ec1e8049db85dbf5b4dc3d35b4170302 Mon Sep 17 00:00:00 2001 From: Tomas Gonzalez Date: Fri, 4 Jul 2025 01:18:30 -0400 Subject: [PATCH 3/9] remove test data --- .gitignore | 7 +- vulns-basic.sarif | 4578 --------------------------------------------- vulns.json | 814 -------- 3 files changed, 6 insertions(+), 5393 deletions(-) delete mode 100644 vulns-basic.sarif delete mode 100644 vulns.json diff --git a/.gitignore b/.gitignore index a851fac..bf728b5 100755 --- a/.gitignore +++ b/.gitignore @@ -88,6 +88,9 @@ log-agent.txt reports/ results/ results.json +vulns.json +vulns-basic.sarif +vulns-enhanced.sarif # Backup files *.bkp @@ -99,4 +102,6 @@ da-analyzer-results # Optional: User-specific test scripts if not shared test-commands.txt -workbench-cli-log.txt \ No newline at end of file +workbench-cli-log.txt +*.sarif + diff --git a/vulns-basic.sarif b/vulns-basic.sarif deleted file mode 100644 index 3d6a688..0000000 --- a/vulns-basic.sarif +++ /dev/null @@ -1,4578 +0,0 @@ -{ - "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", - "version": "2.1.0", - "runs": [ - { - "tool": { - "driver": { - "name": "FossID Workbench", - "version": "1.0.0", - "informationUri": "https://fossid.com/products/workbench/", - "rules": [ - { - "id": "CVE-2017-7375", - "name": "Vulnerability CVE-2017-7375", - "shortDescription": { - "text": "Security vulnerability CVE-2017-7375 (CVSS 9.8)" - }, - "fullDescription": { - "text": "A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).\n\nThis is a n/a severity vulnerability with n/a attack vector and n/a attack complexity. Associated with CWE-611." - }, - "defaultConfiguration": { - "level": "warning" - }, - "properties": { - "security-severity": "9.8", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", - "base_score": "9.8", - "attack_vector": "N/A", - "attack_complexity": "N/A", - "availability_impact": "N/A", - "severity": "N/A", - "tags": [ - "security", - "vulnerability", - "severity-n/a", - "attack-vector-n/a", - "ecosystem-generic", - "cwe-611" - ], - "epss_score": 0.00393, - "epss_percentile": 0.59617, - "cwe_ids": [ - "CWE-611" - ] - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2017-7375", - "help": { - "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2017-7375. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2017-7375 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** N/A (9.8) \n**EPSS Score:** 0.004 (percentile: 0.59617) \n**CWE:** CWE-611\n\n### Description\nA flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).\n\n### Risk Assessment\n- **Severity:** N/A (9.8)\n- **Exploitation Risk:** Low (EPSS: 0.004)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2017-7375)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7375)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](http://www.securityfocus.com/bid/98877)\n - [cve@mitre.org](http://www.securitytracker.com/id/1038623)\n - [cve@mitre.org](https://android.googlesource.com/platform/external/libxml2/+/308396a55280f69ad4112d4f9892f4cbeff042aa)" - } - }, - { - "id": "CVE-2017-7376", - "name": "Vulnerability CVE-2017-7376", - "shortDescription": { - "text": "Security vulnerability CVE-2017-7376 (CVSS 9.8) [EPSS: 0.395, VEX: exploitable]" - }, - "fullDescription": { - "text": "Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.\n\nThis is a n/a severity vulnerability with n/a attack vector and n/a attack complexity. EPSS score of 0.395 indicates elevated risk of exploitation. Associated with CWE-119. VEX Status: exploitable - requires_environment Response: can_not_fix" - }, - "defaultConfiguration": { - "level": "warning" - }, - "properties": { - "security-severity": "9.8", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", - "base_score": "9.8", - "attack_vector": "N/A", - "attack_complexity": "N/A", - "availability_impact": "N/A", - "severity": "N/A", - "tags": [ - "security", - "vulnerability", - "severity-n/a", - "attack-vector-n/a", - "ecosystem-generic", - "high-epss", - "cwe-119", - "vex-exploitable" - ], - "epss_score": 0.39544, - "epss_percentile": 0.97149, - "cwe_ids": [ - "CWE-119" - ], - "vex_status": "exploitable", - "vex_justification": "requires_environment", - "vex_response": "can_not_fix", - "vex_details": "unfixable", - "vex_created": "2025-07-03 13:41:07", - "vex_updated": "2025-07-03 15:41:38", - "vex_created_by": "tomas.gonzalez@fossid.com", - "vex_updated_by": "tomas.gonzalez@fossid.com" - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2017-7376", - "help": { - "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2017-7376. HIGH RISK: EPSS score of 0.395 indicates elevated exploitation risk. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2017-7376 (**HIGH RISK**)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** N/A (9.8) \n**EPSS Score:** 0.395 (percentile: 0.97149) \n**CWE:** CWE-119\n\n### VEX Assessment \n**Status:** exploitable \n**Justification:** requires_environment \n**Response:** can_not_fix \n**Details:** unfixable \n**Last Updated:** 2025-07-03 15:41:38 by tomas.gonzalez@fossid.com\n\n### Description\nBuffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.\n\n### Risk Assessment\n- **Severity:** N/A (9.8)\n- **Exploitation Risk:** HIGH (EPSS: 0.395)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2017-7376)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7376)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](http://www.securityfocus.com/bid/98877)\n - [cve@mitre.org](http://www.securitytracker.com/id/1038623)\n - [cve@mitre.org](https://android.googlesource.com/platform/external/libxml2/+/51e0cb2e5ec18eaf6fb331bc573ff27b743898f4)" - } - }, - { - "id": "CVE-2017-15412", - "name": "Vulnerability CVE-2017-15412", - "shortDescription": { - "text": "Security vulnerability CVE-2017-15412 (CVSS 8.8)" - }, - "fullDescription": { - "text": "Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.\n\nThis is a high severity vulnerability with n/a attack vector and n/a attack complexity. Associated with CWE-416." - }, - "defaultConfiguration": { - "level": "error" - }, - "properties": { - "security-severity": "8.8", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", - "base_score": "8.8", - "attack_vector": "N/A", - "attack_complexity": "N/A", - "availability_impact": "N/A", - "severity": "HIGH", - "tags": [ - "security", - "vulnerability", - "severity-high", - "attack-vector-n/a", - "ecosystem-generic", - "cwe-416" - ], - "epss_score": 0.03481, - "epss_percentile": 0.87129, - "cwe_ids": [ - "CWE-416" - ] - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2017-15412", - "help": { - "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2017-15412. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2017-15412 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** HIGH (8.8) \n**EPSS Score:** 0.035 (percentile: 0.87129) \n**CWE:** CWE-416\n\n### Description\nUse after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.\n\n### Risk Assessment\n- **Severity:** HIGH (8.8)\n- **Exploitation Risk:** Low (EPSS: 0.035)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2017-15412)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15412)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [chrome-cve-admin@google.com](http://www.securitytracker.com/id/1040348)\n - [chrome-cve-admin@google.com](https://access.redhat.com/errata/RHSA-2017:3401)\n - [chrome-cve-admin@google.com](https://access.redhat.com/errata/RHSA-2018:0287)" - } - }, - { - "id": "CVE-2021-3518", - "name": "Vulnerability CVE-2021-3518", - "shortDescription": { - "text": "Security vulnerability CVE-2021-3518 (CVSS 8.8)" - }, - "fullDescription": { - "text": "There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.\n\nThis is a high severity vulnerability with network attack vector and low attack complexity. Associated with CWE-416." - }, - "defaultConfiguration": { - "level": "error" - }, - "properties": { - "security-severity": "8.8", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", - "base_score": "8.8", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "severity": "HIGH", - "tags": [ - "security", - "vulnerability", - "severity-high", - "attack-vector-network", - "ecosystem-generic", - "cwe-416" - ], - "epss_score": 0.00173, - "epss_percentile": 0.39534, - "cwe_ids": [ - "CWE-416" - ] - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2021-3518", - "help": { - "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2021-3518. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2021-3518 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** HIGH (8.8) \n**EPSS Score:** 0.002 (percentile: 0.39534) \n**CWE:** CWE-416\n\n### Description\nThere's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.\n\n### Risk Assessment\n- **Severity:** HIGH (8.8)\n- **Exploitation Risk:** Low (EPSS: 0.002)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2021-3518)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3518)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [secalert@redhat.com](http://seclists.org/fulldisclosure/2021/Jul/54)\n - [secalert@redhat.com](http://seclists.org/fulldisclosure/2021/Jul/55)\n - [secalert@redhat.com](http://seclists.org/fulldisclosure/2021/Jul/58)" - } - }, - { - "id": "CVE-2017-5130", - "name": "Vulnerability CVE-2017-5130", - "shortDescription": { - "text": "Security vulnerability CVE-2017-5130 (CVSS 8.8)" - }, - "fullDescription": { - "text": "An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted XML file.\n\nThis is a high severity vulnerability with n/a attack vector and n/a attack complexity. Associated with CWE-787." - }, - "defaultConfiguration": { - "level": "error" - }, - "properties": { - "security-severity": "8.8", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", - "base_score": "8.8", - "attack_vector": "N/A", - "attack_complexity": "N/A", - "availability_impact": "N/A", - "severity": "HIGH", - "tags": [ - "security", - "vulnerability", - "severity-high", - "attack-vector-n/a", - "ecosystem-generic", - "cwe-787" - ], - "epss_score": 0.00905, - "epss_percentile": 0.74841, - "cwe_ids": [ - "CWE-787" - ] - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2017-5130", - "help": { - "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2017-5130. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2017-5130 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** HIGH (8.8) \n**EPSS Score:** 0.009 (percentile: 0.74841) \n**CWE:** CWE-787\n\n### Description\nAn integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in Google Chrome prior to 62.0.3202.62 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted XML file.\n\n### Risk Assessment\n- **Severity:** HIGH (8.8)\n- **Exploitation Risk:** Low (EPSS: 0.009)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2017-5130)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5130)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [chrome-cve-admin@google.com](http://bugzilla.gnome.org/show_bug.cgi?id=783026)\n - [chrome-cve-admin@google.com](http://www.securityfocus.com/bid/101482)\n - [chrome-cve-admin@google.com](https://access.redhat.com/errata/RHSA-2017:2997)" - } - }, - { - "id": "CVE-2021-3517", - "name": "Vulnerability CVE-2021-3517", - "shortDescription": { - "text": "Security vulnerability CVE-2021-3517 (CVSS 8.6)" - }, - "fullDescription": { - "text": "There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.\n\nThis is a high severity vulnerability with network attack vector and low attack complexity. Associated with CWE-787." - }, - "defaultConfiguration": { - "level": "error" - }, - "properties": { - "security-severity": "8.6", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", - "base_score": "8.6", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "severity": "HIGH", - "tags": [ - "security", - "vulnerability", - "severity-high", - "attack-vector-network", - "ecosystem-generic", - "cwe-787" - ], - "epss_score": 0.00071, - "epss_percentile": 0.22309, - "cwe_ids": [ - "CWE-787" - ] - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2021-3517", - "help": { - "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2021-3517. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2021-3517 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** HIGH (8.6) \n**EPSS Score:** 0.001 (percentile: 0.22309) \n**CWE:** CWE-787\n\n### Description\nThere is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.\n\n### Risk Assessment\n- **Severity:** HIGH (8.6)\n- **Exploitation Risk:** Low (EPSS: 0.001)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2021-3517)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3517)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=1954232)\n - [secalert@redhat.com](https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E)\n - [secalert@redhat.com](https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E)" - } - }, - { - "id": "CVE-2022-40304", - "name": "Vulnerability CVE-2022-40304", - "shortDescription": { - "text": "Security vulnerability CVE-2022-40304 (CVSS 7.8)" - }, - "fullDescription": { - "text": "An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.\n\nThis is a high severity vulnerability with local attack vector and low attack complexity. Associated with CWE-415." - }, - "defaultConfiguration": { - "level": "error" - }, - "properties": { - "security-severity": "7.8", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", - "base_score": "7.8", - "attack_vector": "LOCAL", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "severity": "HIGH", - "tags": [ - "security", - "vulnerability", - "severity-high", - "attack-vector-local", - "ecosystem-generic", - "cwe-415" - ], - "epss_score": 0.00067, - "epss_percentile": 0.21253, - "cwe_ids": [ - "CWE-415" - ] - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2022-40304", - "help": { - "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2022-40304. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2022-40304 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** HIGH (7.8) \n**EPSS Score:** 0.001 (percentile: 0.21253) \n**CWE:** CWE-415\n\n### Description\nAn issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.\n\n### Risk Assessment\n- **Severity:** HIGH (7.8)\n- **Exploitation Risk:** Low (EPSS: 0.001)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2022-40304)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40304)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](http://seclists.org/fulldisclosure/2022/Dec/21)\n - [cve@mitre.org](http://seclists.org/fulldisclosure/2022/Dec/24)\n - [cve@mitre.org](http://seclists.org/fulldisclosure/2022/Dec/25)" - } - }, - { - "id": "CVE-2025-27113", - "name": "Vulnerability CVE-2025-27113", - "shortDescription": { - "text": "Security vulnerability CVE-2025-27113 (CVSS 7.5)" - }, - "fullDescription": { - "text": "libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.\n\nThis is a high severity vulnerability with network attack vector and low attack complexity. Associated with CWE-476." - }, - "defaultConfiguration": { - "level": "error" - }, - "properties": { - "security-severity": "7.5", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", - "base_score": "7.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "severity": "HIGH", - "tags": [ - "security", - "vulnerability", - "severity-high", - "attack-vector-network", - "ecosystem-generic", - "cwe-476" - ], - "epss_score": 0.00069, - "epss_percentile": 0.21588, - "cwe_ids": [ - "CWE-476" - ] - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2025-27113", - "help": { - "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2025-27113. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2025-27113 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** HIGH (7.5) \n**EPSS Score:** 0.001 (percentile: 0.21588) \n**CWE:** CWE-476\n\n### Description\nlibxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.\n\n### Risk Assessment\n- **Severity:** HIGH (7.5)\n- **Exploitation Risk:** Low (EPSS: 0.001)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2025-27113)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27113)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/issues/861)\n - [af854a3a-2127-422b-91ae-364da2661108](https://security.netapp.com/advisory/ntap-20250306-0004/)" - } - }, - { - "id": "CVE-2022-24771", - "name": "Vulnerability CVE-2022-24771", - "shortDescription": { - "text": "Security vulnerability CVE-2022-24771 (CVSS 7.5)" - }, - "fullDescription": { - "text": "Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.\n\nThis is a high severity vulnerability with network attack vector and low attack complexity. Associated with CWE-347." - }, - "defaultConfiguration": { - "level": "error" - }, - "properties": { - "security-severity": "7.5", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", - "base_score": "7.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "NONE", - "severity": "HIGH", - "tags": [ - "security", - "vulnerability", - "severity-high", - "attack-vector-network", - "ecosystem-generic", - "cwe-347" - ], - "epss_score": 0.00106, - "epss_percentile": 0.29681, - "cwe_ids": [ - "CWE-347" - ] - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2022-24771", - "help": { - "text": "The component node-forge version 1.0.0 contains vulnerability CVE-2022-24771. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2022-24771 (Standard)\n\n**Component:** `node-forge` \n**Version:** `1.0.0` \n**Severity:** HIGH (7.5) \n**EPSS Score:** 0.001 (percentile: 0.29681) \n**CWE:** CWE-347\n\n### Description\nForge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.\n\n### Risk Assessment\n- **Severity:** HIGH (7.5)\n- **Exploitation Risk:** Low (EPSS: 0.001)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2022-24771)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24771)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [security-advisories@github.com](https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1)\n - [security-advisories@github.com](https://github.com/digitalbazaar/forge/security/advisories/GHSA-cfm4-qjh2-4765)\n - [af854a3a-2127-422b-91ae-364da2661108](https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1)" - } - }, - { - "id": "CVE-2025-32415", - "name": "Vulnerability CVE-2025-32415", - "shortDescription": { - "text": "Security vulnerability CVE-2025-32415 (CVSS 7.5)" - }, - "fullDescription": { - "text": "In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.\n\nThis is a high severity vulnerability with network attack vector and low attack complexity. Associated with CWE-125." - }, - "defaultConfiguration": { - "level": "error" - }, - "properties": { - "security-severity": "7.5", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", - "base_score": "7.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "severity": "HIGH", - "tags": [ - "security", - "vulnerability", - "severity-high", - "attack-vector-network", - "ecosystem-generic", - "cwe-125" - ], - "epss_score": 0.00027, - "epss_percentile": 0.05708, - "cwe_ids": [ - "CWE-125" - ] - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2025-32415", - "help": { - "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2025-32415. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2025-32415 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** HIGH (7.5) \n**EPSS Score:** 0.000 (percentile: 0.05708) \n**CWE:** CWE-125\n\n### Description\nIn libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.\n\n### Risk Assessment\n- **Severity:** HIGH (7.5)\n- **Exploitation Risk:** Low (EPSS: 0.000)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2025-32415)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32415)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/issues/890)\n - [134c704f-9b21-4f2e-91b3-4a467353bcc0](https://gitlab.gnome.org/GNOME/libxml2/-/issues/890)" - } - }, - { - "id": "CVE-2025-32414", - "name": "Vulnerability CVE-2025-32414", - "shortDescription": { - "text": "Security vulnerability CVE-2025-32414 (CVSS 7.5)" - }, - "fullDescription": { - "text": "In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.\n\nThis is a high severity vulnerability with network attack vector and low attack complexity. Associated with CWE-252." - }, - "defaultConfiguration": { - "level": "error" - }, - "properties": { - "security-severity": "7.5", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L", - "base_score": "7.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "severity": "HIGH", - "tags": [ - "security", - "vulnerability", - "severity-high", - "attack-vector-network", - "ecosystem-generic", - "cwe-252" - ], - "epss_score": 0.00017, - "epss_percentile": 0.02763, - "cwe_ids": [ - "CWE-252" - ] - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2025-32414", - "help": { - "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2025-32414. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2025-32414 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** HIGH (7.5) \n**EPSS Score:** 0.000 (percentile: 0.02763) \n**CWE:** CWE-252\n\n### Description\nIn libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.\n\n### Risk Assessment\n- **Severity:** HIGH (7.5)\n- **Exploitation Risk:** Low (EPSS: 0.000)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2025-32414)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32414)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/issues/889)\n - [134c704f-9b21-4f2e-91b3-4a467353bcc0](https://gitlab.gnome.org/GNOME/libxml2/-/issues/889)" - } - }, - { - "id": "CVE-2024-25062", - "name": "Vulnerability CVE-2024-25062", - "shortDescription": { - "text": "Security vulnerability CVE-2024-25062 (CVSS 7.5)" - }, - "fullDescription": { - "text": "An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.\n\nThis is a high severity vulnerability with network attack vector and low attack complexity. Associated with CWE-416." - }, - "defaultConfiguration": { - "level": "error" - }, - "properties": { - "security-severity": "7.5", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", - "base_score": "7.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "severity": "HIGH", - "tags": [ - "security", - "vulnerability", - "severity-high", - "attack-vector-network", - "ecosystem-generic", - "cwe-416" - ], - "epss_score": 0.0015, - "epss_percentile": 0.3668, - "cwe_ids": [ - "CWE-416" - ] - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2024-25062", - "help": { - "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2024-25062. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2024-25062 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** HIGH (7.5) \n**EPSS Score:** 0.002 (percentile: 0.3668) \n**CWE:** CWE-416\n\n### Description\nAn issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.\n\n### Risk Assessment\n- **Severity:** HIGH (7.5)\n- **Exploitation Risk:** Low (EPSS: 0.002)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2024-25062)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25062)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/issues/604)\n - [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/tags)\n - [af854a3a-2127-422b-91ae-364da2661108](https://gitlab.gnome.org/GNOME/libxml2/-/issues/604)" - } - }, - { - "id": "CVE-2022-40303", - "name": "Vulnerability CVE-2022-40303", - "shortDescription": { - "text": "Security vulnerability CVE-2022-40303 (CVSS 7.5)" - }, - "fullDescription": { - "text": "An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.\n\nThis is a high severity vulnerability with network attack vector and low attack complexity. Associated with CWE-190." - }, - "defaultConfiguration": { - "level": "error" - }, - "properties": { - "security-severity": "7.5", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", - "base_score": "7.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "severity": "HIGH", - "tags": [ - "security", - "vulnerability", - "severity-high", - "attack-vector-network", - "ecosystem-generic", - "cwe-190" - ], - "epss_score": 0.00137, - "epss_percentile": 0.34634, - "cwe_ids": [ - "CWE-190" - ] - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2022-40303", - "help": { - "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2022-40303. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2022-40303 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** HIGH (7.5) \n**EPSS Score:** 0.001 (percentile: 0.34634) \n**CWE:** CWE-190\n\n### Description\nAn issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.\n\n### Risk Assessment\n- **Severity:** HIGH (7.5)\n- **Exploitation Risk:** Low (EPSS: 0.001)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2022-40303)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40303)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](http://seclists.org/fulldisclosure/2022/Dec/21)\n - [cve@mitre.org](http://seclists.org/fulldisclosure/2022/Dec/24)\n - [cve@mitre.org](http://seclists.org/fulldisclosure/2022/Dec/25)" - } - }, - { - "id": "CVE-2022-23308", - "name": "Vulnerability CVE-2022-23308", - "shortDescription": { - "text": "Security vulnerability CVE-2022-23308 (CVSS 7.5)" - }, - "fullDescription": { - "text": "valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.\n\nThis is a high severity vulnerability with network attack vector and low attack complexity. Associated with CWE-416." - }, - "defaultConfiguration": { - "level": "error" - }, - "properties": { - "security-severity": "7.5", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", - "base_score": "7.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "severity": "HIGH", - "tags": [ - "security", - "vulnerability", - "severity-high", - "attack-vector-network", - "ecosystem-generic", - "cwe-416" - ], - "epss_score": 0.00024, - "epss_percentile": 0.04919, - "cwe_ids": [ - "CWE-416" - ] - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2022-23308", - "help": { - "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2022-23308. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2022-23308 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** HIGH (7.5) \n**EPSS Score:** 0.000 (percentile: 0.04919) \n**CWE:** CWE-416\n\n### Description\nvalid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.\n\n### Risk Assessment\n- **Severity:** HIGH (7.5)\n- **Exploitation Risk:** Low (EPSS: 0.000)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2022-23308)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23308)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](http://seclists.org/fulldisclosure/2022/May/33)\n - [cve@mitre.org](http://seclists.org/fulldisclosure/2022/May/34)\n - [cve@mitre.org](http://seclists.org/fulldisclosure/2022/May/35)" - } - }, - { - "id": "CVE-2019-19956", - "name": "Vulnerability CVE-2019-19956", - "shortDescription": { - "text": "Security vulnerability CVE-2019-19956 (CVSS 7.5)" - }, - "fullDescription": { - "text": "xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.\n\nThis is a high severity vulnerability with network attack vector and low attack complexity. Associated with CWE-401." - }, - "defaultConfiguration": { - "level": "error" - }, - "properties": { - "security-severity": "7.5", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", - "base_score": "7.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "severity": "HIGH", - "tags": [ - "security", - "vulnerability", - "severity-high", - "attack-vector-network", - "ecosystem-generic", - "cwe-401" - ], - "epss_score": 0.00212, - "epss_percentile": 0.44118, - "cwe_ids": [ - "CWE-401" - ] - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2019-19956", - "help": { - "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2019-19956. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2019-19956 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** HIGH (7.5) \n**EPSS Score:** 0.002 (percentile: 0.44118) \n**CWE:** CWE-401\n\n### Description\nxmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs.\n\n### Risk Assessment\n- **Severity:** HIGH (7.5)\n- **Exploitation Risk:** Low (EPSS: 0.002)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2019-19956)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19956)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html)\n - [cve@mitre.org](http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00005.html)\n - [cve@mitre.org](https://cert-portal.siemens.com/productcert/pdf/ssa-292794.pdf)" - } - }, - { - "id": "CVE-2018-14404", - "name": "Vulnerability CVE-2018-14404", - "shortDescription": { - "text": "Security vulnerability CVE-2018-14404 (CVSS 7.5) [EPSS: 0.236]" - }, - "fullDescription": { - "text": "A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.\n\nThis is a high severity vulnerability with n/a attack vector and n/a attack complexity. EPSS score of 0.236 indicates elevated risk of exploitation. Associated with CWE-476." - }, - "defaultConfiguration": { - "level": "error" - }, - "properties": { - "security-severity": "7.5", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", - "base_score": "7.5", - "attack_vector": "N/A", - "attack_complexity": "N/A", - "availability_impact": "N/A", - "severity": "HIGH", - "tags": [ - "security", - "vulnerability", - "severity-high", - "attack-vector-n/a", - "ecosystem-generic", - "high-epss", - "cwe-476" - ], - "epss_score": 0.2363, - "epss_percentile": 0.95747, - "cwe_ids": [ - "CWE-476" - ] - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2018-14404", - "help": { - "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2018-14404. HIGH RISK: EPSS score of 0.236 indicates elevated exploitation risk. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2018-14404 (**HIGH RISK**)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** HIGH (7.5) \n**EPSS Score:** 0.236 (percentile: 0.95747) \n**CWE:** CWE-476\n\n### Description\nA NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.\n\n### Risk Assessment\n- **Severity:** HIGH (7.5)\n- **Exploitation Risk:** HIGH (EPSS: 0.236)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2018-14404)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14404)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](https://access.redhat.com/errata/RHSA-2019:1543)\n - [cve@mitre.org](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817)\n - [cve@mitre.org](https://bugzilla.redhat.com/show_bug.cgi?id=1595985)" - } - }, - { - "id": "CVE-2022-24772", - "name": "Vulnerability CVE-2022-24772", - "shortDescription": { - "text": "Security vulnerability CVE-2022-24772 (CVSS 7.5)" - }, - "fullDescription": { - "text": "Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.\n\nThis is a high severity vulnerability with network attack vector and low attack complexity. Associated with CWE-347." - }, - "defaultConfiguration": { - "level": "error" - }, - "properties": { - "security-severity": "7.5", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", - "base_score": "7.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "NONE", - "severity": "HIGH", - "tags": [ - "security", - "vulnerability", - "severity-high", - "attack-vector-network", - "ecosystem-generic", - "cwe-347" - ], - "epss_score": 0.00116, - "epss_percentile": 0.31427, - "cwe_ids": [ - "CWE-347" - ] - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2022-24772", - "help": { - "text": "The component node-forge version 1.0.0 contains vulnerability CVE-2022-24772. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2022-24772 (Standard)\n\n**Component:** `node-forge` \n**Version:** `1.0.0` \n**Severity:** HIGH (7.5) \n**EPSS Score:** 0.001 (percentile: 0.31427) \n**CWE:** CWE-347\n\n### Description\nForge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.\n\n### Risk Assessment\n- **Severity:** HIGH (7.5)\n- **Exploitation Risk:** Low (EPSS: 0.001)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2022-24772)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24772)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [security-advisories@github.com](https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1)\n - [security-advisories@github.com](https://github.com/digitalbazaar/forge/commit/bb822c02df0b61211836472e29b9790cc541cdb2)\n - [security-advisories@github.com](https://github.com/digitalbazaar/forge/security/advisories/GHSA-x4jg-mjrx-434g)" - } - }, - { - "id": "CVE-2022-48285", - "name": "Vulnerability CVE-2022-48285", - "shortDescription": { - "text": "Security vulnerability CVE-2022-48285 (CVSS 7.3)" - }, - "fullDescription": { - "text": "loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.\n\nThis is a high severity vulnerability with network attack vector and low attack complexity. Associated with CWE-22." - }, - "defaultConfiguration": { - "level": "error" - }, - "properties": { - "security-severity": "7.3", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", - "base_score": "7.3", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "LOW", - "severity": "HIGH", - "tags": [ - "security", - "vulnerability", - "severity-high", - "attack-vector-network", - "ecosystem-generic", - "cwe-22" - ], - "epss_score": 0.00419, - "epss_percentile": 0.61148, - "cwe_ids": [ - "CWE-22" - ] - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2022-48285", - "help": { - "text": "The component jszip version 2.6.0 contains vulnerability CVE-2022-48285. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2022-48285 (Standard)\n\n**Component:** `jszip` \n**Version:** `2.6.0` \n**Severity:** HIGH (7.3) \n**EPSS Score:** 0.004 (percentile: 0.61148) \n**CWE:** CWE-22\n\n### Description\nloadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.\n\n### Risk Assessment\n- **Severity:** HIGH (7.3)\n- **Exploitation Risk:** Low (EPSS: 0.004)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2022-48285)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48285)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](https://exchange.xforce.ibmcloud.com/vulnerabilities/244499)\n - [cve@mitre.org](https://github.com/Stuk/jszip/commit/2edab366119c9ee948357c02f1206c28566cdf15)\n - [cve@mitre.org](https://github.com/Stuk/jszip/compare/v3.7.1...v3.8.0)" - } - }, - { - "id": "CVE-2017-18258", - "name": "Vulnerability CVE-2017-18258", - "shortDescription": { - "text": "Security vulnerability CVE-2017-18258 (CVSS 6.5)" - }, - "fullDescription": { - "text": "The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.\n\nThis is a medium severity vulnerability with n/a attack vector and n/a attack complexity. Associated with CWE-770." - }, - "defaultConfiguration": { - "level": "warning" - }, - "properties": { - "security-severity": "6.5", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", - "base_score": "6.5", - "attack_vector": "N/A", - "attack_complexity": "N/A", - "availability_impact": "N/A", - "severity": "MEDIUM", - "tags": [ - "security", - "vulnerability", - "severity-medium", - "attack-vector-n/a", - "ecosystem-generic", - "cwe-770" - ], - "epss_score": 0.00724, - "epss_percentile": 0.71711, - "cwe_ids": [ - "CWE-770" - ] - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2017-18258", - "help": { - "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2017-18258. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2017-18258 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** MEDIUM (6.5) \n**EPSS Score:** 0.007 (percentile: 0.71711) \n**CWE:** CWE-770\n\n### Description\nThe xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.\n\n### Risk Assessment\n- **Severity:** MEDIUM (6.5)\n- **Exploitation Risk:** Low (EPSS: 0.007)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2017-18258)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18258)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](https://git.gnome.org/browse/libxml2/commit/?id=e2a9122b8dde53d320750451e9907a7dcb2ca8bb)\n - [cve@mitre.org](https://kc.mcafee.com/corporate/index?page=content&id=SB10284)\n - [cve@mitre.org](https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html)" - } - }, - { - "id": "CVE-2021-3541", - "name": "Vulnerability CVE-2021-3541", - "shortDescription": { - "text": "Security vulnerability CVE-2021-3541 (CVSS 6.5)" - }, - "fullDescription": { - "text": "A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.\n\nThis is a medium severity vulnerability with network attack vector and low attack complexity. Associated with CWE-776." - }, - "defaultConfiguration": { - "level": "warning" - }, - "properties": { - "security-severity": "6.5", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", - "base_score": "6.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "severity": "MEDIUM", - "tags": [ - "security", - "vulnerability", - "severity-medium", - "attack-vector-network", - "ecosystem-generic", - "cwe-776" - ], - "epss_score": 0.0006, - "epss_percentile": 0.18929, - "cwe_ids": [ - "CWE-776" - ] - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2021-3541", - "help": { - "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2021-3541. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2021-3541 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** MEDIUM (6.5) \n**EPSS Score:** 0.001 (percentile: 0.18929) \n**CWE:** CWE-776\n\n### Description\nA flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.\n\n### Risk Assessment\n- **Severity:** MEDIUM (6.5)\n- **Exploitation Risk:** Low (EPSS: 0.001)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2021-3541)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3541)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=1950515)\n - [secalert@redhat.com](https://security.netapp.com/advisory/ntap-20210805-0007/)\n - [secalert@redhat.com](https://www.oracle.com/security-alerts/cpujan2022.html)" - } - }, - { - "id": "CVE-2016-9598", - "name": "Vulnerability CVE-2016-9598", - "shortDescription": { - "text": "Security vulnerability CVE-2016-9598 (CVSS 6.5)" - }, - "fullDescription": { - "text": "libxml2, as used in Red Hat JBoss Core Services, allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted XML document. NOTE: this vulnerability exists because of a missing fix for CVE-2016-4483.\n\nThis is a medium severity vulnerability with network attack vector and low attack complexity. Associated with CWE-125." - }, - "defaultConfiguration": { - "level": "warning" - }, - "properties": { - "security-severity": "6.5", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", - "base_score": "6.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "severity": "MEDIUM", - "tags": [ - "security", - "vulnerability", - "severity-medium", - "attack-vector-network", - "ecosystem-generic", - "cwe-125" - ], - "epss_score": 0.00673, - "epss_percentile": 0.70578, - "cwe_ids": [ - "CWE-125" - ] - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2016-9598", - "help": { - "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2016-9598. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2016-9598 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** MEDIUM (6.5) \n**EPSS Score:** 0.007 (percentile: 0.70578) \n**CWE:** CWE-125\n\n### Description\nlibxml2, as used in Red Hat JBoss Core Services, allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted XML document. NOTE: this vulnerability exists because of a missing fix for CVE-2016-4483.\n\n### Risk Assessment\n- **Severity:** MEDIUM (6.5)\n- **Exploitation Risk:** Low (EPSS: 0.007)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2016-9598)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9598)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [secalert@redhat.com](https://access.redhat.com/errata/RHSA-2018:2486)\n - [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=1408306)\n - [af854a3a-2127-422b-91ae-364da2661108](https://access.redhat.com/errata/RHSA-2018:2486)" - } - }, - { - "id": "CVE-2022-29824", - "name": "Vulnerability CVE-2022-29824", - "shortDescription": { - "text": "Security vulnerability CVE-2022-29824 (CVSS 6.5)" - }, - "fullDescription": { - "text": "In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.\n\nThis is a medium severity vulnerability with network attack vector and low attack complexity. Associated with CWE-190." - }, - "defaultConfiguration": { - "level": "warning" - }, - "properties": { - "security-severity": "6.5", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", - "base_score": "6.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "severity": "MEDIUM", - "tags": [ - "security", - "vulnerability", - "severity-medium", - "attack-vector-network", - "ecosystem-generic", - "cwe-190" - ], - "epss_score": 0.00041, - "epss_percentile": 0.11669, - "cwe_ids": [ - "CWE-190" - ] - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2022-29824", - "help": { - "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2022-29824. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2022-29824 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** MEDIUM (6.5) \n**EPSS Score:** 0.000 (percentile: 0.11669) \n**CWE:** CWE-190\n\n### Description\nIn libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.\n\n### Risk Assessment\n- **Severity:** MEDIUM (6.5)\n- **Exploitation Risk:** Low (EPSS: 0.000)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2022-29824)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29824)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](http://packetstormsecurity.com/files/167345/libxml2-xmlBufAdd-Heap-Buffer-Overflow.html)\n - [cve@mitre.org](http://packetstormsecurity.com/files/169825/libxml2-xmlParseNameComplex-Integer-Overflow.html)\n - [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/commit/2554a2408e09f13652049e5ffb0d26196b02ebab)" - } - }, - { - "id": "CVE-2016-9596", - "name": "Vulnerability CVE-2016-9596", - "shortDescription": { - "text": "Security vulnerability CVE-2016-9596 (CVSS 6.5)" - }, - "fullDescription": { - "text": "libxml2, as used in Red Hat JBoss Core Services and when in recovery mode, allows context-dependent attackers to cause a denial of service (stack consumption) via a crafted XML document. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-3627.\n\nThis is a medium severity vulnerability with network attack vector and low attack complexity. Associated with CWE-400." - }, - "defaultConfiguration": { - "level": "warning" - }, - "properties": { - "security-severity": "6.5", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", - "base_score": "6.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "severity": "MEDIUM", - "tags": [ - "security", - "vulnerability", - "severity-medium", - "attack-vector-network", - "ecosystem-generic", - "cwe-400" - ], - "epss_score": 0.00673, - "epss_percentile": 0.70578, - "cwe_ids": [ - "CWE-400" - ] - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2016-9596", - "help": { - "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2016-9596. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2016-9596 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** MEDIUM (6.5) \n**EPSS Score:** 0.007 (percentile: 0.70578) \n**CWE:** CWE-400\n\n### Description\nlibxml2, as used in Red Hat JBoss Core Services and when in recovery mode, allows context-dependent attackers to cause a denial of service (stack consumption) via a crafted XML document. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-3627.\n\n### Risk Assessment\n- **Severity:** MEDIUM (6.5)\n- **Exploitation Risk:** Low (EPSS: 0.007)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2016-9596)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9596)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=1408302)\n - [af854a3a-2127-422b-91ae-364da2661108](https://bugzilla.redhat.com/show_bug.cgi?id=1408302)" - } - }, - { - "id": "CVE-2023-28484", - "name": "Vulnerability CVE-2023-28484", - "shortDescription": { - "text": "Security vulnerability CVE-2023-28484 (CVSS 6.5)" - }, - "fullDescription": { - "text": "In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c.\n\nThis is a medium severity vulnerability with network attack vector and low attack complexity. Associated with CWE-476." - }, - "defaultConfiguration": { - "level": "warning" - }, - "properties": { - "security-severity": "6.5", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", - "base_score": "6.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "severity": "MEDIUM", - "tags": [ - "security", - "vulnerability", - "severity-medium", - "attack-vector-network", - "ecosystem-generic", - "cwe-476" - ], - "epss_score": 0.00263, - "epss_percentile": 0.49636, - "cwe_ids": [ - "CWE-476" - ] - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2023-28484", - "help": { - "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2023-28484. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2023-28484 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** MEDIUM (6.5) \n**EPSS Score:** 0.003 (percentile: 0.49636) \n**CWE:** CWE-476\n\n### Description\nIn libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c.\n\n### Risk Assessment\n- **Severity:** MEDIUM (6.5)\n- **Exploitation Risk:** Low (EPSS: 0.003)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2023-28484)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28484)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/issues/491)\n - [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4)\n - [cve@mitre.org](https://lists.debian.org/debian-lts-announce/2023/04/msg00031.html)" - } - }, - { - "id": "CVE-2023-29469", - "name": "Vulnerability CVE-2023-29469", - "shortDescription": { - "text": "Security vulnerability CVE-2023-29469 (CVSS 6.5) [VEX: not_affected]" - }, - "fullDescription": { - "text": "An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\\0' value).\n\nThis is a medium severity vulnerability with network attack vector and low attack complexity. Associated with CWE-415. VEX Status: not_affected - protected_at_runtime Response: will_not_fix" - }, - "defaultConfiguration": { - "level": "warning" - }, - "properties": { - "security-severity": "6.5", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", - "base_score": "6.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "severity": "MEDIUM", - "tags": [ - "security", - "vulnerability", - "severity-medium", - "attack-vector-network", - "ecosystem-generic", - "cwe-415", - "vex-not_affected", - "vex-resolved" - ], - "epss_score": 0.00054, - "epss_percentile": 0.16808, - "cwe_ids": [ - "CWE-415" - ], - "vex_status": "not_affected", - "vex_justification": "protected_at_runtime", - "vex_response": "will_not_fix", - "vex_created": "2025-07-03 13:50:08", - "vex_updated": "2025-07-03 15:50:16", - "vex_created_by": "tomas.gonzalez@fossid.com", - "vex_updated_by": "tomas.gonzalez@fossid.com" - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2023-29469", - "help": { - "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2023-29469. VEX Assessment: Component is not affected by this vulnerability. Verify that the VEX assessment is current and accurate. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2023-29469 (**MITIGATED**)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** MEDIUM (6.5) \n**EPSS Score:** 0.001 (percentile: 0.16808) \n**CWE:** CWE-415\n\n### VEX Assessment \n**Status:** not_affected \n**Justification:** protected_at_runtime \n**Response:** will_not_fix \n**Last Updated:** 2025-07-03 15:50:16 by tomas.gonzalez@fossid.com\n\n### Description\nAn issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\\0' value).\n\n### Risk Assessment\n- **Severity:** MEDIUM (6.5)\n- **Exploitation Risk:** Low (EPSS: 0.001)\n- **VEX Assessment:** NOT AFFECTED - This component is not impacted by this vulnerability\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n**Note:** VEX assessment indicates this vulnerability is not affected. Verify that assessment is current and accurate.\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2023-29469)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29469)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/issues/510)\n - [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4)\n - [cve@mitre.org](https://lists.debian.org/debian-lts-announce/2023/04/msg00031.html)" - } - }, - { - "id": "CVE-2023-45322", - "name": "Vulnerability CVE-2023-45322", - "shortDescription": { - "text": "Security vulnerability CVE-2023-45322 (CVSS 6.5) [VEX: false_positive]" - }, - "fullDescription": { - "text": "libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is \"I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail.\"\n\nThis is a medium severity vulnerability with network attack vector and low attack complexity. Associated with CWE-416. VEX Status: false_positive - code_not_present Response: will_not_fix" - }, - "defaultConfiguration": { - "level": "warning" - }, - "properties": { - "security-severity": "6.5", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", - "base_score": "6.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "severity": "MEDIUM", - "tags": [ - "security", - "vulnerability", - "severity-medium", - "attack-vector-network", - "ecosystem-generic", - "cwe-416", - "vex-false_positive", - "vex-false-positive" - ], - "epss_score": 0.00076, - "epss_percentile": 0.23725, - "cwe_ids": [ - "CWE-416" - ], - "vex_status": "false_positive", - "vex_justification": "code_not_present", - "vex_response": "will_not_fix", - "vex_created": "2025-07-03 13:49:53", - "vex_updated": "2025-07-03 15:50:05", - "vex_created_by": "tomas.gonzalez@fossid.com", - "vex_updated_by": "tomas.gonzalez@fossid.com" - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2023-45322", - "help": { - "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2023-45322. VEX Assessment: This vulnerability is a false positive. Verify that the false positive assessment is accurate and documented. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2023-45322 (**FALSE POSITIVE**)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** MEDIUM (6.5) \n**EPSS Score:** 0.001 (percentile: 0.23725) \n**CWE:** CWE-416\n\n### VEX Assessment \n**Status:** false_positive \n**Justification:** code_not_present \n**Response:** will_not_fix \n**Last Updated:** 2025-07-03 15:50:05 by tomas.gonzalez@fossid.com\n\n### Description\nlibxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is \"I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail.\"\n\n### Risk Assessment\n- **Severity:** MEDIUM (6.5)\n- **Exploitation Risk:** Low (EPSS: 0.001)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2023-45322)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45322)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [cve@mitre.org](http://www.openwall.com/lists/oss-security/2023/10/06/5)\n - [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/issues/344)\n - [cve@mitre.org](https://gitlab.gnome.org/GNOME/libxml2/-/issues/583)" - } - }, - { - "id": "CVE-2016-3709", - "name": "Vulnerability CVE-2016-3709", - "shortDescription": { - "text": "Security vulnerability CVE-2016-3709 (CVSS 6.1) [VEX: in_triage]" - }, - "fullDescription": { - "text": "Possible cross-site scripting vulnerability in libxml after commit 960f0e2.\n\nThis is a medium severity vulnerability with network attack vector and low attack complexity. Associated with CWE-79. VEX Status: in_triage" - }, - "defaultConfiguration": { - "level": "warning" - }, - "properties": { - "security-severity": "6.1", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", - "base_score": "6.1", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "NONE", - "severity": "MEDIUM", - "tags": [ - "security", - "vulnerability", - "severity-medium", - "attack-vector-network", - "ecosystem-generic", - "cwe-79", - "vex-in_triage", - "vex-investigating" - ], - "epss_score": 0.00098, - "epss_percentile": 0.28367, - "cwe_ids": [ - "CWE-79" - ], - "vex_status": "in_triage", - "vex_created": "2025-07-03 13:49:47", - "vex_updated": "2025-07-03 15:49:47", - "vex_created_by": "tomas.gonzalez@fossid.com", - "vex_updated_by": "tomas.gonzalez@fossid.com" - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2016-3709", - "help": { - "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2016-3709. VEX Assessment: Impact is currently being evaluated. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2016-3709 (Standard)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** MEDIUM (6.1) \n**EPSS Score:** 0.001 (percentile: 0.28367) \n**CWE:** CWE-79\n\n### VEX Assessment \n**Status:** in_triage \n**Last Updated:** 2025-07-03 15:49:47 by tomas.gonzalez@fossid.com\n\n### Description\nPossible cross-site scripting vulnerability in libxml after commit 960f0e2.\n\n### Risk Assessment\n- **Severity:** MEDIUM (6.1)\n- **Exploitation Risk:** Low (EPSS: 0.001)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2016-3709)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3709)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [secalert@redhat.com](https://mail.gnome.org/archives/xml/2018-January/msg00010.html)\n - [af854a3a-2127-422b-91ae-364da2661108](https://mail.gnome.org/archives/xml/2018-January/msg00010.html)" - } - }, - { - "id": "CVE-2021-3537", - "name": "Vulnerability CVE-2021-3537", - "shortDescription": { - "text": "Security vulnerability CVE-2021-3537 (CVSS 5.9) [VEX: resolved]" - }, - "fullDescription": { - "text": "A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.\n\nThis is a medium severity vulnerability with network attack vector and high attack complexity. Associated with CWE-476. VEX Status: resolved - code_not_present Response: update,will_not_fix" - }, - "defaultConfiguration": { - "level": "warning" - }, - "properties": { - "security-severity": "5.9", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", - "base_score": "5.9", - "attack_vector": "NETWORK", - "attack_complexity": "HIGH", - "availability_impact": "HIGH", - "severity": "MEDIUM", - "tags": [ - "security", - "vulnerability", - "severity-medium", - "attack-vector-network", - "ecosystem-generic", - "cwe-476", - "vex-resolved", - "vex-resolved" - ], - "epss_score": 0.00127, - "epss_percentile": 0.33184, - "cwe_ids": [ - "CWE-476" - ], - "vex_status": "resolved", - "vex_justification": "code_not_present", - "vex_response": "update,will_not_fix", - "vex_created": "2025-07-03 13:49:22", - "vex_updated": "2025-07-03 15:49:44", - "vex_created_by": "tomas.gonzalez@fossid.com", - "vex_updated_by": "tomas.gonzalez@fossid.com" - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2021-3537", - "help": { - "text": "The component libxml2 version 2.9.2-rc1 contains vulnerability CVE-2021-3537. VEX Assessment: This vulnerability has been resolved. Verify that the resolution is complete and effective. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2021-3537 (**MITIGATED**)\n\n**Component:** `libxml2` \n**Version:** `2.9.2-rc1` \n**Severity:** MEDIUM (5.9) \n**EPSS Score:** 0.001 (percentile: 0.33184) \n**CWE:** CWE-476\n\n### VEX Assessment \n**Status:** resolved \n**Justification:** code_not_present \n**Response:** update,will_not_fix \n**Last Updated:** 2025-07-03 15:49:44 by tomas.gonzalez@fossid.com\n\n### Description\nA vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.\n\n### Risk Assessment\n- **Severity:** MEDIUM (5.9)\n- **Exploitation Risk:** Low (EPSS: 0.001)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2021-3537)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3537)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [secalert@redhat.com](https://bugzilla.redhat.com/show_bug.cgi?id=1956522)\n - [secalert@redhat.com](https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html)\n - [secalert@redhat.com](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/)" - } - }, - { - "id": "CVE-2021-23413", - "name": "Vulnerability CVE-2021-23413", - "shortDescription": { - "text": "Security vulnerability CVE-2021-23413 (CVSS 5.3) [VEX: in_triage]" - }, - "fullDescription": { - "text": "This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance.\n\nThis is a medium severity vulnerability with network attack vector and low attack complexity. Associated with NVD-CWE-noinfo. VEX Status: in_triage" - }, - "defaultConfiguration": { - "level": "warning" - }, - "properties": { - "security-severity": "5.3", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", - "base_score": "5.3", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "LOW", - "severity": "MEDIUM", - "tags": [ - "security", - "vulnerability", - "severity-medium", - "attack-vector-network", - "ecosystem-generic", - "vex-in_triage", - "vex-investigating" - ], - "epss_score": 0.00079, - "epss_percentile": 0.24344, - "cwe_ids": [ - "NVD-CWE-noinfo" - ], - "vex_status": "in_triage", - "vex_created": "2025-07-03 13:49:13", - "vex_updated": "2025-07-03 15:49:13", - "vex_created_by": "tomas.gonzalez@fossid.com", - "vex_updated_by": "tomas.gonzalez@fossid.com" - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2021-23413", - "help": { - "text": "The component jszip version 2.6.0 contains vulnerability CVE-2021-23413. VEX Assessment: Impact is currently being evaluated. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2021-23413 (Standard)\n\n**Component:** `jszip` \n**Version:** `2.6.0` \n**Severity:** MEDIUM (5.3) \n**EPSS Score:** 0.001 (percentile: 0.24344) \n**CWE:** NVD-CWE-noinfo\n\n### VEX Assessment \n**Status:** in_triage \n**Last Updated:** 2025-07-03 15:49:13 by tomas.gonzalez@fossid.com\n\n### Description\nThis affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance.\n\n### Risk Assessment\n- **Severity:** MEDIUM (5.3)\n- **Exploitation Risk:** Low (EPSS: 0.001)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2021-23413)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23413)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [report@snyk.io](https://github.com/Stuk/jszip/blob/master/lib/object.js%23L88)\n - [report@snyk.io](https://github.com/Stuk/jszip/commit/22357494f424178cb416cdb7d93b26dd4f824b36)\n - [report@snyk.io](https://github.com/Stuk/jszip/pull/766)" - } - }, - { - "id": "CVE-2022-24773", - "name": "Vulnerability CVE-2022-24773", - "shortDescription": { - "text": "Security vulnerability CVE-2022-24773 (CVSS 5.3)" - }, - "fullDescription": { - "text": "Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check `DigestInfo` for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.\n\nThis is a medium severity vulnerability with network attack vector and low attack complexity. Associated with CWE-347." - }, - "defaultConfiguration": { - "level": "warning" - }, - "properties": { - "security-severity": "5.3", - "cvss_version": "3.1", - "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", - "base_score": "5.3", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "NONE", - "severity": "MEDIUM", - "tags": [ - "security", - "vulnerability", - "severity-medium", - "attack-vector-network", - "ecosystem-generic", - "cwe-347" - ], - "epss_score": 0.0006, - "epss_percentile": 0.19137, - "cwe_ids": [ - "CWE-347" - ] - }, - "helpUri": "https://nvd.nist.gov/vuln/detail/CVE-2022-24773", - "help": { - "text": "The component node-forge version 1.0.0 contains vulnerability CVE-2022-24773. Consider upgrading to a newer version that addresses this vulnerability. Review your dependency management and consider using tools like Dependabot or Renovate for automated updates.", - "markdown": "## Vulnerability: CVE-2022-24773 (Standard)\n\n**Component:** `node-forge` \n**Version:** `1.0.0` \n**Severity:** MEDIUM (5.3) \n**EPSS Score:** 0.001 (percentile: 0.19137) \n**CWE:** CWE-347\n\n### Description\nForge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check `DigestInfo` for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.\n\n### Risk Assessment\n- **Severity:** MEDIUM (5.3)\n- **Exploitation Risk:** Low (EPSS: 0.001)\n\n### Remediation\n1. **PRIORITY:** Update the component to the latest version that fixes this vulnerability\n2. **Monitor:** Check for security advisories and patches\n3. **Automate:** Implement automated dependency scanning and updates\n4. **Validate:** Test patches in a staging environment before production deployment\n\n### References\n- [NVD Details](https://nvd.nist.gov/vuln/detail/CVE-2022-24773)\n- [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24773)\n- [EPSS Details](https://www.first.org/epss/model)\n- Additional References:\n - [security-advisories@github.com](https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1)\n - [security-advisories@github.com](https://github.com/digitalbazaar/forge/commit/bb822c02df0b61211836472e29b9790cc541cdb2)\n - [security-advisories@github.com](https://github.com/digitalbazaar/forge/security/advisories/GHSA-2r2c-g63r-vccr)" - } - } - ], - "notifications": [ - { - "level": "warning", - "message": { - "text": "🔍 HIGH RISK: 2 vulnerabilities have elevated EPSS exploitation probability scores (>0.1)" - }, - "properties": { - "high_epss_count": 2, - "category": "security", - "priority": "high" - } - }, - { - "level": "note", - "message": { - "text": "✅ VEX ASSESSMENTS: 3 vulnerabilities have been assessed and suppressed based on organizational VEX statements" - }, - "properties": { - "vex_suppressed_count": 3, - "category": "assessment", - "priority": "info" - } - } - ] - } - }, - "results": [ - { - "ruleId": "CVE-2017-7375", - "level": "warning", - "message": { - "text": "Found n/a severity vulnerability CVE-2017-7375 (CVSS 9.8) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Vulnerable component: libxml2 version 2.9.2-rc1" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "libxml2@2.9.2-rc1" - } - } - }, - "logicalLocations": [ - { - "name": "libxml2", - "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 14352, - "cvss_version": "3.1", - "base_score": "9.8", - "attack_vector": "N/A", - "attack_complexity": "N/A", - "availability_impact": "N/A", - "rejected": 0, - "component_id": 12, - "ecosystem": "generic", - "package_url": "pkg:generic/libxml2@2.9.2-rc1", - "scan_id": 772, - "original_level": "warning", - "security-severity": "9.8", - "precision": "medium", - "kind": "review", - "rank": 98.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2017-7375" - ], - "component": [ - "libxml2@2.9.2-rc1" - ], - "severity": [ - "n/a" - ] - }, - "epss_score": 0.00393, - "epss_percentile": 0.59617, - "cwe_ids": [ - "CWE-611" - ] - }, - "fixes": [ - { - "description": { - "text": "Update libxml2 to a version that fixes CVE-2017-7375 - STANDARD priority" - }, - "properties": { - "urgency": "standard", - "guidance": "Check for newer versions of this component that address the vulnerability", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.00393 - } - } - ], - "fingerprints": { - "workbench/component": "libxml2@2.9.2-rc1", - "workbench/vulnerability": "CVE-2017-7375#14352", - "primary": "libxml2@2.9.2-rc1#CVE-2017-7375", - "stable": "CVE-2017-7375" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Component manifest for libxml2" - } - } - }, - "message": { - "text": "Component libxml2 version 2.9.2-rc1" - } - } - ] - }, - { - "ruleId": "CVE-2017-7376", - "level": "warning", - "message": { - "text": "Found n/a severity vulnerability CVE-2017-7376 (CVSS 9.8) in component libxml2 version 2.9.2-rc1. ⚠️ High EPSS score: 0.395. VEX Status: exploitable. Justification: requires_environment This vulnerability should be addressed by updating to a patched version." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Vulnerable component: libxml2 version 2.9.2-rc1" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "libxml2@2.9.2-rc1" - } - } - }, - "logicalLocations": [ - { - "name": "libxml2", - "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 14353, - "cvss_version": "3.1", - "base_score": "9.8", - "attack_vector": "N/A", - "attack_complexity": "N/A", - "availability_impact": "N/A", - "rejected": 0, - "component_id": 12, - "ecosystem": "generic", - "package_url": "pkg:generic/libxml2@2.9.2-rc1", - "scan_id": 772, - "original_level": "warning", - "security-severity": "9.8", - "precision": "high", - "kind": "review", - "rank": 100.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2017-7376" - ], - "component": [ - "libxml2@2.9.2-rc1" - ], - "severity": [ - "n/a" - ] - }, - "epss_score": 0.39544, - "epss_percentile": 0.97149, - "cwe_ids": [ - "CWE-119" - ], - "vex_status": "exploitable", - "vex_justification": "requires_environment", - "vex_response": "can_not_fix", - "vex_details": "unfixable", - "vex_created": "2025-07-03 13:41:07", - "vex_updated": "2025-07-03 15:41:38", - "vex_created_by": "tomas.gonzalez@fossid.com", - "vex_updated_by": "tomas.gonzalez@fossid.com" - }, - "fixes": [ - { - "description": { - "text": "Update libxml2 to a version that fixes CVE-2017-7376 - HIGH priority" - }, - "properties": { - "urgency": "high", - "guidance": "Check for newer versions of this component that address the vulnerability", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.39544, - "vex_status": "exploitable", - "vex_justification": "requires_environment", - "vex_response": "can_not_fix", - "vex_details": "unfixable", - "vex_created": "2025-07-03 13:41:07", - "vex_updated": "2025-07-03 15:41:38", - "vex_created_by": "tomas.gonzalez@fossid.com", - "vex_updated_by": "tomas.gonzalez@fossid.com" - } - } - ], - "fingerprints": { - "workbench/component": "libxml2@2.9.2-rc1", - "workbench/vulnerability": "CVE-2017-7376#14353", - "primary": "libxml2@2.9.2-rc1#CVE-2017-7376", - "stable": "CVE-2017-7376" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Component manifest for libxml2" - } - } - }, - "message": { - "text": "Component libxml2 version 2.9.2-rc1" - } - } - ] - }, - { - "ruleId": "CVE-2017-15412", - "level": "error", - "message": { - "text": "Found high severity vulnerability CVE-2017-15412 (CVSS 8.8) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Vulnerable component: libxml2 version 2.9.2-rc1" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "libxml2@2.9.2-rc1" - } - } - }, - "logicalLocations": [ - { - "name": "libxml2", - "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 14349, - "cvss_version": "3.1", - "base_score": "8.8", - "attack_vector": "N/A", - "attack_complexity": "N/A", - "availability_impact": "N/A", - "rejected": 0, - "component_id": 12, - "ecosystem": "generic", - "package_url": "pkg:generic/libxml2@2.9.2-rc1", - "scan_id": 772, - "original_level": "error", - "security-severity": "8.8", - "precision": "medium", - "kind": "review", - "rank": 93.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2017-15412" - ], - "component": [ - "libxml2@2.9.2-rc1" - ], - "severity": [ - "high" - ] - }, - "epss_score": 0.03481, - "epss_percentile": 0.87129, - "cwe_ids": [ - "CWE-416" - ] - }, - "fixes": [ - { - "description": { - "text": "Update libxml2 to a version that fixes CVE-2017-15412 - STANDARD priority" - }, - "properties": { - "urgency": "standard", - "guidance": "Check for newer versions of this component that address the vulnerability", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.03481 - } - } - ], - "fingerprints": { - "workbench/component": "libxml2@2.9.2-rc1", - "workbench/vulnerability": "CVE-2017-15412#14349", - "primary": "libxml2@2.9.2-rc1#CVE-2017-15412", - "stable": "CVE-2017-15412" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Component manifest for libxml2" - } - } - }, - "message": { - "text": "Component libxml2 version 2.9.2-rc1" - } - } - ] - }, - { - "ruleId": "CVE-2021-3518", - "level": "error", - "message": { - "text": "Found high severity vulnerability CVE-2021-3518 (CVSS 8.8) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Vulnerable component: libxml2 version 2.9.2-rc1" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "libxml2@2.9.2-rc1" - } - } - }, - "logicalLocations": [ - { - "name": "libxml2", - "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 48, - "cvss_version": "3.1", - "base_score": "8.8", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "ecosystem": "generic", - "package_url": "pkg:generic/libxml2@2.9.2-rc1", - "scan_id": 772, - "original_level": "error", - "security-severity": "8.8", - "precision": "medium", - "kind": "review", - "rank": 88.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2021-3518" - ], - "component": [ - "libxml2@2.9.2-rc1" - ], - "severity": [ - "high" - ] - }, - "epss_score": 0.00173, - "epss_percentile": 0.39534, - "cwe_ids": [ - "CWE-416" - ] - }, - "fixes": [ - { - "description": { - "text": "Update libxml2 to a version that fixes CVE-2021-3518 - STANDARD priority" - }, - "properties": { - "urgency": "standard", - "guidance": "Check for newer versions of this component that address the vulnerability", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.00173 - } - } - ], - "fingerprints": { - "workbench/component": "libxml2@2.9.2-rc1", - "workbench/vulnerability": "CVE-2021-3518#48", - "primary": "libxml2@2.9.2-rc1#CVE-2021-3518", - "stable": "CVE-2021-3518" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Component manifest for libxml2" - } - } - }, - "message": { - "text": "Component libxml2 version 2.9.2-rc1" - } - } - ] - }, - { - "ruleId": "CVE-2017-5130", - "level": "error", - "message": { - "text": "Found high severity vulnerability CVE-2017-5130 (CVSS 8.8) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Vulnerable component: libxml2 version 2.9.2-rc1" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "libxml2@2.9.2-rc1" - } - } - }, - "logicalLocations": [ - { - "name": "libxml2", - "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 14351, - "cvss_version": "3.1", - "base_score": "8.8", - "attack_vector": "N/A", - "attack_complexity": "N/A", - "availability_impact": "N/A", - "rejected": 0, - "component_id": 12, - "ecosystem": "generic", - "package_url": "pkg:generic/libxml2@2.9.2-rc1", - "scan_id": 772, - "original_level": "error", - "security-severity": "8.8", - "precision": "medium", - "kind": "review", - "rank": 88.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2017-5130" - ], - "component": [ - "libxml2@2.9.2-rc1" - ], - "severity": [ - "high" - ] - }, - "epss_score": 0.00905, - "epss_percentile": 0.74841, - "cwe_ids": [ - "CWE-787" - ] - }, - "fixes": [ - { - "description": { - "text": "Update libxml2 to a version that fixes CVE-2017-5130 - STANDARD priority" - }, - "properties": { - "urgency": "standard", - "guidance": "Check for newer versions of this component that address the vulnerability", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.00905 - } - } - ], - "fingerprints": { - "workbench/component": "libxml2@2.9.2-rc1", - "workbench/vulnerability": "CVE-2017-5130#14351", - "primary": "libxml2@2.9.2-rc1#CVE-2017-5130", - "stable": "CVE-2017-5130" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Component manifest for libxml2" - } - } - }, - "message": { - "text": "Component libxml2 version 2.9.2-rc1" - } - } - ] - }, - { - "ruleId": "CVE-2021-3517", - "level": "error", - "message": { - "text": "Found high severity vulnerability CVE-2021-3517 (CVSS 8.6) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Vulnerable component: libxml2 version 2.9.2-rc1" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "libxml2@2.9.2-rc1" - } - } - }, - "logicalLocations": [ - { - "name": "libxml2", - "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 47, - "cvss_version": "3.1", - "base_score": "8.6", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "ecosystem": "generic", - "package_url": "pkg:generic/libxml2@2.9.2-rc1", - "scan_id": 772, - "original_level": "error", - "security-severity": "8.6", - "precision": "medium", - "kind": "review", - "rank": 86.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2021-3517" - ], - "component": [ - "libxml2@2.9.2-rc1" - ], - "severity": [ - "high" - ] - }, - "epss_score": 0.00071, - "epss_percentile": 0.22309, - "cwe_ids": [ - "CWE-787" - ] - }, - "fixes": [ - { - "description": { - "text": "Update libxml2 to a version that fixes CVE-2021-3517 - STANDARD priority" - }, - "properties": { - "urgency": "standard", - "guidance": "Check for newer versions of this component that address the vulnerability", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.00071 - } - } - ], - "fingerprints": { - "workbench/component": "libxml2@2.9.2-rc1", - "workbench/vulnerability": "CVE-2021-3517#47", - "primary": "libxml2@2.9.2-rc1#CVE-2021-3517", - "stable": "CVE-2021-3517" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Component manifest for libxml2" - } - } - }, - "message": { - "text": "Component libxml2 version 2.9.2-rc1" - } - } - ] - }, - { - "ruleId": "CVE-2022-40304", - "level": "error", - "message": { - "text": "Found high severity vulnerability CVE-2022-40304 (CVSS 7.8) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Vulnerable component: libxml2 version 2.9.2-rc1" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "libxml2@2.9.2-rc1" - } - } - }, - "logicalLocations": [ - { - "name": "libxml2", - "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 54, - "cvss_version": "3.1", - "base_score": "7.8", - "attack_vector": "LOCAL", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "ecosystem": "generic", - "package_url": "pkg:generic/libxml2@2.9.2-rc1", - "scan_id": 772, - "original_level": "error", - "security-severity": "7.8", - "precision": "medium", - "kind": "review", - "rank": 78.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2022-40304" - ], - "component": [ - "libxml2@2.9.2-rc1" - ], - "severity": [ - "high" - ] - }, - "epss_score": 0.00067, - "epss_percentile": 0.21253, - "cwe_ids": [ - "CWE-415" - ] - }, - "fixes": [ - { - "description": { - "text": "Update libxml2 to a version that fixes CVE-2022-40304 - STANDARD priority" - }, - "properties": { - "urgency": "standard", - "guidance": "Check for newer versions of this component that address the vulnerability", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.00067 - } - } - ], - "fingerprints": { - "workbench/component": "libxml2@2.9.2-rc1", - "workbench/vulnerability": "CVE-2022-40304#54", - "primary": "libxml2@2.9.2-rc1#CVE-2022-40304", - "stable": "CVE-2022-40304" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Component manifest for libxml2" - } - } - }, - "message": { - "text": "Component libxml2 version 2.9.2-rc1" - } - } - ] - }, - { - "ruleId": "CVE-2025-27113", - "level": "error", - "message": { - "text": "Found high severity vulnerability CVE-2025-27113 (CVSS 7.5) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Vulnerable component: libxml2 version 2.9.2-rc1" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "libxml2@2.9.2-rc1" - } - } - }, - "logicalLocations": [ - { - "name": "libxml2", - "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 7327, - "cvss_version": "3.1", - "base_score": "7.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "ecosystem": "generic", - "package_url": "pkg:generic/libxml2@2.9.2-rc1", - "scan_id": 772, - "original_level": "error", - "security-severity": "7.5", - "precision": "medium", - "kind": "review", - "rank": 75.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2025-27113" - ], - "component": [ - "libxml2@2.9.2-rc1" - ], - "severity": [ - "high" - ] - }, - "epss_score": 0.00069, - "epss_percentile": 0.21588, - "cwe_ids": [ - "CWE-476" - ] - }, - "fixes": [ - { - "description": { - "text": "Update libxml2 to a version that fixes CVE-2025-27113 - STANDARD priority" - }, - "properties": { - "urgency": "standard", - "guidance": "Check for newer versions of this component that address the vulnerability", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.00069 - } - } - ], - "fingerprints": { - "workbench/component": "libxml2@2.9.2-rc1", - "workbench/vulnerability": "CVE-2025-27113#7327", - "primary": "libxml2@2.9.2-rc1#CVE-2025-27113", - "stable": "CVE-2025-27113" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Component manifest for libxml2" - } - } - }, - "message": { - "text": "Component libxml2 version 2.9.2-rc1" - } - } - ] - }, - { - "ruleId": "CVE-2022-24771", - "level": "error", - "message": { - "text": "Found high severity vulnerability CVE-2022-24771 (CVSS 7.5) in component node-forge version 1.0.0. This vulnerability should be addressed by updating to a patched version." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/node-forge@1.0.0", - "description": { - "text": "Vulnerable component: node-forge version 1.0.0" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "node-forge@1.0.0" - } - } - }, - "logicalLocations": [ - { - "name": "node-forge", - "fullyQualifiedName": "pkg:generic/node-forge@1.0.0", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 3, - "cvss_version": "3.1", - "base_score": "7.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "NONE", - "rejected": 0, - "component_id": 7, - "ecosystem": "generic", - "package_url": "pkg:generic/node-forge@1.0.0", - "scan_id": 772, - "original_level": "error", - "security-severity": "7.5", - "precision": "medium", - "kind": "review", - "rank": 75.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2022-24771" - ], - "component": [ - "node-forge@1.0.0" - ], - "severity": [ - "high" - ] - }, - "epss_score": 0.00106, - "epss_percentile": 0.29681, - "cwe_ids": [ - "CWE-347" - ] - }, - "fixes": [ - { - "description": { - "text": "Update node-forge to a version that fixes CVE-2022-24771 - STANDARD priority" - }, - "properties": { - "urgency": "standard", - "guidance": "Check for newer versions of this component that address the vulnerability", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.00106 - } - } - ], - "fingerprints": { - "workbench/component": "node-forge@1.0.0", - "workbench/vulnerability": "CVE-2022-24771#3", - "primary": "node-forge@1.0.0#CVE-2022-24771", - "stable": "CVE-2022-24771" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/node-forge@1.0.0", - "description": { - "text": "Component manifest for node-forge" - } - } - }, - "message": { - "text": "Component node-forge version 1.0.0" - } - } - ] - }, - { - "ruleId": "CVE-2025-32415", - "level": "error", - "message": { - "text": "Found high severity vulnerability CVE-2025-32415 (CVSS 7.5) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Vulnerable component: libxml2 version 2.9.2-rc1" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "libxml2@2.9.2-rc1" - } - } - }, - "logicalLocations": [ - { - "name": "libxml2", - "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 7321, - "cvss_version": "3.1", - "base_score": "7.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "ecosystem": "generic", - "package_url": "pkg:generic/libxml2@2.9.2-rc1", - "scan_id": 772, - "original_level": "error", - "security-severity": "7.5", - "precision": "medium", - "kind": "review", - "rank": 75.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2025-32415" - ], - "component": [ - "libxml2@2.9.2-rc1" - ], - "severity": [ - "high" - ] - }, - "epss_score": 0.00027, - "epss_percentile": 0.05708, - "cwe_ids": [ - "CWE-125" - ] - }, - "fixes": [ - { - "description": { - "text": "Update libxml2 to a version that fixes CVE-2025-32415 - STANDARD priority" - }, - "properties": { - "urgency": "standard", - "guidance": "Check for newer versions of this component that address the vulnerability", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.00027 - } - } - ], - "fingerprints": { - "workbench/component": "libxml2@2.9.2-rc1", - "workbench/vulnerability": "CVE-2025-32415#7321", - "primary": "libxml2@2.9.2-rc1#CVE-2025-32415", - "stable": "CVE-2025-32415" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Component manifest for libxml2" - } - } - }, - "message": { - "text": "Component libxml2 version 2.9.2-rc1" - } - } - ] - }, - { - "ruleId": "CVE-2025-32414", - "level": "error", - "message": { - "text": "Found high severity vulnerability CVE-2025-32414 (CVSS 7.5) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Vulnerable component: libxml2 version 2.9.2-rc1" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "libxml2@2.9.2-rc1" - } - } - }, - "logicalLocations": [ - { - "name": "libxml2", - "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 7320, - "cvss_version": "3.1", - "base_score": "7.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "ecosystem": "generic", - "package_url": "pkg:generic/libxml2@2.9.2-rc1", - "scan_id": 772, - "original_level": "error", - "security-severity": "7.5", - "precision": "medium", - "kind": "review", - "rank": 75.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2025-32414" - ], - "component": [ - "libxml2@2.9.2-rc1" - ], - "severity": [ - "high" - ] - }, - "epss_score": 0.00017, - "epss_percentile": 0.02763, - "cwe_ids": [ - "CWE-252" - ] - }, - "fixes": [ - { - "description": { - "text": "Update libxml2 to a version that fixes CVE-2025-32414 - STANDARD priority" - }, - "properties": { - "urgency": "standard", - "guidance": "Check for newer versions of this component that address the vulnerability", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.00017 - } - } - ], - "fingerprints": { - "workbench/component": "libxml2@2.9.2-rc1", - "workbench/vulnerability": "CVE-2025-32414#7320", - "primary": "libxml2@2.9.2-rc1#CVE-2025-32414", - "stable": "CVE-2025-32414" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Component manifest for libxml2" - } - } - }, - "message": { - "text": "Component libxml2 version 2.9.2-rc1" - } - } - ] - }, - { - "ruleId": "CVE-2024-25062", - "level": "error", - "message": { - "text": "Found high severity vulnerability CVE-2024-25062 (CVSS 7.5) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Vulnerable component: libxml2 version 2.9.2-rc1" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "libxml2@2.9.2-rc1" - } - } - }, - "logicalLocations": [ - { - "name": "libxml2", - "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 58, - "cvss_version": "3.1", - "base_score": "7.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "ecosystem": "generic", - "package_url": "pkg:generic/libxml2@2.9.2-rc1", - "scan_id": 772, - "original_level": "error", - "security-severity": "7.5", - "precision": "medium", - "kind": "review", - "rank": 75.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2024-25062" - ], - "component": [ - "libxml2@2.9.2-rc1" - ], - "severity": [ - "high" - ] - }, - "epss_score": 0.0015, - "epss_percentile": 0.3668, - "cwe_ids": [ - "CWE-416" - ] - }, - "fixes": [ - { - "description": { - "text": "Update libxml2 to a version that fixes CVE-2024-25062 - STANDARD priority" - }, - "properties": { - "urgency": "standard", - "guidance": "Check for newer versions of this component that address the vulnerability", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.0015 - } - } - ], - "fingerprints": { - "workbench/component": "libxml2@2.9.2-rc1", - "workbench/vulnerability": "CVE-2024-25062#58", - "primary": "libxml2@2.9.2-rc1#CVE-2024-25062", - "stable": "CVE-2024-25062" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Component manifest for libxml2" - } - } - }, - "message": { - "text": "Component libxml2 version 2.9.2-rc1" - } - } - ] - }, - { - "ruleId": "CVE-2022-40303", - "level": "error", - "message": { - "text": "Found high severity vulnerability CVE-2022-40303 (CVSS 7.5) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Vulnerable component: libxml2 version 2.9.2-rc1" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "libxml2@2.9.2-rc1" - } - } - }, - "logicalLocations": [ - { - "name": "libxml2", - "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 53, - "cvss_version": "3.1", - "base_score": "7.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "ecosystem": "generic", - "package_url": "pkg:generic/libxml2@2.9.2-rc1", - "scan_id": 772, - "original_level": "error", - "security-severity": "7.5", - "precision": "medium", - "kind": "review", - "rank": 75.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2022-40303" - ], - "component": [ - "libxml2@2.9.2-rc1" - ], - "severity": [ - "high" - ] - }, - "epss_score": 0.00137, - "epss_percentile": 0.34634, - "cwe_ids": [ - "CWE-190" - ] - }, - "fixes": [ - { - "description": { - "text": "Update libxml2 to a version that fixes CVE-2022-40303 - STANDARD priority" - }, - "properties": { - "urgency": "standard", - "guidance": "Check for newer versions of this component that address the vulnerability", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.00137 - } - } - ], - "fingerprints": { - "workbench/component": "libxml2@2.9.2-rc1", - "workbench/vulnerability": "CVE-2022-40303#53", - "primary": "libxml2@2.9.2-rc1#CVE-2022-40303", - "stable": "CVE-2022-40303" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Component manifest for libxml2" - } - } - }, - "message": { - "text": "Component libxml2 version 2.9.2-rc1" - } - } - ] - }, - { - "ruleId": "CVE-2022-23308", - "level": "error", - "message": { - "text": "Found high severity vulnerability CVE-2022-23308 (CVSS 7.5) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Vulnerable component: libxml2 version 2.9.2-rc1" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "libxml2@2.9.2-rc1" - } - } - }, - "logicalLocations": [ - { - "name": "libxml2", - "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 51, - "cvss_version": "3.1", - "base_score": "7.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "ecosystem": "generic", - "package_url": "pkg:generic/libxml2@2.9.2-rc1", - "scan_id": 772, - "original_level": "error", - "security-severity": "7.5", - "precision": "medium", - "kind": "review", - "rank": 75.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2022-23308" - ], - "component": [ - "libxml2@2.9.2-rc1" - ], - "severity": [ - "high" - ] - }, - "epss_score": 0.00024, - "epss_percentile": 0.04919, - "cwe_ids": [ - "CWE-416" - ] - }, - "fixes": [ - { - "description": { - "text": "Update libxml2 to a version that fixes CVE-2022-23308 - STANDARD priority" - }, - "properties": { - "urgency": "standard", - "guidance": "Check for newer versions of this component that address the vulnerability", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.00024 - } - } - ], - "fingerprints": { - "workbench/component": "libxml2@2.9.2-rc1", - "workbench/vulnerability": "CVE-2022-23308#51", - "primary": "libxml2@2.9.2-rc1#CVE-2022-23308", - "stable": "CVE-2022-23308" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Component manifest for libxml2" - } - } - }, - "message": { - "text": "Component libxml2 version 2.9.2-rc1" - } - } - ] - }, - { - "ruleId": "CVE-2019-19956", - "level": "error", - "message": { - "text": "Found high severity vulnerability CVE-2019-19956 (CVSS 7.5) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Vulnerable component: libxml2 version 2.9.2-rc1" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "libxml2@2.9.2-rc1" - } - } - }, - "logicalLocations": [ - { - "name": "libxml2", - "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 46, - "cvss_version": "3.1", - "base_score": "7.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "ecosystem": "generic", - "package_url": "pkg:generic/libxml2@2.9.2-rc1", - "scan_id": 772, - "original_level": "error", - "security-severity": "7.5", - "precision": "medium", - "kind": "review", - "rank": 75.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2019-19956" - ], - "component": [ - "libxml2@2.9.2-rc1" - ], - "severity": [ - "high" - ] - }, - "epss_score": 0.00212, - "epss_percentile": 0.44118, - "cwe_ids": [ - "CWE-401" - ] - }, - "fixes": [ - { - "description": { - "text": "Update libxml2 to a version that fixes CVE-2019-19956 - STANDARD priority" - }, - "properties": { - "urgency": "standard", - "guidance": "Check for newer versions of this component that address the vulnerability", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.00212 - } - } - ], - "fingerprints": { - "workbench/component": "libxml2@2.9.2-rc1", - "workbench/vulnerability": "CVE-2019-19956#46", - "primary": "libxml2@2.9.2-rc1#CVE-2019-19956", - "stable": "CVE-2019-19956" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Component manifest for libxml2" - } - } - }, - "message": { - "text": "Component libxml2 version 2.9.2-rc1" - } - } - ] - }, - { - "ruleId": "CVE-2018-14404", - "level": "error", - "message": { - "text": "Found high severity vulnerability CVE-2018-14404 (CVSS 7.5) in component libxml2 version 2.9.2-rc1. ⚠️ High EPSS score: 0.236. This vulnerability should be addressed by updating to a patched version." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Vulnerable component: libxml2 version 2.9.2-rc1" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "libxml2@2.9.2-rc1" - } - } - }, - "logicalLocations": [ - { - "name": "libxml2", - "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 14354, - "cvss_version": "3.1", - "base_score": "7.5", - "attack_vector": "N/A", - "attack_complexity": "N/A", - "availability_impact": "N/A", - "rejected": 0, - "component_id": 12, - "ecosystem": "generic", - "package_url": "pkg:generic/libxml2@2.9.2-rc1", - "scan_id": 772, - "original_level": "error", - "security-severity": "7.5", - "precision": "medium", - "kind": "review", - "rank": 90.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2018-14404" - ], - "component": [ - "libxml2@2.9.2-rc1" - ], - "severity": [ - "high" - ] - }, - "epss_score": 0.2363, - "epss_percentile": 0.95747, - "cwe_ids": [ - "CWE-476" - ] - }, - "fixes": [ - { - "description": { - "text": "Update libxml2 to a version that fixes CVE-2018-14404 - HIGH priority" - }, - "properties": { - "urgency": "high", - "guidance": "Check for newer versions of this component that address the vulnerability", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.2363 - } - } - ], - "fingerprints": { - "workbench/component": "libxml2@2.9.2-rc1", - "workbench/vulnerability": "CVE-2018-14404#14354", - "primary": "libxml2@2.9.2-rc1#CVE-2018-14404", - "stable": "CVE-2018-14404" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Component manifest for libxml2" - } - } - }, - "message": { - "text": "Component libxml2 version 2.9.2-rc1" - } - } - ] - }, - { - "ruleId": "CVE-2022-24772", - "level": "error", - "message": { - "text": "Found high severity vulnerability CVE-2022-24772 (CVSS 7.5) in component node-forge version 1.0.0. This vulnerability should be addressed by updating to a patched version." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/node-forge@1.0.0", - "description": { - "text": "Vulnerable component: node-forge version 1.0.0" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "node-forge@1.0.0" - } - } - }, - "logicalLocations": [ - { - "name": "node-forge", - "fullyQualifiedName": "pkg:generic/node-forge@1.0.0", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 4, - "cvss_version": "3.1", - "base_score": "7.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "NONE", - "rejected": 0, - "component_id": 7, - "ecosystem": "generic", - "package_url": "pkg:generic/node-forge@1.0.0", - "scan_id": 772, - "original_level": "error", - "security-severity": "7.5", - "precision": "medium", - "kind": "review", - "rank": 75.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2022-24772" - ], - "component": [ - "node-forge@1.0.0" - ], - "severity": [ - "high" - ] - }, - "epss_score": 0.00116, - "epss_percentile": 0.31427, - "cwe_ids": [ - "CWE-347" - ] - }, - "fixes": [ - { - "description": { - "text": "Update node-forge to a version that fixes CVE-2022-24772 - STANDARD priority" - }, - "properties": { - "urgency": "standard", - "guidance": "Check for newer versions of this component that address the vulnerability", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.00116 - } - } - ], - "fingerprints": { - "workbench/component": "node-forge@1.0.0", - "workbench/vulnerability": "CVE-2022-24772#4", - "primary": "node-forge@1.0.0#CVE-2022-24772", - "stable": "CVE-2022-24772" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/node-forge@1.0.0", - "description": { - "text": "Component manifest for node-forge" - } - } - }, - "message": { - "text": "Component node-forge version 1.0.0" - } - } - ] - }, - { - "ruleId": "CVE-2022-48285", - "level": "error", - "message": { - "text": "Found high severity vulnerability CVE-2022-48285 (CVSS 7.3) in component jszip version 2.6.0. This vulnerability should be addressed by updating to a patched version." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/jszip@2.6.0", - "description": { - "text": "Vulnerable component: jszip version 2.6.0" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "jszip@2.6.0" - } - } - }, - "logicalLocations": [ - { - "name": "jszip", - "fullyQualifiedName": "pkg:generic/jszip@2.6.0", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 2, - "cvss_version": "3.1", - "base_score": "7.3", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "LOW", - "rejected": 0, - "component_id": 6, - "ecosystem": "generic", - "package_url": "pkg:generic/jszip@2.6.0", - "scan_id": 772, - "original_level": "error", - "security-severity": "7.3", - "precision": "medium", - "kind": "review", - "rank": 73.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2022-48285" - ], - "component": [ - "jszip@2.6.0" - ], - "severity": [ - "high" - ] - }, - "epss_score": 0.00419, - "epss_percentile": 0.61148, - "cwe_ids": [ - "CWE-22" - ] - }, - "fixes": [ - { - "description": { - "text": "Update jszip to a version that fixes CVE-2022-48285 - STANDARD priority" - }, - "properties": { - "urgency": "standard", - "guidance": "Check for newer versions of this component that address the vulnerability", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.00419 - } - } - ], - "fingerprints": { - "workbench/component": "jszip@2.6.0", - "workbench/vulnerability": "CVE-2022-48285#2", - "primary": "jszip@2.6.0#CVE-2022-48285", - "stable": "CVE-2022-48285" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/jszip@2.6.0", - "description": { - "text": "Component manifest for jszip" - } - } - }, - "message": { - "text": "Component jszip version 2.6.0" - } - } - ] - }, - { - "ruleId": "CVE-2017-18258", - "level": "warning", - "message": { - "text": "Found medium severity vulnerability CVE-2017-18258 (CVSS 6.5) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Vulnerable component: libxml2 version 2.9.2-rc1" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "libxml2@2.9.2-rc1" - } - } - }, - "logicalLocations": [ - { - "name": "libxml2", - "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 14350, - "cvss_version": "3.1", - "base_score": "6.5", - "attack_vector": "N/A", - "attack_complexity": "N/A", - "availability_impact": "N/A", - "rejected": 0, - "component_id": 12, - "ecosystem": "generic", - "package_url": "pkg:generic/libxml2@2.9.2-rc1", - "scan_id": 772, - "original_level": "warning", - "security-severity": "6.5", - "precision": "medium", - "kind": "review", - "rank": 65.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2017-18258" - ], - "component": [ - "libxml2@2.9.2-rc1" - ], - "severity": [ - "medium" - ] - }, - "epss_score": 0.00724, - "epss_percentile": 0.71711, - "cwe_ids": [ - "CWE-770" - ] - }, - "fixes": [ - { - "description": { - "text": "Update libxml2 to a version that fixes CVE-2017-18258 - STANDARD priority" - }, - "properties": { - "urgency": "standard", - "guidance": "Check for newer versions of this component that address the vulnerability", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.00724 - } - } - ], - "fingerprints": { - "workbench/component": "libxml2@2.9.2-rc1", - "workbench/vulnerability": "CVE-2017-18258#14350", - "primary": "libxml2@2.9.2-rc1#CVE-2017-18258", - "stable": "CVE-2017-18258" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Component manifest for libxml2" - } - } - }, - "message": { - "text": "Component libxml2 version 2.9.2-rc1" - } - } - ] - }, - { - "ruleId": "CVE-2021-3541", - "level": "warning", - "message": { - "text": "Found medium severity vulnerability CVE-2021-3541 (CVSS 6.5) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Vulnerable component: libxml2 version 2.9.2-rc1" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "libxml2@2.9.2-rc1" - } - } - }, - "logicalLocations": [ - { - "name": "libxml2", - "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 50, - "cvss_version": "3.1", - "base_score": "6.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "ecosystem": "generic", - "package_url": "pkg:generic/libxml2@2.9.2-rc1", - "scan_id": 772, - "original_level": "warning", - "security-severity": "6.5", - "precision": "medium", - "kind": "review", - "rank": 65.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2021-3541" - ], - "component": [ - "libxml2@2.9.2-rc1" - ], - "severity": [ - "medium" - ] - }, - "epss_score": 0.0006, - "epss_percentile": 0.18929, - "cwe_ids": [ - "CWE-776" - ] - }, - "fixes": [ - { - "description": { - "text": "Update libxml2 to a version that fixes CVE-2021-3541 - STANDARD priority" - }, - "properties": { - "urgency": "standard", - "guidance": "Check for newer versions of this component that address the vulnerability", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.0006 - } - } - ], - "fingerprints": { - "workbench/component": "libxml2@2.9.2-rc1", - "workbench/vulnerability": "CVE-2021-3541#50", - "primary": "libxml2@2.9.2-rc1#CVE-2021-3541", - "stable": "CVE-2021-3541" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Component manifest for libxml2" - } - } - }, - "message": { - "text": "Component libxml2 version 2.9.2-rc1" - } - } - ] - }, - { - "ruleId": "CVE-2016-9598", - "level": "warning", - "message": { - "text": "Found medium severity vulnerability CVE-2016-9598 (CVSS 6.5) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Vulnerable component: libxml2 version 2.9.2-rc1" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "libxml2@2.9.2-rc1" - } - } - }, - "logicalLocations": [ - { - "name": "libxml2", - "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 37, - "cvss_version": "3.1", - "base_score": "6.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "ecosystem": "generic", - "package_url": "pkg:generic/libxml2@2.9.2-rc1", - "scan_id": 772, - "original_level": "warning", - "security-severity": "6.5", - "precision": "medium", - "kind": "review", - "rank": 65.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2016-9598" - ], - "component": [ - "libxml2@2.9.2-rc1" - ], - "severity": [ - "medium" - ] - }, - "epss_score": 0.00673, - "epss_percentile": 0.70578, - "cwe_ids": [ - "CWE-125" - ] - }, - "fixes": [ - { - "description": { - "text": "Update libxml2 to a version that fixes CVE-2016-9598 - STANDARD priority" - }, - "properties": { - "urgency": "standard", - "guidance": "Check for newer versions of this component that address the vulnerability", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.00673 - } - } - ], - "fingerprints": { - "workbench/component": "libxml2@2.9.2-rc1", - "workbench/vulnerability": "CVE-2016-9598#37", - "primary": "libxml2@2.9.2-rc1#CVE-2016-9598", - "stable": "CVE-2016-9598" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Component manifest for libxml2" - } - } - }, - "message": { - "text": "Component libxml2 version 2.9.2-rc1" - } - } - ] - }, - { - "ruleId": "CVE-2022-29824", - "level": "warning", - "message": { - "text": "Found medium severity vulnerability CVE-2022-29824 (CVSS 6.5) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Vulnerable component: libxml2 version 2.9.2-rc1" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "libxml2@2.9.2-rc1" - } - } - }, - "logicalLocations": [ - { - "name": "libxml2", - "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 52, - "cvss_version": "3.1", - "base_score": "6.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "ecosystem": "generic", - "package_url": "pkg:generic/libxml2@2.9.2-rc1", - "scan_id": 772, - "original_level": "warning", - "security-severity": "6.5", - "precision": "medium", - "kind": "review", - "rank": 65.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2022-29824" - ], - "component": [ - "libxml2@2.9.2-rc1" - ], - "severity": [ - "medium" - ] - }, - "epss_score": 0.00041, - "epss_percentile": 0.11669, - "cwe_ids": [ - "CWE-190" - ] - }, - "fixes": [ - { - "description": { - "text": "Update libxml2 to a version that fixes CVE-2022-29824 - STANDARD priority" - }, - "properties": { - "urgency": "standard", - "guidance": "Check for newer versions of this component that address the vulnerability", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.00041 - } - } - ], - "fingerprints": { - "workbench/component": "libxml2@2.9.2-rc1", - "workbench/vulnerability": "CVE-2022-29824#52", - "primary": "libxml2@2.9.2-rc1#CVE-2022-29824", - "stable": "CVE-2022-29824" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Component manifest for libxml2" - } - } - }, - "message": { - "text": "Component libxml2 version 2.9.2-rc1" - } - } - ] - }, - { - "ruleId": "CVE-2016-9596", - "level": "warning", - "message": { - "text": "Found medium severity vulnerability CVE-2016-9596 (CVSS 6.5) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Vulnerable component: libxml2 version 2.9.2-rc1" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "libxml2@2.9.2-rc1" - } - } - }, - "logicalLocations": [ - { - "name": "libxml2", - "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 36, - "cvss_version": "3.1", - "base_score": "6.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "ecosystem": "generic", - "package_url": "pkg:generic/libxml2@2.9.2-rc1", - "scan_id": 772, - "original_level": "warning", - "security-severity": "6.5", - "precision": "medium", - "kind": "review", - "rank": 65.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2016-9596" - ], - "component": [ - "libxml2@2.9.2-rc1" - ], - "severity": [ - "medium" - ] - }, - "epss_score": 0.00673, - "epss_percentile": 0.70578, - "cwe_ids": [ - "CWE-400" - ] - }, - "fixes": [ - { - "description": { - "text": "Update libxml2 to a version that fixes CVE-2016-9596 - STANDARD priority" - }, - "properties": { - "urgency": "standard", - "guidance": "Check for newer versions of this component that address the vulnerability", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.00673 - } - } - ], - "fingerprints": { - "workbench/component": "libxml2@2.9.2-rc1", - "workbench/vulnerability": "CVE-2016-9596#36", - "primary": "libxml2@2.9.2-rc1#CVE-2016-9596", - "stable": "CVE-2016-9596" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Component manifest for libxml2" - } - } - }, - "message": { - "text": "Component libxml2 version 2.9.2-rc1" - } - } - ] - }, - { - "ruleId": "CVE-2023-28484", - "level": "warning", - "message": { - "text": "Found medium severity vulnerability CVE-2023-28484 (CVSS 6.5) in component libxml2 version 2.9.2-rc1. This vulnerability should be addressed by updating to a patched version." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Vulnerable component: libxml2 version 2.9.2-rc1" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "libxml2@2.9.2-rc1" - } - } - }, - "logicalLocations": [ - { - "name": "libxml2", - "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 55, - "cvss_version": "3.1", - "base_score": "6.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "ecosystem": "generic", - "package_url": "pkg:generic/libxml2@2.9.2-rc1", - "scan_id": 772, - "original_level": "warning", - "security-severity": "6.5", - "precision": "medium", - "kind": "review", - "rank": 65.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2023-28484" - ], - "component": [ - "libxml2@2.9.2-rc1" - ], - "severity": [ - "medium" - ] - }, - "epss_score": 0.00263, - "epss_percentile": 0.49636, - "cwe_ids": [ - "CWE-476" - ] - }, - "fixes": [ - { - "description": { - "text": "Update libxml2 to a version that fixes CVE-2023-28484 - STANDARD priority" - }, - "properties": { - "urgency": "standard", - "guidance": "Check for newer versions of this component that address the vulnerability", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.00263 - } - } - ], - "fingerprints": { - "workbench/component": "libxml2@2.9.2-rc1", - "workbench/vulnerability": "CVE-2023-28484#55", - "primary": "libxml2@2.9.2-rc1#CVE-2023-28484", - "stable": "CVE-2023-28484" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Component manifest for libxml2" - } - } - }, - "message": { - "text": "Component libxml2 version 2.9.2-rc1" - } - } - ] - }, - { - "ruleId": "CVE-2023-29469", - "level": "note", - "message": { - "text": "Found medium severity vulnerability CVE-2023-29469 (CVSS 6.5) in component libxml2 version 2.9.2-rc1. VEX Status: not_affected. Justification: protected_at_runtime Verify VEX assessment is current and accurate." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Vulnerable component: libxml2 version 2.9.2-rc1" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "libxml2@2.9.2-rc1" - } - } - }, - "logicalLocations": [ - { - "name": "libxml2", - "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 56, - "cvss_version": "3.1", - "base_score": "6.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "ecosystem": "generic", - "package_url": "pkg:generic/libxml2@2.9.2-rc1", - "scan_id": 772, - "original_level": "warning", - "security-severity": "6.5", - "precision": "high", - "kind": "review", - "rank": 6.5, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2023-29469" - ], - "component": [ - "libxml2@2.9.2-rc1" - ], - "severity": [ - "medium" - ] - }, - "epss_score": 0.00054, - "epss_percentile": 0.16808, - "cwe_ids": [ - "CWE-415" - ], - "vex_status": "not_affected", - "vex_justification": "protected_at_runtime", - "vex_response": "will_not_fix", - "vex_created": "2025-07-03 13:50:08", - "vex_updated": "2025-07-03 15:50:16", - "vex_created_by": "tomas.gonzalez@fossid.com", - "vex_updated_by": "tomas.gonzalez@fossid.com" - }, - "fixes": [ - { - "description": { - "text": "Verify VEX assessment for libxml2 CVE-2023-29469 - Component reported as not_affected" - }, - "properties": { - "urgency": "standard", - "guidance": "Validate that VEX assessment is current and accurate", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.00054, - "vex_status": "not_affected", - "vex_justification": "protected_at_runtime", - "vex_response": "will_not_fix", - "vex_created": "2025-07-03 13:50:08", - "vex_updated": "2025-07-03 15:50:16", - "vex_created_by": "tomas.gonzalez@fossid.com", - "vex_updated_by": "tomas.gonzalez@fossid.com" - } - } - ], - "fingerprints": { - "workbench/component": "libxml2@2.9.2-rc1", - "workbench/vulnerability": "CVE-2023-29469#56", - "primary": "libxml2@2.9.2-rc1#CVE-2023-29469", - "stable": "CVE-2023-29469" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Component manifest for libxml2" - } - } - }, - "message": { - "text": "Component libxml2 version 2.9.2-rc1" - } - } - ], - "suppressions": [ - { - "kind": "inSource", - "status": "accepted", - "justification": "protected_at_runtime" - } - ] - }, - { - "ruleId": "CVE-2023-45322", - "level": "note", - "message": { - "text": "Found medium severity vulnerability CVE-2023-45322 (CVSS 6.5) in component libxml2 version 2.9.2-rc1. VEX Status: false_positive. Justification: code_not_present Verify false positive assessment is accurate." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Vulnerable component: libxml2 version 2.9.2-rc1" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "libxml2@2.9.2-rc1" - } - } - }, - "logicalLocations": [ - { - "name": "libxml2", - "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 57, - "cvss_version": "3.1", - "base_score": "6.5", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "ecosystem": "generic", - "package_url": "pkg:generic/libxml2@2.9.2-rc1", - "scan_id": 772, - "original_level": "warning", - "security-severity": "6.5", - "precision": "high", - "kind": "review", - "rank": 13.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2023-45322" - ], - "component": [ - "libxml2@2.9.2-rc1" - ], - "severity": [ - "medium" - ] - }, - "epss_score": 0.00076, - "epss_percentile": 0.23725, - "cwe_ids": [ - "CWE-416" - ], - "vex_status": "false_positive", - "vex_justification": "code_not_present", - "vex_response": "will_not_fix", - "vex_created": "2025-07-03 13:49:53", - "vex_updated": "2025-07-03 15:50:05", - "vex_created_by": "tomas.gonzalez@fossid.com", - "vex_updated_by": "tomas.gonzalez@fossid.com" - }, - "fixes": [ - { - "description": { - "text": "Verify false positive assessment for libxml2 CVE-2023-45322 - FALSE POSITIVE status" - }, - "properties": { - "urgency": "standard", - "guidance": "Validate that false positive assessment is accurate and documented", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.00076, - "vex_status": "false_positive", - "vex_justification": "code_not_present", - "vex_response": "will_not_fix", - "vex_created": "2025-07-03 13:49:53", - "vex_updated": "2025-07-03 15:50:05", - "vex_created_by": "tomas.gonzalez@fossid.com", - "vex_updated_by": "tomas.gonzalez@fossid.com" - } - } - ], - "fingerprints": { - "workbench/component": "libxml2@2.9.2-rc1", - "workbench/vulnerability": "CVE-2023-45322#57", - "primary": "libxml2@2.9.2-rc1#CVE-2023-45322", - "stable": "CVE-2023-45322" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Component manifest for libxml2" - } - } - }, - "message": { - "text": "Component libxml2 version 2.9.2-rc1" - } - } - ], - "suppressions": [ - { - "kind": "inSource", - "status": "accepted", - "justification": "code_not_present" - } - ] - }, - { - "ruleId": "CVE-2016-3709", - "level": "warning", - "message": { - "text": "Found medium severity vulnerability CVE-2016-3709 (CVSS 6.1) in component libxml2 version 2.9.2-rc1. VEX Status: in_triage. This vulnerability should be addressed by updating to a patched version." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Vulnerable component: libxml2 version 2.9.2-rc1" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "libxml2@2.9.2-rc1" - } - } - }, - "logicalLocations": [ - { - "name": "libxml2", - "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 28, - "cvss_version": "3.1", - "base_score": "6.1", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "NONE", - "rejected": 0, - "component_id": 12, - "ecosystem": "generic", - "package_url": "pkg:generic/libxml2@2.9.2-rc1", - "scan_id": 772, - "original_level": "warning", - "security-severity": "6.1", - "precision": "high", - "kind": "review", - "rank": 61.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2016-3709" - ], - "component": [ - "libxml2@2.9.2-rc1" - ], - "severity": [ - "medium" - ] - }, - "epss_score": 0.00098, - "epss_percentile": 0.28367, - "cwe_ids": [ - "CWE-79" - ], - "vex_status": "in_triage", - "vex_created": "2025-07-03 13:49:47", - "vex_updated": "2025-07-03 15:49:47", - "vex_created_by": "tomas.gonzalez@fossid.com", - "vex_updated_by": "tomas.gonzalez@fossid.com" - }, - "fixes": [ - { - "description": { - "text": "Monitor investigation progress for libxml2 CVE-2016-3709 - IN TRIAGE" - }, - "properties": { - "urgency": "standard", - "guidance": "Follow up on investigation status and prepare for potential remediation", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.00098, - "vex_status": "in_triage", - "vex_created": "2025-07-03 13:49:47", - "vex_updated": "2025-07-03 15:49:47", - "vex_created_by": "tomas.gonzalez@fossid.com", - "vex_updated_by": "tomas.gonzalez@fossid.com" - } - } - ], - "fingerprints": { - "workbench/component": "libxml2@2.9.2-rc1", - "workbench/vulnerability": "CVE-2016-3709#28", - "primary": "libxml2@2.9.2-rc1#CVE-2016-3709", - "stable": "CVE-2016-3709" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Component manifest for libxml2" - } - } - }, - "message": { - "text": "Component libxml2 version 2.9.2-rc1" - } - } - ] - }, - { - "ruleId": "CVE-2021-3537", - "level": "note", - "message": { - "text": "Found medium severity vulnerability CVE-2021-3537 (CVSS 5.9) in component libxml2 version 2.9.2-rc1. VEX Status: resolved. Justification: code_not_present Verify resolution is complete and effective." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Vulnerable component: libxml2 version 2.9.2-rc1" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "libxml2@2.9.2-rc1" - } - } - }, - "logicalLocations": [ - { - "name": "libxml2", - "fullyQualifiedName": "pkg:generic/libxml2@2.9.2-rc1", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 49, - "cvss_version": "3.1", - "base_score": "5.9", - "attack_vector": "NETWORK", - "attack_complexity": "HIGH", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "ecosystem": "generic", - "package_url": "pkg:generic/libxml2@2.9.2-rc1", - "scan_id": 772, - "original_level": "warning", - "security-severity": "5.9", - "precision": "high", - "kind": "review", - "rank": 5.9, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2021-3537" - ], - "component": [ - "libxml2@2.9.2-rc1" - ], - "severity": [ - "medium" - ] - }, - "epss_score": 0.00127, - "epss_percentile": 0.33184, - "cwe_ids": [ - "CWE-476" - ], - "vex_status": "resolved", - "vex_justification": "code_not_present", - "vex_response": "update,will_not_fix", - "vex_created": "2025-07-03 13:49:22", - "vex_updated": "2025-07-03 15:49:44", - "vex_created_by": "tomas.gonzalez@fossid.com", - "vex_updated_by": "tomas.gonzalez@fossid.com" - }, - "fixes": [ - { - "description": { - "text": "Verify resolution for libxml2 CVE-2021-3537 - RESOLVED status" - }, - "properties": { - "urgency": "standard", - "guidance": "Confirm that resolution is complete and effective", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.00127, - "vex_status": "resolved", - "vex_justification": "code_not_present", - "vex_response": "update,will_not_fix", - "vex_created": "2025-07-03 13:49:22", - "vex_updated": "2025-07-03 15:49:44", - "vex_created_by": "tomas.gonzalez@fossid.com", - "vex_updated_by": "tomas.gonzalez@fossid.com" - } - } - ], - "fingerprints": { - "workbench/component": "libxml2@2.9.2-rc1", - "workbench/vulnerability": "CVE-2021-3537#49", - "primary": "libxml2@2.9.2-rc1#CVE-2021-3537", - "stable": "CVE-2021-3537" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/libxml2@2.9.2-rc1", - "description": { - "text": "Component manifest for libxml2" - } - } - }, - "message": { - "text": "Component libxml2 version 2.9.2-rc1" - } - } - ], - "suppressions": [ - { - "kind": "inSource", - "status": "accepted", - "justification": "code_not_present" - } - ] - }, - { - "ruleId": "CVE-2021-23413", - "level": "warning", - "message": { - "text": "Found medium severity vulnerability CVE-2021-23413 (CVSS 5.3) in component jszip version 2.6.0. VEX Status: in_triage. This vulnerability should be addressed by updating to a patched version." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/jszip@2.6.0", - "description": { - "text": "Vulnerable component: jszip version 2.6.0" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "jszip@2.6.0" - } - } - }, - "logicalLocations": [ - { - "name": "jszip", - "fullyQualifiedName": "pkg:generic/jszip@2.6.0", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 1, - "cvss_version": "3.1", - "base_score": "5.3", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "LOW", - "rejected": 0, - "component_id": 6, - "ecosystem": "generic", - "package_url": "pkg:generic/jszip@2.6.0", - "scan_id": 772, - "original_level": "warning", - "security-severity": "5.3", - "precision": "high", - "kind": "review", - "rank": 53.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2021-23413" - ], - "component": [ - "jszip@2.6.0" - ], - "severity": [ - "medium" - ] - }, - "epss_score": 0.00079, - "epss_percentile": 0.24344, - "cwe_ids": [ - "NVD-CWE-noinfo" - ], - "vex_status": "in_triage", - "vex_created": "2025-07-03 13:49:13", - "vex_updated": "2025-07-03 15:49:13", - "vex_created_by": "tomas.gonzalez@fossid.com", - "vex_updated_by": "tomas.gonzalez@fossid.com" - }, - "fixes": [ - { - "description": { - "text": "Monitor investigation progress for jszip CVE-2021-23413 - IN TRIAGE" - }, - "properties": { - "urgency": "standard", - "guidance": "Follow up on investigation status and prepare for potential remediation", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.00079, - "vex_status": "in_triage", - "vex_created": "2025-07-03 13:49:13", - "vex_updated": "2025-07-03 15:49:13", - "vex_created_by": "tomas.gonzalez@fossid.com", - "vex_updated_by": "tomas.gonzalez@fossid.com" - } - } - ], - "fingerprints": { - "workbench/component": "jszip@2.6.0", - "workbench/vulnerability": "CVE-2021-23413#1", - "primary": "jszip@2.6.0#CVE-2021-23413", - "stable": "CVE-2021-23413" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/jszip@2.6.0", - "description": { - "text": "Component manifest for jszip" - } - } - }, - "message": { - "text": "Component jszip version 2.6.0" - } - } - ] - }, - { - "ruleId": "CVE-2022-24773", - "level": "warning", - "message": { - "text": "Found medium severity vulnerability CVE-2022-24773 (CVSS 5.3) in component node-forge version 1.0.0. This vulnerability should be addressed by updating to a patched version." - }, - "locations": [ - { - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/node-forge@1.0.0", - "description": { - "text": "Vulnerable component: node-forge version 1.0.0" - } - }, - "region": { - "startLine": 1, - "startColumn": 1, - "snippet": { - "text": "node-forge@1.0.0" - } - } - }, - "logicalLocations": [ - { - "name": "node-forge", - "fullyQualifiedName": "pkg:generic/node-forge@1.0.0", - "kind": "package" - } - ] - } - ], - "properties": { - "vulnerability_id": 5, - "cvss_version": "3.1", - "base_score": "5.3", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "NONE", - "rejected": 0, - "component_id": 7, - "ecosystem": "generic", - "package_url": "pkg:generic/node-forge@1.0.0", - "scan_id": 772, - "original_level": "warning", - "security-severity": "5.3", - "precision": "medium", - "kind": "review", - "rank": 53.0, - "baseline": "unchanged", - "tags": { - "vulnerability": [ - "CVE-2022-24773" - ], - "component": [ - "node-forge@1.0.0" - ], - "severity": [ - "medium" - ] - }, - "epss_score": 0.0006, - "epss_percentile": 0.19137, - "cwe_ids": [ - "CWE-347" - ] - }, - "fixes": [ - { - "description": { - "text": "Update node-forge to a version that fixes CVE-2022-24773 - STANDARD priority" - }, - "properties": { - "urgency": "standard", - "guidance": "Check for newer versions of this component that address the vulnerability", - "automation": "Consider using automated dependency update tools", - "cisa_kev": false, - "epss_score": 0.0006 - } - } - ], - "fingerprints": { - "workbench/component": "node-forge@1.0.0", - "workbench/vulnerability": "CVE-2022-24773#5", - "primary": "node-forge@1.0.0#CVE-2022-24773", - "stable": "CVE-2022-24773" - }, - "relatedLocations": [ - { - "id": 0, - "physicalLocation": { - "artifactLocation": { - "uri": "pkg:generic/node-forge@1.0.0", - "description": { - "text": "Component manifest for node-forge" - } - } - }, - "message": { - "text": "Component node-forge version 1.0.0" - } - } - ] - } - ], - "properties": { - "scan_code": "ScanZIPwithShinobiAutoID_772", - "generated_at": "2025-07-03T18:10:55.703803Z", - "total_vulnerabilities": 30, - "severity_distribution": { - "CRITICAL": 0, - "HIGH": 16, - "MEDIUM": 12, - "LOW": 0, - "UNKNOWN": 2 - }, - "external_data_sources": [ - "FIRST EPSS", - "NVD" - ], - "high_risk_vulnerabilities": { - "cisa_kev": 0, - "high_epss": 2, - "critical_severity": 0, - "total_high_risk": 2 - }, - "vex_statements": { - "total_with_vex": 6, - "status_distribution": { - "exploitable": 1, - "not_affected": 1, - "false_positive": 1, - "in_triage": 2, - "resolved": 1 - }, - "with_justification": 4, - "with_response": 4, - "with_details": 1 - } - } - } - ] -} \ No newline at end of file diff --git a/vulns.json b/vulns.json deleted file mode 100644 index 144c74d..0000000 --- a/vulns.json +++ /dev/null @@ -1,814 +0,0 @@ -{ - "vulnerabilities": [ - { - "id": 14352, - "cve": "CVE-2017-7375", - "cvss_version": "3.1", - "base_score": "9.8", - "severity": "N/A", - "attack_vector": "N/A", - "attack_complexity": "N/A", - "availability_impact": "N/A", - "rejected": 0, - "component_id": 12, - "component_name": "libxml2", - "component_version": "2.9.2-rc1", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": null, - "vuln_exp_status": null, - "vuln_exp_justification": null, - "vuln_exp_response": null, - "vuln_exp_details": null, - "vuln_exp_created": null, - "vuln_exp_updated": null, - "vuln_exp_created_by": null, - "vuln_exp_updated_by": null, - "vuln_exp_created_by_username": null, - "vuln_exp_updated_by_username": null - }, - { - "id": 14353, - "cve": "CVE-2017-7376", - "cvss_version": "3.1", - "base_score": "9.8", - "severity": "N/A", - "attack_vector": "N/A", - "attack_complexity": "N/A", - "availability_impact": "N/A", - "rejected": 0, - "component_id": 12, - "component_name": "libxml2", - "component_version": "2.9.2-rc1", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": 27, - "vuln_exp_status": "exploitable", - "vuln_exp_justification": "requires_environment", - "vuln_exp_response": "can_not_fix", - "vuln_exp_details": "unfixable", - "vuln_exp_created": "2025-07-03 13:41:07", - "vuln_exp_updated": "2025-07-03 15:41:38", - "vuln_exp_created_by": 3, - "vuln_exp_updated_by": 3, - "vuln_exp_created_by_username": "tomas.gonzalez@fossid.com", - "vuln_exp_updated_by_username": "tomas.gonzalez@fossid.com" - }, - { - "id": 14349, - "cve": "CVE-2017-15412", - "cvss_version": "3.1", - "base_score": "8.8", - "severity": "HIGH", - "attack_vector": "N/A", - "attack_complexity": "N/A", - "availability_impact": "N/A", - "rejected": 0, - "component_id": 12, - "component_name": "libxml2", - "component_version": "2.9.2-rc1", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": null, - "vuln_exp_status": null, - "vuln_exp_justification": null, - "vuln_exp_response": null, - "vuln_exp_details": null, - "vuln_exp_created": null, - "vuln_exp_updated": null, - "vuln_exp_created_by": null, - "vuln_exp_updated_by": null, - "vuln_exp_created_by_username": null, - "vuln_exp_updated_by_username": null - }, - { - "id": 48, - "cve": "CVE-2021-3518", - "cvss_version": "3.1", - "base_score": "8.8", - "severity": "HIGH", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "component_name": "libxml2", - "component_version": "2.9.2-rc1", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": null, - "vuln_exp_status": null, - "vuln_exp_justification": null, - "vuln_exp_response": null, - "vuln_exp_details": null, - "vuln_exp_created": null, - "vuln_exp_updated": null, - "vuln_exp_created_by": null, - "vuln_exp_updated_by": null, - "vuln_exp_created_by_username": null, - "vuln_exp_updated_by_username": null - }, - { - "id": 14351, - "cve": "CVE-2017-5130", - "cvss_version": "3.1", - "base_score": "8.8", - "severity": "HIGH", - "attack_vector": "N/A", - "attack_complexity": "N/A", - "availability_impact": "N/A", - "rejected": 0, - "component_id": 12, - "component_name": "libxml2", - "component_version": "2.9.2-rc1", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": null, - "vuln_exp_status": null, - "vuln_exp_justification": null, - "vuln_exp_response": null, - "vuln_exp_details": null, - "vuln_exp_created": null, - "vuln_exp_updated": null, - "vuln_exp_created_by": null, - "vuln_exp_updated_by": null, - "vuln_exp_created_by_username": null, - "vuln_exp_updated_by_username": null - }, - { - "id": 47, - "cve": "CVE-2021-3517", - "cvss_version": "3.1", - "base_score": "8.6", - "severity": "HIGH", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "component_name": "libxml2", - "component_version": "2.9.2-rc1", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": null, - "vuln_exp_status": null, - "vuln_exp_justification": null, - "vuln_exp_response": null, - "vuln_exp_details": null, - "vuln_exp_created": null, - "vuln_exp_updated": null, - "vuln_exp_created_by": null, - "vuln_exp_updated_by": null, - "vuln_exp_created_by_username": null, - "vuln_exp_updated_by_username": null - }, - { - "id": 54, - "cve": "CVE-2022-40304", - "cvss_version": "3.1", - "base_score": "7.8", - "severity": "HIGH", - "attack_vector": "LOCAL", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "component_name": "libxml2", - "component_version": "2.9.2-rc1", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": null, - "vuln_exp_status": null, - "vuln_exp_justification": null, - "vuln_exp_response": null, - "vuln_exp_details": null, - "vuln_exp_created": null, - "vuln_exp_updated": null, - "vuln_exp_created_by": null, - "vuln_exp_updated_by": null, - "vuln_exp_created_by_username": null, - "vuln_exp_updated_by_username": null - }, - { - "id": 7327, - "cve": "CVE-2025-27113", - "cvss_version": "3.1", - "base_score": "7.5", - "severity": "HIGH", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "component_name": "libxml2", - "component_version": "2.9.2-rc1", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": null, - "vuln_exp_status": null, - "vuln_exp_justification": null, - "vuln_exp_response": null, - "vuln_exp_details": null, - "vuln_exp_created": null, - "vuln_exp_updated": null, - "vuln_exp_created_by": null, - "vuln_exp_updated_by": null, - "vuln_exp_created_by_username": null, - "vuln_exp_updated_by_username": null - }, - { - "id": 3, - "cve": "CVE-2022-24771", - "cvss_version": "3.1", - "base_score": "7.5", - "severity": "HIGH", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "NONE", - "rejected": 0, - "component_id": 7, - "component_name": "node-forge", - "component_version": "1.0.0", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": null, - "vuln_exp_status": null, - "vuln_exp_justification": null, - "vuln_exp_response": null, - "vuln_exp_details": null, - "vuln_exp_created": null, - "vuln_exp_updated": null, - "vuln_exp_created_by": null, - "vuln_exp_updated_by": null, - "vuln_exp_created_by_username": null, - "vuln_exp_updated_by_username": null - }, - { - "id": 7321, - "cve": "CVE-2025-32415", - "cvss_version": "3.1", - "base_score": "7.5", - "severity": "HIGH", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "component_name": "libxml2", - "component_version": "2.9.2-rc1", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": null, - "vuln_exp_status": null, - "vuln_exp_justification": null, - "vuln_exp_response": null, - "vuln_exp_details": null, - "vuln_exp_created": null, - "vuln_exp_updated": null, - "vuln_exp_created_by": null, - "vuln_exp_updated_by": null, - "vuln_exp_created_by_username": null, - "vuln_exp_updated_by_username": null - }, - { - "id": 7320, - "cve": "CVE-2025-32414", - "cvss_version": "3.1", - "base_score": "7.5", - "severity": "HIGH", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "component_name": "libxml2", - "component_version": "2.9.2-rc1", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": null, - "vuln_exp_status": null, - "vuln_exp_justification": null, - "vuln_exp_response": null, - "vuln_exp_details": null, - "vuln_exp_created": null, - "vuln_exp_updated": null, - "vuln_exp_created_by": null, - "vuln_exp_updated_by": null, - "vuln_exp_created_by_username": null, - "vuln_exp_updated_by_username": null - }, - { - "id": 58, - "cve": "CVE-2024-25062", - "cvss_version": "3.1", - "base_score": "7.5", - "severity": "HIGH", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "component_name": "libxml2", - "component_version": "2.9.2-rc1", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": null, - "vuln_exp_status": null, - "vuln_exp_justification": null, - "vuln_exp_response": null, - "vuln_exp_details": null, - "vuln_exp_created": null, - "vuln_exp_updated": null, - "vuln_exp_created_by": null, - "vuln_exp_updated_by": null, - "vuln_exp_created_by_username": null, - "vuln_exp_updated_by_username": null - }, - { - "id": 53, - "cve": "CVE-2022-40303", - "cvss_version": "3.1", - "base_score": "7.5", - "severity": "HIGH", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "component_name": "libxml2", - "component_version": "2.9.2-rc1", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": null, - "vuln_exp_status": null, - "vuln_exp_justification": null, - "vuln_exp_response": null, - "vuln_exp_details": null, - "vuln_exp_created": null, - "vuln_exp_updated": null, - "vuln_exp_created_by": null, - "vuln_exp_updated_by": null, - "vuln_exp_created_by_username": null, - "vuln_exp_updated_by_username": null - }, - { - "id": 51, - "cve": "CVE-2022-23308", - "cvss_version": "3.1", - "base_score": "7.5", - "severity": "HIGH", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "component_name": "libxml2", - "component_version": "2.9.2-rc1", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": null, - "vuln_exp_status": null, - "vuln_exp_justification": null, - "vuln_exp_response": null, - "vuln_exp_details": null, - "vuln_exp_created": null, - "vuln_exp_updated": null, - "vuln_exp_created_by": null, - "vuln_exp_updated_by": null, - "vuln_exp_created_by_username": null, - "vuln_exp_updated_by_username": null - }, - { - "id": 46, - "cve": "CVE-2019-19956", - "cvss_version": "3.1", - "base_score": "7.5", - "severity": "HIGH", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "component_name": "libxml2", - "component_version": "2.9.2-rc1", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": null, - "vuln_exp_status": null, - "vuln_exp_justification": null, - "vuln_exp_response": null, - "vuln_exp_details": null, - "vuln_exp_created": null, - "vuln_exp_updated": null, - "vuln_exp_created_by": null, - "vuln_exp_updated_by": null, - "vuln_exp_created_by_username": null, - "vuln_exp_updated_by_username": null - }, - { - "id": 14354, - "cve": "CVE-2018-14404", - "cvss_version": "3.1", - "base_score": "7.5", - "severity": "HIGH", - "attack_vector": "N/A", - "attack_complexity": "N/A", - "availability_impact": "N/A", - "rejected": 0, - "component_id": 12, - "component_name": "libxml2", - "component_version": "2.9.2-rc1", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": null, - "vuln_exp_status": null, - "vuln_exp_justification": null, - "vuln_exp_response": null, - "vuln_exp_details": null, - "vuln_exp_created": null, - "vuln_exp_updated": null, - "vuln_exp_created_by": null, - "vuln_exp_updated_by": null, - "vuln_exp_created_by_username": null, - "vuln_exp_updated_by_username": null - }, - { - "id": 4, - "cve": "CVE-2022-24772", - "cvss_version": "3.1", - "base_score": "7.5", - "severity": "HIGH", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "NONE", - "rejected": 0, - "component_id": 7, - "component_name": "node-forge", - "component_version": "1.0.0", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": null, - "vuln_exp_status": null, - "vuln_exp_justification": null, - "vuln_exp_response": null, - "vuln_exp_details": null, - "vuln_exp_created": null, - "vuln_exp_updated": null, - "vuln_exp_created_by": null, - "vuln_exp_updated_by": null, - "vuln_exp_created_by_username": null, - "vuln_exp_updated_by_username": null - }, - { - "id": 2, - "cve": "CVE-2022-48285", - "cvss_version": "3.1", - "base_score": "7.3", - "severity": "HIGH", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "LOW", - "rejected": 0, - "component_id": 6, - "component_name": "jszip", - "component_version": "2.6.0", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": null, - "vuln_exp_status": null, - "vuln_exp_justification": null, - "vuln_exp_response": null, - "vuln_exp_details": null, - "vuln_exp_created": null, - "vuln_exp_updated": null, - "vuln_exp_created_by": null, - "vuln_exp_updated_by": null, - "vuln_exp_created_by_username": null, - "vuln_exp_updated_by_username": null - }, - { - "id": 14350, - "cve": "CVE-2017-18258", - "cvss_version": "3.1", - "base_score": "6.5", - "severity": "MEDIUM", - "attack_vector": "N/A", - "attack_complexity": "N/A", - "availability_impact": "N/A", - "rejected": 0, - "component_id": 12, - "component_name": "libxml2", - "component_version": "2.9.2-rc1", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": null, - "vuln_exp_status": null, - "vuln_exp_justification": null, - "vuln_exp_response": null, - "vuln_exp_details": null, - "vuln_exp_created": null, - "vuln_exp_updated": null, - "vuln_exp_created_by": null, - "vuln_exp_updated_by": null, - "vuln_exp_created_by_username": null, - "vuln_exp_updated_by_username": null - }, - { - "id": 50, - "cve": "CVE-2021-3541", - "cvss_version": "3.1", - "base_score": "6.5", - "severity": "MEDIUM", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "component_name": "libxml2", - "component_version": "2.9.2-rc1", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": null, - "vuln_exp_status": null, - "vuln_exp_justification": null, - "vuln_exp_response": null, - "vuln_exp_details": null, - "vuln_exp_created": null, - "vuln_exp_updated": null, - "vuln_exp_created_by": null, - "vuln_exp_updated_by": null, - "vuln_exp_created_by_username": null, - "vuln_exp_updated_by_username": null - }, - { - "id": 37, - "cve": "CVE-2016-9598", - "cvss_version": "3.1", - "base_score": "6.5", - "severity": "MEDIUM", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "component_name": "libxml2", - "component_version": "2.9.2-rc1", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": null, - "vuln_exp_status": null, - "vuln_exp_justification": null, - "vuln_exp_response": null, - "vuln_exp_details": null, - "vuln_exp_created": null, - "vuln_exp_updated": null, - "vuln_exp_created_by": null, - "vuln_exp_updated_by": null, - "vuln_exp_created_by_username": null, - "vuln_exp_updated_by_username": null - }, - { - "id": 52, - "cve": "CVE-2022-29824", - "cvss_version": "3.1", - "base_score": "6.5", - "severity": "MEDIUM", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "component_name": "libxml2", - "component_version": "2.9.2-rc1", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": null, - "vuln_exp_status": null, - "vuln_exp_justification": null, - "vuln_exp_response": null, - "vuln_exp_details": null, - "vuln_exp_created": null, - "vuln_exp_updated": null, - "vuln_exp_created_by": null, - "vuln_exp_updated_by": null, - "vuln_exp_created_by_username": null, - "vuln_exp_updated_by_username": null - }, - { - "id": 36, - "cve": "CVE-2016-9596", - "cvss_version": "3.1", - "base_score": "6.5", - "severity": "MEDIUM", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "component_name": "libxml2", - "component_version": "2.9.2-rc1", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": null, - "vuln_exp_status": null, - "vuln_exp_justification": null, - "vuln_exp_response": null, - "vuln_exp_details": null, - "vuln_exp_created": null, - "vuln_exp_updated": null, - "vuln_exp_created_by": null, - "vuln_exp_updated_by": null, - "vuln_exp_created_by_username": null, - "vuln_exp_updated_by_username": null - }, - { - "id": 55, - "cve": "CVE-2023-28484", - "cvss_version": "3.1", - "base_score": "6.5", - "severity": "MEDIUM", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "component_name": "libxml2", - "component_version": "2.9.2-rc1", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": null, - "vuln_exp_status": null, - "vuln_exp_justification": null, - "vuln_exp_response": null, - "vuln_exp_details": null, - "vuln_exp_created": null, - "vuln_exp_updated": null, - "vuln_exp_created_by": null, - "vuln_exp_updated_by": null, - "vuln_exp_created_by_username": null, - "vuln_exp_updated_by_username": null - }, - { - "id": 56, - "cve": "CVE-2023-29469", - "cvss_version": "3.1", - "base_score": "6.5", - "severity": "MEDIUM", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "component_name": "libxml2", - "component_version": "2.9.2-rc1", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": 32, - "vuln_exp_status": "not_affected", - "vuln_exp_justification": "protected_at_runtime", - "vuln_exp_response": "will_not_fix", - "vuln_exp_details": null, - "vuln_exp_created": "2025-07-03 13:50:08", - "vuln_exp_updated": "2025-07-03 15:50:16", - "vuln_exp_created_by": 3, - "vuln_exp_updated_by": 3, - "vuln_exp_created_by_username": "tomas.gonzalez@fossid.com", - "vuln_exp_updated_by_username": "tomas.gonzalez@fossid.com" - }, - { - "id": 57, - "cve": "CVE-2023-45322", - "cvss_version": "3.1", - "base_score": "6.5", - "severity": "MEDIUM", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "component_name": "libxml2", - "component_version": "2.9.2-rc1", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": 31, - "vuln_exp_status": "false_positive", - "vuln_exp_justification": "code_not_present", - "vuln_exp_response": "will_not_fix", - "vuln_exp_details": null, - "vuln_exp_created": "2025-07-03 13:49:53", - "vuln_exp_updated": "2025-07-03 15:50:05", - "vuln_exp_created_by": 3, - "vuln_exp_updated_by": 3, - "vuln_exp_created_by_username": "tomas.gonzalez@fossid.com", - "vuln_exp_updated_by_username": "tomas.gonzalez@fossid.com" - }, - { - "id": 28, - "cve": "CVE-2016-3709", - "cvss_version": "3.1", - "base_score": "6.1", - "severity": "MEDIUM", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "NONE", - "rejected": 0, - "component_id": 12, - "component_name": "libxml2", - "component_version": "2.9.2-rc1", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": 30, - "vuln_exp_status": "in_triage", - "vuln_exp_justification": null, - "vuln_exp_response": null, - "vuln_exp_details": null, - "vuln_exp_created": "2025-07-03 13:49:47", - "vuln_exp_updated": "2025-07-03 15:49:47", - "vuln_exp_created_by": 3, - "vuln_exp_updated_by": 3, - "vuln_exp_created_by_username": "tomas.gonzalez@fossid.com", - "vuln_exp_updated_by_username": "tomas.gonzalez@fossid.com" - }, - { - "id": 49, - "cve": "CVE-2021-3537", - "cvss_version": "3.1", - "base_score": "5.9", - "severity": "MEDIUM", - "attack_vector": "NETWORK", - "attack_complexity": "HIGH", - "availability_impact": "HIGH", - "rejected": 0, - "component_id": 12, - "component_name": "libxml2", - "component_version": "2.9.2-rc1", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": 29, - "vuln_exp_status": "resolved", - "vuln_exp_justification": "code_not_present", - "vuln_exp_response": "update,will_not_fix", - "vuln_exp_details": null, - "vuln_exp_created": "2025-07-03 13:49:22", - "vuln_exp_updated": "2025-07-03 15:49:44", - "vuln_exp_created_by": 3, - "vuln_exp_updated_by": 3, - "vuln_exp_created_by_username": "tomas.gonzalez@fossid.com", - "vuln_exp_updated_by_username": "tomas.gonzalez@fossid.com" - }, - { - "id": 1, - "cve": "CVE-2021-23413", - "cvss_version": "3.1", - "base_score": "5.3", - "severity": "MEDIUM", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "LOW", - "rejected": 0, - "component_id": 6, - "component_name": "jszip", - "component_version": "2.6.0", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": 28, - "vuln_exp_status": "in_triage", - "vuln_exp_justification": null, - "vuln_exp_response": null, - "vuln_exp_details": null, - "vuln_exp_created": "2025-07-03 13:49:13", - "vuln_exp_updated": "2025-07-03 15:49:13", - "vuln_exp_created_by": 3, - "vuln_exp_updated_by": 3, - "vuln_exp_created_by_username": "tomas.gonzalez@fossid.com", - "vuln_exp_updated_by_username": "tomas.gonzalez@fossid.com" - }, - { - "id": 5, - "cve": "CVE-2022-24773", - "cvss_version": "3.1", - "base_score": "5.3", - "severity": "MEDIUM", - "attack_vector": "NETWORK", - "attack_complexity": "LOW", - "availability_impact": "NONE", - "rejected": 0, - "component_id": 7, - "component_name": "node-forge", - "component_version": "1.0.0", - "scan_id": 772, - "scan_code": "ScanZIPwithShinobiAutoID_772", - "vuln_exp_id": null, - "vuln_exp_status": null, - "vuln_exp_justification": null, - "vuln_exp_response": null, - "vuln_exp_details": null, - "vuln_exp_created": null, - "vuln_exp_updated": null, - "vuln_exp_created_by": null, - "vuln_exp_updated_by": null, - "vuln_exp_created_by_username": null, - "vuln_exp_updated_by_username": null - } - ] -} \ No newline at end of file From d977e39ea06a7cd264b69193a056e48a8e8de40e Mon Sep 17 00:00:00 2001 From: Tomas Gonzalez Date: Sat, 5 Jul 2025 12:29:58 -0400 Subject: [PATCH 4/9] expand scope --- src/workbench_cli/cli.py | 55 + src/workbench_cli/handlers/__init__.py | 4 +- src/workbench_cli/handlers/export_sarif.py | 18 +- src/workbench_cli/handlers/export_vulns.py | 666 ++++++++++++ src/workbench_cli/main.py | 2 + .../utilities/sarif_generation.py | 225 ++-- .../utilities/vuln_report/__init__.py | 24 + .../{ => vuln_report}/component_enrichment.py | 77 +- .../vuln_report/cyclonedx_generator.py | 853 +++++++++++++++ .../utilities/vuln_report/risk_adjustments.py | 312 ++++++ .../utilities/vuln_report/sarif_generator.py | 987 ++++++++++++++++++ .../utilities/vuln_report/spdx_generator.py | 400 +++++++ .../vulnerability_enricher.py | 0 vuln-report-epss.json | 1 + vuln-report.json | 1 + 15 files changed, 3530 insertions(+), 95 deletions(-) create mode 100644 src/workbench_cli/handlers/export_vulns.py create mode 100644 src/workbench_cli/utilities/vuln_report/__init__.py rename src/workbench_cli/utilities/{ => vuln_report}/component_enrichment.py (79%) create mode 100644 src/workbench_cli/utilities/vuln_report/cyclonedx_generator.py create mode 100644 src/workbench_cli/utilities/vuln_report/risk_adjustments.py create mode 100644 src/workbench_cli/utilities/vuln_report/sarif_generator.py create mode 100644 src/workbench_cli/utilities/vuln_report/spdx_generator.py rename src/workbench_cli/utilities/{ => vuln_report}/vulnerability_enricher.py (100%) create mode 100644 vuln-report-epss.json create mode 100644 vuln-report.json diff --git a/src/workbench_cli/cli.py b/src/workbench_cli/cli.py index b33f4a5..dfaef4b 100644 --- a/src/workbench_cli/cli.py +++ b/src/workbench_cli/cli.py @@ -128,6 +128,20 @@ def parse_cmdline_args(): workbench-cli --api-url --api-user --api-token \\ export-sarif --project-name MYPROJ --scan-name MYSCAN01 -o vulns.sarif \\ --quiet + + # Export vulnerability results in CycloneDX format + workbench-cli --api-url --api-user --api-token \\ + export-vulns --project-name MYPROJ --scan-name MYSCAN01 --format cyclonedx -o vulns.cdx.json + + # Augment existing CycloneDX SBOM with vulnerability data + workbench-cli --api-url --api-user --api-token \\ + export-vulns --project-name MYPROJ --scan-name MYSCAN01 --format cyclonedx -o vulns-with-vulns.cdx.json \\ + --base-sbom existing-sbom.cdx.json --enrich-nvd --enrich-epss + + # Export vulnerability results in SPDX 3.0 format with enrichment + workbench-cli --api-url --api-user --api-token \\ + export-vulns --project-name MYPROJ --scan-name MYSCAN01 --format spdx3 -o vulns.spdx.json \\ + --enrich-nvd --enrich-epss """ ) @@ -344,6 +358,47 @@ def parse_cmdline_args(): add_common_monitoring_options(export_sarif_parser) + # --- 'export-vulns' Subcommand --- + export_vulns_parser = subparsers.add_parser( + 'export-vulns', + help='Export vulnerability results in multiple formats (SARIF, CycloneDX, SPDX 3.0).', + description='Export vulnerability results from an existing scan in various formats:\n' + '• SARIF (Static Analysis Results Interchange Format) v2.1.0 - compatible with GitHub Advanced Security\n' + '• CycloneDX - Software Bill of Materials with vulnerability information\n' + '• SPDX 3.0 - Security Profile for vulnerability reporting\n\n' + 'All formats share the same data enrichment pipeline and VEX assessment processing.', + formatter_class=RawTextHelpFormatter + ) + + # Required arguments + required_args = export_vulns_parser.add_argument_group("Required") + required_args.add_argument("--project-name", help="Project name containing the scan.", type=str, required=True, metavar="NAME") + required_args.add_argument("--scan-name", help="Scan name to export vulnerability results from.", type=str, required=True, metavar="NAME") + required_args.add_argument("--format", help="Output format for the vulnerability report.", choices=["sarif", "cyclonedx", "spdx3"], required=True, metavar="FORMAT") + required_args.add_argument("-o", "--output", help="Output file path for the vulnerability report.", type=str, required=True, metavar="PATH") + + # External API enrichment + external_api_args = export_vulns_parser.add_argument_group("External API Enrichment (Network Calls)") + external_api_args.add_argument("--enrich-nvd", help="Fetch CVE descriptions from NVD API (Default: False - opt-in).", action=argparse.BooleanOptionalAction, default=False) + external_api_args.add_argument("--enrich-epss", help="Fetch EPSS scores from FIRST API (Default: False - opt-in).", action=argparse.BooleanOptionalAction, default=False) + external_api_args.add_argument("--enrich-cisa-kev", help="Fetch CISA Known Exploited Vulnerabilities (Default: False - opt-in).", action=argparse.BooleanOptionalAction, default=False) + external_api_args.add_argument("--external-timeout", help="Timeout for external API calls in seconds (Default: 30).", type=int, default=30, metavar="SECONDS") + + # Output processing & suppression + processing_args = export_vulns_parser.add_argument_group("Output Processing & Suppression") + processing_args.add_argument("--severity-threshold", help="Filter vulnerabilities by CVSS severity.", choices=["critical", "high", "medium", "low"], metavar="LEVEL") + processing_args.add_argument("--disable-vex-suppression", help="Disable automatic suppression of VEX-assessed findings (mitigated, accepted risk, false positives).", action="store_true") + + # CycloneDX-specific options + cyclonedx_args = export_vulns_parser.add_argument_group("CycloneDX Format Options") + cyclonedx_args.add_argument("--base-sbom", help="Path to existing CycloneDX SBOM to augment with vulnerability data (CycloneDX format only).", type=str, metavar="PATH") + + # Output control + output_control_args = export_vulns_parser.add_argument_group("Output Control") + output_control_args.add_argument("--quiet", help="Suppress progress output.", action="store_true") + + add_common_monitoring_options(export_vulns_parser) + # --- Validate args after parsing --- args = parser.parse_args() diff --git a/src/workbench_cli/handlers/__init__.py b/src/workbench_cli/handlers/__init__.py index 80ccc89..c933515 100644 --- a/src/workbench_cli/handlers/__init__.py +++ b/src/workbench_cli/handlers/__init__.py @@ -14,6 +14,7 @@ from .evaluate_gates import handle_evaluate_gates from .download_reports import handle_download_reports from .export_sarif import handle_export_sarif +from .export_vulns import handle_export_vulns __all__ = [ 'handle_scan', @@ -23,5 +24,6 @@ 'handle_show_results', 'handle_evaluate_gates', 'handle_download_reports', - 'handle_export_sarif' + 'handle_export_sarif', + 'handle_export_vulns' ] diff --git a/src/workbench_cli/handlers/export_sarif.py b/src/workbench_cli/handlers/export_sarif.py index a7473da..e0631ea 100644 --- a/src/workbench_cli/handlers/export_sarif.py +++ b/src/workbench_cli/handlers/export_sarif.py @@ -5,7 +5,7 @@ from typing import TYPE_CHECKING, List, Dict, Any from ..utilities.error_handling import handler_error_wrapper -from ..utilities.sarif_generation import save_vulns_to_sarif +from ..utilities.vuln_report.sarif_generator import save_vulns_to_sarif from ..exceptions import ( ApiError, NetworkError, @@ -94,7 +94,7 @@ def handle_export_sarif(workbench: "WorkbenchAPI", params: argparse.Namespace) - print(f"\n📋 Retrieving Vulnerabilities and VEX...") # Combine vulnerability count and severity breakdown in one line - from ..utilities.sarif_generation import _calculate_severity_distribution, _format_severity_breakdown_compact + from ..utilities.vuln_report.sarif_generator import _calculate_severity_distribution, _format_severity_breakdown_compact severity_dist = _calculate_severity_distribution(vulnerabilities) severity_breakdown = _format_severity_breakdown_compact(severity_dist) print(f" • Retrieved {len(vulnerabilities)} Vulnerabilities{severity_threshold_text} {severity_breakdown}") @@ -102,7 +102,7 @@ def handle_export_sarif(workbench: "WorkbenchAPI", params: argparse.Namespace) - # Step 2: Pre-fetch component information print(f"\n🔧 Retrieving Component Information...") - from ..utilities.component_enrichment import prefetch_component_info + from ..utilities.vuln_report.component_enrichment import prefetch_component_info # Count unique components before fetching unique_components = list(set( @@ -132,8 +132,8 @@ def handle_export_sarif(workbench: "WorkbenchAPI", params: argparse.Namespace) - ) else: # Still need to fetch external data for SARIF generation, but quietly - from ..utilities.sarif_generation import _fetch_external_enrichment_data - from ..utilities.component_enrichment import prefetch_component_info + from ..utilities.vuln_report.sarif_generator import _fetch_external_enrichment_data + from ..utilities.vuln_report.component_enrichment import prefetch_component_info # Pre-fetch component information quietly (no progress messages) prefetch_component_info(vulnerabilities, quiet=True) @@ -188,7 +188,7 @@ def _perform_external_enrichment( ) -> Dict[str, Dict[str, Any]]: """Perform external enrichment and display status messages.""" import os - from ..utilities.sarif_generation import _fetch_external_enrichment_data + from ..utilities.vuln_report.sarif_generator import _fetch_external_enrichment_data # Show enrichment status enrichment_sources = [] @@ -203,7 +203,7 @@ def _perform_external_enrichment( print(f"\n🔍 External Enrichment: {', '.join(enrichment_sources)}") # Get unique CVEs for display - from ..utilities.sarif_generation import _extract_unique_cves + from ..utilities.vuln_report.sarif_generator import _extract_unique_cves unique_cves = _extract_unique_cves(vulnerabilities) # Show custom NVD message if NVD enrichment is enabled @@ -247,7 +247,7 @@ def _perform_external_enrichment( def _display_vex_summary(vulnerabilities: List[Dict[str, Any]], indent: str = "") -> None: """Display VEX assessment information in a concise format.""" - from ..utilities.sarif_generation import _count_vex_assessments + from ..utilities.vuln_report.sarif_generator import _count_vex_assessments vex_counts = _count_vex_assessments(vulnerabilities) if vex_counts["total_with_vex"] > 0: @@ -260,7 +260,7 @@ def _display_dynamic_scoring( external_data: Dict[str, Dict[str, Any]] ) -> None: """Display dynamic scoring information including both suppressions and promotions.""" - from ..utilities.sarif_generation import _count_high_risk_vulnerabilities, _count_vex_assessments + from ..utilities.vuln_report.sarif_generator import _count_high_risk_vulnerabilities, _count_vex_assessments print(f"\n🔧 Dynamic Scoring:") diff --git a/src/workbench_cli/handlers/export_vulns.py b/src/workbench_cli/handlers/export_vulns.py new file mode 100644 index 0000000..757972e --- /dev/null +++ b/src/workbench_cli/handlers/export_vulns.py @@ -0,0 +1,666 @@ +# workbench_cli/handlers/export_vulns.py + +import logging +import argparse +import tempfile +import os +from typing import TYPE_CHECKING, List, Dict, Any, Optional + +from ..utilities.error_handling import handler_error_wrapper +from ..utilities.vuln_report.sarif_generator import save_vulns_to_sarif +from ..utilities.vuln_report.cyclonedx_generator import save_vulns_to_cyclonedx, build_cyclonedx_from_components +from ..utilities.vuln_report.spdx_generator import save_vulns_to_spdx +from ..utilities.vuln_report.vulnerability_enricher import enrich_vulnerabilities +from ..utilities.vuln_report.component_enrichment import prefetch_component_info, cache_components_from_cyclonedx +from ..exceptions import ( + ApiError, + NetworkError, + ProcessTimeoutError, + ProcessError +) + +if TYPE_CHECKING: + from ..api import WorkbenchAPI + +logger = logging.getLogger("workbench-cli") + + +@handler_error_wrapper +def handle_export_vulns(workbench: "WorkbenchAPI", params: argparse.Namespace) -> bool: + """ + Handler for the 'export-vulns' command. Exports vulnerability results in various formats. + + Args: + workbench: The Workbench API client + params: Command line parameters + + Returns: + bool: True if the operation was successful + """ + + print(f"\n--- Running {params.command.upper()} Command ---") + + # Validate format + supported_formats = ['sarif', 'cyclonedx', 'spdx3'] + if params.format not in supported_formats: + raise ProcessError(f"Unsupported format '{params.format}'. Supported formats: {', '.join(supported_formats)}") + + # Check format-specific dependencies + _check_format_dependencies(params.format) + + # Resolve project and scan (find only) + if not params.quiet: + print(f"\nResolving scan for {params.format.upper()} export...") + project_code = workbench.resolve_project(params.project_name, create_if_missing=False) + scan_code, scan_id = workbench.resolve_scan( + scan_name=params.scan_name, + project_name=params.project_name, + create_if_missing=False, + params=params + ) + + # Ensure scan processes are idle before fetching results + if not params.quiet: + print("\nEnsuring scan processes are idle before fetching vulnerability data...") + try: + workbench.ensure_scan_is_idle(scan_code, params, ["SCAN", "DEPENDENCY_ANALYSIS"]) + except (ProcessTimeoutError, ProcessError, ApiError, NetworkError) as e: + logger.warning(f"Could not verify scan completion for '{scan_code}': {e}. Proceeding anyway.") + if not params.quiet: + print("\nWarning: Could not verify scan completion status. Results may be incomplete.") + + # Fetch and enrich vulnerability data (applies to all formats) + vulnerabilities, external_data = _fetch_and_enrich_vulnerabilities(workbench, scan_code, params) + + # Handle CycloneDX export first because it uses a slightly different generation flow + if params.format == 'cyclonedx': + if not params.quiet: + print(f"\n📤 Exporting {params.format.upper()} report...") + return _handle_cyclonedx_export( + workbench=workbench, + scan_code=scan_code, + vulnerabilities=vulnerabilities, + external_data=external_data, + params=params, + ) + + # Proceed with the original path for SARIF and SPDX3 + # Export to the requested format + if not params.quiet: + print(f"\n📤 Exporting {params.format.upper()} report...") + + try: + if params.format == 'sarif': + save_vulns_to_sarif( + filepath=params.output, + vulnerabilities=vulnerabilities, + scan_code=scan_code, + external_data=external_data, + nvd_enrichment=getattr(params, 'enrich_nvd', False), + epss_enrichment=getattr(params, 'enrich_epss', False), + cisa_kev_enrichment=getattr(params, 'enrich_cisa_kev', False), + api_timeout=getattr(params, 'external_timeout', 30), + enable_vex_suppression=not getattr(params, 'disable_vex_suppression', False), + quiet=getattr(params, 'quiet', False) + ) + elif params.format == 'spdx3': + save_vulns_to_spdx( + filepath=params.output, + vulnerabilities=vulnerabilities, + scan_code=scan_code, + external_data=external_data, + nvd_enrichment=getattr(params, 'enrich_nvd', False), + epss_enrichment=getattr(params, 'enrich_epss', False), + cisa_kev_enrichment=getattr(params, 'enrich_cisa_kev', False), + api_timeout=getattr(params, 'external_timeout', 30), + enable_vex_suppression=not getattr(params, 'disable_vex_suppression', False), + quiet=getattr(params, 'quiet', False) + ) + + if not params.quiet: + print(f"\n✅ {params.format.upper()} export completed successfully!") + print(f"📄 Report saved to: {params.output}") + + return True + + except Exception as e: + logger.error(f"Failed to export {params.format.upper()}: {e}") + if isinstance(e, (ApiError, NetworkError, ProcessTimeoutError, ProcessError)): + raise + else: + raise ProcessError(f"Failed to export vulnerability data to {params.format.upper()} format: {str(e)}") + + +def _check_format_dependencies(format_name: str) -> None: + """Check if required dependencies are available for the specified format.""" + if format_name == 'cyclonedx': + try: + import cyclonedx + except ImportError: + raise ProcessError( + "CycloneDX format requires the 'cyclonedx-python-lib' package. " + "This should be installed automatically with workbench-cli. " + "Try reinstalling: pip install --force-reinstall workbench-cli" + ) + elif format_name == 'spdx3': + try: + import spdx_tools + except ImportError: + raise ProcessError( + "SPDX 3.0 format requires the 'spdx-tools' package. " + "This should be installed automatically with workbench-cli. " + "Try reinstalling: pip install --force-reinstall workbench-cli" + ) + # SARIF format has no external dependencies + + +def _fetch_and_enrich_vulnerabilities( + workbench: "WorkbenchAPI", + scan_code: str, + params: argparse.Namespace +) -> tuple[List[Dict[str, Any]], Dict[str, Dict[str, Any]]]: + """ + Fetch vulnerability data from Workbench and enrich it with external data. + + Returns: + Tuple of (vulnerabilities, external_data) + """ + # Fetch vulnerability data + if not params.quiet: + print("\n🔍 Fetching data from Workbench...") + + vulnerabilities = workbench.list_vulnerabilities(scan_code) + + # Apply severity filtering if specified + severity_threshold_text = "" + if getattr(params, 'severity_threshold', None): + severity_order = {'critical': 4, 'high': 3, 'medium': 2, 'low': 1} + min_severity = severity_order.get(params.severity_threshold.lower(), 0) + original_count = len(vulnerabilities) + vulnerabilities = [ + vuln for vuln in vulnerabilities + if severity_order.get(vuln.get('severity', '').lower(), 0) >= min_severity + ] + severity_threshold_text = f" (Severity Threshold: {params.severity_threshold.upper()})" + + # Extract configuration values from parameters + nvd_enrichment = getattr(params, 'enrich_nvd', False) + epss_enrichment = getattr(params, 'enrich_epss', False) + cisa_kev_enrichment = getattr(params, 'enrich_cisa_kev', False) + api_timeout = getattr(params, 'external_timeout', 30) + enable_vex_suppression = not getattr(params, 'disable_vex_suppression', False) + quiet = getattr(params, 'quiet', False) + + if not vulnerabilities: + if not params.quiet: + print("⚠️ No vulnerabilities found in the scan.") + print("An empty report will be generated.") + external_data = {} + else: + if not params.quiet: + # Step 1: Show vulnerability and VEX retrieval + print(f"\n📋 Retrieving Vulnerabilities and VEX...") + + # Combine vulnerability count and severity breakdown in one line + from ..utilities.vuln_report.sarif_generator import _calculate_severity_distribution, _format_severity_breakdown_compact + severity_dist = _calculate_severity_distribution(vulnerabilities) + severity_breakdown = _format_severity_breakdown_compact(severity_dist) + print(f" • Retrieved {len(vulnerabilities)} Vulnerabilities{severity_threshold_text} {severity_breakdown}") + _display_vex_summary(vulnerabilities, indent=" ") + + # Step 2: Pre-fetch component information + print(f"\n🔧 Retrieving Component Information...") + + # ------------------------------------------------------------ + # CycloneDX: attempt to download SBOM early so we can populate + # the component-info cache before hitting the API. This avoids + # unnecessary network calls when the SBOM already has the data. + # ------------------------------------------------------------ + if params.format == "cyclonedx": + sbom_path = _attempt_download_cyclonedx_sbom(workbench, scan_code, params) + if sbom_path: + cache_components_from_cyclonedx(sbom_path, quiet=True) + # The helper stores the temp file path on *params* for + # later reuse by _handle_cyclonedx_export. + + # Count unique components before fetching + unique_components = list(set( + f"{vuln.get('component_name', 'Unknown')}@{vuln.get('component_version', 'Unknown')}" + for vuln in vulnerabilities + if vuln.get("component_name") and vuln.get("component_version") + )) + component_count = len(unique_components) + + prefetch_component_info(vulnerabilities, quiet=True) # Always quiet to suppress progress messages + print(f" • Component information retrieved for {component_count} Components") + + # Step 3: Perform external enrichment and display status + external_data = _perform_external_enrichment( + vulnerabilities, + nvd_enrichment, + epss_enrichment, + cisa_kev_enrichment, + api_timeout + ) + + # Step 4: Show Dynamic Scoring section + _display_dynamic_scoring( + vulnerabilities, + enable_vex_suppression, + external_data + ) + else: + # Still need to fetch external data for report generation, but quietly + from ..utilities.vuln_report.sarif_generator import _fetch_external_enrichment_data + + # Pre-fetch component information quietly (no progress messages) + prefetch_component_info(vulnerabilities, quiet=True) + + # Fetch external data if any enrichment is enabled + if nvd_enrichment or epss_enrichment or cisa_kev_enrichment: + from ..utilities.vuln_report.sarif_generator import _extract_unique_cves + unique_cves = _extract_unique_cves(vulnerabilities) + external_data = enrich_vulnerabilities( + unique_cves, + nvd_enrichment, + epss_enrichment, + cisa_kev_enrichment, + api_timeout + ) + else: + external_data = {} + + return vulnerabilities, external_data + + +# --------------------------------------------------------------------------- +# Helper: Download CycloneDX SBOM (best-effort) +# --------------------------------------------------------------------------- + + +def _attempt_download_cyclonedx_sbom( + workbench: "WorkbenchAPI", + scan_code: str, + params: argparse.Namespace, +) -> Optional[str]: + """Return path to a temporary CycloneDX SBOM or *None* on failure. + + If we already downloaded the SBOM earlier in this session the cached path + stored on *params* (``_cyclonedx_sbom_path``) is returned. + """ + + if getattr(params, "_cyclonedx_sbom_path", None): + return params._cyclonedx_sbom_path # type: ignore[attr-defined] + + try: + report_type = "cyclone_dx" + is_async = report_type in workbench.ASYNC_REPORT_TYPES + + if not params.quiet: + print(" 📦 Downloading CycloneDX SBOM from Workbench …") + + if is_async: + process_id = workbench.generate_scan_report( + scan_code, report_type=report_type, include_vex=True + ) + + workbench._wait_for_process( + process_description=f"CycloneDX report generation (Process ID: {process_id})", + check_function=workbench.check_scan_report_status, + check_args={"process_id": process_id, "scan_code": scan_code}, + status_accessor=lambda d: d.get("progress_state", "UNKNOWN"), + success_values={"FINISHED"}, + failure_values={"FAILED", "CANCELLED", "ERROR"}, + max_tries=getattr(params, "scan_number_of_tries", 60), + wait_interval=3, + progress_indicator=False, + ) + + response = workbench.download_scan_report(process_id) + else: + response = workbench.generate_scan_report( + scan_code, report_type=report_type, include_vex=True + ) + + import tempfile + + with tempfile.NamedTemporaryFile(mode="w", suffix=".json", delete=False, encoding="utf-8") as tmp: + if hasattr(response, "content") and response.content is not None: + tmp.write(response.content.decode("utf-8")) + else: + tmp.write(getattr(response, "text", str(response))) + + sbom_path = tmp.name + + params._cyclonedx_sbom_path = sbom_path # cache for later reuse + return sbom_path + + except Exception as exc: + logger.debug(f"CycloneDX SBOM download failed: {exc}") + return None + + +def _handle_cyclonedx_export( + workbench: "WorkbenchAPI", + scan_code: str, + vulnerabilities: List[Dict[str, Any]], + external_data: Dict[str, Dict[str, Any]], + params: argparse.Namespace + ) -> bool: + """ + Generate a CycloneDX 1.6 report enriched with vulnerability data. + + The strategy is: + 1. We already have the full vulnerability list (and any external enrichment). + 2. We *attempt* to fetch the scan-level CycloneDX SBOM from Workbench so we + can retain rich component metadata & dependency graph. If this fails + for any reason we simply fall back to building a fresh SBOM from the + vulnerability list alone. + """ + import os + import tempfile + + # Reuse SBOM if already downloaded during component enrichment + base_sbom_path: Optional[str] = getattr(params, "_cyclonedx_sbom_path", None) + + # If the early download failed (no cached path), we simply build a fresh + # SBOM directly from the vulnerabilities rather than trying a second + # download – this avoids redundant Workbench requests (slow when + # enrichment is enabled). + + # 2. Generate & save the enriched CycloneDX report -------------------------------------- + save_vulns_to_cyclonedx( + filepath=params.output, + vulnerabilities=vulnerabilities, + scan_code=scan_code, + external_data=external_data, + nvd_enrichment=getattr(params, "enrich_nvd", False), + epss_enrichment=getattr(params, "enrich_epss", False), + cisa_kev_enrichment=getattr(params, "enrich_cisa_kev", False), + enable_vex_suppression=not getattr(params, "disable_vex_suppression", False), + quiet=getattr(params, "quiet", False), + base_sbom_path=base_sbom_path, + ) + + if not params.quiet: + print("\n✅ CycloneDX export completed successfully!") + print(f"📄 Report saved to: {params.output}") + + # 3. Clean up temp file ----------------------------------------------------------------- + if base_sbom_path and os.path.exists(base_sbom_path): + try: + os.unlink(base_sbom_path) + except OSError: + pass # ignore cleanup errors + + return True + + +def _extract_vulnerabilities_from_cyclonedx_report(cyclonedx_path: str) -> List[Dict[str, Any]]: + """ + Extract vulnerability data from a CycloneDX report for external enrichment. + + Args: + cyclonedx_path: Path to the CycloneDX JSON file + + Returns: + List of vulnerability dictionaries compatible with enrichment functions + """ + import json + + vulnerabilities = [] + + try: + with open(cyclonedx_path, 'r', encoding='utf-8') as f: + cyclonedx_data = json.load(f) + + # Create component lookup by bom-ref + components_by_ref = {} + if 'components' in cyclonedx_data: + for component in cyclonedx_data['components']: + bom_ref = component.get('bom-ref') + if bom_ref: + components_by_ref[bom_ref] = component + + # Extract vulnerabilities + if 'vulnerabilities' in cyclonedx_data: + for vuln in cyclonedx_data['vulnerabilities']: + cve = vuln.get('id', 'UNKNOWN') + + # Find affected components + affected_components = [] + if 'affects' in vuln: + for affect in vuln['affects']: + ref = affect.get('ref') + if ref and ref in components_by_ref: + affected_components.append(components_by_ref[ref]) + + # Create vulnerability records for each affected component + for component in affected_components: + vuln_record = { + 'cve': cve, + 'component_name': component.get('name', 'Unknown'), + 'component_version': component.get('version', 'Unknown'), + 'id': f"{cve}-{component.get('name', 'Unknown')}-{component.get('version', 'Unknown')}", + } + + # Extract severity and score from ratings + if 'ratings' in vuln and vuln['ratings']: + # Use the first rating as base + first_rating = vuln['ratings'][0] + if 'severity' in first_rating: + vuln_record['severity'] = first_rating['severity'].lower() + if 'score' in first_rating: + vuln_record['base_score'] = str(first_rating['score']) + + # Extract VEX analysis state + if 'analysis' in vuln: + analysis = vuln['analysis'] + if 'state' in analysis: + vuln_record['vex_assessment'] = { + 'status': analysis['state'], + 'response': analysis.get('response', []), + 'justification': analysis.get('justification', ''), + 'detail': analysis.get('detail', ''), + } + + vulnerabilities.append(vuln_record) + + logger.debug(f"Extracted {len(vulnerabilities)} vulnerabilities from CycloneDX report") + return vulnerabilities + + except Exception as e: + logger.error(f"Failed to extract vulnerabilities from CycloneDX report: {e}") + return [] + + +def _perform_external_enrichment_for_cyclonedx( + vulnerabilities: List[Dict[str, Any]], + params: argparse.Namespace, + quiet: bool = False +) -> Dict[str, Dict[str, Any]]: + """ + Perform external enrichment for CycloneDX vulnerabilities. + + Args: + vulnerabilities: List of vulnerability dictionaries + params: Command line parameters + quiet: Whether to suppress output messages + + Returns: + Dictionary of external enrichment data keyed by CVE + """ + # Extract configuration values from parameters + nvd_enrichment = getattr(params, 'enrich_nvd', False) + epss_enrichment = getattr(params, 'enrich_epss', False) + cisa_kev_enrichment = getattr(params, 'enrich_cisa_kev', False) + api_timeout = getattr(params, 'external_timeout', 30) + + if not (nvd_enrichment or epss_enrichment or cisa_kev_enrichment): + if not quiet: + print(f"\n🔍 External Enrichment: DISABLED") + return {} + + # Show enrichment status + enrichment_sources = [] + if nvd_enrichment: + enrichment_sources.append("NVD") + if epss_enrichment: + enrichment_sources.append("EPSS") + if cisa_kev_enrichment: + enrichment_sources.append("CISA KEV") + + if not quiet: + print(f"\n🔍 External Enrichment: {', '.join(enrichment_sources)}") + + # Get unique CVEs for enrichment + unique_cves = list(set( + vuln.get('cve', 'UNKNOWN') + for vuln in vulnerabilities + if vuln.get('cve') and vuln.get('cve') != 'UNKNOWN' + )) + + if not unique_cves: + if not quiet: + print(" • No CVEs found for enrichment") + return {} + + # Show custom NVD message if NVD enrichment is enabled + if nvd_enrichment and unique_cves: + if not quiet: + print(f" 📋 Fetching additional details for {len(unique_cves)} CVEs from NVD") + if not os.environ.get('NVD_API_KEY'): + print(f" 💡 For faster performance, set the 'NVD_API_KEY' environment variable") + + # Perform the actual enrichment with suppressed logging + # Temporarily increase logging level to suppress INFO messages + nvd_logger = logging.getLogger('workbench_cli.utilities.vuln_report.vulnerability_enricher') + original_level = nvd_logger.level + nvd_logger.setLevel(logging.WARNING) + + try: + external_data = enrich_vulnerabilities( + unique_cves, + nvd_enrichment, + epss_enrichment, + cisa_kev_enrichment, + api_timeout + ) + finally: + nvd_logger.setLevel(original_level) + + # Show EPSS results if EPSS enrichment was enabled + if epss_enrichment and external_data and not quiet: + epss_count = sum(1 for cve_data in external_data.values() if cve_data.get('epss_score') is not None) + if epss_count > 0: + print(f" 📊 EPSS scores retrieved for {epss_count} CVEs") + + return external_data + + +def _perform_external_enrichment( + vulnerabilities: List[Dict[str, Any]], + nvd_enrichment: bool, + epss_enrichment: bool, + cisa_kev_enrichment: bool, + api_timeout: int +) -> Dict[str, Dict[str, Any]]: + """Perform external enrichment and display status messages.""" + import os + + # Show enrichment status + enrichment_sources = [] + if nvd_enrichment: + enrichment_sources.append("NVD") + if epss_enrichment: + enrichment_sources.append("EPSS") + if cisa_kev_enrichment: + enrichment_sources.append("CISA KEV") + + if enrichment_sources: + print(f"\n🔍 External Enrichment: {', '.join(enrichment_sources)}") + + # Get unique CVEs for display + from ..utilities.vuln_report.sarif_generator import _extract_unique_cves + unique_cves = _extract_unique_cves(vulnerabilities) + + # Show custom NVD message if NVD enrichment is enabled + if nvd_enrichment and unique_cves: + print(f" 📋 Fetching additional details for {len(unique_cves)} CVEs from NVD") + if not os.environ.get('NVD_API_KEY'): + print(f" 💡 For faster performance, set the 'NVD_API_KEY' environment variable") + + # Perform the actual enrichment with suppressed logging + # Temporarily increase logging level to suppress INFO messages + import logging + nvd_logger = logging.getLogger('workbench_cli.utilities.vuln_report.vulnerability_enricher') + original_level = nvd_logger.level + nvd_logger.setLevel(logging.WARNING) + + try: + external_data = enrich_vulnerabilities( + unique_cves, + nvd_enrichment, + epss_enrichment, + cisa_kev_enrichment, + api_timeout + ) + finally: + nvd_logger.setLevel(original_level) + + # Show EPSS results if EPSS enrichment was enabled + if epss_enrichment and external_data: + epss_count = sum(1 for cve_data in external_data.values() if cve_data.get('epss_score') is not None) + if epss_count > 0: + print(f" 📊 EPSS scores retrieved for {epss_count} CVEs") + + return external_data + else: + print(f"\n🔍 External Enrichment: DISABLED") + return {} + + +def _display_vex_summary(vulnerabilities: List[Dict[str, Any]], indent: str = "") -> None: + """Display VEX assessment information in a concise format.""" + from ..utilities.vuln_report.sarif_generator import _count_vex_assessments + vex_counts = _count_vex_assessments(vulnerabilities) + + if vex_counts["total_with_vex"] > 0: + print(f"{indent}• Retrieved VEX for {vex_counts['total_with_vex']}/{len(vulnerabilities)} CVEs [Status: {vex_counts['with_status']}, Response: {vex_counts['with_response']}]") + + +def _display_dynamic_scoring( + vulnerabilities: List[Dict[str, Any]], + enable_vex_suppression: bool, + external_data: Dict[str, Dict[str, Any]] +) -> None: + """Display dynamic scoring information including both suppressions and promotions.""" + from ..utilities.vuln_report.sarif_generator import _count_high_risk_vulnerabilities, _count_vex_assessments + + print(f"\n🔧 Dynamic Scoring:") + + # Show VEX suppression + vex_counts = _count_vex_assessments(vulnerabilities) + if enable_vex_suppression and vex_counts["total_with_vex"] > 0: + if vex_counts["suppressed"] > 0: + print(f" • VEX Risk: {vex_counts['suppressed']} CVEs Suppressed") + else: + print(f" • VEX Suppression: Enabled (no CVEs Suppressed)") + else: + print(f" • VEX Suppression: {'Enabled' if enable_vex_suppression else 'Disabled'}") + + # Show high-risk vulnerability information with promotion details + if external_data: + high_risk_counts = _count_high_risk_vulnerabilities(vulnerabilities, external_data) + + # Show EPSS promotions + if high_risk_counts.get("high_epss", 0) > 0: + print(f" • EPSS Risk: {high_risk_counts['high_epss']} CVEs Escalated") + + # Show CISA KEV if present + if high_risk_counts.get("cisa_kev", 0) > 0: + print(f" • CISA KEV: {high_risk_counts['cisa_kev']} CVEs Escalated") + + # Show VEX-based promotions (exploitable CVEs get promoted to 'error' level) + if vex_counts["total_with_vex"] > 0 and vex_counts["exploitable"] > 0: + print(f" • VEX Risk: {vex_counts['exploitable']} CVEs Escalated") \ No newline at end of file diff --git a/src/workbench_cli/main.py b/src/workbench_cli/main.py index 0c4413f..8525954 100644 --- a/src/workbench_cli/main.py +++ b/src/workbench_cli/main.py @@ -32,6 +32,7 @@ handle_download_reports, handle_scan_git, handle_export_sarif, + handle_export_vulns, ) @@ -91,6 +92,7 @@ def main() -> int: "download-reports": handle_download_reports, "scan-git": handle_scan_git, "export-sarif": handle_export_sarif, + "export-vulns": handle_export_vulns, } handler = COMMAND_HANDLERS.get(params.command) diff --git a/src/workbench_cli/utilities/sarif_generation.py b/src/workbench_cli/utilities/sarif_generation.py index 9a6e6be..0ac1464 100644 --- a/src/workbench_cli/utilities/sarif_generation.py +++ b/src/workbench_cli/utilities/sarif_generation.py @@ -27,6 +27,51 @@ logger = logging.getLogger(__name__) +@dataclass +class SarifConfig: + """Configuration for SARIF generation""" + nvd_enrichment: bool = False + epss_enrichment: bool = False + cisa_kev_enrichment: bool = False + api_timeout: int = 30 + enable_vex_suppression: bool = True + quiet: bool = False + + +@dataclass +class VulnerabilityInfo: + """Processed vulnerability information""" + cve: str + component_name: str + component_version: str + severity: str + base_score: str + rule_id: str + vex_info: Optional[Dict[str, Any]] = None + + @classmethod + def from_vuln_dict(cls, vuln: Dict[str, Any]) -> 'VulnerabilityInfo': + """Create VulnerabilityInfo from vulnerability dictionary""" + cve = vuln.get("cve", "UNKNOWN") + component_name = vuln.get("component_name", "Unknown") + component_version = vuln.get("component_version", "Unknown") + severity = vuln.get("severity", "UNKNOWN") + base_score = vuln.get("base_score", "N/A") + + # Create unique rule ID combining CVE, component, and version + rule_id = f"{cve}:{component_name}@{component_version}" if cve != "UNKNOWN" else f"UNKNOWN:{component_name}@{component_version}" + + return cls( + cve=cve, + component_name=component_name, + component_version=component_version, + severity=severity, + base_score=base_score, + rule_id=rule_id, + vex_info=get_vex_info(vuln) + ) + + # Configuration removed - CLI arguments now drive behavior directly @@ -91,13 +136,7 @@ def convert_vulns_to_sarif( vulnerabilities: List[Dict[str, Any]], scan_code: str, external_data: Optional[Dict[str, Dict[str, Any]]] = None, - *, - nvd_enrichment: bool = False, - epss_enrichment: bool = False, - cisa_kev_enrichment: bool = False, - api_timeout: int = 30, - enable_vex_suppression: bool = True, - quiet: bool = False, + config: Optional[SarifConfig] = None, ) -> Dict[str, Any]: """ Convert vulnerability data to SARIF v2.1.0 format with sensible defaults. @@ -109,12 +148,7 @@ def convert_vulns_to_sarif( vulnerabilities: List of vulnerability dictionaries from the Workbench API scan_code: The scan code for reference external_data: Pre-fetched external enrichment data (optional) - include_cve_descriptions: Fetch CVE descriptions from NVD (default: False) - include_epss_scores: Fetch EPSS scores from FIRST (default: False) - include_exploit_info: Fetch exploit info from CISA KEV (default: False) - api_timeout: Timeout for external API calls in seconds (default: 30) - enable_vex_suppression: Apply VEX-based suppression (default: True) - quiet: Suppress progress messages (default: False) + config: SARIF generation configuration (optional, uses defaults if None) Returns: Dict containing SARIF-formatted data compatible with GitHub Advanced Security, @@ -125,49 +159,33 @@ def convert_vulns_to_sarif( sarif_data = convert_vulns_to_sarif(vulnerabilities, scan_code) # Full enrichment with external API calls - sarif_data = convert_vulns_to_sarif( - vulnerabilities, scan_code, - nvd_enrichment=True, - epss_enrichment=True, - cisa_kev_enrichment=True - ) + config = SarifConfig(nvd_enrichment=True, epss_enrichment=True, cisa_kev_enrichment=True) + sarif_data = convert_vulns_to_sarif(vulnerabilities, scan_code, config=config) # With pre-fetched external data (avoids duplicate enrichment) - external_data = _fetch_external_enrichment_data(vulnerabilities, True, True, True, 30) - sarif_data = convert_vulns_to_sarif(vulnerabilities, scan_code, external_data) + external_data = _fetch_external_enrichment_data(vulnerabilities, config) + sarif_data = convert_vulns_to_sarif(vulnerabilities, scan_code, external_data, config) """ if not vulnerabilities: return _create_empty_sarif_report(scan_code) + # Use default config if none provided + if config is None: + config = SarifConfig() + # Use pre-fetched external data if provided, otherwise fetch it if external_data is None: - external_data = _fetch_external_enrichment_data( - vulnerabilities, - nvd_enrichment, - epss_enrichment, - cisa_kev_enrichment, - api_timeout - ) + external_data = _fetch_external_enrichment_data(vulnerabilities, config) # Build SARIF structure - sarif_data = _build_sarif_structure( - vulnerabilities, scan_code, external_data, - nvd_enrichment=nvd_enrichment, - epss_enrichment=epss_enrichment, - cisa_kev_enrichment=cisa_kev_enrichment, - enable_vex_suppression=enable_vex_suppression, - quiet=quiet - ) + sarif_data = _build_sarif_structure(vulnerabilities, scan_code, external_data, config) return sarif_data def _fetch_external_enrichment_data( vulnerabilities: List[Dict[str, Any]], - nvd_enrichment: bool, - epss_enrichment: bool, - cisa_kev_enrichment: bool, - api_timeout: int + config: SarifConfig ) -> Dict[str, Dict[str, Any]]: """Fetch external enrichment data for vulnerabilities.""" unique_cves = _extract_unique_cves(vulnerabilities) @@ -177,10 +195,10 @@ def _fetch_external_enrichment_data( try: external_data = enrich_vulnerabilities( unique_cves, - nvd_enrichment, - epss_enrichment, - cisa_kev_enrichment, - api_timeout + config.nvd_enrichment, + config.epss_enrichment, + config.cisa_kev_enrichment, + config.api_timeout ) except Exception as e: logger.warning(f"Failed to fetch external vulnerability data: {e}") @@ -192,11 +210,7 @@ def _build_sarif_structure( vulnerabilities: List[Dict[str, Any]], scan_code: str, external_data: Dict[str, Dict[str, Any]], - nvd_enrichment: bool, - epss_enrichment: bool, - cisa_kev_enrichment: bool, - enable_vex_suppression: bool, - quiet: bool + config: SarifConfig ) -> Dict[str, Any]: """Build the main SARIF structure with notifications and metadata.""" # Count VEX statements for reporting @@ -302,13 +316,7 @@ def save_vulns_to_sarif( vulnerabilities: List[Dict[str, Any]], scan_code: str, external_data: Optional[Dict[str, Dict[str, Any]]] = None, - *, - nvd_enrichment: bool = False, - epss_enrichment: bool = False, - cisa_kev_enrichment: bool = False, - api_timeout: int = 30, - enable_vex_suppression: bool = True, - quiet: bool = False, + config: Optional[SarifConfig] = None, ) -> None: """ Save vulnerability results in SARIF format with sensible defaults. @@ -321,28 +329,19 @@ def save_vulns_to_sarif( vulnerabilities: List of vulnerability dictionaries from the API scan_code: The scan code for reference external_data: Pre-fetched external enrichment data (optional) - nvd_enrichment: Fetch CVE descriptions from NVD (default: False) - epss_enrichment: Fetch EPSS scores from FIRST (default: False) - cisa_kev_enrichment: Fetch exploit info from CISA KEV (default: False) - api_timeout: Timeout for external API calls in seconds (default: 30) - enable_vex_suppression: Apply VEX-based suppression (default: True) - quiet: Suppress progress messages (default: False) + config: SARIF generation configuration (optional, uses defaults if None) Examples: # Simple usage with defaults (VEX assessments enabled, no external enrichment) save_vulns_to_sarif("vulns.sarif", vulnerabilities, scan_code) # Full enrichment with external API calls - save_vulns_to_sarif( - "vulns.sarif", vulnerabilities, scan_code, - nvd_enrichment=True, - epss_enrichment=True, - cisa_kev_enrichment=True - ) + config = SarifConfig(nvd_enrichment=True, epss_enrichment=True, cisa_kev_enrichment=True) + save_vulns_to_sarif("vulns.sarif", vulnerabilities, scan_code, config=config) # With pre-fetched external data (avoids duplicate enrichment) - external_data = _fetch_external_enrichment_data(vulnerabilities, True, True, True, 30) - save_vulns_to_sarif("vulns.sarif", vulnerabilities, scan_code, external_data) + external_data = _fetch_external_enrichment_data(vulnerabilities, config) + save_vulns_to_sarif("vulns.sarif", vulnerabilities, scan_code, external_data, config) Raises: IOError: If the file cannot be written @@ -350,31 +349,27 @@ def save_vulns_to_sarif( """ output_dir = os.path.dirname(filepath) or "." + # Use default config if none provided + if config is None: + config = SarifConfig() + try: os.makedirs(output_dir, exist_ok=True) # Calculate how many findings would be suppressed by VEX original_count = len(vulnerabilities) suppressed_count = 0 - if enable_vex_suppression: + if config.enable_vex_suppression: suppressed_count = original_count - len(apply_vex_suppression(vulnerabilities)) - sarif_data = convert_vulns_to_sarif( - vulnerabilities, scan_code, external_data, - nvd_enrichment=nvd_enrichment, - epss_enrichment=epss_enrichment, - cisa_kev_enrichment=cisa_kev_enrichment, - api_timeout=api_timeout, - enable_vex_suppression=enable_vex_suppression, - quiet=quiet - ) + sarif_data = convert_vulns_to_sarif(vulnerabilities, scan_code, external_data, config) with open(filepath, 'w', encoding='utf-8') as f: json.dump(sarif_data, f, indent=2, ensure_ascii=False) # Only print messages if not quiet and external_data wasn't pre-provided # (indicating the handler is managing output) - if not quiet and external_data is None: + if not config.quiet and external_data is None: print(f"Saved enhanced SARIF results to: {filepath}") # Print summary of external data sources used @@ -383,11 +378,49 @@ def save_vulns_to_sarif( print(f"External data sources used: {', '.join(props['external_data_sources'])}") except (IOError, OSError) as e: - if not quiet: + if not config.quiet: print(f"\nWarning: Failed to save SARIF results to {filepath}: {e}") raise +# --------------------------------------------------------------------------- +# Helper Functions +# --------------------------------------------------------------------------- + +def _build_external_data_properties(ext_data: Dict[str, Any]) -> Dict[str, Any]: + """Build external data properties for SARIF output""" + properties = {} + + # EPSS properties + if ext_data.get("epss_score") is not None: + properties["epss_score"] = ext_data["epss_score"] + properties["epss_percentile"] = ext_data["epss_percentile"] + + # CISA KEV properties + if ext_data.get("cisa_kev"): + properties["cisa_known_exploited"] = True + + # NVD properties + if ext_data.get("nvd_cwe"): + properties["cwe_ids"] = ext_data["nvd_cwe"] + + if ext_data.get("nvd_description"): + properties["nvd_description"] = ext_data["nvd_description"] + + if ext_data.get("full_cvss_vector"): + properties["full_cvss_vector"] = ext_data["full_cvss_vector"] + + # NVD references + if ext_data.get("nvd_references"): + properties["nvd_reference_count"] = len(ext_data["nvd_references"]) + properties["nvd_vendor_advisories"] = len([ + ref for ref in ext_data["nvd_references"] + if "vendor advisory" in [tag.lower() for tag in ref.get("tags", [])] + ]) + + return properties + + # --------------------------------------------------------------------------- # VEX Helper Functions # --------------------------------------------------------------------------- @@ -724,6 +757,34 @@ def _extract_version_ranges(references: List[Dict[str, Any]]) -> str: return "" +def _build_rule_description(vuln_info: VulnerabilityInfo, ext_data: Dict[str, Any]) -> Dict[str, str]: + """Build short and full descriptions for SARIF rule.""" + # Create enhanced descriptions using NVD data + short_desc = f"{vuln_info.cve} in {vuln_info.component_name}@{vuln_info.component_version} (CVSS {vuln_info.base_score})" + if ext_data.get("nvd_cwe"): + cwe_list = ext_data["nvd_cwe"][:2] # Show first 2 CWEs to keep it concise + cwe_text = ", ".join(cwe_list) + short_desc += f" - {cwe_text}" + + # Use NVD description if available, otherwise fall back to generic description + nvd_desc = ext_data.get("nvd_description") + if nvd_desc and nvd_desc.strip() and nvd_desc != "No description available": + full_desc = nvd_desc + else: + full_desc = f"Security vulnerability {vuln_info.cve} affecting {vuln_info.component_name} with CVSS score {vuln_info.base_score}" + + # Add component context to NVD description + if ext_data.get("nvd_description") and ext_data["nvd_description"] != "No description available": + full_desc += f"\n\nAffected Component: {vuln_info.component_name} version {vuln_info.component_version}" + + # Add affected version ranges if we can extract them from references + version_info = _extract_version_ranges(ext_data.get("nvd_references", [])) + if version_info: + full_desc += f"\nKnown Affected Versions: {version_info}" + + return {"short": short_desc, "full": full_desc} + + def _generate_enhanced_rules(vulnerabilities: List[Dict[str, Any]], external_data: Dict[str, Dict[str, Any]]) -> List[Dict[str, Any]]: """Generate enhanced SARIF rules from vulnerability data with external enrichment and VEX information.""" diff --git a/src/workbench_cli/utilities/vuln_report/__init__.py b/src/workbench_cli/utilities/vuln_report/__init__.py new file mode 100644 index 0000000..7425ae2 --- /dev/null +++ b/src/workbench_cli/utilities/vuln_report/__init__.py @@ -0,0 +1,24 @@ +""" +Vulnerability report generation utilities. + +This package contains utilities for generating vulnerability reports in various formats: +- SARIF (Static Analysis Results Interchange Format) +- CycloneDX (Software Bill of Materials with vulnerability information) +- SPDX 3.0 (Security Profile) + +All formats share the same data enrichment pipeline but use different output serializers. +""" + +__all__ = [ + # Core enrichment utilities + "component_enrichment", + "vulnerability_enricher", + + # Dynamic risk adjustments + "risk_adjustments", + + # Format generators + "sarif_generator", + "cyclonedx_generator", + "spdx_generator", +] \ No newline at end of file diff --git a/src/workbench_cli/utilities/component_enrichment.py b/src/workbench_cli/utilities/vuln_report/component_enrichment.py similarity index 79% rename from src/workbench_cli/utilities/component_enrichment.py rename to src/workbench_cli/utilities/vuln_report/component_enrichment.py index 268860f..bb699ef 100644 --- a/src/workbench_cli/utilities/component_enrichment.py +++ b/src/workbench_cli/utilities/vuln_report/component_enrichment.py @@ -14,8 +14,8 @@ from typing import Dict, Any, Optional, Tuple, List from concurrent.futures import ThreadPoolExecutor, as_completed -from ..api.components_api import ComponentsAPI -from ..exceptions import ApiError, NetworkError +from ...api.components_api import ComponentsAPI +from ...exceptions import ApiError, NetworkError logger = logging.getLogger(__name__) @@ -225,4 +225,75 @@ def _detect_package_ecosystem( "_get_component_info", "_detect_package_ecosystem", "prefetch_component_info", # New function for pre-fetching -] \ No newline at end of file + "cache_components_from_cyclonedx", # Populate cache from SBOM +] + + +# --------------------------------------------------------------------------- +# CycloneDX SBOM helper +# --------------------------------------------------------------------------- + +def cache_components_from_cyclonedx(sbom_path: str, quiet: bool = False) -> int: + """Parse *sbom_path* and cache component records. + + The function iterates through each *component* entry in the JSON SBOM and + populates the ``_COMPONENT_INFO_CACHE`` so that later calls to + :pyfunc:`prefetch_component_info` / :pyfunc:`_get_component_info` do not + need to hit the Workbench API. + + It is *best effort* – if the file cannot be parsed the cache remains + unchanged and the function returns 0. + + Parameters + ---------- + sbom_path: + Path to a CycloneDX JSON file. + quiet: + Suppress informational output when *True*. + + Returns + ------- + int + Number of component entries added to the cache. + """ + import json + + added = 0 + + if not os.path.isfile(sbom_path): + return 0 + + try: + with open(sbom_path, "r", encoding="utf-8") as fh: + data = json.load(fh) + except Exception as exc: + logger.debug(f"Failed to parse CycloneDX SBOM at {sbom_path}: {exc}") + return 0 + + for comp in data.get("components", []): + name = comp.get("name") + version = comp.get("version") + if not name or not version: + continue + + key = (name, version) + if key in _COMPONENT_INFO_CACHE: + continue # already cached + + # Only store a subset of fields that the rest of the codebase relies on + cache_entry: Dict[str, Any] = { + "purl": comp.get("purl"), + # Older SBOMs might store purl_type/namespace/name/version separately + "purl_type": comp.get("purl_type"), + "purl_namespace": comp.get("purl_namespace"), + "purl_name": comp.get("purl_name"), + "purl_version": comp.get("purl_version"), + } + + _COMPONENT_INFO_CACHE[key] = cache_entry + added += 1 + + if added and not quiet: + print(f" ✅ Loaded component metadata for {added} components from CycloneDX SBOM") + + return added \ No newline at end of file diff --git a/src/workbench_cli/utilities/vuln_report/cyclonedx_generator.py b/src/workbench_cli/utilities/vuln_report/cyclonedx_generator.py new file mode 100644 index 0000000..b8f7589 --- /dev/null +++ b/src/workbench_cli/utilities/vuln_report/cyclonedx_generator.py @@ -0,0 +1,853 @@ +""" +CycloneDX vulnerability report generation. + +This module provides functionality to convert vulnerability data from the Workbench API +into CycloneDX format, which is a software bill of materials (SBOM) format that includes +vulnerability information. + +The module supports two approaches: +1. Building a new SBOM from vulnerability data (current approach) +2. Augmenting an existing CycloneDX SBOM with vulnerability data (NEW) +""" + +import json +import logging +import os +from typing import Dict, List, Any, Optional +from datetime import datetime + +logger = logging.getLogger(__name__) + +# CycloneDX imports (optional dependency) +try: + from cyclonedx.model.component import Component, ComponentType + from cyclonedx.model.vulnerability import ( + Vulnerability, + VulnerabilityRating, + VulnerabilityReference, + BomTarget, + VulnerabilitySource, + VulnerabilityScoreSource, + VulnerabilitySeverity, + ) + from cyclonedx.model.bom import Bom + from cyclonedx.output.json import JsonV1Dot6 + from cyclonedx.model import ExternalReference, ExternalReferenceType, Property + from packageurl import PackageURL + CYCLONEDX_AVAILABLE = True +except ImportError: + # Fallback types when CycloneDX is not available + Bom = Any + Component = Any + Vulnerability = Any + VulnerabilityRating = Any + VulnerabilityReference = Any + VulnerabilitySource = Any + VulnerabilityScoreSource = Any + ComponentType = Any + JsonV1Dot6 = Any + ExternalReference = Any + ExternalReferenceType = Any + PackageURL = Any + BomTarget = Any + Property = Any + CYCLONEDX_AVAILABLE = False + +from .component_enrichment import _detect_package_ecosystem +from .risk_adjustments import calculate_dynamic_risk, risk_level_to_cyclonedx_severity + + +def save_vulns_to_cyclonedx( + filepath: str, + vulnerabilities: List[Dict[str, Any]], + scan_code: str, + external_data: Optional[Dict[str, Dict[str, Any]]] = None, + nvd_enrichment: bool = False, + epss_enrichment: bool = False, + cisa_kev_enrichment: bool = False, + api_timeout: int = 30, + enable_vex_suppression: bool = True, + quiet: bool = False, + base_sbom_path: Optional[str] = None +) -> None: + """ + Save vulnerability results in CycloneDX format. + + Args: + filepath: Path where the CycloneDX file should be saved + vulnerabilities: List of vulnerability dictionaries from the API + scan_code: The scan code for reference + external_data: Pre-fetched external enrichment data (optional) + nvd_enrichment: Whether NVD enrichment was enabled + epss_enrichment: Whether EPSS enrichment was enabled + cisa_kev_enrichment: Whether CISA KEV enrichment was enabled + api_timeout: API timeout used for enrichment + enable_vex_suppression: Whether VEX suppression is enabled + quiet: Whether to suppress output messages + base_sbom_path: Path to existing CycloneDX SBOM to augment (optional) + + Raises: + ImportError: If cyclonedx-python-lib is not installed + IOError: If the file cannot be written + OSError: If the directory cannot be created + FileNotFoundError: If base_sbom_path is provided but file doesn't exist + """ + if not CYCLONEDX_AVAILABLE: + raise ImportError( + "CycloneDX support requires the 'cyclonedx-python-lib' package. " + "This should be installed automatically with workbench-cli. " + "Try reinstalling: pip install --force-reinstall workbench-cli" + ) + + output_dir = os.path.dirname(filepath) or "." + + try: + os.makedirs(output_dir, exist_ok=True) + + if base_sbom_path and os.path.exists(base_sbom_path): + # NEW: Augment existing SBOM approach + cyclonedx_data = build_cyclonedx_from_components( + base_sbom_path, + vulnerabilities, + scan_code, + external_data, + nvd_enrichment, + epss_enrichment, + cisa_kev_enrichment, + enable_vex_suppression + ) + if not quiet: + print(f"Augmented existing SBOM from: {base_sbom_path}") + else: + # Original: Build new SBOM approach + cyclonedx_data = convert_vulns_to_cyclonedx( + vulnerabilities, + scan_code, + external_data, + nvd_enrichment, + epss_enrichment, + cisa_kev_enrichment, + enable_vex_suppression + ) + if base_sbom_path and not quiet: + print(f"Warning: Base SBOM not found at {base_sbom_path}, creating new SBOM") + + # Use CycloneDX JSON serializer + json_serializer = JsonV1Dot6(cyclonedx_data) + + with open(filepath, 'w', encoding='utf-8') as f: + f.write(json_serializer.output_as_string()) + + if not quiet: + print(f"Saved CycloneDX SBOM to: {filepath}") + + except (IOError, OSError) as e: + if not quiet: + print(f"\nWarning: Failed to save CycloneDX results to {filepath}: {e}") + raise + + +def convert_vulns_to_cyclonedx( + vulnerabilities: List[Dict[str, Any]], + scan_code: str, + external_data: Optional[Dict[str, Dict[str, Any]]] = None, + nvd_enrichment: bool = False, + epss_enrichment: bool = False, + cisa_kev_enrichment: bool = False, + enable_vex_suppression: bool = True +) -> Bom: + """ + Convert vulnerability data to CycloneDX BOM format. + + Args: + vulnerabilities: List of vulnerability dictionaries from the Workbench API + scan_code: The scan code for reference + external_data: Pre-fetched external enrichment data (optional) + nvd_enrichment: Whether NVD enrichment was enabled + epss_enrichment: Whether EPSS enrichment was enabled + cisa_kev_enrichment: Whether CISA KEV enrichment was enabled + enable_vex_suppression: Whether VEX suppression is enabled + + Returns: + CycloneDX BOM object containing vulnerability information + """ + if not CYCLONEDX_AVAILABLE: + raise ImportError("CycloneDX support requires the 'cyclonedx-python-lib' package which should be installed automatically") + + if external_data is None: + external_data = {} + + # Create BOM + bom = Bom() + bom.metadata.timestamp = datetime.utcnow() + + # Create components and vulnerabilities + components = {} + vulnerabilities_list = [] + + for vuln in vulnerabilities: + component_name = vuln.get("component_name", "Unknown") + component_version = vuln.get("component_version", "Unknown") + cve = vuln.get("cve", "UNKNOWN") + + # Create component if not exists + component_key = f"{component_name}@{component_version}" + if component_key not in components: + ecosystem = _detect_package_ecosystem(component_name, component_version) + + try: + purl = PackageURL( + type=ecosystem, + name=component_name, + version=component_version + ) + component = Component( + name=component_name, + version=component_version, + type=ComponentType.LIBRARY, + purl=purl + ) + except Exception: + # Fallback if PackageURL creation fails + component = Component( + name=component_name, + version=component_version, + type=ComponentType.LIBRARY + ) + + components[component_key] = component + bom.components.add(component) + + # Create vulnerability + vulnerability = _create_cyclonedx_vulnerability(vuln, external_data.get(cve, {})) + vulnerabilities_list.append(vulnerability) + + # Add vulnerability to BOM + bom.vulnerabilities.add(vulnerability) + + return bom + + +# NEW builder function that creates a fresh BOM using components & dependencies from an existing SBOM + +def build_cyclonedx_from_components( + base_sbom_path: str, + vulnerabilities: List[Dict[str, Any]], + scan_code: str, + external_data: Optional[Dict[str, Dict[str, Any]]] = None, + nvd_enrichment: bool = False, + epss_enrichment: bool = False, + cisa_kev_enrichment: bool = False, + enable_vex_suppression: bool = True +) -> Bom: + """Build a brand-new CycloneDX 1.6 BOM while retaining component list & dependency graph from + a pre-existing Workbench SBOM (typically 1.5). This is the preferred middle-ground refactor – + we ignore legacy metadata quirks and simply copy components & edges, then inject enriched + vulnerability data. + """ + + if not CYCLONEDX_AVAILABLE: + raise ImportError("CycloneDX support requires the 'cyclonedx-python-lib' package") + + if external_data is None: + external_data = {} + + # 1. Load the source SBOM (expected JSON) + try: + with open(base_sbom_path, "r", encoding="utf-8") as f: + source_json = json.load(f) + except FileNotFoundError: + raise FileNotFoundError(f"Base SBOM not found at: {base_sbom_path}") + except json.JSONDecodeError as exc: + raise ValueError(f"Invalid JSON in base SBOM {base_sbom_path}: {exc}") + + # 2. Start a fresh BOM (defaults to latest, i.e. 1.6) + new_bom: Bom = Bom() + new_bom.metadata.timestamp = datetime.utcnow() + + # 3. Copy components – retain basic identity info plus purl & bom-ref + component_lookup: Dict[str, Component] = {} + + for comp_data in source_json.get("components", []): + name = comp_data.get("name", "Unknown") + version = comp_data.get("version", "") + comp_type_raw = comp_data.get("type", "library").upper() + comp_type = ComponentType.LIBRARY + try: + comp_type = ComponentType[comp_type_raw] + except Exception: + pass # default stays LIBRARY + + # Coerce bom-ref to pure string (handles object refs in legacy SBOMs) + bom_ref_val = str(comp_data.get("bom-ref", f"{name}_{version}")) + + # Attempt to parse PURL + purl_obj = None + if comp_data.get("purl"): + try: + purl_obj = PackageURL.from_string(comp_data["purl"]) + except Exception: + purl_obj = None + + component = Component( + name=name, + version=version, + type=comp_type, + purl=purl_obj, + bom_ref=bom_ref_val, + ) + + # Best-effort: copy licenses if an SPDX id is present + if comp_data.get("licenses"): + try: + from cyclonedx.model.license import LicenseChoice, DisjunctiveLicenseSet, License, SpdxLicense + + lic_objs = [] + for lic in comp_data["licenses"]: + lic_id = lic.get("license", {}).get("id") + if lic_id: + lic_objs.append(SpdxLicense(lic_id)) + if lic_objs: + component.licenses = LicenseChoice(DisjunctiveLicenseSet(licenses=lic_objs)) + except Exception: + pass # ignore license copy issues + + # Supplier and other metadata are skipped to keep implementation lean + + new_bom.components.add(component) + + # lookup keys for later vuln matching + component_lookup[f"{name.lower()}@{version.lower()}"] = component + component_lookup[name.lower()] = component + if purl_obj: + component_lookup[str(purl_obj)] = component + component_lookup[purl_obj.name.lower()] = component + + # 4. Copy dependency graph edges (if present) + if source_json.get("dependencies"): + try: + from cyclonedx.model.dependency import Dependency + for dep in source_json["dependencies"]: + ref_id = str(dep.get("ref")) + depends_on = [str(d) for d in dep.get("dependsOn", [])] + new_bom.dependencies.add(Dependency(ref=ref_id, depends_on=set(depends_on))) + except Exception: + # If dependency model not available, silently skip – components are still present + pass + + # 5. Process vulnerabilities – enrich & attach + unmatched_vulns: List[Dict[str, Any]] = [] + for vuln in vulnerabilities: + cve = vuln.get("cve", "UNKNOWN") + component_name = vuln.get("component_name", "Unknown") + component_version = vuln.get("component_version", "Unknown") + + match_key = f"{component_name.lower()}@{component_version.lower()}" + matched_component = component_lookup.get(match_key) or component_lookup.get(component_name.lower()) + + if not matched_component: + # create minimal component for edge case + ecosystem = _detect_package_ecosystem(component_name, component_version) + try: + purl_tmp = PackageURL(type=ecosystem, name=component_name, version=component_version) + except Exception: + purl_tmp = None + matched_component = Component(name=component_name, version=component_version, type=ComponentType.LIBRARY, purl=purl_tmp) + new_bom.components.add(matched_component) + component_lookup[match_key] = matched_component + + vuln_obj = _create_cyclonedx_vulnerability(vuln, external_data.get(cve, {})) + vuln_obj.affects = [BomTarget(ref=str(matched_component.bom_ref))] + new_bom.vulnerabilities.add(vuln_obj) + + # 6. Annotate metadata to indicate augmentation & counts + props = [ + Property(name="augmented_with_vulnerabilities", value="true"), + Property(name="augmentation_timestamp", value=datetime.utcnow().isoformat() + "Z"), + Property(name="vulnerability_count", value=str(len(vulnerabilities))), + Property(name="scan_code", value=scan_code), + ] + try: + new_bom.metadata.properties.update(props) + except Exception: + # Some library versions require .properties to be initialised first + if not getattr(new_bom.metadata, "properties", None): + from sortedcontainers import SortedSet # type: ignore + new_bom.metadata.properties = SortedSet() + new_bom.metadata.properties.update(props) + + return new_bom + + +def augment_existing_cyclonedx_sbom( + base_sbom_path: str, + vulnerabilities: List[Dict[str, Any]], + scan_code: str, + external_data: Optional[Dict[str, Dict[str, Any]]] = None, + nvd_enrichment: bool = False, + epss_enrichment: bool = False, + cisa_kev_enrichment: bool = False, + enable_vex_suppression: bool = True +) -> Bom: + """ + Augment an existing CycloneDX SBOM with vulnerability data. + + This approach preserves all the rich component metadata from the existing SBOM + (licenses, suppliers, dependencies, etc.) while adding vulnerability information. + + Args: + base_sbom_path: Path to the existing CycloneDX SBOM file + vulnerabilities: List of vulnerability dictionaries from the API + scan_code: The scan code for reference + external_data: Pre-fetched external enrichment data (optional) + nvd_enrichment: Whether NVD enrichment was enabled + epss_enrichment: Whether EPSS enrichment was enabled + cisa_kev_enrichment: Whether CISA KEV enrichment was enabled + enable_vex_suppression: Whether VEX suppression is enabled + + Returns: + Augmented CycloneDX BOM object with vulnerability information + + Raises: + FileNotFoundError: If the base SBOM file doesn't exist + ValueError: If the base SBOM cannot be parsed + """ + if not CYCLONEDX_AVAILABLE: + raise ImportError("CycloneDX support requires the 'cyclonedx-python-lib' package") + + if external_data is None: + external_data = {} + + # Load existing SBOM + try: + with open(base_sbom_path, 'r', encoding='utf-8') as f: + json_data = json.load(f) + + # Create a new BOM and populate it with existing data + existing_bom = Bom() + + # Set metadata from existing SBOM + if 'metadata' in json_data: + metadata = json_data['metadata'] + if 'timestamp' in metadata: + try: + existing_bom.metadata.timestamp = datetime.fromisoformat(metadata['timestamp'].replace('Z', '+00:00')) + except: + existing_bom.metadata.timestamp = datetime.utcnow() + else: + existing_bom.metadata.timestamp = datetime.utcnow() + + # Add existing components + if 'components' in json_data: + for comp_data in json_data['components']: + try: + component = Component( + name=comp_data.get('name', 'Unknown'), + version=comp_data.get('version', ''), + type=ComponentType.LIBRARY, + bom_ref=comp_data.get('bom-ref') or None, + ) + + # Set PURL if available + if 'purl' in comp_data: + try: + component.purl = PackageURL.from_string(comp_data['purl']) + except: + pass # Skip invalid PURLs + + # Set bom-ref if available + if 'bom-ref' in comp_data: + component.bom_ref = comp_data['bom-ref'] + + existing_bom.components.add(component) + except: + # Skip components that can't be parsed + continue + + # Add existing vulnerabilities + if 'vulnerabilities' in json_data: + for vuln_data in json_data['vulnerabilities']: + try: + vulnerability = Vulnerability( + bom_ref=vuln_data.get('bom-ref', f"vuln-{vuln_data.get('id', 'unknown')}"), + id=vuln_data.get('id', 'UNKNOWN') + ) + + # Set description + if 'description' in vuln_data: + vulnerability.description = vuln_data['description'] + + # Add affects relationships + if 'affects' in vuln_data: + affects = [] + for affect in vuln_data['affects']: + if 'ref' in affect: + affects.append(BomTarget(ref=affect['ref'])) + if affects: + vulnerability.affects = affects + + existing_bom.vulnerabilities.add(vulnerability) + except: + # Skip vulnerabilities that can't be parsed + continue + + except FileNotFoundError: + raise FileNotFoundError(f"Base SBOM file not found: {base_sbom_path}") + except json.JSONDecodeError as e: + raise ValueError(f"Invalid JSON in base SBOM file: {e}") + except Exception as e: + raise ValueError(f"Failed to parse base SBOM file: {e}") + + # Create component lookup for matching vulnerabilities to existing components + component_lookup = {} + for component in existing_bom.components: + # Create multiple lookup keys for flexible matching + keys = [ + component.name, # Simple name match + f"{component.name}@{component.version}" if component.version else component.name, # Name@version + ] + + # Add PURL-based matching if available + if component.purl: + keys.append(str(component.purl)) + keys.append(component.purl.name) # Just the name part of PURL + + for key in keys: + if key: + component_lookup[key.lower()] = component + + # Process vulnerabilities and match to existing components + vulnerabilities_to_add = [] + unmatched_vulnerabilities = [] + + for vuln in vulnerabilities: + component_name = vuln.get("component_name", "Unknown") + component_version = vuln.get("component_version", "Unknown") + cve = vuln.get("cve", "UNKNOWN") + + # Try to match vulnerability to existing component + matched_component = None + + # Try different matching strategies + match_keys = [ + component_name.lower(), + f"{component_name}@{component_version}".lower(), + f"{component_name}-{component_version}".lower(), + ] + + for key in match_keys: + if key in component_lookup: + matched_component = component_lookup[key] + break + + if matched_component: + # Create vulnerability and link to existing component + vulnerability = _create_cyclonedx_vulnerability(vuln, external_data.get(cve, {})) + + # Ensure the bom-ref is a plain string for JSON serialization + ref_id = matched_component.bom_ref + if not isinstance(ref_id, str): + ref_id = str(ref_id) + + # Add BOM target to link vulnerability to component + vulnerability.affects = [BomTarget(ref=ref_id)] + + vulnerabilities_to_add.append(vulnerability) + else: + # Component not found in existing SBOM + unmatched_vulnerabilities.append(vuln) + + # Add matched vulnerabilities to the BOM + for vulnerability in vulnerabilities_to_add: + existing_bom.vulnerabilities.add(vulnerability) + + # Handle unmatched vulnerabilities by creating minimal components + if unmatched_vulnerabilities: + logger.warning(f"Found {len(unmatched_vulnerabilities)} vulnerabilities for components not in base SBOM") + + for vuln in unmatched_vulnerabilities: + component_name = vuln.get("component_name", "Unknown") + component_version = vuln.get("component_version", "Unknown") + cve = vuln.get("cve", "UNKNOWN") + + # Create minimal component for unmatched vulnerability + ecosystem = _detect_package_ecosystem(component_name, component_version) + + try: + purl = PackageURL( + type=ecosystem, + name=component_name, + version=component_version + ) + component = Component( + name=component_name, + version=component_version, + type=ComponentType.LIBRARY, + purl=purl + ) + except Exception: + component = Component( + name=component_name, + version=component_version, + type=ComponentType.LIBRARY + ) + + # Add component to BOM + existing_bom.components.add(component) + + # Create and add vulnerability + vulnerability = _create_cyclonedx_vulnerability(vuln, external_data.get(cve, {})) + + # Ensure bom-ref serializes as a string + ref_id = component.bom_ref if isinstance(component.bom_ref, str) else str(component.bom_ref) + vulnerability.affects = [BomTarget(ref=ref_id)] + existing_bom.vulnerabilities.add(vulnerability) + + # Update BOM metadata to reflect augmentation + existing_bom.metadata.timestamp = datetime.utcnow() + + # Add properties to indicate this is an augmented SBOM + # Note: existing_bom.metadata.properties is a SortedSet, so we use update() with Property objects + properties_to_add = [ + Property(name="augmented_with_vulnerabilities", value="true"), + Property(name="augmentation_timestamp", value=datetime.utcnow().isoformat() + "Z"), + Property(name="vulnerability_count", value=str(len(vulnerabilities))), + Property(name="unmatched_vulnerabilities", value=str(len(unmatched_vulnerabilities))), + Property(name="scan_code", value=scan_code), + ] + + existing_bom.metadata.properties.update(properties_to_add) + + return existing_bom + + +def _create_cyclonedx_vulnerability( + vuln: Dict[str, Any], + ext_data: Dict[str, Any] +) -> Vulnerability: + """Create a CycloneDX Vulnerability object from vulnerability data.""" + cve = vuln.get("cve", "UNKNOWN") + component_name = vuln.get("component_name", "Unknown") + component_version = vuln.get("component_version", "Unknown") + + # Create vulnerability + vulnerability = Vulnerability( + bom_ref=f"vuln-{cve}-{component_name}-{component_version}", + id=cve if cve != "UNKNOWN" else f"UNKNOWN-{vuln.get('id', 'unknown')}" + ) + + # Add description from NVD if available + if ext_data.get("nvd_description"): + vulnerability.description = ext_data["nvd_description"] + else: + vulnerability.description = f"Security vulnerability affecting {component_name} version {component_version}" + + # Add ratings + ratings = [] + + # Base CVSS rating + base_score = vuln.get("base_score") + if base_score and base_score != "N/A": + try: + score_value = float(base_score) + rating = VulnerabilityRating( + # No specific originating source for this rating + source=None, + score=score_value, + severity=_map_severity_to_cyclonedx(vuln.get("severity", "UNKNOWN")), + method=VulnerabilityScoreSource.CVSS_V3, + ) + + # Add CVSS vector if available + cvss_vector = ext_data.get("full_cvss_vector") or _build_cvss_vector(vuln) + if cvss_vector and cvss_vector != "CVSS vector not available": + rating.vector = cvss_vector + + ratings.append(rating) + except (ValueError, TypeError): + pass + + # Dynamic Risk rating (NEW - applies intelligent prioritization) + risk_adjustment = calculate_dynamic_risk(vuln, ext_data, enable_vex_suppression=True) + if risk_adjustment.adjusted_level != risk_adjustment.original_level: + # Add dynamic risk rating when risk level was adjusted + dynamic_rating = VulnerabilityRating( + source=None, + severity=_map_severity_to_cyclonedx(risk_level_to_cyclonedx_severity(risk_adjustment.adjusted_level)), + method=VulnerabilityScoreSource.OTHER, + ) + + # Add a score based on risk level for sorting + risk_scores = {"critical": 10.0, "high": 8.0, "medium": 5.0, "low": 3.0, "info": 1.0} + dynamic_rating.score = risk_scores.get(risk_adjustment.adjusted_level.value, 5.0) + + ratings.append(dynamic_rating) + + # EPSS rating + if ext_data.get("epss_score") is not None: + epss_rating = VulnerabilityRating( + source=None, + score=ext_data["epss_score"], + method=VulnerabilityScoreSource.OTHER, + ) + ratings.append(epss_rating) + + vulnerability.ratings = ratings + + # ------------------------------------------------------------------ + # VEX / Impact Analysis + # ------------------------------------------------------------------ + + try: + from cyclonedx.model.impact_analysis import ( + ImpactAnalysisState, + ImpactAnalysisJustification, + ImpactAnalysisResponse, + ) + from cyclonedx.model.vulnerability import VulnerabilityAnalysis + + vex_status = (vuln.get("vuln_exp_status") or "").lower() + vex_justification = (vuln.get("vuln_exp_justification") or "").lower() + vex_response = vuln.get("vuln_exp_response") or [] + if isinstance(vex_response, str): + vex_response = [vex_response] + + analysis_kwargs = {} + + # Map status → ImpactAnalysisState + state_enum = next((s for s in ImpactAnalysisState if s.value == vex_status), None) + if state_enum: + analysis_kwargs["state"] = state_enum + + # Map justification + just_enum = next((j for j in ImpactAnalysisJustification if j.value == vex_justification), None) + if just_enum: + analysis_kwargs["justification"] = just_enum + + # Map responses (list) + mapped_responses = [] + for item in vex_response: + item_lower = str(item).lower() + enum_match = next((r for r in ImpactAnalysisResponse if r.value == item_lower), None) + if enum_match: + mapped_responses.append(enum_match) + if mapped_responses: + analysis_kwargs["responses"] = mapped_responses + + # Detail (if present) + if vuln.get("vuln_exp_detail"): + analysis_kwargs["detail"] = vuln["vuln_exp_detail"] + + if analysis_kwargs: + vulnerability.analysis = VulnerabilityAnalysis(**analysis_kwargs) # type: ignore[arg-type] + + except Exception: + # Best-effort; don't fail report generation if mapping fails + pass + + # ------------------------------------------------------------------ + # References & Metadata + # ------------------------------------------------------------------ + # Add references + references = [] + + # NVD reference + if cve != "UNKNOWN": + nvd_ref = VulnerabilityReference( + id=cve, + source=VulnerabilitySource(name="NVD", url=f"https://nvd.nist.gov/vuln/detail/{cve}") + ) + references.append(nvd_ref) + + # Additional NVD references + if ext_data.get("nvd_references"): + for ref in ext_data["nvd_references"][:5]: # Limit to 5 references + ref_obj = VulnerabilityReference( + source=VulnerabilitySource( + name=ref.get("source", "Unknown"), + url=ref.get("url", "") + ) + ) + references.append(ref_obj) + + vulnerability.references = references + + # Add CWE information + if ext_data.get("nvd_cwe"): + vulnerability.cwes = [int(cwe.replace("CWE-", "")) for cwe in ext_data["nvd_cwe"] if cwe.startswith("CWE-")] + + # Add properties for additional metadata + properties = [] + + if ext_data.get("cisa_kev"): + properties.append({"name": "cisa_known_exploited", "value": "true"}) + + if ext_data.get("epss_percentile"): + properties.append({"name": "epss_percentile", "value": str(ext_data["epss_percentile"])}) + + # VEX properties + vex_status = vuln.get("vuln_exp_status") + if vex_status: + properties.append({"name": "vex_status", "value": vex_status}) + + vex_response = vuln.get("vuln_exp_response") + if vex_response: + properties.append({"name": "vex_response", "value": vex_response}) + + vex_justification = vuln.get("vuln_exp_justification") + if vex_justification: + properties.append({"name": "vex_justification", "value": vex_justification}) + + # Dynamic risk properties (NEW) + risk_adjustment = calculate_dynamic_risk(vuln, ext_data, enable_vex_suppression=True) + if risk_adjustment.adjusted_level != risk_adjustment.original_level: + properties.append({"name": "dynamic_risk_level", "value": risk_adjustment.adjusted_level.value}) + properties.append({"name": "risk_adjustment_reason", "value": risk_adjustment.adjustment_reason}) + if risk_adjustment.priority_context: + properties.append({"name": "risk_priority_context", "value": risk_adjustment.priority_context}) + + # Note: CycloneDX doesn't have a direct properties field on Vulnerability + # These would typically be added as external references or in the BOM metadata + + return vulnerability + + +def _map_severity_to_cyclonedx(severity: str) -> "VulnerabilitySeverity": + """Map severity string to CycloneDX VulnerabilitySeverity enum.""" + severity_map = { + "NONE": VulnerabilitySeverity.NONE, + "INFO": VulnerabilitySeverity.INFO, + "LOW": VulnerabilitySeverity.LOW, + "MEDIUM": VulnerabilitySeverity.MEDIUM, + "HIGH": VulnerabilitySeverity.HIGH, + "CRITICAL": VulnerabilitySeverity.CRITICAL, + "UNKNOWN": VulnerabilitySeverity.UNKNOWN, + } + return severity_map.get(severity.upper(), VulnerabilitySeverity.UNKNOWN) + + +def _build_cvss_vector(vuln: Dict[str, Any]) -> str: + """Build a CVSS vector string from available vulnerability data.""" + version = vuln.get("cvss_version", "3.1") + + vector_parts = [f"CVSS:{version}"] + + # Attack Vector + av = vuln.get("attack_vector", "") + if av: + av_map = {"NETWORK": "N", "ADJACENT_NETWORK": "A", "LOCAL": "L", "PHYSICAL": "P"} + vector_parts.append(f"AV:{av_map.get(av, av[0] if av else 'N')}") + + # Attack Complexity + ac = vuln.get("attack_complexity", "") + if ac: + ac_map = {"LOW": "L", "HIGH": "H"} + vector_parts.append(f"AC:{ac_map.get(ac, ac[0] if ac else 'L')}") + + # Availability Impact + a = vuln.get("availability_impact", "") + if a: + a_map = {"NONE": "N", "LOW": "L", "HIGH": "H"} + vector_parts.append(f"A:{a_map.get(a, a[0] if a else 'N')}") + + return "/".join(vector_parts) if len(vector_parts) > 1 else "CVSS vector not available" \ No newline at end of file diff --git a/src/workbench_cli/utilities/vuln_report/risk_adjustments.py b/src/workbench_cli/utilities/vuln_report/risk_adjustments.py new file mode 100644 index 0000000..72742d3 --- /dev/null +++ b/src/workbench_cli/utilities/vuln_report/risk_adjustments.py @@ -0,0 +1,312 @@ +""" +Dynamic risk adjustment utilities for vulnerability reports. + +This module provides format-agnostic logic for calculating dynamic risk levels +based on VEX assessments, EPSS scores, CISA KEV status, and other intelligence. +The risk calculations can be applied consistently across SARIF, CycloneDX, and SPDX formats. +""" + +from typing import Dict, List, Any, Optional, Tuple +from enum import Enum +import logging + +logger = logging.getLogger(__name__) + + +class RiskLevel(Enum): + """Standardized risk levels for vulnerability prioritization.""" + CRITICAL = "critical" # CISA KEV, high EPSS + exploitable VEX + HIGH = "high" # High EPSS (>0.1), exploitable VEX status + MEDIUM = "medium" # Default CVSS-based severity + LOW = "low" # Low severity or mitigated VEX + INFO = "info" # Suppressed by VEX (resolved/false positive) + + +class RiskAdjustment: + """Container for risk adjustment information.""" + + def __init__( + self, + original_level: RiskLevel, + adjusted_level: RiskLevel, + adjustment_reason: str, + priority_context: str = "", + suppressed: bool = False + ): + self.original_level = original_level + self.adjusted_level = adjusted_level + self.adjustment_reason = adjustment_reason + self.priority_context = priority_context + self.suppressed = suppressed + + @property + def was_promoted(self) -> bool: + """Check if risk level was promoted (increased).""" + level_order = [RiskLevel.INFO, RiskLevel.LOW, RiskLevel.MEDIUM, RiskLevel.HIGH, RiskLevel.CRITICAL] + return level_order.index(self.adjusted_level) > level_order.index(self.original_level) + + @property + def was_demoted(self) -> bool: + """Check if risk level was demoted (decreased).""" + level_order = [RiskLevel.INFO, RiskLevel.LOW, RiskLevel.MEDIUM, RiskLevel.HIGH, RiskLevel.CRITICAL] + return level_order.index(self.adjusted_level) < level_order.index(self.original_level) + + +def calculate_dynamic_risk( + vuln: Dict[str, Any], + external_data: Dict[str, Any], + enable_vex_suppression: bool = True +) -> RiskAdjustment: + """ + Calculate dynamic risk level for a vulnerability based on intelligence sources. + + Args: + vuln: Vulnerability dictionary from Workbench API + external_data: External enrichment data (EPSS, CISA KEV, NVD) + enable_vex_suppression: Whether to apply VEX-based suppression + + Returns: + RiskAdjustment object containing original and adjusted risk levels + """ + # Start with base severity + base_severity = vuln.get("severity", "UNKNOWN").upper() + original_level = _map_cvss_severity_to_risk_level(base_severity) + + # Extract VEX information + vex_status = (vuln.get("vuln_exp_status") or "").lower() + vex_response = (vuln.get("vuln_exp_response") or "").lower() + + # Check for promotion to CRITICAL level + if external_data.get("cisa_kev"): + return RiskAdjustment( + original_level=original_level, + adjusted_level=RiskLevel.CRITICAL, + adjustment_reason="CISA Known Exploited Vulnerability", + priority_context="[CISA KEV]" + ) + + # Check for promotion to HIGH level + epss_score = external_data.get("epss_score", 0) + if epss_score and epss_score > 0.1: + return RiskAdjustment( + original_level=original_level, + adjusted_level=RiskLevel.HIGH, + adjustment_reason=f"High EPSS exploitation probability: {epss_score:.3f}", + priority_context=f"[EPSS: {epss_score:.3f}]" + ) + + # Check VEX status for promotion to HIGH + if vex_status in ["exploitable", "affected"]: + return RiskAdjustment( + original_level=original_level, + adjusted_level=RiskLevel.HIGH, + adjustment_reason=f"VEX assessment indicates {vex_status} status", + priority_context=f"[VEX: {vex_status.upper()}]" + ) + + # Check for VEX-based suppression/demotion + if enable_vex_suppression: + # Suppress (demote to INFO) if VEX indicates resolved/mitigated + if vex_status in ["not_affected", "fixed", "mitigated", "resolved", "false_positive"]: + return RiskAdjustment( + original_level=original_level, + adjusted_level=RiskLevel.INFO, + adjustment_reason=f"VEX assessment: {vex_status}", + priority_context=f"[VEX: {vex_status.upper()}]", + suppressed=True + ) + + # Suppress if VEX response indicates accepted risk + if vex_response in ["will_not_fix", "update", "can_not_fix"]: + return RiskAdjustment( + original_level=original_level, + adjusted_level=RiskLevel.INFO, + adjustment_reason=f"VEX response: {vex_response}", + priority_context=f"[VEX: {vex_response.upper()}]", + suppressed=True + ) + + # No adjustment needed + return RiskAdjustment( + original_level=original_level, + adjusted_level=original_level, + adjustment_reason="No risk adjustment applied" + ) + + +def calculate_batch_risk_adjustments( + vulnerabilities: List[Dict[str, Any]], + external_data: Dict[str, Dict[str, Any]], + enable_vex_suppression: bool = True +) -> Dict[str, RiskAdjustment]: + """ + Calculate risk adjustments for a batch of vulnerabilities. + + Args: + vulnerabilities: List of vulnerability dictionaries + external_data: External enrichment data keyed by CVE + enable_vex_suppression: Whether to apply VEX-based suppression + + Returns: + Dictionary mapping vulnerability IDs to RiskAdjustment objects + """ + adjustments = {} + + for vuln in vulnerabilities: + vuln_id = str(vuln.get("id", "unknown")) + cve = vuln.get("cve", "UNKNOWN") + ext_data = external_data.get(cve, {}) + + adjustment = calculate_dynamic_risk(vuln, ext_data, enable_vex_suppression) + adjustments[vuln_id] = adjustment + + return adjustments + + +def get_risk_summary(adjustments: Dict[str, RiskAdjustment]) -> Dict[str, int]: + """ + Generate a summary of risk adjustments. + + Args: + adjustments: Dictionary of risk adjustments + + Returns: + Summary statistics about risk adjustments + """ + summary = { + "total_vulnerabilities": len(adjustments), + "promoted": 0, + "demoted": 0, + "suppressed": 0, + "unchanged": 0, + "by_adjusted_level": {level.value: 0 for level in RiskLevel}, + "promotion_reasons": {}, + "suppression_reasons": {} + } + + for adjustment in adjustments.values(): + # Count by adjusted level + summary["by_adjusted_level"][adjustment.adjusted_level.value] += 1 + + # Count adjustments + if adjustment.was_promoted: + summary["promoted"] += 1 + reason = adjustment.adjustment_reason + summary["promotion_reasons"][reason] = summary["promotion_reasons"].get(reason, 0) + 1 + elif adjustment.was_demoted: + summary["demoted"] += 1 + if adjustment.suppressed: + summary["suppressed"] += 1 + reason = adjustment.adjustment_reason + summary["suppression_reasons"][reason] = summary["suppression_reasons"].get(reason, 0) + 1 + else: + summary["unchanged"] += 1 + + return summary + + +# Format-specific mapping functions + +def risk_level_to_sarif_level(risk_level: RiskLevel) -> str: + """Map RiskLevel to SARIF level.""" + mapping = { + RiskLevel.CRITICAL: "error", + RiskLevel.HIGH: "error", + RiskLevel.MEDIUM: "warning", + RiskLevel.LOW: "warning", + RiskLevel.INFO: "note" + } + return mapping[risk_level] + + +def risk_level_to_cyclonedx_severity(risk_level: RiskLevel) -> str: + """Map RiskLevel to CycloneDX severity.""" + mapping = { + RiskLevel.CRITICAL: "critical", + RiskLevel.HIGH: "high", + RiskLevel.MEDIUM: "medium", + RiskLevel.LOW: "low", + RiskLevel.INFO: "info" + } + return mapping[risk_level] + + +def risk_level_to_spdx_severity(risk_level: RiskLevel) -> str: + """Map RiskLevel to SPDX severity.""" + mapping = { + RiskLevel.CRITICAL: "CRITICAL", + RiskLevel.HIGH: "HIGH", + RiskLevel.MEDIUM: "MEDIUM", + RiskLevel.LOW: "LOW", + RiskLevel.INFO: "LOW" # SPDX doesn't have INFO, use LOW + } + return mapping[risk_level] + + +# Helper functions + +def _map_cvss_severity_to_risk_level(severity: str) -> RiskLevel: + """Map CVSS severity string to RiskLevel.""" + mapping = { + "CRITICAL": RiskLevel.CRITICAL, + "HIGH": RiskLevel.HIGH, + "MEDIUM": RiskLevel.MEDIUM, + "LOW": RiskLevel.LOW, + "UNKNOWN": RiskLevel.MEDIUM # Default to medium for unknown + } + return mapping.get(severity.upper(), RiskLevel.MEDIUM) + + +def apply_vex_suppression_filter( + vulnerabilities: List[Dict[str, Any]], + external_data: Dict[str, Dict[str, Any]] +) -> Tuple[List[Dict[str, Any]], List[Dict[str, Any]]]: + """ + Filter vulnerabilities based on VEX suppression rules. + + Args: + vulnerabilities: List of vulnerability dictionaries + external_data: External enrichment data + + Returns: + Tuple of (non_suppressed_vulnerabilities, suppressed_vulnerabilities) + """ + non_suppressed = [] + suppressed = [] + + for vuln in vulnerabilities: + cve = vuln.get("cve", "UNKNOWN") + ext_data = external_data.get(cve, {}) + + adjustment = calculate_dynamic_risk(vuln, ext_data, enable_vex_suppression=True) + + if adjustment.suppressed: + suppressed.append(vuln) + else: + non_suppressed.append(vuln) + + return non_suppressed, suppressed + + +# Legacy compatibility functions (for existing SARIF code) + +def map_vex_status_to_sarif_level( + vex_status: str, + original_level: str, + external_data: Dict[str, Any] = None +) -> str: + """ + Legacy compatibility function for existing SARIF code. + Maps to the new risk calculation system. + """ + if external_data is None: + external_data = {} + + # Create a mock vulnerability for the calculation + mock_vuln = { + "vuln_exp_status": vex_status, + "severity": "MEDIUM" # Default, will be overridden by external data logic + } + + adjustment = calculate_dynamic_risk(mock_vuln, external_data) + return risk_level_to_sarif_level(adjustment.adjusted_level) \ No newline at end of file diff --git a/src/workbench_cli/utilities/vuln_report/sarif_generator.py b/src/workbench_cli/utilities/vuln_report/sarif_generator.py new file mode 100644 index 0000000..9a6e6be --- /dev/null +++ b/src/workbench_cli/utilities/vuln_report/sarif_generator.py @@ -0,0 +1,987 @@ +"""workbench_cli.utilities.sarif_generation +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +SARIF generation utilities for vulnerability data. + +This module provides functionality to convert vulnerability data from the Workbench API +into SARIF (Static Analysis Results Interchange Format) v2.1.0 format, which is +compatible with GitHub Advanced Security and other security tools. + +Enhanced with external API integration for EPSS scores, known exploits, CVE details, +and VEX (Vulnerability Exploitability eXchange) information. +""" +from __future__ import annotations + +import json +import logging +import os +from typing import Dict, List, Any, Optional +from datetime import datetime +from dataclasses import dataclass + +from .vulnerability_enricher import enrich_vulnerabilities +from .component_enrichment import ( + _detect_package_ecosystem, +) + +logger = logging.getLogger(__name__) + + +# Configuration removed - CLI arguments now drive behavior directly + + +__all__ = [ + # Public API + "convert_vulns_to_sarif", + "save_vulns_to_sarif", + # Selected VEX helpers exposed for risk-guidance logic + "apply_vex_suppression", + "get_vex_info", + "map_vex_status_to_sarif_level", + "generate_vex_properties", + "analyze_vex_statements", + # Internal functions exposed for export_sarif handler + "_fetch_external_enrichment_data", + "_count_high_risk_vulnerabilities", + "_calculate_severity_distribution", + "_format_severity_breakdown_compact", + "_extract_unique_cves", + "_count_vex_assessments", +] + + +def apply_vex_suppression(vulnerabilities: List[Dict[str, Any]]) -> List[Dict[str, Any]]: + """ + Apply VEX-based suppression to vulnerabilities. + + Suppresses findings that have been assessed through VEX as: + - Mitigated/not affected/resolved + - Accepted risk + - False positives + + Args: + vulnerabilities: List of vulnerability dictionaries + + Returns: + Filtered list of vulnerabilities after applying VEX suppression rules + """ + filtered_vulns = [] + + for vuln in vulnerabilities: + should_suppress = False + + # Check VEX status for suppression + vex_status = (vuln.get("vuln_exp_status") or "").lower() + vex_response = (vuln.get("vuln_exp_response") or "").lower() + + # Suppress VEX mitigated findings + if vex_status in ["not_affected", "resolved", "false_positive"]: + should_suppress = True + + # Suppress accepted risk findings + if vex_response in ["will_not_fix", "update", "can_not_fix"]: + should_suppress = True + + if not should_suppress: + filtered_vulns.append(vuln) + + return filtered_vulns + +def convert_vulns_to_sarif( + vulnerabilities: List[Dict[str, Any]], + scan_code: str, + external_data: Optional[Dict[str, Dict[str, Any]]] = None, + *, + nvd_enrichment: bool = False, + epss_enrichment: bool = False, + cisa_kev_enrichment: bool = False, + api_timeout: int = 30, + enable_vex_suppression: bool = True, + quiet: bool = False, +) -> Dict[str, Any]: + """ + Convert vulnerability data to SARIF v2.1.0 format with sensible defaults. + + VEX assessments, component grouping, and metadata inclusion are always enabled. + External enrichment is OFF by default - users must opt-in for better performance and privacy. + + Args: + vulnerabilities: List of vulnerability dictionaries from the Workbench API + scan_code: The scan code for reference + external_data: Pre-fetched external enrichment data (optional) + include_cve_descriptions: Fetch CVE descriptions from NVD (default: False) + include_epss_scores: Fetch EPSS scores from FIRST (default: False) + include_exploit_info: Fetch exploit info from CISA KEV (default: False) + api_timeout: Timeout for external API calls in seconds (default: 30) + enable_vex_suppression: Apply VEX-based suppression (default: True) + quiet: Suppress progress messages (default: False) + + Returns: + Dict containing SARIF-formatted data compatible with GitHub Advanced Security, + enhanced with VEX (Vulnerability Exploitability eXchange) information + + Examples: + # Simple usage with defaults (VEX assessments enabled, no external enrichment) + sarif_data = convert_vulns_to_sarif(vulnerabilities, scan_code) + + # Full enrichment with external API calls + sarif_data = convert_vulns_to_sarif( + vulnerabilities, scan_code, + nvd_enrichment=True, + epss_enrichment=True, + cisa_kev_enrichment=True + ) + + # With pre-fetched external data (avoids duplicate enrichment) + external_data = _fetch_external_enrichment_data(vulnerabilities, True, True, True, 30) + sarif_data = convert_vulns_to_sarif(vulnerabilities, scan_code, external_data) + """ + if not vulnerabilities: + return _create_empty_sarif_report(scan_code) + + # Use pre-fetched external data if provided, otherwise fetch it + if external_data is None: + external_data = _fetch_external_enrichment_data( + vulnerabilities, + nvd_enrichment, + epss_enrichment, + cisa_kev_enrichment, + api_timeout + ) + + # Build SARIF structure + sarif_data = _build_sarif_structure( + vulnerabilities, scan_code, external_data, + nvd_enrichment=nvd_enrichment, + epss_enrichment=epss_enrichment, + cisa_kev_enrichment=cisa_kev_enrichment, + enable_vex_suppression=enable_vex_suppression, + quiet=quiet + ) + + return sarif_data + + +def _fetch_external_enrichment_data( + vulnerabilities: List[Dict[str, Any]], + nvd_enrichment: bool, + epss_enrichment: bool, + cisa_kev_enrichment: bool, + api_timeout: int +) -> Dict[str, Dict[str, Any]]: + """Fetch external enrichment data for vulnerabilities.""" + unique_cves = _extract_unique_cves(vulnerabilities) + + external_data = {} + if unique_cves: + try: + external_data = enrich_vulnerabilities( + unique_cves, + nvd_enrichment, + epss_enrichment, + cisa_kev_enrichment, + api_timeout + ) + except Exception as e: + logger.warning(f"Failed to fetch external vulnerability data: {e}") + + return external_data + + +def _build_sarif_structure( + vulnerabilities: List[Dict[str, Any]], + scan_code: str, + external_data: Dict[str, Dict[str, Any]], + nvd_enrichment: bool, + epss_enrichment: bool, + cisa_kev_enrichment: bool, + enable_vex_suppression: bool, + quiet: bool +) -> Dict[str, Any]: + """Build the main SARIF structure with notifications and metadata.""" + # Count VEX statements for reporting + vex_stats = analyze_vex_statements(vulnerabilities) + + # Generate notifications for high-risk findings + notifications = _generate_risk_notifications(vulnerabilities, external_data) + + # Build concise run-level summary + generated_at_utc = datetime.utcnow().isoformat() + "Z" + vex_counts = _count_vex_assessments(vulnerabilities) + summary = { + "scanCode": scan_code, + "generated": generated_at_utc, + "totalFindings": len(vulnerabilities), + "severityBreakdown": _calculate_severity_distribution(vulnerabilities), + "withVEX": vex_counts["total_with_vex"], + "suppressedByVEX": vex_counts["suppressed"] + } + + return { + "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", + "version": "2.1.0", + "runs": [{ + "tool": { + "driver": { + "name": "FossID Workbench", + "version": "1.0.0", + "informationUri": "https://fossid.com/products/workbench/", + "rules": _generate_enhanced_rules(vulnerabilities, external_data), + "notifications": notifications + } + }, + "results": _generate_enhanced_results(vulnerabilities, external_data), + "properties": { + "scan_code": scan_code, + "generated_at": generated_at_utc, + "total_vulnerabilities": len(vulnerabilities), + "severity_distribution": _calculate_severity_distribution(vulnerabilities), + "external_data_sources": _get_data_sources_used(external_data), + "high_risk_vulnerabilities": _count_high_risk_vulnerabilities(vulnerabilities, external_data), + "vex_statements": vex_stats, + "summary": summary + } + }] + } + + +def _generate_risk_notifications(vulnerabilities: List[Dict[str, Any]], + external_data: Dict[str, Dict[str, Any]]) -> List[Dict[str, Any]]: + """Generate notifications for high-risk findings.""" + notifications = [] + + cisa_kev_count = sum(1 for vuln in vulnerabilities if external_data.get(vuln.get("cve", ""), {}).get("cisa_kev")) + high_epss_count = sum(1 for vuln in vulnerabilities if (external_data.get(vuln.get("cve", ""), {}).get("epss_score") or 0) > 0.1) + vex_counts = _count_vex_assessments(vulnerabilities) + vex_suppressed_count = vex_counts["suppressed"] + + if cisa_kev_count > 0: + notifications.append({ + "level": "error", + "message": { + "text": f"⚠️ URGENT: {cisa_kev_count} vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog and require immediate attention" + }, + "properties": { + "cisa_kev_count": cisa_kev_count, + "category": "security", + "priority": "critical" + } + }) + + if high_epss_count > 0: + notifications.append({ + "level": "warning", + "message": { + "text": f"🔍 HIGH RISK: {high_epss_count} vulnerabilities have elevated EPSS exploitation probability scores (>0.1)" + }, + "properties": { + "high_epss_count": high_epss_count, + "category": "security", + "priority": "high" + } + }) + + if vex_suppressed_count > 0: + notifications.append({ + "level": "note", + "message": { + "text": f"✅ VEX ASSESSMENTS: {vex_suppressed_count} vulnerabilities have been assessed and suppressed based on organizational VEX statements" + }, + "properties": { + "vex_suppressed_count": vex_suppressed_count, + "category": "assessment", + "priority": "info" + } + }) + + return notifications + + +def save_vulns_to_sarif( + filepath: str, + vulnerabilities: List[Dict[str, Any]], + scan_code: str, + external_data: Optional[Dict[str, Dict[str, Any]]] = None, + *, + nvd_enrichment: bool = False, + epss_enrichment: bool = False, + cisa_kev_enrichment: bool = False, + api_timeout: int = 30, + enable_vex_suppression: bool = True, + quiet: bool = False, +) -> None: + """ + Save vulnerability results in SARIF format with sensible defaults. + + VEX assessments, component grouping, and metadata inclusion are always enabled. + External enrichment is OFF by default - users must opt-in for better performance and privacy. + + Args: + filepath: Path where the SARIF file should be saved + vulnerabilities: List of vulnerability dictionaries from the API + scan_code: The scan code for reference + external_data: Pre-fetched external enrichment data (optional) + nvd_enrichment: Fetch CVE descriptions from NVD (default: False) + epss_enrichment: Fetch EPSS scores from FIRST (default: False) + cisa_kev_enrichment: Fetch exploit info from CISA KEV (default: False) + api_timeout: Timeout for external API calls in seconds (default: 30) + enable_vex_suppression: Apply VEX-based suppression (default: True) + quiet: Suppress progress messages (default: False) + + Examples: + # Simple usage with defaults (VEX assessments enabled, no external enrichment) + save_vulns_to_sarif("vulns.sarif", vulnerabilities, scan_code) + + # Full enrichment with external API calls + save_vulns_to_sarif( + "vulns.sarif", vulnerabilities, scan_code, + nvd_enrichment=True, + epss_enrichment=True, + cisa_kev_enrichment=True + ) + + # With pre-fetched external data (avoids duplicate enrichment) + external_data = _fetch_external_enrichment_data(vulnerabilities, True, True, True, 30) + save_vulns_to_sarif("vulns.sarif", vulnerabilities, scan_code, external_data) + + Raises: + IOError: If the file cannot be written + OSError: If the directory cannot be created + """ + output_dir = os.path.dirname(filepath) or "." + + try: + os.makedirs(output_dir, exist_ok=True) + + # Calculate how many findings would be suppressed by VEX + original_count = len(vulnerabilities) + suppressed_count = 0 + if enable_vex_suppression: + suppressed_count = original_count - len(apply_vex_suppression(vulnerabilities)) + + sarif_data = convert_vulns_to_sarif( + vulnerabilities, scan_code, external_data, + nvd_enrichment=nvd_enrichment, + epss_enrichment=epss_enrichment, + cisa_kev_enrichment=cisa_kev_enrichment, + api_timeout=api_timeout, + enable_vex_suppression=enable_vex_suppression, + quiet=quiet + ) + + with open(filepath, 'w', encoding='utf-8') as f: + json.dump(sarif_data, f, indent=2, ensure_ascii=False) + + # Only print messages if not quiet and external_data wasn't pre-provided + # (indicating the handler is managing output) + if not quiet and external_data is None: + print(f"Saved enhanced SARIF results to: {filepath}") + + # Print summary of external data sources used + props = sarif_data["runs"][0]["properties"] + if props.get("external_data_sources"): + print(f"External data sources used: {', '.join(props['external_data_sources'])}") + + except (IOError, OSError) as e: + if not quiet: + print(f"\nWarning: Failed to save SARIF results to {filepath}: {e}") + raise + + +# --------------------------------------------------------------------------- +# VEX Helper Functions +# --------------------------------------------------------------------------- + +def get_vex_info(vuln: Dict[str, Any]) -> Optional[Dict[str, Any]]: + """Extract VEX information from vulnerability data.""" + vex_fields = [ + "vuln_exp_id", "vuln_exp_status", "vuln_exp_justification", + "vuln_exp_response", "vuln_exp_details", "vuln_exp_created", + "vuln_exp_updated", "vuln_exp_created_by", "vuln_exp_updated_by", + "vuln_exp_created_by_username", "vuln_exp_updated_by_username" + ] + + vex_info = {} + has_vex_data = False + + for field in vex_fields: + value = vuln.get(field) + if value is not None: + vex_info[field] = value + has_vex_data = True + + return vex_info if has_vex_data else None + + + + + +def generate_vex_properties(vex_info: Dict[str, Any]) -> Dict[str, Any]: + """Generate VEX-related properties for SARIF output.""" + properties = {} + + if vex_info.get("vuln_exp_status"): + properties["vex_status"] = vex_info["vuln_exp_status"] + + if vex_info.get("vuln_exp_justification"): + properties["vex_justification"] = vex_info["vuln_exp_justification"] + + if vex_info.get("vuln_exp_response"): + properties["vex_response"] = vex_info["vuln_exp_response"] + + if vex_info.get("vuln_exp_details"): + properties["vex_details"] = vex_info["vuln_exp_details"] + + if vex_info.get("vuln_exp_created"): + properties["vex_created"] = vex_info["vuln_exp_created"] + + if vex_info.get("vuln_exp_updated"): + properties["vex_updated"] = vex_info["vuln_exp_updated"] + + if vex_info.get("vuln_exp_created_by_username"): + properties["vex_created_by"] = vex_info["vuln_exp_created_by_username"] + + if vex_info.get("vuln_exp_updated_by_username"): + properties["vex_updated_by"] = vex_info["vuln_exp_updated_by_username"] + + return properties + + +def analyze_vex_statements(vulnerabilities: List[Dict[str, Any]]) -> Dict[str, int]: + """Analyze VEX statements in vulnerability data.""" + vex_stats = { + "total_with_vex": 0, + "status_distribution": {}, + "with_justification": 0, + "with_response": 0, + "with_details": 0 + } + + for vuln in vulnerabilities: + # Check if vulnerability has VEX information + has_vex = any([ + vuln.get("vuln_exp_status"), + vuln.get("vuln_exp_justification"), + vuln.get("vuln_exp_response"), + vuln.get("vuln_exp_details") + ]) + + if has_vex: + vex_stats["total_with_vex"] += 1 + + # Count status distribution + status = vuln.get("vuln_exp_status") + if status: + vex_stats["status_distribution"][status] = vex_stats["status_distribution"].get(status, 0) + 1 + else: + # Count VEX entries without an explicit status + vex_stats["status_distribution"]["no status"] = vex_stats["status_distribution"].get("no status", 0) + 1 + + # Count fields with content + if vuln.get("vuln_exp_justification"): + vex_stats["with_justification"] += 1 + if vuln.get("vuln_exp_response"): + vex_stats["with_response"] += 1 + if vuln.get("vuln_exp_details"): + vex_stats["with_details"] += 1 + + return vex_stats + + +# --------------------------------------------------------------------------- +# Internal Helper Functions +# --------------------------------------------------------------------------- + +def _create_empty_sarif_report(scan_code: str) -> Dict[str, Any]: + """Create an empty SARIF report when no vulnerabilities are found.""" + return { + "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", + "version": "2.1.0", + "runs": [{ + "tool": { + "driver": { + "name": "FossID Workbench", + "version": "1.0.0", + "informationUri": "https://fossid.com/products/workbench/", + "rules": [] + } + }, + "results": [], + "properties": { + "scan_code": scan_code, + "generated_at": datetime.utcnow().isoformat() + "Z", + "total_vulnerabilities": 0, + "severity_distribution": {"CRITICAL": 0, "HIGH": 0, "MEDIUM": 0, "LOW": 0, "UNKNOWN": 0}, + "external_data_sources": [], + "high_risk_vulnerabilities": {"cisa_kev": 0, "high_epss": 0, "critical_severity": 0, "total_high_risk": 0} + } + }] + } + + +def _calculate_severity_distribution(vulnerabilities: List[Dict[str, Any]]) -> Dict[str, int]: + """Calculate the distribution of vulnerabilities by severity.""" + distribution = {"CRITICAL": 0, "HIGH": 0, "MEDIUM": 0, "LOW": 0, "UNKNOWN": 0} + + for vuln in vulnerabilities: + severity = vuln.get("severity", "UNKNOWN").upper() + if severity in distribution: + distribution[severity] += 1 + else: + distribution["UNKNOWN"] += 1 + + return distribution + + +def _format_severity_breakdown_compact(severity_dist: Dict[str, int]) -> str: + """Format severity distribution as compact text for CLI display.""" + breakdown_parts = [] + abbreviations = {'CRITICAL': 'C', 'HIGH': 'H', 'MEDIUM': 'M', 'LOW': 'L', 'UNKNOWN': 'U'} + for severity in ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW', 'UNKNOWN']: + if severity_dist.get(severity, 0) > 0: + abbrev = abbreviations.get(severity, severity) + breakdown_parts.append(f"{abbrev}: {severity_dist[severity]}") + + return f"[{', '.join(breakdown_parts)}]" if breakdown_parts else "" + + +def _extract_unique_cves(vulnerabilities: List[Dict[str, Any]]) -> List[str]: + """Extract unique CVEs from vulnerability data, excluding UNKNOWN values.""" + return list(set( + vuln.get("cve", "UNKNOWN") + for vuln in vulnerabilities + if vuln.get("cve") != "UNKNOWN" + )) + + +def _count_vex_assessments(vulnerabilities: List[Dict[str, Any]]) -> Dict[str, int]: + """Count various VEX assessment metrics.""" + return { + "total_with_vex": sum(1 for vuln in vulnerabilities if vuln.get("vuln_exp_id")), + "with_status": sum(1 for vuln in vulnerabilities if vuln.get("vuln_exp_status")), + "with_response": sum(1 for vuln in vulnerabilities if vuln.get("vuln_exp_response")), + "exploitable": sum(1 for vuln in vulnerabilities if vuln.get("vuln_exp_status") == "exploitable"), + "suppressed": sum(1 for vuln in vulnerabilities if get_vex_info(vuln) and get_vex_info(vuln).get("vuln_exp_status") in ["not_affected", "fixed", "mitigated", "resolved", "false_positive"]) + } + + +def _get_data_sources_used(external_data: Dict[str, Dict[str, Any]]) -> List[str]: + """Get list of external data sources that were successfully used.""" + sources = [] + + for cve_data in external_data.values(): + if cve_data.get("epss_score") is not None and "FIRST EPSS" not in sources: + sources.append("FIRST EPSS") + if cve_data.get("cisa_kev") and "CISA KEV" not in sources: + sources.append("CISA KEV") + if cve_data.get("nvd_description") and "NVD" not in sources: + sources.append("NVD") + + return sources + + +def _count_high_risk_vulnerabilities(vulnerabilities: List[Dict[str, Any]], + external_data: Dict[str, Dict[str, Any]]) -> Dict[str, int]: + """Count high-risk vulnerabilities based on external data.""" + counts = { + "cisa_kev": 0, + "high_epss": 0, + "critical_severity": 0, + "total_high_risk": 0 + } + + high_risk_cves = set() + + for vuln in vulnerabilities: + cve = vuln.get("cve", "UNKNOWN") + ext_data = external_data.get(cve, {}) + + is_high_risk = False + + if ext_data.get("cisa_kev"): + counts["cisa_kev"] += 1 + is_high_risk = True + + epss_score = ext_data.get("epss_score") + if epss_score is not None and epss_score > 0.1: + counts["high_epss"] += 1 + is_high_risk = True + + if vuln.get("severity", "").upper() == "CRITICAL": + counts["critical_severity"] += 1 + is_high_risk = True + + if is_high_risk: + high_risk_cves.add(cve) + + counts["total_high_risk"] = len(high_risk_cves) + return counts + + +def _map_severity_to_sarif_level(severity: str) -> str: + """Map Workbench severity levels to SARIF levels - defaults to WARNING for intelligent promotion/demotion.""" + # Default to WARNING - will be intelligently promoted/demoted based on external intelligence + return "warning" + + +def map_vex_status_to_sarif_level(vex_status: str, original_level: str, external_data: Dict[str, Any] = None) -> str: + """ + Map VEX status and external intelligence to appropriate SARIF level. + + New intelligent prioritization logic: + - Default: WARNING (from _map_severity_to_sarif_level) + - Promote to ERROR if: + - High EPSS score (>0.1) + - VEX status is "exploitable" with response "can_not_fix" + - CISA KEV vulnerability + - Demote to NOTE if: + - VEX status indicates resolved/mitigated/not_affected/false_positive + - VEX response indicates will_not_fix/update (accepted risk) + """ + if external_data is None: + external_data = {} + + # Check for promotion to ERROR level + + # Promote if high EPSS score + epss_score = external_data.get("epss_score", 0) + if epss_score and epss_score > 0.1: + return "error" + + # Promote if CISA KEV + if external_data.get("cisa_kev"): + return "error" + + # Promote if VEX status indicates exploitable and can't fix + if vex_status: + vex_status_lower = vex_status.lower() + + # For now, we'll handle the "exploitable + can_not_fix" case + # This would require also checking the VEX response, but for now we'll focus on the status + if vex_status_lower in ["exploitable", "affected"]: + return "error" # Promote exploitable/affected vulnerabilities + + # Check for demotion to NOTE level + + if vex_status: + vex_status_lower = vex_status.lower() + + # Demote VEX assessed vulnerabilities that are resolved or mitigated + if vex_status_lower in ["not_affected", "fixed", "mitigated", "resolved", "false_positive"]: + return "note" + + # Default to WARNING for everything else + return "warning" + + +def _build_cvss_vector(vuln: Dict[str, Any]) -> str: + """Build a CVSS vector string from available vulnerability data.""" + version = vuln.get("cvss_version", "3.1") + + vector_parts = [f"CVSS:{version}"] + + # Attack Vector + av = vuln.get("attack_vector", "") + if av: + av_map = {"NETWORK": "N", "ADJACENT_NETWORK": "A", "LOCAL": "L", "PHYSICAL": "P"} + vector_parts.append(f"AV:{av_map.get(av, av[0] if av else 'N')}") + + # Attack Complexity + ac = vuln.get("attack_complexity", "") + if ac: + ac_map = {"LOW": "L", "HIGH": "H"} + vector_parts.append(f"AC:{ac_map.get(ac, ac[0] if ac else 'L')}") + + # Availability Impact + a = vuln.get("availability_impact", "") + if a: + a_map = {"NONE": "N", "LOW": "L", "HIGH": "H"} + vector_parts.append(f"A:{a_map.get(a, a[0] if a else 'N')}") + + return "/".join(vector_parts) if len(vector_parts) > 1 else "CVSS vector not available" + + +def _extract_version_ranges(references: List[Dict[str, Any]]) -> str: + """Extract version information from NVD references where possible.""" + version_patterns = [] + + for ref in references: + url = ref.get("url", "").lower() + tags = [tag.lower() for tag in ref.get("tags", [])] + + # Look for vendor advisory URLs that often contain version info + if any(tag in ["vendor advisory", "patch", "mitigation"] for tag in tags): + # Common patterns in vendor URLs + if "github.com" in url and "/releases/" in url: + # GitHub release pages often have version info + version_patterns.append("See GitHub releases for affected versions") + elif any(vendor in url for vendor in ["apache.org", "nodejs.org", "golang.org", "python.org"]): + version_patterns.append("Check vendor advisory for version details") + + if version_patterns: + return "; ".join(set(version_patterns)) # Remove duplicates + + return "" + + +def _generate_enhanced_rules(vulnerabilities: List[Dict[str, Any]], + external_data: Dict[str, Dict[str, Any]]) -> List[Dict[str, Any]]: + """Generate enhanced SARIF rules from vulnerability data with external enrichment and VEX information.""" + rules = {} + + for vuln in vulnerabilities: + cve = vuln.get("cve", "UNKNOWN") + component_name = vuln.get("component_name", "Unknown") + component_version = vuln.get("component_version", "Unknown") + + # Create unique rule ID combining CVE, component, and version + rule_id = f"{cve}:{component_name}@{component_version}" if cve != "UNKNOWN" else f"UNKNOWN:{component_name}@{component_version}" + + if rule_id not in rules: + # Get external data and VEX information + ext_data = external_data.get(cve, {}) + vex_info = get_vex_info(vuln) + + # Use intelligent prioritization for default configuration level + original_level = _map_severity_to_sarif_level(vuln.get("severity", "UNKNOWN")) + vex_status = vex_info.get("vuln_exp_status") if vex_info else None + intelligent_level = map_vex_status_to_sarif_level(vex_status, original_level, ext_data) + + # Create enhanced descriptions using NVD data + short_desc = f"{cve} in {component_name}@{component_version} (CVSS {vuln.get('base_score', 'N/A')})" + if ext_data.get("nvd_cwe"): + cwe_list = ext_data["nvd_cwe"][:2] # Show first 2 CWEs to keep it concise + cwe_text = ", ".join(cwe_list) + short_desc += f" - {cwe_text}" + + # Use NVD description if available, otherwise fall back to generic description + nvd_desc = ext_data.get("nvd_description") + if nvd_desc and nvd_desc.strip() and nvd_desc != "No description available": + full_desc = nvd_desc + else: + full_desc = f"Security vulnerability {cve} affecting {component_name} with CVSS score {vuln.get('base_score', 'N/A')}" + + # Add component context to NVD description + if ext_data.get("nvd_description") and ext_data["nvd_description"] != "No description available": + full_desc += f"\n\nAffected Component: {component_name} version {component_version}" + + # Add affected version ranges if we can extract them from references + version_info = _extract_version_ranges(ext_data.get("nvd_references", [])) + if version_info: + full_desc += f"\nKnown Affected Versions: {version_info}" + + rule = { + "id": rule_id, + "name": f"{cve} in {component_name}@{component_version}", + "shortDescription": { + "text": short_desc + }, + "fullDescription": { + "text": full_desc + }, + "defaultConfiguration": { + "level": intelligent_level + }, + "properties": { + "security-severity": str(vuln.get("base_score", "0.0")), + "cvss_version": vuln.get("cvss_version", "N/A"), + "cvss_vector": ext_data.get("full_cvss_vector") or _build_cvss_vector(vuln), + "base_score": ext_data.get("cvss_score") or vuln.get("base_score", "N/A"), + "attack_vector": vuln.get("attack_vector", "N/A"), + "attack_complexity": vuln.get("attack_complexity", "N/A"), + "availability_impact": vuln.get("availability_impact", "N/A"), + "severity": vuln.get("severity", "UNKNOWN"), + "component_name": component_name, + "tags": ["security", "vulnerability"], + "nvd_enriched": bool(ext_data.get("nvd_description")) + }, + "helpUri": f"https://nvd.nist.gov/vuln/detail/{cve}" if cve != "UNKNOWN" else None + } + + # Add external data properties + if ext_data.get("epss_score") is not None: + rule["properties"]["epss_score"] = ext_data["epss_score"] + rule["properties"]["epss_percentile"] = ext_data["epss_percentile"] + + if ext_data.get("cisa_kev"): + rule["properties"]["cisa_known_exploited"] = True + + if ext_data.get("nvd_cwe"): + rule["properties"]["cwe_ids"] = ext_data["nvd_cwe"] + + # Add NVD references for additional context + if ext_data.get("nvd_references"): + # Include up to 5 most relevant references + relevant_refs = [] + for ref in ext_data["nvd_references"][:5]: + ref_info = { + "url": ref.get("url", ""), + "source": ref.get("source", "Unknown") + } + if ref.get("tags"): + ref_info["tags"] = ref["tags"] + relevant_refs.append(ref_info) + rule["properties"]["nvd_references"] = relevant_refs + + # Add VEX properties + if vex_info: + vex_properties = generate_vex_properties(vex_info) + rule["properties"].update(vex_properties) + + rules[rule_id] = rule + + return list(rules.values()) + + +def _generate_enhanced_results(vulnerabilities: List[Dict[str, Any]], + external_data: Dict[str, Dict[str, Any]]) -> List[Dict[str, Any]]: + """Generate enhanced SARIF results with external data and VEX information.""" + results = [] + + for vuln in vulnerabilities: + cve = vuln.get("cve", "UNKNOWN") + component_name = vuln.get("component_name", "Unknown") + component_version = vuln.get("component_version", "Unknown") + severity = vuln.get("severity", "UNKNOWN") + base_score = vuln.get("base_score", "N/A") + + # Get external data and VEX info + ext_data = external_data.get(cve, {}) + vex_info = get_vex_info(vuln) + + # Create enhanced package URL with ecosystem detection + ecosystem = _detect_package_ecosystem(component_name, component_version, ext_data.get("purl")) + artifact_uri = f"pkg:{ecosystem}/{component_name}@{component_version}" + + # Create unique rule ID combining CVE, component, and version + rule_id = f"{cve}:{component_name}@{component_version}" if cve != "UNKNOWN" else f"UNKNOWN:{component_name}@{component_version}" + + # Map severity to SARIF level with VEX consideration + original_level = _map_severity_to_sarif_level(severity) + vex_status = vex_info.get("vuln_exp_status") if vex_info else None + final_level = map_vex_status_to_sarif_level(vex_status, original_level, ext_data) + + # Determine prioritization context based on promotion/demotion logic + priority_context = "" + + # Check if promoted to ERROR by external intelligence + if final_level == "error" and original_level == "warning": + # Check promotion reasons in order of priority + if ext_data.get("cisa_kev"): + priority_context = "[CISA KEV] " + elif (ext_data.get("epss_score") or 0) > 0.1: + priority_context = f"[EPSS: {ext_data['epss_score']:.3f}] " + elif vex_status and vex_status.lower() in ["exploitable", "affected"]: + priority_context = f"[VEX: {vex_status.upper()}] " + + # Check if demoted to NOTE by VEX + elif final_level == "note" and original_level == "warning": + if vex_status: + priority_context = f"[VEX: {vex_status.upper()}] " + + # Create clean message without component details (since grouped by component) + message_text = f"{priority_context}[CVSS: {base_score}] {cve}" + + + result = { + "ruleId": rule_id, + "level": final_level, + "message": { + "text": message_text + }, + "locations": [{ + "physicalLocation": { + "artifactLocation": { + "uri": artifact_uri, + "description": { + "text": f"Vulnerable component: {component_name} version {component_version}" + } + }, + "region": { + "startLine": 1, + "startColumn": 1, + "snippet": { + "text": f"{component_name}@{component_version}" + } + } + }, + "logicalLocations": [{ + "name": component_name, + "fullyQualifiedName": artifact_uri, + "kind": "package" + }] + }], + "properties": { + "vulnerability_id": vuln.get("id"), + "cvss_version": vuln.get("cvss_version"), + "security-severity": str(base_score), # SARIF standard property for security findings + "attack_vector": vuln.get("attack_vector"), + "attack_complexity": vuln.get("attack_complexity"), + "availability_impact": vuln.get("availability_impact"), + "component_id": vuln.get("component_id"), + "component_name": component_name, + "component_version": component_version, + "ecosystem": ecosystem, + "package_url": artifact_uri, + "baselineState": "unchanged", + "tags": { + "vulnerability": [cve], + "component": [f"{component_name}@{component_version}"], + "severity": [severity.lower() if severity != "UNKNOWN" else "unknown"] + } + } + } + + # Add external data properties + if ext_data.get("epss_score") is not None: + result["properties"]["epss_score"] = ext_data["epss_score"] + result["properties"]["epss_percentile"] = ext_data["epss_percentile"] + + if ext_data.get("cisa_kev"): + result["properties"]["cisa_known_exploited"] = True + + if ext_data.get("nvd_cwe"): + result["properties"]["cwe_ids"] = ext_data["nvd_cwe"] + + if ext_data.get("nvd_description"): + result["properties"]["nvd_description"] = ext_data["nvd_description"] + + if ext_data.get("full_cvss_vector"): + result["properties"]["full_cvss_vector"] = ext_data["full_cvss_vector"] + + if ext_data.get("nvd_references"): + # Store key references for analysis tools + result["properties"]["nvd_reference_count"] = len(ext_data["nvd_references"]) + result["properties"]["nvd_vendor_advisories"] = len([ + ref for ref in ext_data["nvd_references"] + if "vendor advisory" in [tag.lower() for tag in ref.get("tags", [])] + ]) + + # Add VEX properties + if vex_info: + vex_properties = generate_vex_properties(vex_info) + result["properties"].update(vex_properties) + + # Add fingerprints for deduplication + wid = str(vuln.get("id", "unknown")) + result["fingerprints"] = { + "workbench/component": f"{component_name}@{component_version}", + "workbench/vulnerability": f"{cve}#{wid}", + "workbench/id": wid, + "primary": f"{wid}", + "stable": f"{cve}" + } + + # Add suppression information if VEX status indicates resolved/mitigated + if vex_info and vex_info.get("vuln_exp_status"): + vex_status = vex_info["vuln_exp_status"].lower() + if vex_status in ["not_affected", "fixed", "mitigated", "accepted_risk", "false_positive", "resolved"]: + result["suppressions"] = [{ + "kind": "externalTriage", + "status": "accepted", + "justification": vex_info.get("vuln_exp_justification", f"VEX status: {vex_status}") + }] + + results.append(result) + + return results \ No newline at end of file diff --git a/src/workbench_cli/utilities/vuln_report/spdx_generator.py b/src/workbench_cli/utilities/vuln_report/spdx_generator.py new file mode 100644 index 0000000..2d0fd1b --- /dev/null +++ b/src/workbench_cli/utilities/vuln_report/spdx_generator.py @@ -0,0 +1,400 @@ +""" +SPDX 3.0 vulnerability report generation. + +This module provides functionality to convert vulnerability data from the Workbench API +into SPDX 3.0 format with Security Profile, which provides standardized vulnerability +information within software bill of materials. +""" + +import json +import logging +import os +from typing import Dict, List, Any, Optional +from datetime import datetime + +logger = logging.getLogger(__name__) + +# SPDX imports (optional dependency) +try: + from spdx_tools.spdx.model import Document, CreationInfo, Actor, ActorType + from spdx_tools.spdx.model.package import Package + from spdx_tools.spdx.model.vulnerability import Vulnerability, VulnerabilityReference + from spdx_tools.spdx.writer.json import write_document_to_file + SPDX_AVAILABLE = True +except ImportError: + # Fallback types when SPDX is not available + Document = Any + CreationInfo = Any + Actor = Any + ActorType = Any + Package = Any + Vulnerability = Any + VulnerabilityReference = Any + SPDX_AVAILABLE = False + +from .component_enrichment import _detect_package_ecosystem +from .risk_adjustments import calculate_dynamic_risk, risk_level_to_spdx_severity + + +def save_vulns_to_spdx( + filepath: str, + vulnerabilities: List[Dict[str, Any]], + scan_code: str, + external_data: Optional[Dict[str, Dict[str, Any]]] = None, + nvd_enrichment: bool = False, + epss_enrichment: bool = False, + cisa_kev_enrichment: bool = False, + api_timeout: int = 30, + enable_vex_suppression: bool = True, + quiet: bool = False +) -> None: + """ + Save vulnerability results in SPDX 3.0 format. + + Args: + filepath: Path where the SPDX file should be saved + vulnerabilities: List of vulnerability dictionaries from the API + scan_code: The scan code for reference + external_data: Pre-fetched external enrichment data (optional) + nvd_enrichment: Whether NVD enrichment was enabled + epss_enrichment: Whether EPSS enrichment was enabled + cisa_kev_enrichment: Whether CISA KEV enrichment was enabled + api_timeout: API timeout used for enrichment + enable_vex_suppression: Whether VEX suppression is enabled + quiet: Whether to suppress output messages + + Raises: + ImportError: If spdx-tools is not installed + IOError: If the file cannot be written + OSError: If the directory cannot be created + """ + if not SPDX_AVAILABLE: + raise ImportError( + "SPDX support requires the 'spdx-tools' package. " + "This should be installed automatically with workbench-cli. " + "Try reinstalling: pip install --force-reinstall workbench-cli" + ) + + output_dir = os.path.dirname(filepath) or "." + + try: + os.makedirs(output_dir, exist_ok=True) + + spdx_document = convert_vulns_to_spdx( + vulnerabilities, + scan_code, + external_data, + nvd_enrichment, + epss_enrichment, + cisa_kev_enrichment, + enable_vex_suppression + ) + + # Use SPDX JSON writer + write_document_to_file(spdx_document, filepath) + + if not quiet: + print(f"Saved SPDX 3.0 document to: {filepath}") + + except (IOError, OSError) as e: + if not quiet: + print(f"\nWarning: Failed to save SPDX results to {filepath}: {e}") + raise + + +def convert_vulns_to_spdx( + vulnerabilities: List[Dict[str, Any]], + scan_code: str, + external_data: Optional[Dict[str, Dict[str, Any]]] = None, + nvd_enrichment: bool = False, + epss_enrichment: bool = False, + cisa_kev_enrichment: bool = False, + enable_vex_suppression: bool = True +) -> Document: + """ + Convert vulnerability data to SPDX 3.0 Document format. + + Args: + vulnerabilities: List of vulnerability dictionaries from the Workbench API + scan_code: The scan code for reference + external_data: Pre-fetched external enrichment data (optional) + nvd_enrichment: Whether NVD enrichment was enabled + epss_enrichment: Whether EPSS enrichment was enabled + cisa_kev_enrichment: Whether CISA KEV enrichment was enabled + enable_vex_suppression: Whether VEX suppression is enabled + + Returns: + SPDX Document object containing vulnerability information + """ + if not SPDX_AVAILABLE: + raise ImportError("SPDX support requires the 'spdx-tools' package which should be installed automatically") + + if external_data is None: + external_data = {} + + # Create SPDX document + creation_info = CreationInfo( + spdx_version="SPDX-3.0", + spdx_id=f"SPDXRef-DOCUMENT-{scan_code}", + name=f"Vulnerability Report - {scan_code}", + document_namespace=f"https://workbench.fossid.com/spdx/{scan_code}", + creators=[Actor(ActorType.TOOL, "FossID Workbench CLI")], + created=datetime.utcnow() + ) + + document = Document(creation_info) + + # Create packages and vulnerabilities + packages = {} + + for vuln in vulnerabilities: + component_name = vuln.get("component_name", "Unknown") + component_version = vuln.get("component_version", "Unknown") + cve = vuln.get("cve", "UNKNOWN") + + # Create package if not exists + package_key = f"{component_name}@{component_version}" + if package_key not in packages: + ecosystem = _detect_package_ecosystem(component_name, component_version) + + package = Package( + spdx_id=f"SPDXRef-Package-{component_name}-{component_version}", + name=component_name, + version=component_version, + download_location="NOASSERTION" # Required field + ) + + # Add package URL if possible + if ecosystem != "generic": + package.external_package_refs = [ + f"pkg:{ecosystem}/{component_name}@{component_version}" + ] + + packages[package_key] = package + document.packages.append(package) + + # Create vulnerability + vulnerability = _create_spdx_vulnerability(vuln, external_data.get(cve, {})) + document.vulnerabilities.append(vulnerability) + + return document + + +def _create_spdx_vulnerability( + vuln: Dict[str, Any], + ext_data: Dict[str, Any] +) -> Vulnerability: + """Create an SPDX Vulnerability object from vulnerability data.""" + cve = vuln.get("cve", "UNKNOWN") + component_name = vuln.get("component_name", "Unknown") + component_version = vuln.get("component_version", "Unknown") + + # Create vulnerability + vulnerability_id = cve if cve != "UNKNOWN" else f"UNKNOWN-{vuln.get('id', 'unknown')}" + + vulnerability = Vulnerability( + spdx_id=f"SPDXRef-Vulnerability-{vulnerability_id}-{component_name}-{component_version}", + name=vulnerability_id + ) + + # Add description from NVD if available + if ext_data.get("nvd_description"): + vulnerability.summary = ext_data["nvd_description"] + else: + vulnerability.summary = f"Security vulnerability affecting {component_name} version {component_version}" + + # Add CVSS information and dynamic risk assessment + base_score = vuln.get("base_score") + if base_score and base_score != "N/A": + try: + score_value = float(base_score) + # Note: SPDX 3.0 vulnerability model is still evolving + # This is a simplified representation + vulnerability.cvss_score = score_value + + # Apply dynamic risk assessment to severity (NEW) + risk_adjustment = calculate_dynamic_risk(vuln, ext_data, enable_vex_suppression=True) + if risk_adjustment.adjusted_level != risk_adjustment.original_level: + # Use dynamic risk level for severity when adjusted + vulnerability.severity = risk_level_to_spdx_severity(risk_adjustment.adjusted_level) + else: + # Use original CVSS-based severity + vulnerability.severity = _map_severity_to_spdx(vuln.get("severity", "UNKNOWN")) + except (ValueError, TypeError): + pass + + # Add external references + references = [] + + # NVD reference + if cve != "UNKNOWN": + nvd_ref = VulnerabilityReference( + locator=f"https://nvd.nist.gov/vuln/detail/{cve}", + reference_type="advisory" + ) + references.append(nvd_ref) + + # Additional NVD references + if ext_data.get("nvd_references"): + for ref in ext_data["nvd_references"][:5]: # Limit to 5 references + ref_obj = VulnerabilityReference( + locator=ref.get("url", ""), + reference_type="other" + ) + references.append(ref_obj) + + vulnerability.external_references = references + + # Add VEX information and dynamic risk as annotations + annotations = [] + + # Dynamic risk assessment annotations (NEW) + risk_adjustment = calculate_dynamic_risk(vuln, ext_data, enable_vex_suppression=True) + if risk_adjustment.adjusted_level != risk_adjustment.original_level: + annotations.append(f"Dynamic Risk: {risk_adjustment.adjusted_level.value.upper()}") + annotations.append(f"Risk Adjustment: {risk_adjustment.adjustment_reason}") + if risk_adjustment.priority_context: + annotations.append(f"Priority: {risk_adjustment.priority_context}") + + vex_status = vuln.get("vuln_exp_status") + if vex_status: + annotations.append(f"VEX Status: {vex_status}") + + vex_response = vuln.get("vuln_exp_response") + if vex_response: + annotations.append(f"VEX Response: {vex_response}") + + vex_justification = vuln.get("vuln_exp_justification") + if vex_justification: + annotations.append(f"VEX Justification: {vex_justification}") + + # External enrichment annotations + if ext_data.get("epss_score") is not None: + annotations.append(f"EPSS Score: {ext_data['epss_score']:.3f}") + annotations.append(f"EPSS Percentile: {ext_data.get('epss_percentile', 'N/A')}") + + if ext_data.get("cisa_kev"): + annotations.append("CISA Known Exploited Vulnerability") + + if annotations: + vulnerability.comment = "; ".join(annotations) + + return vulnerability + + +def _map_severity_to_spdx(severity: str) -> str: + """Map Workbench severity to SPDX severity.""" + severity_map = { + "CRITICAL": "CRITICAL", + "HIGH": "HIGH", + "MEDIUM": "MEDIUM", + "LOW": "LOW", + "UNKNOWN": "UNKNOWN" + } + return severity_map.get(severity.upper(), "UNKNOWN") + + +# Fallback implementation for when spdx-tools is not available +def _create_spdx_json_fallback( + vulnerabilities: List[Dict[str, Any]], + scan_code: str, + external_data: Optional[Dict[str, Dict[str, Any]]] = None +) -> Dict[str, Any]: + """ + Create a simplified SPDX 3.0-like JSON structure when spdx-tools is not available. + This is a fallback implementation that creates a basic structure. + """ + if external_data is None: + external_data = {} + + # Create basic SPDX 3.0 structure + spdx_doc = { + "spdxVersion": "SPDX-3.0", + "dataLicense": "CC0-1.0", + "SPDXID": f"SPDXRef-DOCUMENT-{scan_code}", + "name": f"Vulnerability Report - {scan_code}", + "documentNamespace": f"https://workbench.fossid.com/spdx/{scan_code}", + "creationInfo": { + "created": datetime.utcnow().isoformat() + "Z", + "creators": ["Tool: FossID Workbench CLI"] + }, + "packages": [], + "vulnerabilities": [] + } + + # Track unique packages + packages = {} + + for vuln in vulnerabilities: + component_name = vuln.get("component_name", "Unknown") + component_version = vuln.get("component_version", "Unknown") + cve = vuln.get("cve", "UNKNOWN") + + # Create package if not exists + package_key = f"{component_name}@{component_version}" + if package_key not in packages: + ecosystem = _detect_package_ecosystem(component_name, component_version) + + package = { + "SPDXID": f"SPDXRef-Package-{component_name}-{component_version}", + "name": component_name, + "version": component_version, + "downloadLocation": "NOASSERTION" + } + + if ecosystem != "generic": + package["externalRefs"] = [{ + "referenceCategory": "PACKAGE-MANAGER", + "referenceType": "purl", + "referenceLocator": f"pkg:{ecosystem}/{component_name}@{component_version}" + }] + + packages[package_key] = package + spdx_doc["packages"].append(package) + + # Create vulnerability + vulnerability_id = cve if cve != "UNKNOWN" else f"UNKNOWN-{vuln.get('id', 'unknown')}" + + vulnerability = { + "SPDXID": f"SPDXRef-Vulnerability-{vulnerability_id}-{component_name}-{component_version}", + "name": vulnerability_id + } + + # Add description + if external_data.get(cve, {}).get("nvd_description"): + vulnerability["summary"] = external_data[cve]["nvd_description"] + else: + vulnerability["summary"] = f"Security vulnerability affecting {component_name} version {component_version}" + + # Add CVSS information + base_score = vuln.get("base_score") + if base_score and base_score != "N/A": + try: + vulnerability["cvssScore"] = float(base_score) + vulnerability["severity"] = vuln.get("severity", "UNKNOWN") + except (ValueError, TypeError): + pass + + # Add external references + references = [] + if cve != "UNKNOWN": + references.append({ + "referenceCategory": "SECURITY", + "referenceType": "advisory", + "referenceLocator": f"https://nvd.nist.gov/vuln/detail/{cve}" + }) + + if external_data.get(cve, {}).get("nvd_references"): + for ref in external_data[cve]["nvd_references"][:5]: + references.append({ + "referenceCategory": "OTHER", + "referenceType": "other", + "referenceLocator": ref.get("url", "") + }) + + if references: + vulnerability["externalRefs"] = references + + spdx_doc["vulnerabilities"].append(vulnerability) + + return spdx_doc \ No newline at end of file diff --git a/src/workbench_cli/utilities/vulnerability_enricher.py b/src/workbench_cli/utilities/vuln_report/vulnerability_enricher.py similarity index 100% rename from src/workbench_cli/utilities/vulnerability_enricher.py rename to src/workbench_cli/utilities/vuln_report/vulnerability_enricher.py diff --git a/vuln-report-epss.json b/vuln-report-epss.json new file mode 100644 index 0000000..9fb401e --- /dev/null +++ b/vuln-report-epss.json @@ -0,0 +1 @@ +{"components": [{"bom-ref": "BomRef.5015867418398539.5529893063021064", "name": "Flask", "purl": "pkg:pypi/flask@1.1.2", "type": "library", "version": "1.1.2"}, {"bom-ref": "BomRef.9410242564228095.34944569487824817", "name": "Jaxer", "purl": "pkg:github/jaxer@1.0.3", "type": "library", "version": "1.0.3"}, {"bom-ref": "BomRef.9883471750381841.7466662592964213", "name": "Werkzeug", "purl": "pkg:pypi/werkzeug@1.0.1", "type": "library", "version": "1.0.1"}, {"bom-ref": "BomRef.673543781581126.1839168456417254", "name": "async", "purl": "pkg:npm/async@2.6.3", "type": "library", "version": "2.6.3"}, {"bom-ref": "BomRef.728053427688792.5378136988069724", "name": "body-parser", "purl": "pkg:npm/body-parser@1.19.0", "type": "library", "version": "1.19.0"}, {"bom-ref": "BomRef.8487697603637333.4730879948474398", "name": "certifi", "purl": "pkg:pypi/certifi@2018.11.29", "type": "library", "version": "2018.11.29"}, {"bom-ref": "BomRef.22433138186869872.8560950398655969", "name": "com.google.crypto.tink/tink", "purl": "pkg:maven/com.google.crypto.tink/tink@1.3.0-rc2", "type": "library", "version": "1.3.0-rc2"}, {"bom-ref": "BomRef.6804180962281385.13176555549611935", "name": "com.google.protobuf/protobuf-java", "purl": "pkg:maven/com.google.protobuf/protobuf-java@3.10.0", "type": "library", "version": "3.10.0"}, {"bom-ref": "BomRef.01341803731587321.2123770698572679", "name": "core", "purl": "pkg:github/core@23.1", "type": "library", "version": "23.1"}, {"bom-ref": "BomRef.1474893841097934.4949872678438342", "name": "debug", "purl": "pkg:npm/debug@2.2.0", "type": "library", "version": "2.2.0"}, {"bom-ref": "BomRef.7377350103591641.9999959620672784", "name": "decode-uri-component", "purl": "pkg:npm/decode-uri-component@0.2.0", "type": "library", "version": "0.2.0"}, {"bom-ref": "BomRef.32603828750058794.13944987388968155", "name": "dottie", "purl": "pkg:npm/dottie@2.0.2", "type": "library", "version": "2.0.2"}, {"bom-ref": "BomRef.9958908726427385.41640262961572616", "name": "express", "purl": "pkg:npm/express@4.17.1", "type": "library", "version": "4.17.1"}, {"bom-ref": "BomRef.16248057238852376.11894782673472637", "name": "gitpython", "purl": "pkg:pypi/gitpython@2.1.11", "type": "library", "version": "2.1.11"}, {"bom-ref": "BomRef.38172497497161795.022580157295507552", "name": "glob-parent", "purl": "pkg:npm/glob-parent@3.1.0", "type": "library", "version": "3.1.0"}, {"bom-ref": "BomRef.26125065962048877.006979537446065942", "name": "handlebars", "purl": "pkg:npm/handlebars@2.0.0", "type": "library", "version": "2.0.0"}, {"bom-ref": "BomRef.5587360668863955.3901355586579408", "name": "httpd", "purl": "pkg:github/httpd@2.1.5", "type": "library", "version": "2.1.5"}, {"bom-ref": "BomRef.0671755541171144.9281861038312356", "name": "jsonwebtoken", "purl": "pkg:npm/jsonwebtoken@8.5.1", "type": "library", "version": "8.5.1"}, {"bom-ref": "BomRef.19165222568146623.13818775783266168", "name": "junit/junit", "purl": "pkg:maven/junit/junit@4.12", "type": "library", "version": "4.12"}, {"bom-ref": "BomRef.5016908150967304.04660173011288682", "name": "lodash", "purl": "pkg:npm/lodash@4.17.20", "type": "library", "version": "4.17.20"}, {"bom-ref": "BomRef.9672349152734327.2572747503716969", "name": "minimatch", "purl": "pkg:npm/minimatch@3.0.4", "type": "library", "version": "3.0.4"}, {"bom-ref": "BomRef.20473345059877013.9811815430820026", "name": "minimist", "purl": "pkg:npm/minimist@0.0.8", "type": "library", "version": "0.0.8"}, {"bom-ref": "BomRef.10101367219257584.8276993172182099", "name": "moment", "purl": "pkg:npm/moment@2.28.0", "type": "library", "version": "2.28.0"}, {"bom-ref": "BomRef.8220319534931615.5732818757286379", "name": "ms", "purl": "pkg:npm/ms@0.7.1", "type": "library", "version": "0.7.1"}, {"bom-ref": "BomRef.5919948334602787.9912958500788254", "name": "mysql-server", "purl": "pkg:github/mysql-server@mysql-5.0.52", "type": "library", "version": "mysql-5.0.52"}, {"bom-ref": "BomRef.6470797888368227.8823503558806409", "name": "opencart", "purl": "pkg:github/opencart@3.0.3.9", "type": "library", "version": "3.0.3.9"}, {"bom-ref": "BomRef.9849441235973053.9905469000440621", "name": "org.apache.derby/derby", "purl": "pkg:maven/org.apache.derby/derby@10.8.2.2", "type": "library", "version": "10.8.2.2"}, {"bom-ref": "BomRef.5027080234434728.663798481118192", "name": "path-parse", "purl": "pkg:npm/path-parse@1.0.6", "type": "library", "version": "1.0.6"}, {"bom-ref": "BomRef.5084068118501069.2920661410204173", "name": "pyjwt", "purl": "pkg:pypi/pyjwt@1.6.4", "type": "library", "version": "1.6.4"}, {"bom-ref": "BomRef.7926947193899209.2736944734351441", "name": "qs", "purl": "pkg:npm/qs@6.7.0", "type": "library", "version": "6.7.0"}, {"bom-ref": "BomRef.2852608381709688.3192075891818317", "name": "requests", "purl": "pkg:pypi/requests@2.21.0", "type": "library", "version": "2.21.0"}, {"bom-ref": "BomRef.34100267956153885.052308719330987685", "name": "revel/revel", "purl": "pkg:golang/revel/revel@v0.21.0", "type": "library", "version": "v0.21.0"}, {"bom-ref": "BomRef.3158569679011557.9291257878786697", "name": "safety", "purl": "pkg:pypi/safety@1.8.4", "type": "library", "version": "1.8.4"}, {"bom-ref": "BomRef.30667251441621235.9950025739109604", "name": "semver", "purl": "pkg:npm/semver@5.7.1", "type": "library", "version": "5.7.1"}, {"bom-ref": "BomRef.35274273626357255.9602057346237564", "name": "semver", "purl": "pkg:npm/semver@7.3.2", "type": "library", "version": "7.3.2"}, {"bom-ref": "BomRef.34445063472709214.44310022635101853", "name": "send", "purl": "pkg:npm/send@0.17.1", "type": "library", "version": "0.17.1"}, {"bom-ref": "BomRef.7220939765471375.37886797857186616", "name": "sequelize", "purl": "pkg:npm/sequelize@6.3.5", "type": "library", "version": "6.3.5"}, {"bom-ref": "BomRef.8167051593528316.5339527606923408", "name": "serve-static", "purl": "pkg:npm/serve-static@1.14.1", "type": "library", "version": "1.14.1"}, {"bom-ref": "BomRef.8316312714127189.4105365732006804", "name": "shelljs", "purl": "pkg:npm/shelljs@0.7.8", "type": "library", "version": "0.7.8"}, {"bom-ref": "BomRef.02646854172307067.6197331165603063", "name": "swagger-ui", "purl": "pkg:github/swagger-ui@3.19.3", "type": "library", "version": "3.19.3"}, {"bom-ref": "BomRef.966334455593416.9532032122253387", "name": "textpattern", "purl": "pkg:github/textpattern@4.3.0", "type": "library", "version": "4.3.0"}, {"bom-ref": "BomRef.6500836204522693.34253115076410534", "name": "underscore", "purl": "pkg:github/underscore@1.7.0", "type": "library", "version": "1.7.0"}, {"bom-ref": "BomRef.9377925526969101.017428398274038637", "name": "urllib3", "purl": "pkg:pypi/urllib3@1.24.1", "type": "library", "version": "1.24.1"}, {"bom-ref": "BomRef.6998936851785492.30381529048995426", "name": "validator", "purl": "pkg:npm/validator@10.11.0", "type": "library", "version": "10.11.0"}, {"bom-ref": "BomRef.7738192653583078.45062690508264314", "name": "web", "purl": "pkg:maven/web@2.0.0", "type": "library", "version": "2.0.0"}, {"bom-ref": "BomRef.2641455631118449.5895151060591177", "name": "wheel", "purl": "pkg:pypi/wheel@0.32.3", "type": "library", "version": "0.32.3"}], "dependencies": [{"ref": "BomRef.5015867418398539.5529893063021064"}, {"ref": "BomRef.9410242564228095.34944569487824817"}, {"ref": "BomRef.9883471750381841.7466662592964213"}, {"ref": "BomRef.673543781581126.1839168456417254"}, {"ref": "BomRef.728053427688792.5378136988069724"}, {"ref": "BomRef.8487697603637333.4730879948474398"}, {"ref": "BomRef.22433138186869872.8560950398655969"}, {"ref": "BomRef.6804180962281385.13176555549611935"}, {"ref": "BomRef.01341803731587321.2123770698572679"}, {"ref": "BomRef.1474893841097934.4949872678438342"}, {"ref": "BomRef.7377350103591641.9999959620672784"}, {"ref": "BomRef.32603828750058794.13944987388968155"}, {"ref": "BomRef.9958908726427385.41640262961572616"}, {"ref": "BomRef.16248057238852376.11894782673472637"}, {"ref": "BomRef.38172497497161795.022580157295507552"}, {"ref": "BomRef.26125065962048877.006979537446065942"}, {"ref": "BomRef.5587360668863955.3901355586579408"}, {"ref": "BomRef.0671755541171144.9281861038312356"}, {"ref": "BomRef.19165222568146623.13818775783266168"}, {"ref": "BomRef.5016908150967304.04660173011288682"}, {"ref": "BomRef.9672349152734327.2572747503716969"}, {"ref": "BomRef.20473345059877013.9811815430820026"}, {"ref": "BomRef.10101367219257584.8276993172182099"}, {"ref": "BomRef.8220319534931615.5732818757286379"}, {"ref": "BomRef.5919948334602787.9912958500788254"}, {"ref": "BomRef.6470797888368227.8823503558806409"}, {"ref": "BomRef.9849441235973053.9905469000440621"}, {"ref": "BomRef.5027080234434728.663798481118192"}, {"ref": "BomRef.5084068118501069.2920661410204173"}, {"ref": "BomRef.7926947193899209.2736944734351441"}, {"ref": "BomRef.2852608381709688.3192075891818317"}, {"ref": "BomRef.34100267956153885.052308719330987685"}, {"ref": "BomRef.3158569679011557.9291257878786697"}, {"ref": "BomRef.30667251441621235.9950025739109604"}, {"ref": "BomRef.35274273626357255.9602057346237564"}, {"ref": "BomRef.34445063472709214.44310022635101853"}, {"ref": "BomRef.7220939765471375.37886797857186616"}, {"ref": "BomRef.8167051593528316.5339527606923408"}, {"ref": "BomRef.8316312714127189.4105365732006804"}, {"ref": "BomRef.02646854172307067.6197331165603063"}, {"ref": "BomRef.966334455593416.9532032122253387"}, {"ref": "BomRef.6500836204522693.34253115076410534"}, {"ref": "BomRef.9377925526969101.017428398274038637"}, {"ref": "BomRef.6998936851785492.30381529048995426"}, {"ref": "BomRef.7738192653583078.45062690508264314"}, {"ref": "BomRef.2641455631118449.5895151060591177"}], "metadata": {"timestamp": "2025-07-05T16:13:37.108960-04:00"}, "serialNumber": "urn:uuid:4780e153-7f38-4c21-a026-d4b13eb195a9", "version": 1, "vulnerabilities": [{"bom-ref": "vuln-CVE-2006-20001-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2006-20001", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2006-20001", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-20001"}}]}, {"bom-ref": "vuln-CVE-2016-8612-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2016-8612", "ratings": [{"method": "CVSSv3", "score": "4.3", "severity": "medium", "vector": "CVSS:3.0/AV:A/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2016-8612", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8612"}}]}, {"bom-ref": "vuln-CVE-2016-8750-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2016-8750", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2016-8750", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8750"}}]}, {"bom-ref": "vuln-CVE-2017-16137-debug-2.2.0", "description": "Security vulnerability affecting debug version 2.2.0", "id": "CVE-2017-16137", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2017-16137", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16137"}}]}, {"bom-ref": "vuln-CVE-2017-20162-ms-0.7.1", "description": "Security vulnerability affecting ms version 0.7.1", "id": "CVE-2017-20162", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2017-20162", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-20162"}}]}, {"bom-ref": "vuln-CVE-2017-20165-debug-2.2.0", "description": "Security vulnerability affecting debug version 2.2.0", "id": "CVE-2017-20165", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2017-20165", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-20165"}}]}, {"bom-ref": "vuln-CVE-2018-0735-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2018-0735", "ratings": [{"method": "CVSSv3", "score": "5.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}, {"method": "other", "score": "0.1"}], "references": [{"id": "CVE-2018-0735", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0735"}}]}, {"bom-ref": "vuln-CVE-2018-11786-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2018-11786", "ratings": [{"method": "CVSSv3", "score": "8.8", "severity": "high", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2018-11786", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11786"}}]}, {"bom-ref": "vuln-CVE-2018-11787-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2018-11787", "ratings": [{"method": "CVSSv3", "score": "8.1", "severity": "high", "vector": "CVSS:3.0/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2018-11787", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11787"}}]}, {"bom-ref": "vuln-CVE-2018-11788-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2018-11788", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.2"}], "references": [{"id": "CVE-2018-11788", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11788"}}]}, {"bom-ref": "vuln-CVE-2018-1301-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2018-1301", "ratings": [{"method": "CVSSv3", "score": "5.9", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.1"}], "references": [{"id": "CVE-2018-1301", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1301"}}]}, {"bom-ref": "vuln-CVE-2018-1302-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2018-1302", "ratings": [{"method": "CVSSv3", "score": "5.9", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.1"}], "references": [{"id": "CVE-2018-1302", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1302"}}]}, {"bom-ref": "vuln-CVE-2018-1303-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2018-1303", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.3"}], "references": [{"id": "CVE-2018-1303", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1303"}}]}, {"bom-ref": "vuln-CVE-2018-1313-org.apache.derby/derby-10.8.2.2", "description": "Security vulnerability affecting org.apache.derby/derby version 10.8.2.2", "id": "CVE-2018-1313", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2018-1313", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1313"}}]}, {"bom-ref": "vuln-CVE-2018-25031-swagger-ui-3.19.3", "description": "Security vulnerability affecting swagger-ui version 3.19.3", "id": "CVE-2018-25031", "ratings": [{"method": "other", "score": "8.0", "severity": "high"}, {"method": "CVSSv3", "score": "4.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.8"}], "references": [{"id": "CVE-2018-25031", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25031"}}]}, {"bom-ref": "vuln-CVE-2018-25091-urllib3-1.24.1", "description": "Security vulnerability affecting urllib3 version 1.24.1", "id": "CVE-2018-25091", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2018-25091", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25091"}}]}, {"bom-ref": "vuln-CVE-2018-3061-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2018-3061", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2018-3061", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3061"}}]}, {"bom-ref": "vuln-CVE-2018-3071-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2018-3071", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2018-3071", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3071"}}]}, {"bom-ref": "vuln-CVE-2018-7474-textpattern-4.3.0", "description": "Security vulnerability affecting textpattern version 4.3.0", "id": "CVE-2018-7474", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.2"}], "references": [{"id": "CVE-2018-7474", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7474"}}]}, {"bom-ref": "vuln-CVE-2019-0191-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2019-0191", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.1"}], "references": [{"id": "CVE-2019-0191", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0191"}}]}, {"bom-ref": "vuln-CVE-2019-0226-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2019-0226", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2019-0226", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0226"}}]}, {"bom-ref": "vuln-CVE-2019-11236-urllib3-1.24.1", "description": "Security vulnerability affecting urllib3 version 1.24.1", "id": "CVE-2019-11236", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2019-11236", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11236"}}]}, {"bom-ref": "vuln-CVE-2019-11324-urllib3-1.24.1", "description": "Security vulnerability affecting urllib3 version 1.24.1", "id": "CVE-2019-11324", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.0/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2019-11324", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11324"}}]}, {"bom-ref": "vuln-CVE-2019-14312-Jaxer-1.0.3", "description": "Security vulnerability affecting Jaxer version 1.0.3", "id": "CVE-2019-14312", "ratings": [{"method": "other", "score": "8.0", "severity": "high"}, {"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.4"}], "references": [{"id": "CVE-2019-14312", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14312"}}]}, {"bom-ref": "vuln-CVE-2019-17495-swagger-ui-3.19.3", "description": "Security vulnerability affecting swagger-ui version 3.19.3", "id": "CVE-2019-17495", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.2"}], "references": [{"id": "CVE-2019-17495", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17495"}}]}, {"bom-ref": "vuln-CVE-2019-20920-handlebars-2.0.0", "description": "Security vulnerability affecting handlebars version 2.0.0", "id": "CVE-2019-20920", "ratings": [{"method": "CVSSv3", "score": "8.1", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:H/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2019-20920", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20920"}}]}, {"bom-ref": "vuln-CVE-2019-2731-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2019-2731", "ratings": [{"method": "CVSSv3", "score": "5.4", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2019-2731", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2731"}}]}, {"bom-ref": "vuln-CVE-2019-2741-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2019-2741", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2019-2741", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2741"}}]}, {"bom-ref": "vuln-CVE-2019-2755-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2019-2755", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2019-2755", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2755"}}]}, {"bom-ref": "vuln-CVE-2019-2757-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2019-2757", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2019-2757", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2757"}}]}, {"bom-ref": "vuln-CVE-2019-7317-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2019-7317", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2019-7317", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317"}}]}, {"bom-ref": "vuln-CVE-2020-11980-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2020-11980", "ratings": [{"method": "CVSSv3", "score": "6.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-11980", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11980"}}]}, {"bom-ref": "vuln-CVE-2020-14760-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14760", "ratings": [{"method": "CVSSv3", "score": "5.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-14760", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14760"}}]}, {"bom-ref": "vuln-CVE-2020-14814-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14814", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-14814", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14814"}}]}, {"bom-ref": "vuln-CVE-2020-14830-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14830", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-14830", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14830"}}]}, {"bom-ref": "vuln-CVE-2020-14837-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14837", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-14837", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14837"}}]}, {"bom-ref": "vuln-CVE-2020-14839-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14839", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-14839", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14839"}}]}, {"bom-ref": "vuln-CVE-2020-14845-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14845", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-14845", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14845"}}]}, {"bom-ref": "vuln-CVE-2020-14846-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14846", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-14846", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14846"}}]}, {"bom-ref": "vuln-CVE-2020-14852-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14852", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-14852", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14852"}}]}, {"bom-ref": "vuln-CVE-2020-15250-junit/junit-4.12", "description": "Security vulnerability affecting junit/junit version 4.12", "id": "CVE-2020-15250", "ratings": [{"method": "CVSSv3", "score": "5.5", "severity": "medium", "vector": "CVSS:3.1/AV:L/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-15250", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15250"}}]}, {"bom-ref": "vuln-CVE-2020-15358-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-15358", "ratings": [{"method": "CVSSv3", "score": "5.5", "severity": "medium", "vector": "CVSS:3.1/AV:L/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-15358", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15358"}}]}, {"analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2020-1967-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-1967", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.6"}], "references": [{"id": "CVE-2020-1967", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1967"}}]}, {"bom-ref": "vuln-CVE-2020-1971-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-1971", "ratings": [{"method": "CVSSv3", "score": "5.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-1971", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1971"}}]}, {"bom-ref": "vuln-CVE-2020-26137-urllib3-1.24.1", "description": "Security vulnerability affecting urllib3 version 1.24.1", "id": "CVE-2020-26137", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-26137", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26137"}}]}, {"bom-ref": "vuln-CVE-2020-28469-glob-parent-3.1.0", "description": "Security vulnerability affecting glob-parent version 3.1.0", "id": "CVE-2020-28469", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-28469", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28469"}}]}, {"bom-ref": "vuln-CVE-2020-28500-lodash-4.17.20", "description": "Security vulnerability affecting lodash version 4.17.20", "id": "CVE-2020-28500", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-28500", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28500"}}]}, {"bom-ref": "vuln-CVE-2020-36568-revel/revel-v0.21.0", "description": "Security vulnerability affecting revel/revel version v0.21.0", "id": "CVE-2020-36568", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-36568", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36568"}}]}, {"bom-ref": "vuln-CVE-2020-5252-safety-1.8.4", "description": "Security vulnerability affecting safety version 1.8.4", "id": "CVE-2020-5252", "ratings": [{"method": "CVSSv3", "score": "4.1", "severity": "medium", "vector": "CVSS:3.1/AV:L/AC:H/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-5252", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5252"}}]}, {"bom-ref": "vuln-CVE-2020-7598-minimist-0.0.8", "description": "Security vulnerability affecting minimist version 0.0.8", "id": "CVE-2020-7598", "ratings": [{"method": "CVSSv3", "score": "5.6", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-7598", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7598"}}]}, {"bom-ref": "vuln-CVE-2020-8929-com.google.crypto.tink/tink-1.3.0-rc2", "description": "Security vulnerability affecting com.google.crypto.tink/tink version 1.3.0-rc2", "id": "CVE-2020-8929", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-8929", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8929"}}]}, {"bom-ref": "vuln-CVE-2021-22569-com.google.protobuf/protobuf-java-3.10.0", "description": "Security vulnerability affecting com.google.protobuf/protobuf-java version 3.10.0", "id": "CVE-2021-22569", "ratings": [{"method": "CVSSv3", "score": "5.5", "severity": "medium", "vector": "CVSS:3.1/AV:L/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-22569", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22569"}}]}, {"bom-ref": "vuln-CVE-2021-22570-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2021-22570", "ratings": [{"method": "CVSSv3", "score": "5.5", "severity": "medium", "vector": "CVSS:3.1/AV:L/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-22570", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22570"}}]}, {"bom-ref": "vuln-CVE-2021-23337-lodash-4.17.20", "description": "Security vulnerability affecting lodash version 4.17.20", "id": "CVE-2021-23337", "ratings": [{"method": "CVSSv3", "score": "7.2", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-23337", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23337"}}]}, {"bom-ref": "vuln-CVE-2021-23343-path-parse-1.0.6", "description": "Security vulnerability affecting path-parse version 1.0.6", "id": "CVE-2021-23343", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-23343", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23343"}}]}, {"bom-ref": "vuln-CVE-2021-23358-underscore-1.7.0", "description": "Security vulnerability affecting underscore version 1.7.0", "id": "CVE-2021-23358", "ratings": [{"method": "CVSSv3", "score": "7.2", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-23358", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23358"}}]}, {"bom-ref": "vuln-CVE-2021-23369-handlebars-2.0.0", "description": "Security vulnerability affecting handlebars version 2.0.0", "id": "CVE-2021-23369", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-23369", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23369"}}]}, {"bom-ref": "vuln-CVE-2021-23383-handlebars-2.0.0", "description": "Security vulnerability affecting handlebars version 2.0.0", "id": "CVE-2021-23383", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.1"}], "references": [{"id": "CVE-2021-23383", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23383"}}]}, {"bom-ref": "vuln-CVE-2021-2356-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2021-2356", "ratings": [{"method": "CVSSv3", "score": "5.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-2356", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-2356"}}]}, {"bom-ref": "vuln-CVE-2021-32785-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-32785", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-32785", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32785"}}]}, {"bom-ref": "vuln-CVE-2021-32786-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-32786", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-32786", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32786"}}]}, {"bom-ref": "vuln-CVE-2021-32791-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-32791", "ratings": [{"method": "CVSSv3", "score": "5.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-32791", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32791"}}]}, {"bom-ref": "vuln-CVE-2021-32792-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-32792", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-32792", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32792"}}]}, {"bom-ref": "vuln-CVE-2021-34798-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-34798", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.1"}], "references": [{"id": "CVE-2021-34798", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34798"}}]}, {"bom-ref": "vuln-CVE-2021-3765-validator-10.11.0", "description": "Security vulnerability affecting validator version 10.11.0", "id": "CVE-2021-3765", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-3765", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3765"}}]}, {"analysis": {"state": "exploitable"}, "bom-ref": "vuln-CVE-2021-39275-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-39275", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.5"}], "references": [{"id": "CVE-2021-39275", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39275"}}]}, {"bom-ref": "vuln-CVE-2021-40438-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-40438", "ratings": [{"method": "CVSSv3", "score": "9.0", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.9"}], "references": [{"id": "CVE-2021-40438", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40438"}}]}, {"bom-ref": "vuln-CVE-2021-40642-textpattern-4.3.0", "description": "Security vulnerability affecting textpattern version 4.3.0", "id": "CVE-2021-40642", "ratings": [{"method": "CVSSv3", "score": "4.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-40642", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40642"}}]}, {"bom-ref": "vuln-CVE-2021-41766-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2021-41766", "ratings": [{"method": "CVSSv3", "score": "8.1", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-41766", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41766"}}]}, {"bom-ref": "vuln-CVE-2021-43138-async-2.6.3", "description": "Security vulnerability affecting async version 2.6.3", "id": "CVE-2021-43138", "ratings": [{"method": "CVSSv3", "score": "7.8", "severity": "high", "vector": "CVSS:3.1/AV:L/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-43138", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43138"}}]}, {"bom-ref": "vuln-CVE-2021-44906-minimist-0.0.8", "description": "Security vulnerability affecting minimist version 0.0.8", "id": "CVE-2021-44906", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-44906", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906"}}]}, {"bom-ref": "vuln-CVE-2022-0144-shelljs-0.7.8", "description": "Security vulnerability affecting shelljs version 0.7.8", "id": "CVE-2022-0144", "ratings": [{"method": "CVSSv3", "score": "7.1", "severity": "high", "vector": "CVSS:3.0/AV:L/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-0144", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0144"}}]}, {"bom-ref": "vuln-CVE-2022-21417-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2022-21417", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-21417", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21417"}}]}, {"bom-ref": "vuln-CVE-2022-21444-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2022-21444", "ratings": [{"method": "CVSSv3", "score": "4.4", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-21444", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21444"}}]}, {"bom-ref": "vuln-CVE-2022-22719-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-22719", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.4"}], "references": [{"id": "CVE-2022-22719", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22719"}}]}, {"bom-ref": "vuln-CVE-2022-22720-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-22720", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.3"}], "references": [{"id": "CVE-2022-22720", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22720"}}]}, {"bom-ref": "vuln-CVE-2022-22721-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-22721", "ratings": [{"method": "CVSSv3", "score": "9.1", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.2"}], "references": [{"id": "CVE-2022-22721", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22721"}}]}, {"bom-ref": "vuln-CVE-2022-22932-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2022-22932", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-22932", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22932"}}]}, {"bom-ref": "vuln-CVE-2022-23491-certifi-2018.11.29", "description": "Security vulnerability affecting certifi version 2018.11.29", "id": "CVE-2022-23491", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-23491", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23491"}}]}, {"bom-ref": "vuln-CVE-2022-23539-jsonwebtoken-8.5.1", "description": "Security vulnerability affecting jsonwebtoken version 8.5.1", "id": "CVE-2022-23539", "ratings": [{"method": "CVSSv3", "score": "8.1", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-23539", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23539"}}]}, {"bom-ref": "vuln-CVE-2022-23540-jsonwebtoken-8.5.1", "description": "Security vulnerability affecting jsonwebtoken version 8.5.1", "id": "CVE-2022-23540", "ratings": [{"method": "CVSSv3", "score": "7.6", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-23540", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23540"}}]}, {"bom-ref": "vuln-CVE-2022-23541-jsonwebtoken-8.5.1", "description": "Security vulnerability affecting jsonwebtoken version 8.5.1", "id": "CVE-2022-23541", "ratings": [{"method": "CVSSv3", "score": "6.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-23541", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23541"}}]}, {"bom-ref": "vuln-CVE-2022-24439-gitpython-2.1.11", "description": "Security vulnerability affecting gitpython version 2.1.11", "id": "CVE-2022-24439", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.7"}], "references": [{"id": "CVE-2022-24439", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24439"}}]}, {"bom-ref": "vuln-CVE-2022-24785-moment-2.28.0", "description": "Security vulnerability affecting moment version 2.28.0", "id": "CVE-2022-24785", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-24785", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24785"}}]}, {"bom-ref": "vuln-CVE-2022-24999-express-4.17.1", "description": "Security vulnerability affecting express version 4.17.1", "id": "CVE-2022-24999", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-24999", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24999"}}]}, {"bom-ref": "vuln-CVE-2022-24999-qs-6.7.0", "description": "Security vulnerability affecting qs version 6.7.0", "id": "CVE-2022-24999", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-24999", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24999"}}]}, {"bom-ref": "vuln-CVE-2022-25883-semver-5.7.1", "description": "Security vulnerability affecting semver version 5.7.1", "id": "CVE-2022-25883", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-25883", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25883"}}]}, {"bom-ref": "vuln-CVE-2022-25883-semver-7.3.2", "description": "Security vulnerability affecting semver version 7.3.2", "id": "CVE-2022-25883", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-25883", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25883"}}]}, {"bom-ref": "vuln-CVE-2022-28330-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-28330", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-28330", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28330"}}]}, {"bom-ref": "vuln-CVE-2022-28614-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-28614", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-28614", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28614"}}]}, {"bom-ref": "vuln-CVE-2022-28615-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-28615", "ratings": [{"method": "CVSSv3", "score": "9.1", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-28615", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28615"}}]}, {"bom-ref": "vuln-CVE-2022-29217-pyjwt-1.6.4", "description": "Security vulnerability affecting pyjwt version 1.6.4", "id": "CVE-2022-29217", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-29217", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29217"}}]}, {"bom-ref": "vuln-CVE-2022-29361-Werkzeug-1.0.1", "description": "Security vulnerability affecting Werkzeug version 1.0.1", "id": "CVE-2022-29361", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.3"}], "references": [{"id": "CVE-2022-29361", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29361"}}]}, {"bom-ref": "vuln-CVE-2022-29404-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-29404", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-29404", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29404"}}]}, {"bom-ref": "vuln-CVE-2022-30556-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-30556", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-30556", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30556"}}]}, {"bom-ref": "vuln-CVE-2022-31129-moment-2.28.0", "description": "Security vulnerability affecting moment version 2.28.0", "id": "CVE-2022-31129", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-31129", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31129"}}]}, {"bom-ref": "vuln-CVE-2022-3171-com.google.protobuf/protobuf-java-3.10.0", "description": "Security vulnerability affecting com.google.protobuf/protobuf-java version 3.10.0", "id": "CVE-2022-3171", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-3171", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3171"}}]}, {"bom-ref": "vuln-CVE-2022-31813-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-31813", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-31813", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31813"}}]}, {"bom-ref": "vuln-CVE-2022-3517-minimatch-3.0.4", "description": "Security vulnerability affecting minimatch version 3.0.4", "id": "CVE-2022-3517", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-3517", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517"}}]}, {"bom-ref": "vuln-CVE-2022-37436-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-37436", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-37436", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37436"}}]}, {"bom-ref": "vuln-CVE-2022-38778-decode-uri-component-0.2.0", "description": "Security vulnerability affecting decode-uri-component version 0.2.0", "id": "CVE-2022-38778", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-38778", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38778"}}]}, {"analysis": {"response": ["will_not_fix"], "state": "exploitable"}, "bom-ref": "vuln-CVE-2022-40145-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2022-40145", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-40145", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40145"}}]}, {"bom-ref": "vuln-CVE-2022-40898-wheel-0.32.3", "description": "Security vulnerability affecting wheel version 0.32.3", "id": "CVE-2022-40898", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-40898", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40898"}}]}, {"analysis": {"response": ["can_not_fix"], "state": "exploitable"}, "bom-ref": "vuln-CVE-2022-46337-org.apache.derby/derby-10.8.2.2", "description": "Security vulnerability affecting org.apache.derby/derby version 10.8.2.2", "id": "CVE-2022-46337", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-46337", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46337"}}]}, {"bom-ref": "vuln-CVE-2023-21977-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2023-21977", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-21977", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21977"}}]}, {"analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2023-21980-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2023-21980", "ratings": [{"method": "CVSSv3", "score": "7.1", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-21980", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21980"}}]}, {"bom-ref": "vuln-CVE-2023-22007-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2023-22007", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-22007", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22007"}}]}, {"bom-ref": "vuln-CVE-2023-22015-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2023-22015", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-22015", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22015"}}]}, {"bom-ref": "vuln-CVE-2023-22026-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2023-22026", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-22026", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22026"}}]}, {"bom-ref": "vuln-CVE-2023-22028-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2023-22028", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-22028", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22028"}}]}, {"bom-ref": "vuln-CVE-2023-22578-sequelize-6.3.5", "description": "Security vulnerability affecting sequelize version 6.3.5", "id": "CVE-2023-22578", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-22578", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22578"}}]}, {"bom-ref": "vuln-CVE-2023-22579-sequelize-6.3.5", "description": "Security vulnerability affecting sequelize version 6.3.5", "id": "CVE-2023-22579", "ratings": [{"method": "CVSSv3", "score": "8.8", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-22579", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22579"}}]}, {"bom-ref": "vuln-CVE-2023-22580-sequelize-6.3.5", "description": "Security vulnerability affecting sequelize version 6.3.5", "id": "CVE-2023-22580", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-22580", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22580"}}]}, {"bom-ref": "vuln-CVE-2023-23934-Werkzeug-1.0.1", "description": "Security vulnerability affecting Werkzeug version 1.0.1", "id": "CVE-2023-23934", "ratings": [{"method": "CVSSv3", "score": "3.5", "severity": "low", "vector": "CVSS:3.1/AV:A/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-23934", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23934"}}]}, {"bom-ref": "vuln-CVE-2023-25577-Werkzeug-1.0.1", "description": "Security vulnerability affecting Werkzeug version 1.0.1", "id": "CVE-2023-25577", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-25577", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25577"}}]}, {"bom-ref": "vuln-CVE-2023-25813-sequelize-6.3.5", "description": "Security vulnerability affecting sequelize version 6.3.5", "id": "CVE-2023-25813", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-25813", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25813"}}]}, {"bom-ref": "vuln-CVE-2023-26132-dottie-2.0.2", "description": "Security vulnerability affecting dottie version 2.0.2", "id": "CVE-2023-26132", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-26132", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26132"}}]}, {"bom-ref": "vuln-CVE-2023-26852-textpattern-4.3.0", "description": "Security vulnerability affecting textpattern version 4.3.0", "id": "CVE-2023-26852", "ratings": [{"method": "CVSSv3", "score": "7.2", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.1"}], "references": [{"id": "CVE-2023-26852", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26852"}}]}, {"bom-ref": "vuln-CVE-2023-27152-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-27152", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-27152", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27152"}}]}, {"bom-ref": "vuln-CVE-2023-30861-Flask-1.1.2", "description": "Security vulnerability affecting Flask version 1.1.2", "id": "CVE-2023-30861", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-30861", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30861"}}]}, {"bom-ref": "vuln-CVE-2023-31122-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2023-31122", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-31122", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31122"}}]}, {"bom-ref": "vuln-CVE-2023-32681-requests-2.21.0", "description": "Security vulnerability affecting requests version 2.21.0", "id": "CVE-2023-32681", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}, {"method": "other", "score": "0.1"}], "references": [{"id": "CVE-2023-32681", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32681"}}]}, {"bom-ref": "vuln-CVE-2023-37920-certifi-2018.11.29", "description": "Security vulnerability affecting certifi version 2018.11.29", "id": "CVE-2023-37920", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-37920", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37920"}}]}, {"bom-ref": "vuln-CVE-2023-38997-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-38997", "ratings": [{"method": "CVSSv3", "score": "7.2", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-38997", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38997"}}]}, {"bom-ref": "vuln-CVE-2023-38998-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-38998", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-38998", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38998"}}]}, {"bom-ref": "vuln-CVE-2023-38999-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-38999", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-38999", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38999"}}]}, {"bom-ref": "vuln-CVE-2023-39000-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39000", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-39000", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39000"}}]}, {"bom-ref": "vuln-CVE-2023-39001-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39001", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-39001", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39001"}}]}, {"bom-ref": "vuln-CVE-2023-39002-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39002", "ratings": [{"method": "other", "score": "8.0", "severity": "high"}, {"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.2"}], "references": [{"id": "CVE-2023-39002", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39002"}}]}, {"bom-ref": "vuln-CVE-2023-39003-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39003", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-39003", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39003"}}]}, {"bom-ref": "vuln-CVE-2023-39004-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39004", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-39004", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39004"}}]}, {"bom-ref": "vuln-CVE-2023-39005-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39005", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-39005", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39005"}}]}, {"bom-ref": "vuln-CVE-2023-39006-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39006", "ratings": [{"method": "CVSSv3", "score": "5.4", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-39006", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39006"}}]}, {"bom-ref": "vuln-CVE-2023-39007-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39007", "ratings": [{"method": "CVSSv3", "score": "9.6", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.5"}], "references": [{"id": "CVE-2023-39007", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39007"}}]}, {"bom-ref": "vuln-CVE-2023-39008-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39008", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-39008", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39008"}}]}, {"bom-ref": "vuln-CVE-2023-40267-gitpython-2.1.11", "description": "Security vulnerability affecting gitpython version 2.1.11", "id": "CVE-2023-40267", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-40267", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40267"}}]}, {"bom-ref": "vuln-CVE-2023-40590-gitpython-2.1.11", "description": "Security vulnerability affecting gitpython version 2.1.11", "id": "CVE-2023-40590", "ratings": [{"method": "CVSSv3", "score": "7.8", "severity": "high", "vector": "CVSS:3.1/AV:L/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-40590", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40590"}}]}, {"bom-ref": "vuln-CVE-2023-41040-gitpython-2.1.11", "description": "Security vulnerability affecting gitpython version 2.1.11", "id": "CVE-2023-41040", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-41040", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41040"}}]}, {"bom-ref": "vuln-CVE-2023-43804-urllib3-1.24.1", "description": "Security vulnerability affecting urllib3 version 1.24.1", "id": "CVE-2023-43804", "ratings": [{"method": "CVSSv3", "score": "8.1", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-43804", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43804"}}]}, {"bom-ref": "vuln-CVE-2023-44275-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-44275", "ratings": [{"method": "CVSSv3", "score": "5.4", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-44275", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44275"}}]}, {"bom-ref": "vuln-CVE-2023-44276-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-44276", "ratings": [{"method": "CVSSv3", "score": "5.4", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-44276", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44276"}}]}, {"bom-ref": "vuln-CVE-2023-45803-urllib3-1.24.1", "description": "Security vulnerability affecting urllib3 version 1.24.1", "id": "CVE-2023-45803", "ratings": [{"method": "CVSSv3", "score": "4.2", "severity": "medium", "vector": "CVSS:3.1/AV:A/AC:H/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-45803", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45803"}}]}, {"bom-ref": "vuln-CVE-2023-46136-Werkzeug-1.0.1", "description": "Security vulnerability affecting Werkzeug version 1.0.1", "id": "CVE-2023-46136", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-46136", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46136"}}]}, {"bom-ref": "vuln-CVE-2024-21514-opencart-3.0.3.9", "description": "Security vulnerability affecting opencart version 3.0.3.9", "id": "CVE-2024-21514", "ratings": [{"method": "CVSSv3", "score": "8.1", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.4"}], "references": [{"id": "CVE-2024-21514", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21514"}}]}, {"bom-ref": "vuln-CVE-2024-22190-gitpython-2.1.11", "description": "Security vulnerability affecting gitpython version 2.1.11", "id": "CVE-2024-22190", "ratings": [{"method": "CVSSv3", "score": "7.8", "severity": "high", "vector": "CVSS:3.1/AV:L/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2024-22190", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22190"}}]}, {"bom-ref": "vuln-CVE-2024-40898-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2024-40898", "ratings": [{"method": "CVSSv3", "score": "9.1", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2024-40898", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40898"}}]}, {"bom-ref": "vuln-CVE-2024-43796-express-4.17.1", "description": "Security vulnerability affecting express version 4.17.1", "id": "CVE-2024-43796", "ratings": [{"method": "CVSSv3", "score": "4.7", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2024-43796", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43796"}}]}, {"bom-ref": "vuln-CVE-2024-43799-send-0.17.1", "description": "Security vulnerability affecting send version 0.17.1", "id": "CVE-2024-43799", "ratings": [{"method": "CVSSv3", "score": "4.7", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2024-43799", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43799"}}]}, {"bom-ref": "vuln-CVE-2024-43800-serve-static-1.14.1", "description": "Security vulnerability affecting serve-static version 1.14.1", "id": "CVE-2024-43800", "ratings": [{"method": "CVSSv3", "score": "4.7", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2024-43800", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43800"}}]}, {"bom-ref": "vuln-CVE-2024-45590-body-parser-1.19.0", "description": "Security vulnerability affecting body-parser version 1.19.0", "id": "CVE-2024-45590", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2024-45590", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45590"}}]}, {"bom-ref": "vuln-CVE-2024-49767-Werkzeug-1.0.1", "description": "Security vulnerability affecting Werkzeug version 1.0.1", "id": "CVE-2024-49767", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2024-49767", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49767"}}]}, {"bom-ref": "vuln-CVE-2025-1746-opencart-3.0.3.9", "description": "Security vulnerability affecting opencart version 3.0.3.9", "id": "CVE-2025-1746", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2025-1746", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1746"}}]}, {"bom-ref": "vuln-CVE-2025-1747-opencart-3.0.3.9", "description": "Security vulnerability affecting opencart version 3.0.3.9", "id": "CVE-2025-1747", "ratings": [{"method": "CVSSv3", "score": "4.7", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2025-1747", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1747"}}]}, {"bom-ref": "vuln-CVE-2025-1748-opencart-3.0.3.9", "description": "Security vulnerability affecting opencart version 3.0.3.9", "id": "CVE-2025-1748", "ratings": [{"method": "CVSSv3", "score": "4.7", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2025-1748", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1748"}}]}, {"bom-ref": "vuln-CVE-2025-1749-opencart-3.0.3.9", "description": "Security vulnerability affecting opencart version 3.0.3.9", "id": "CVE-2025-1749", "ratings": [{"method": "CVSSv3", "score": "4.7", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2025-1749", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1749"}}]}], "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6"} \ No newline at end of file diff --git a/vuln-report.json b/vuln-report.json new file mode 100644 index 0000000..3c05d5c --- /dev/null +++ b/vuln-report.json @@ -0,0 +1 @@ +{"components": [{"bom-ref": "13781114_6_5921a168-b2f9-433b-8fc7-c571149626cd", "name": "13781114", "purl": "pkg:janus%20troelsen/13781114@6", "type": "library", "version": "6"}, {"bom-ref": "9082892_1_7a436aaf-79c0-420a-858a-dd66fbac7593", "name": "9082892", "purl": "pkg:milan%20mendpara/9082892@1", "type": "library", "version": "1"}, {"bom-ref": "android_frameworks_base_android-n-mr1-preview-1_ba08e169-e972-43f9-bd63-c41a6af0203c", "name": "android_frameworks_base", "purl": "pkg:github/crdroidandroid/android_frameworks_base@android-n-mr1-preview-1", "type": "library", "version": "android-n-mr1-preview-1"}, {"bom-ref": "blaze-material-ui_0.1.9_7094ad42-9743-4aea-9061-221b208c4672", "name": "blaze-material-ui", "purl": "pkg:github/codesignal/blaze-material-ui@0.1.9", "type": "library", "version": "0.1.9"}, {"bom-ref": "jszip_2.6.0_b9eaec93-b563-4fbf-9faf-58579c366643", "name": "jszip", "purl": "pkg:github/stuk/jszip@2.6.0", "type": "library", "version": "2.6.0"}, {"bom-ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d", "name": "libxml2", "purl": "pkg:github/gnome/libxml2@2.9.2-rc1", "type": "library", "version": "2.9.2-rc1"}, {"bom-ref": "nclick_0.0.0_63777c38-bbbc-49b5-8f03-9b7f6a58cafa", "name": "nclick", "purl": "pkg:pypi/nclick@0.0.0", "type": "library", "version": "0.0.0"}, {"bom-ref": "node-forge_1.0.0_21925db1-71e0-4277-95c4-d3e6f1d9e5c8", "name": "node-forge", "purl": "pkg:npm/npmjs/node-forge@1.0.0", "type": "library", "version": "1.0.0"}, {"bom-ref": "ofp_1.1_01407baf-dd04-4e91-b641-784792cb9ff9", "name": "ofp", "type": "library", "version": "1.1"}, {"bom-ref": "ruby-domain_name_0.5.20160826_df0a1fd4-b948-402f-ab26-ceeeaa28fab1", "name": "ruby-domain_name", "purl": "pkg:github/knu/ruby-domain_name@0.5.20160826", "type": "library", "version": "0.5.20160826"}, {"bom-ref": "samba_tevent-0.9.34_47fbcd4f-a9ac-43c2-aa40-9c064bdcbbc8", "name": "samba", "purl": "pkg:github/samba-team/samba@0.9.34", "type": "library", "version": "tevent-0.9.34"}], "dependencies": [{"ref": "13781114_6_5921a168-b2f9-433b-8fc7-c571149626cd"}, {"ref": "9082892_1_7a436aaf-79c0-420a-858a-dd66fbac7593"}, {"ref": "android_frameworks_base_android-n-mr1-preview-1_ba08e169-e972-43f9-bd63-c41a6af0203c"}, {"ref": "blaze-material-ui_0.1.9_7094ad42-9743-4aea-9061-221b208c4672"}, {"ref": "jszip_2.6.0_b9eaec93-b563-4fbf-9faf-58579c366643"}, {"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}, {"ref": "nclick_0.0.0_63777c38-bbbc-49b5-8f03-9b7f6a58cafa"}, {"ref": "node-forge_1.0.0_21925db1-71e0-4277-95c4-d3e6f1d9e5c8"}, {"ref": "ofp_1.1_01407baf-dd04-4e91-b641-784792cb9ff9"}, {"ref": "ruby-domain_name_0.5.20160826_df0a1fd4-b948-402f-ab26-ceeeaa28fab1"}, {"ref": "samba_tevent-0.9.34_47fbcd4f-a9ac-43c2-aa40-9c064bdcbbc8"}], "metadata": {"properties": [{"name": "augmentation_timestamp", "value": "2025-07-05T16:02:25.607108Z"}, {"name": "augmented_with_vulnerabilities", "value": "true"}, {"name": "scan_code", "value": "ScanZIPwithShinobiAutoID_772"}, {"name": "vulnerability_count", "value": "30"}], "timestamp": "2025-07-05T16:02:25.591401-04:00"}, "serialNumber": "urn:uuid:5dc3ef61-2a12-4806-9e44-80481506a83c", "version": 1, "vulnerabilities": [{"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2016-3709-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2016-3709", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2016-3709", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3709"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2016-9596-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2016-9596", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2016-9596", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9596"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2016-9598-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2016-9598", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2016-9598", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9598"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"response": ["can_not_fix"], "state": "exploitable"}, "bom-ref": "vuln-CVE-2017-15412-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2017-15412", "ratings": [{"method": "CVSSv3", "score": "8.8", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:N/A:N"}], "references": [{"id": "CVE-2017-15412", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15412"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2017-18258-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2017-18258", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:N/A:N"}], "references": [{"id": "CVE-2017-18258", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18258"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"response": ["can_not_fix"], "state": "exploitable"}, "bom-ref": "vuln-CVE-2017-5130-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2017-5130", "ratings": [{"method": "CVSSv3", "score": "8.8", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:N/A:N"}], "references": [{"id": "CVE-2017-5130", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5130"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2017-7375-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2017-7375", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "unknown", "vector": "CVSS:3.1/AV:N/AC:N/A:N"}], "references": [{"id": "CVE-2017-7375", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7375"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2017-7376-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2017-7376", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "unknown", "vector": "CVSS:3.1/AV:N/AC:N/A:N"}], "references": [{"id": "CVE-2017-7376", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7376"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2018-14404-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2018-14404", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:N/A:N"}], "references": [{"id": "CVE-2018-14404", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14404"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2019-19956-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2019-19956", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2019-19956", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19956"}}]}, {"affects": [{"ref": "jszip_2.6.0_b9eaec93-b563-4fbf-9faf-58579c366643"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2021-23413-jszip-2.6.0", "description": "Security vulnerability affecting jszip version 2.6.0", "id": "CVE-2021-23413", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}], "references": [{"id": "CVE-2021-23413", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23413"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2021-3517-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2021-3517", "ratings": [{"method": "CVSSv3", "score": "8.6", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2021-3517", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3517"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "exploitable"}, "bom-ref": "vuln-CVE-2021-3518-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2021-3518", "ratings": [{"method": "CVSSv3", "score": "8.8", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2021-3518", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3518"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"justification": "code_not_present", "state": "resolved"}, "bom-ref": "vuln-CVE-2021-3537-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2021-3537", "ratings": [{"method": "other", "score": "1.0", "severity": "info"}, {"method": "CVSSv3", "score": "5.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}], "references": [{"id": "CVE-2021-3537", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3537"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2021-3541-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2021-3541", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2021-3541", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3541"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "bom-ref": "vuln-CVE-2022-23308-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2022-23308", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2022-23308", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23308"}}]}, {"affects": [{"ref": "node-forge_1.0.0_21925db1-71e0-4277-95c4-d3e6f1d9e5c8"}], "analysis": {"response": ["update"], "state": "resolved"}, "bom-ref": "vuln-CVE-2022-24771-node-forge-1.0.0", "description": "Security vulnerability affecting node-forge version 1.0.0", "id": "CVE-2022-24771", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "1.0", "severity": "info"}], "references": [{"id": "CVE-2022-24771", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24771"}}]}, {"affects": [{"ref": "node-forge_1.0.0_21925db1-71e0-4277-95c4-d3e6f1d9e5c8"}], "bom-ref": "vuln-CVE-2022-24772-node-forge-1.0.0", "description": "Security vulnerability affecting node-forge version 1.0.0", "id": "CVE-2022-24772", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2022-24772", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24772"}}]}, {"affects": [{"ref": "node-forge_1.0.0_21925db1-71e0-4277-95c4-d3e6f1d9e5c8"}], "bom-ref": "vuln-CVE-2022-24773-node-forge-1.0.0", "description": "Security vulnerability affecting node-forge version 1.0.0", "id": "CVE-2022-24773", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2022-24773", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24773"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2022-29824-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2022-29824", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2022-29824", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29824"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "bom-ref": "vuln-CVE-2022-40303-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2022-40303", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2022-40303", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40303"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2022-40304-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2022-40304", "ratings": [{"method": "CVSSv3", "score": "7.8", "severity": "high", "vector": "CVSS:3.1/AV:L/AC:L/A:H"}], "references": [{"id": "CVE-2022-40304", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40304"}}]}, {"affects": [{"ref": "jszip_2.6.0_b9eaec93-b563-4fbf-9faf-58579c366643"}], "analysis": {"response": ["will_not_fix"], "state": "false_positive"}, "bom-ref": "vuln-CVE-2022-48285-jszip-2.6.0", "description": "Security vulnerability affecting jszip version 2.6.0", "id": "CVE-2022-48285", "ratings": [{"method": "CVSSv3", "score": "7.3", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}, {"method": "other", "score": "1.0", "severity": "info"}], "references": [{"id": "CVE-2022-48285", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48285"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"justification": "code_not_reachable", "response": ["will_not_fix"], "state": "not_affected"}, "bom-ref": "vuln-CVE-2023-28484-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2023-28484", "ratings": [{"method": "other", "score": "1.0", "severity": "info"}, {"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-28484", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28484"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"justification": "code_not_reachable", "response": ["will_not_fix"], "state": "not_affected"}, "bom-ref": "vuln-CVE-2023-29469-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2023-29469", "ratings": [{"method": "other", "score": "1.0", "severity": "info"}, {"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-29469", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29469"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"justification": "code_not_present", "response": ["will_not_fix"], "state": "false_positive"}, "bom-ref": "vuln-CVE-2023-45322-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2023-45322", "ratings": [{"method": "other", "score": "1.0", "severity": "info"}, {"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-45322", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45322"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2024-25062-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2024-25062", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2024-25062", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25062"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2025-27113-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2025-27113", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2025-27113", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27113"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2025-32414-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2025-32414", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2025-32414", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32414"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "bom-ref": "vuln-CVE-2025-32415-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2025-32415", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2025-32415", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32415"}}]}], "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6"} \ No newline at end of file From 7b4c343b1ebd39396176234051a77cd9a254b808 Mon Sep 17 00:00:00 2001 From: Tomas Gonzalez Date: Sat, 5 Jul 2025 17:49:07 -0400 Subject: [PATCH 5/9] need to fix api fallback for components --- .gitignore | 5 + src/workbench_cli/cli.py | 18 +- src/workbench_cli/handlers/__init__.py | 2 - src/workbench_cli/handlers/export_sarif.py | 291 ------------ src/workbench_cli/handlers/export_vulns.py | 447 +++++------------- src/workbench_cli/main.py | 2 - src/workbench_cli/utilities/sbom_validator.py | 16 +- .../vuln_report/component_enrichment.py | 194 +++++++- .../vuln_report/cyclonedx_generator.py | 434 ++++++----------- .../vuln_report/vulnerability_enricher.py | 37 +- vuln-report-epss.json | 2 +- vuln-report.json | 2 +- 12 files changed, 511 insertions(+), 939 deletions(-) delete mode 100644 src/workbench_cli/handlers/export_sarif.py diff --git a/.gitignore b/.gitignore index bf728b5..87d07d3 100755 --- a/.gitignore +++ b/.gitignore @@ -105,3 +105,8 @@ test-commands.txt workbench-cli-log.txt *.sarif +vuln-report-epss-kev.json +vuln-report-epss.json +vuln-report-nvd-epss-kev.json +vuln-report.json +vuln-report-epss.json diff --git a/src/workbench_cli/cli.py b/src/workbench_cli/cli.py index dfaef4b..51ff9a7 100644 --- a/src/workbench_cli/cli.py +++ b/src/workbench_cli/cli.py @@ -115,20 +115,6 @@ def parse_cmdline_args(): workbench-cli --api-url --api-user --api-token \\ download-reports --scan-name MYSCAN01 --report-scope scan --report-type html --report-save-path reports/ - # Export vulnerability results in SARIF format for security tooling - workbench-cli --api-url --api-user --api-token \\ - export-sarif --project-name MYPROJ --scan-name MYSCAN01 -o security-report.sarif - - # Export SARIF with custom enrichment and filtering options - workbench-cli --api-url --api-user --api-token \\ - export-sarif --project-name MYPROJ --scan-name MYSCAN01 -o vulns.sarif \\ - --enrich-epss --enrich-cisa-kev --severity-threshold high --disable-vex-suppression - - # Export SARIF without external enrichment (default behavior) - workbench-cli --api-url --api-user --api-token \\ - export-sarif --project-name MYPROJ --scan-name MYSCAN01 -o vulns.sarif \\ - --quiet - # Export vulnerability results in CycloneDX format workbench-cli --api-url --api-user --api-token \\ export-vulns --project-name MYPROJ --scan-name MYSCAN01 --format cyclonedx -o vulns.cdx.json @@ -349,7 +335,7 @@ def parse_cmdline_args(): # Output processing & suppression processing_args = export_sarif_parser.add_argument_group("Output Processing & Suppression") processing_args.add_argument("--severity-threshold", help="Filter vulnerabilities by CVSS severity.", choices=["critical", "high", "medium", "low"], metavar="LEVEL") - processing_args.add_argument("--disable-vex-suppression", help="Disable automatic suppression of VEX-assessed findings (mitigated, accepted risk, false positives).", action="store_true") + processing_args.add_argument("--disable-dynamic-risk-scoring", dest="disable_dynamic_risk_scoring", help="Disable Dynamic Risk Scoring (VEX suppression and EPSS / KEV escalation).", action="store_true") # Output control output_control_args = export_sarif_parser.add_argument_group("Output Control") @@ -387,7 +373,7 @@ def parse_cmdline_args(): # Output processing & suppression processing_args = export_vulns_parser.add_argument_group("Output Processing & Suppression") processing_args.add_argument("--severity-threshold", help="Filter vulnerabilities by CVSS severity.", choices=["critical", "high", "medium", "low"], metavar="LEVEL") - processing_args.add_argument("--disable-vex-suppression", help="Disable automatic suppression of VEX-assessed findings (mitigated, accepted risk, false positives).", action="store_true") + processing_args.add_argument("--disable-dynamic-risk-scoring", dest="disable_dynamic_risk_scoring", help="Disable Dynamic Risk Scoring (VEX suppression and EPSS / KEV escalation).", action="store_true") # CycloneDX-specific options cyclonedx_args = export_vulns_parser.add_argument_group("CycloneDX Format Options") diff --git a/src/workbench_cli/handlers/__init__.py b/src/workbench_cli/handlers/__init__.py index c933515..69b098a 100644 --- a/src/workbench_cli/handlers/__init__.py +++ b/src/workbench_cli/handlers/__init__.py @@ -13,7 +13,6 @@ from .show_results import handle_show_results from .evaluate_gates import handle_evaluate_gates from .download_reports import handle_download_reports -from .export_sarif import handle_export_sarif from .export_vulns import handle_export_vulns __all__ = [ @@ -24,6 +23,5 @@ 'handle_show_results', 'handle_evaluate_gates', 'handle_download_reports', - 'handle_export_sarif', 'handle_export_vulns' ] diff --git a/src/workbench_cli/handlers/export_sarif.py b/src/workbench_cli/handlers/export_sarif.py deleted file mode 100644 index e0631ea..0000000 --- a/src/workbench_cli/handlers/export_sarif.py +++ /dev/null @@ -1,291 +0,0 @@ -# workbench_cli/handlers/export_sarif.py - -import logging -import argparse -from typing import TYPE_CHECKING, List, Dict, Any - -from ..utilities.error_handling import handler_error_wrapper -from ..utilities.vuln_report.sarif_generator import save_vulns_to_sarif -from ..exceptions import ( - ApiError, - NetworkError, - ProcessTimeoutError, - ProcessError -) - -if TYPE_CHECKING: - from ..api import WorkbenchAPI - -logger = logging.getLogger("workbench-cli") - - -@handler_error_wrapper -def handle_export_sarif(workbench: "WorkbenchAPI", params: argparse.Namespace) -> bool: - """ - Handler for the 'export-sarif' command. Exports vulnerability results in SARIF format. - - Args: - workbench: The Workbench API client - params: Command line parameters - - Returns: - bool: True if the operation was successful - """ - - print(f"\n--- Running {params.command.upper()} Command ---") - - # Resolve project and scan (find only) - if not params.quiet: - print("\nResolving scan for SARIF export...") - project_code = workbench.resolve_project(params.project_name, create_if_missing=False) - scan_code, scan_id = workbench.resolve_scan( - scan_name=params.scan_name, - project_name=params.project_name, - create_if_missing=False, - params=params - ) - - # Ensure scan processes are idle before fetching results - if not params.quiet: - print("\nEnsuring scan processes are idle before fetching vulnerability data...") - try: - workbench.ensure_scan_is_idle(scan_code, params, ["SCAN", "DEPENDENCY_ANALYSIS"]) - except (ProcessTimeoutError, ProcessError, ApiError, NetworkError) as e: - logger.warning(f"Could not verify scan completion for '{scan_code}': {e}. Proceeding anyway.") - if not params.quiet: - print("\nWarning: Could not verify scan completion status. Results may be incomplete.") - - # Fetch vulnerability data - if not params.quiet: - print("\n🔍 Fetching data from Workbench...") - try: - vulnerabilities = workbench.list_vulnerabilities(scan_code) - - # Apply severity filtering if specified - severity_threshold_text = "" - if getattr(params, 'severity_threshold', None): - severity_order = {'critical': 4, 'high': 3, 'medium': 2, 'low': 1} - min_severity = severity_order.get(params.severity_threshold.lower(), 0) - original_count = len(vulnerabilities) - vulnerabilities = [ - vuln for vuln in vulnerabilities - if severity_order.get(vuln.get('severity', '').lower(), 0) >= min_severity - ] - severity_threshold_text = f" (Severity Threshold: {params.severity_threshold.upper()})" - else: - severity_threshold_text = "" - - # Extract configuration values from parameters - nvd_enrichment = getattr(params, 'enrich_nvd', False) - epss_enrichment = getattr(params, 'enrich_epss', False) - cisa_kev_enrichment = getattr(params, 'enrich_cisa_kev', False) - api_timeout = getattr(params, 'external_timeout', 30) - enable_vex_suppression = not getattr(params, 'disable_vex_suppression', False) - quiet = getattr(params, 'quiet', False) - - if not vulnerabilities: - if not params.quiet: - print("⚠️ No vulnerabilities found in the scan.") - print("An empty SARIF report will be generated.") - external_data = {} - else: - if not params.quiet: - # Step 1: Show vulnerability and VEX retrieval - print(f"\n📋 Retrieving Vulnerabilities and VEX...") - - # Combine vulnerability count and severity breakdown in one line - from ..utilities.vuln_report.sarif_generator import _calculate_severity_distribution, _format_severity_breakdown_compact - severity_dist = _calculate_severity_distribution(vulnerabilities) - severity_breakdown = _format_severity_breakdown_compact(severity_dist) - print(f" • Retrieved {len(vulnerabilities)} Vulnerabilities{severity_threshold_text} {severity_breakdown}") - _display_vex_summary(vulnerabilities, indent=" ") - - # Step 2: Pre-fetch component information - print(f"\n🔧 Retrieving Component Information...") - from ..utilities.vuln_report.component_enrichment import prefetch_component_info - - # Count unique components before fetching - unique_components = list(set( - f"{vuln.get('component_name', 'Unknown')}@{vuln.get('component_version', 'Unknown')}" - for vuln in vulnerabilities - if vuln.get("component_name") and vuln.get("component_version") - )) - component_count = len(unique_components) - - prefetch_component_info(vulnerabilities, quiet=True) # Always quiet to suppress progress messages - print(f" • Component information retrieved for {component_count} Components") - - # Step 3: Perform external enrichment and display status - external_data = _perform_external_enrichment( - vulnerabilities, - nvd_enrichment, - epss_enrichment, - cisa_kev_enrichment, - api_timeout - ) - - # Step 4: Show Dynamic Scoring section - _display_dynamic_scoring( - vulnerabilities, - enable_vex_suppression, - external_data - ) - else: - # Still need to fetch external data for SARIF generation, but quietly - from ..utilities.vuln_report.sarif_generator import _fetch_external_enrichment_data - from ..utilities.vuln_report.component_enrichment import prefetch_component_info - - # Pre-fetch component information quietly (no progress messages) - prefetch_component_info(vulnerabilities, quiet=True) - - external_data = _fetch_external_enrichment_data( - vulnerabilities, - nvd_enrichment, - epss_enrichment, - cisa_kev_enrichment, - api_timeout - ) - - # Export to SARIF - if not params.quiet: - print(f"\n📤 Exporting SARIF report...") - save_vulns_to_sarif( - filepath=params.output, - vulnerabilities=vulnerabilities, - scan_code=scan_code, - external_data=external_data, - nvd_enrichment=nvd_enrichment, - epss_enrichment=epss_enrichment, - cisa_kev_enrichment=cisa_kev_enrichment, - api_timeout=api_timeout, - enable_vex_suppression=enable_vex_suppression, - quiet=quiet - ) - - if not params.quiet: - print(f"\n✅ SARIF export completed successfully!") - print(f"📄 Report saved to: {params.output}") - - return True - - except Exception as e: - logger.error(f"Failed to export SARIF: {e}") - if isinstance(e, (ApiError, NetworkError, ProcessTimeoutError, ProcessError)): - raise - else: - raise ProcessError(f"Failed to export vulnerability data to SARIF format: {str(e)}") - - -# Configuration function removed - CLI arguments now used directly - - -def _perform_external_enrichment( - vulnerabilities: List[Dict[str, Any]], - nvd_enrichment: bool, - epss_enrichment: bool, - cisa_kev_enrichment: bool, - api_timeout: int -) -> Dict[str, Dict[str, Any]]: - """Perform external enrichment and display status messages.""" - import os - from ..utilities.vuln_report.sarif_generator import _fetch_external_enrichment_data - - # Show enrichment status - enrichment_sources = [] - if nvd_enrichment: - enrichment_sources.append("NVD") - if epss_enrichment: - enrichment_sources.append("EPSS") - if cisa_kev_enrichment: - enrichment_sources.append("CISA KEV") - - if enrichment_sources: - print(f"\n🔍 External Enrichment: {', '.join(enrichment_sources)}") - - # Get unique CVEs for display - from ..utilities.vuln_report.sarif_generator import _extract_unique_cves - unique_cves = _extract_unique_cves(vulnerabilities) - - # Show custom NVD message if NVD enrichment is enabled - if nvd_enrichment and unique_cves: - print(f" 📋 Fetching additional details for {len(unique_cves)} CVEs from NVD") - if not os.environ.get('NVD_API_KEY'): - print(f" 💡 For faster performance, set the 'NVD_API_KEY' environment variable") - - # Perform the actual enrichment with suppressed logging - # Temporarily increase logging level to suppress INFO messages - import logging - nvd_logger = logging.getLogger('workbench_cli.utilities.vulnerability_enricher') - original_level = nvd_logger.level - nvd_logger.setLevel(logging.WARNING) - - try: - external_data = _fetch_external_enrichment_data( - vulnerabilities, - nvd_enrichment, - epss_enrichment, - cisa_kev_enrichment, - api_timeout - ) - finally: - nvd_logger.setLevel(original_level) - - # Show EPSS results if EPSS enrichment was enabled - if epss_enrichment and external_data: - epss_count = sum(1 for cve_data in external_data.values() if cve_data.get('epss_score') is not None) - if epss_count > 0: - print(f" 📊 EPSS scores retrieved for {epss_count} CVEs") - - return external_data - else: - print(f"\n🔍 External Enrichment: DISABLED") - return {} - - - - - -def _display_vex_summary(vulnerabilities: List[Dict[str, Any]], indent: str = "") -> None: - """Display VEX assessment information in a concise format.""" - from ..utilities.vuln_report.sarif_generator import _count_vex_assessments - vex_counts = _count_vex_assessments(vulnerabilities) - - if vex_counts["total_with_vex"] > 0: - print(f"{indent}• Retrieved VEX for {vex_counts['total_with_vex']}/{len(vulnerabilities)} CVEs [Status: {vex_counts['with_status']}, Response: {vex_counts['with_response']}]") - - -def _display_dynamic_scoring( - vulnerabilities: List[Dict[str, Any]], - enable_vex_suppression: bool, - external_data: Dict[str, Dict[str, Any]] -) -> None: - """Display dynamic scoring information including both suppressions and promotions.""" - from ..utilities.vuln_report.sarif_generator import _count_high_risk_vulnerabilities, _count_vex_assessments - - print(f"\n🔧 Dynamic Scoring:") - - # Show VEX suppression - vex_counts = _count_vex_assessments(vulnerabilities) - if enable_vex_suppression and vex_counts["total_with_vex"] > 0: - if vex_counts["suppressed"] > 0: - print(f" • VEX Risk: {vex_counts['suppressed']} CVEs Suppressed") - else: - print(f" • VEX Suppression: Enabled (no CVEs Suppressed)") - else: - print(f" • VEX Suppression: {'Enabled' if enable_vex_suppression else 'Disabled'}") - - # Show high-risk vulnerability information with promotion details - if external_data: - high_risk_counts = _count_high_risk_vulnerabilities(vulnerabilities, external_data) - - # Show EPSS promotions - if high_risk_counts.get("high_epss", 0) > 0: - print(f" • EPSS Risk: {high_risk_counts['high_epss']} CVEs Escalated") - - # Show CISA KEV if present - if high_risk_counts.get("cisa_kev", 0) > 0: - print(f" • CISA KEV: {high_risk_counts['cisa_kev']} CVEs Escalated") - - # Show VEX-based promotions (exploitable CVEs get promoted to 'error' level) - if vex_counts["total_with_vex"] > 0 and vex_counts["exploitable"] > 0: - print(f" • VEX Risk: {vex_counts['exploitable']} CVEs Escalated") \ No newline at end of file diff --git a/src/workbench_cli/handlers/export_vulns.py b/src/workbench_cli/handlers/export_vulns.py index 757972e..a0a3c52 100644 --- a/src/workbench_cli/handlers/export_vulns.py +++ b/src/workbench_cli/handlers/export_vulns.py @@ -11,7 +11,11 @@ from ..utilities.vuln_report.cyclonedx_generator import save_vulns_to_cyclonedx, build_cyclonedx_from_components from ..utilities.vuln_report.spdx_generator import save_vulns_to_spdx from ..utilities.vuln_report.vulnerability_enricher import enrich_vulnerabilities -from ..utilities.vuln_report.component_enrichment import prefetch_component_info, cache_components_from_cyclonedx +from ..utilities.vuln_report.component_enrichment import ( + prefetch_component_info, + cache_components_from_sbom, + fetch_sbom, +) from ..exceptions import ( ApiError, NetworkError, @@ -69,8 +73,25 @@ def handle_export_vulns(workbench: "WorkbenchAPI", params: argparse.Namespace) - if not params.quiet: print("\nWarning: Could not verify scan completion status. Results may be incomplete.") - # Fetch and enrich vulnerability data (applies to all formats) - vulnerabilities, external_data = _fetch_and_enrich_vulnerabilities(workbench, scan_code, params) + # ------------------------------------------------------------------ + # 1. Fetch vulnerability list & built-in VEX + # ------------------------------------------------------------------ + vulnerabilities = _fetch_vulnerabilities_and_vex(workbench, scan_code, params) + + # ------------------------------------------------------------------ + # 2. Enrich component metadata (Workbench Components API or SBOM cache) + # ------------------------------------------------------------------ + _enrich_components(workbench, vulnerabilities, scan_code, params) + + # ------------------------------------------------------------------ + # 3. External vulnerability enrichment (NVD / EPSS / KEV) + # ------------------------------------------------------------------ + external_data = _perform_external_vulnerability_enrichment(vulnerabilities, params) + + # ------------------------------------------------------------------ + # 4. Apply dynamic scoring (VEX suppression, EPSS / KEV promotion) + # ------------------------------------------------------------------ + _apply_dynamic_scoring(vulnerabilities, external_data, params) # Handle CycloneDX export first because it uses a slightly different generation flow if params.format == 'cyclonedx': @@ -100,7 +121,7 @@ def handle_export_vulns(workbench: "WorkbenchAPI", params: argparse.Namespace) - epss_enrichment=getattr(params, 'enrich_epss', False), cisa_kev_enrichment=getattr(params, 'enrich_cisa_kev', False), api_timeout=getattr(params, 'external_timeout', 30), - enable_vex_suppression=not getattr(params, 'disable_vex_suppression', False), + enable_vex_suppression=not getattr(params, 'disable_dynamic_risk_scoring', False), quiet=getattr(params, 'quiet', False) ) elif params.format == 'spdx3': @@ -113,7 +134,7 @@ def handle_export_vulns(workbench: "WorkbenchAPI", params: argparse.Namespace) - epss_enrichment=getattr(params, 'enrich_epss', False), cisa_kev_enrichment=getattr(params, 'enrich_cisa_kev', False), api_timeout=getattr(params, 'external_timeout', 30), - enable_vex_suppression=not getattr(params, 'disable_vex_suppression', False), + enable_vex_suppression=not getattr(params, 'disable_dynamic_risk_scoring', False), quiet=getattr(params, 'quiet', False) ) @@ -153,191 +174,105 @@ def _check_format_dependencies(format_name: str) -> None: ) # SARIF format has no external dependencies - -def _fetch_and_enrich_vulnerabilities( - workbench: "WorkbenchAPI", - scan_code: str, - params: argparse.Namespace -) -> tuple[List[Dict[str, Any]], Dict[str, Dict[str, Any]]]: - """ - Fetch vulnerability data from Workbench and enrich it with external data. - - Returns: - Tuple of (vulnerabilities, external_data) - """ - # Fetch vulnerability data +def _fetch_vulnerabilities_and_vex( + workbench: "WorkbenchAPI", + scan_code: str, + params: argparse.Namespace, +) -> List[Dict[str, Any]]: + """Retrieve vulnerabilities from Workbench (with severity filter) and print VEX summary.""" if not params.quiet: - print("\n🔍 Fetching data from Workbench...") - + print("\n🔍 Fetching data from Workbench…") + vulnerabilities = workbench.list_vulnerabilities(scan_code) - - # Apply severity filtering if specified - severity_threshold_text = "" - if getattr(params, 'severity_threshold', None): - severity_order = {'critical': 4, 'high': 3, 'medium': 2, 'low': 1} - min_severity = severity_order.get(params.severity_threshold.lower(), 0) - original_count = len(vulnerabilities) - vulnerabilities = [ - vuln for vuln in vulnerabilities - if severity_order.get(vuln.get('severity', '').lower(), 0) >= min_severity - ] - severity_threshold_text = f" (Severity Threshold: {params.severity_threshold.upper()})" - - # Extract configuration values from parameters - nvd_enrichment = getattr(params, 'enrich_nvd', False) - epss_enrichment = getattr(params, 'enrich_epss', False) - cisa_kev_enrichment = getattr(params, 'enrich_cisa_kev', False) - api_timeout = getattr(params, 'external_timeout', 30) - enable_vex_suppression = not getattr(params, 'disable_vex_suppression', False) - quiet = getattr(params, 'quiet', False) - - if not vulnerabilities: - if not params.quiet: - print("⚠️ No vulnerabilities found in the scan.") - print("An empty report will be generated.") - external_data = {} - else: - if not params.quiet: - # Step 1: Show vulnerability and VEX retrieval - print(f"\n📋 Retrieving Vulnerabilities and VEX...") - - # Combine vulnerability count and severity breakdown in one line - from ..utilities.vuln_report.sarif_generator import _calculate_severity_distribution, _format_severity_breakdown_compact - severity_dist = _calculate_severity_distribution(vulnerabilities) - severity_breakdown = _format_severity_breakdown_compact(severity_dist) - print(f" • Retrieved {len(vulnerabilities)} Vulnerabilities{severity_threshold_text} {severity_breakdown}") - _display_vex_summary(vulnerabilities, indent=" ") - - # Step 2: Pre-fetch component information - print(f"\n🔧 Retrieving Component Information...") - - # ------------------------------------------------------------ - # CycloneDX: attempt to download SBOM early so we can populate - # the component-info cache before hitting the API. This avoids - # unnecessary network calls when the SBOM already has the data. - # ------------------------------------------------------------ - if params.format == "cyclonedx": - sbom_path = _attempt_download_cyclonedx_sbom(workbench, scan_code, params) - if sbom_path: - cache_components_from_cyclonedx(sbom_path, quiet=True) - # The helper stores the temp file path on *params* for - # later reuse by _handle_cyclonedx_export. - - # Count unique components before fetching - unique_components = list(set( - f"{vuln.get('component_name', 'Unknown')}@{vuln.get('component_version', 'Unknown')}" - for vuln in vulnerabilities - if vuln.get("component_name") and vuln.get("component_version") - )) - component_count = len(unique_components) - - prefetch_component_info(vulnerabilities, quiet=True) # Always quiet to suppress progress messages - print(f" • Component information retrieved for {component_count} Components") - - # Step 3: Perform external enrichment and display status - external_data = _perform_external_enrichment( - vulnerabilities, - nvd_enrichment, - epss_enrichment, - cisa_kev_enrichment, - api_timeout - ) - - # Step 4: Show Dynamic Scoring section - _display_dynamic_scoring( - vulnerabilities, - enable_vex_suppression, - external_data - ) - else: - # Still need to fetch external data for report generation, but quietly - from ..utilities.vuln_report.sarif_generator import _fetch_external_enrichment_data - - # Pre-fetch component information quietly (no progress messages) - prefetch_component_info(vulnerabilities, quiet=True) - - # Fetch external data if any enrichment is enabled - if nvd_enrichment or epss_enrichment or cisa_kev_enrichment: - from ..utilities.vuln_report.sarif_generator import _extract_unique_cves - unique_cves = _extract_unique_cves(vulnerabilities) - external_data = enrich_vulnerabilities( - unique_cves, - nvd_enrichment, - epss_enrichment, - cisa_kev_enrichment, - api_timeout - ) - else: - external_data = {} - - return vulnerabilities, external_data + # Severity filter + if getattr(params, "severity_threshold", None): + sev_order = {"critical": 4, "high": 3, "medium": 2, "low": 1} + min_level = sev_order.get(params.severity_threshold.lower(), 0) + vulnerabilities = [v for v in vulnerabilities if sev_order.get(v.get("severity", "").lower(), 0) >= min_level] -# --------------------------------------------------------------------------- -# Helper: Download CycloneDX SBOM (best-effort) -# --------------------------------------------------------------------------- + if not params.quiet: + from ..utilities.vuln_report.sarif_generator import ( + _calculate_severity_distribution, + _format_severity_breakdown_compact, + ) + dist = _calculate_severity_distribution(vulnerabilities) + print( + f"📋 Retrieved {len(vulnerabilities)} Vulnerabilities {_format_severity_breakdown_compact(dist)}" + ) + _display_vex_summary(vulnerabilities, indent=" ") + return vulnerabilities -def _attempt_download_cyclonedx_sbom( + +def _enrich_components( workbench: "WorkbenchAPI", + vulnerabilities: List[Dict[str, Any]], scan_code: str, params: argparse.Namespace, -) -> Optional[str]: - """Return path to a temporary CycloneDX SBOM or *None* on failure. - - If we already downloaded the SBOM earlier in this session the cached path - stored on *params* (``_cyclonedx_sbom_path``) is returned. - """ - - if getattr(params, "_cyclonedx_sbom_path", None): - return params._cyclonedx_sbom_path # type: ignore[attr-defined] - - try: - report_type = "cyclone_dx" - is_async = report_type in workbench.ASYNC_REPORT_TYPES - - if not params.quiet: - print(" 📦 Downloading CycloneDX SBOM from Workbench …") - - if is_async: - process_id = workbench.generate_scan_report( - scan_code, report_type=report_type, include_vex=True - ) +) -> None: + """Prefetch component info via Components API or SBOM cache.""" + if not vulnerabilities: + return - workbench._wait_for_process( - process_description=f"CycloneDX report generation (Process ID: {process_id})", - check_function=workbench.check_scan_report_status, - check_args={"process_id": process_id, "scan_code": scan_code}, - status_accessor=lambda d: d.get("progress_state", "UNKNOWN"), - success_values={"FINISHED"}, - failure_values={"FAILED", "CANCELLED", "ERROR"}, - max_tries=getattr(params, "scan_number_of_tries", 60), - wait_interval=3, - progress_indicator=False, - ) + if not params.quiet: + print("\n🔧 Retrieving Component Information…") + + # CycloneDX: early SBOM download → cache components + if params.format in {"cyclonedx", "spdx3"}: + sbom_path = fetch_sbom( + workbench, + scan_code, + sbom_format=params.format, + include_vex=True, + params=params, + quiet=True, + ) + if sbom_path: + cache_components_from_sbom(sbom_path, sbom_format=params.format, quiet=True) + + # Parallel Components API prefetch + unique = { + (v.get("component_name"), v.get("component_version")) + for v in vulnerabilities + if v.get("component_name") and v.get("component_version") + } + prefetch_component_info(vulnerabilities, quiet=True) + if not params.quiet: + print(f" • Component information retrieved for {len(unique)} Components") - response = workbench.download_scan_report(process_id) - else: - response = workbench.generate_scan_report( - scan_code, report_type=report_type, include_vex=True - ) - import tempfile +def _perform_external_vulnerability_enrichment( + vulnerabilities: List[Dict[str, Any]], + params: argparse.Namespace, +) -> Dict[str, Dict[str, Any]]: + nvd = getattr(params, "enrich_nvd", False) + epss = getattr(params, "enrich_epss", False) + kev = getattr(params, "enrich_cisa_kev", False) + timeout = getattr(params, "external_timeout", 30) + + ext_data = _perform_external_enrichment( + vulnerabilities, + nvd, + epss, + kev, + timeout, + ) + return ext_data - with tempfile.NamedTemporaryFile(mode="w", suffix=".json", delete=False, encoding="utf-8") as tmp: - if hasattr(response, "content") and response.content is not None: - tmp.write(response.content.decode("utf-8")) - else: - tmp.write(getattr(response, "text", str(response))) - sbom_path = tmp.name +def _apply_dynamic_scoring( + vulnerabilities: List[Dict[str, Any]], + external_data: Dict[str, Dict[str, Any]], + params: argparse.Namespace, +) -> None: + enable_vex_suppression = not getattr(params, "disable_dynamic_risk_scoring", False) + _display_dynamic_scoring(vulnerabilities, enable_vex_suppression, external_data) - params._cyclonedx_sbom_path = sbom_path # cache for later reuse - return sbom_path - except Exception as exc: - logger.debug(f"CycloneDX SBOM download failed: {exc}") - return None +# --------------------------------------------------------------------------- +# Helper: Download CycloneDX SBOM (best-effort) +# --------------------------------------------------------------------------- def _handle_cyclonedx_export( @@ -377,7 +312,7 @@ def _handle_cyclonedx_export( nvd_enrichment=getattr(params, "enrich_nvd", False), epss_enrichment=getattr(params, "enrich_epss", False), cisa_kev_enrichment=getattr(params, "enrich_cisa_kev", False), - enable_vex_suppression=not getattr(params, "disable_vex_suppression", False), + enable_vex_suppression=not getattr(params, "disable_dynamic_risk_scoring", False), quiet=getattr(params, "quiet", False), base_sbom_path=base_sbom_path, ) @@ -396,168 +331,6 @@ def _handle_cyclonedx_export( return True -def _extract_vulnerabilities_from_cyclonedx_report(cyclonedx_path: str) -> List[Dict[str, Any]]: - """ - Extract vulnerability data from a CycloneDX report for external enrichment. - - Args: - cyclonedx_path: Path to the CycloneDX JSON file - - Returns: - List of vulnerability dictionaries compatible with enrichment functions - """ - import json - - vulnerabilities = [] - - try: - with open(cyclonedx_path, 'r', encoding='utf-8') as f: - cyclonedx_data = json.load(f) - - # Create component lookup by bom-ref - components_by_ref = {} - if 'components' in cyclonedx_data: - for component in cyclonedx_data['components']: - bom_ref = component.get('bom-ref') - if bom_ref: - components_by_ref[bom_ref] = component - - # Extract vulnerabilities - if 'vulnerabilities' in cyclonedx_data: - for vuln in cyclonedx_data['vulnerabilities']: - cve = vuln.get('id', 'UNKNOWN') - - # Find affected components - affected_components = [] - if 'affects' in vuln: - for affect in vuln['affects']: - ref = affect.get('ref') - if ref and ref in components_by_ref: - affected_components.append(components_by_ref[ref]) - - # Create vulnerability records for each affected component - for component in affected_components: - vuln_record = { - 'cve': cve, - 'component_name': component.get('name', 'Unknown'), - 'component_version': component.get('version', 'Unknown'), - 'id': f"{cve}-{component.get('name', 'Unknown')}-{component.get('version', 'Unknown')}", - } - - # Extract severity and score from ratings - if 'ratings' in vuln and vuln['ratings']: - # Use the first rating as base - first_rating = vuln['ratings'][0] - if 'severity' in first_rating: - vuln_record['severity'] = first_rating['severity'].lower() - if 'score' in first_rating: - vuln_record['base_score'] = str(first_rating['score']) - - # Extract VEX analysis state - if 'analysis' in vuln: - analysis = vuln['analysis'] - if 'state' in analysis: - vuln_record['vex_assessment'] = { - 'status': analysis['state'], - 'response': analysis.get('response', []), - 'justification': analysis.get('justification', ''), - 'detail': analysis.get('detail', ''), - } - - vulnerabilities.append(vuln_record) - - logger.debug(f"Extracted {len(vulnerabilities)} vulnerabilities from CycloneDX report") - return vulnerabilities - - except Exception as e: - logger.error(f"Failed to extract vulnerabilities from CycloneDX report: {e}") - return [] - - -def _perform_external_enrichment_for_cyclonedx( - vulnerabilities: List[Dict[str, Any]], - params: argparse.Namespace, - quiet: bool = False -) -> Dict[str, Dict[str, Any]]: - """ - Perform external enrichment for CycloneDX vulnerabilities. - - Args: - vulnerabilities: List of vulnerability dictionaries - params: Command line parameters - quiet: Whether to suppress output messages - - Returns: - Dictionary of external enrichment data keyed by CVE - """ - # Extract configuration values from parameters - nvd_enrichment = getattr(params, 'enrich_nvd', False) - epss_enrichment = getattr(params, 'enrich_epss', False) - cisa_kev_enrichment = getattr(params, 'enrich_cisa_kev', False) - api_timeout = getattr(params, 'external_timeout', 30) - - if not (nvd_enrichment or epss_enrichment or cisa_kev_enrichment): - if not quiet: - print(f"\n🔍 External Enrichment: DISABLED") - return {} - - # Show enrichment status - enrichment_sources = [] - if nvd_enrichment: - enrichment_sources.append("NVD") - if epss_enrichment: - enrichment_sources.append("EPSS") - if cisa_kev_enrichment: - enrichment_sources.append("CISA KEV") - - if not quiet: - print(f"\n🔍 External Enrichment: {', '.join(enrichment_sources)}") - - # Get unique CVEs for enrichment - unique_cves = list(set( - vuln.get('cve', 'UNKNOWN') - for vuln in vulnerabilities - if vuln.get('cve') and vuln.get('cve') != 'UNKNOWN' - )) - - if not unique_cves: - if not quiet: - print(" • No CVEs found for enrichment") - return {} - - # Show custom NVD message if NVD enrichment is enabled - if nvd_enrichment and unique_cves: - if not quiet: - print(f" 📋 Fetching additional details for {len(unique_cves)} CVEs from NVD") - if not os.environ.get('NVD_API_KEY'): - print(f" 💡 For faster performance, set the 'NVD_API_KEY' environment variable") - - # Perform the actual enrichment with suppressed logging - # Temporarily increase logging level to suppress INFO messages - nvd_logger = logging.getLogger('workbench_cli.utilities.vuln_report.vulnerability_enricher') - original_level = nvd_logger.level - nvd_logger.setLevel(logging.WARNING) - - try: - external_data = enrich_vulnerabilities( - unique_cves, - nvd_enrichment, - epss_enrichment, - cisa_kev_enrichment, - api_timeout - ) - finally: - nvd_logger.setLevel(original_level) - - # Show EPSS results if EPSS enrichment was enabled - if epss_enrichment and external_data and not quiet: - epss_count = sum(1 for cve_data in external_data.values() if cve_data.get('epss_score') is not None) - if epss_count > 0: - print(f" 📊 EPSS scores retrieved for {epss_count} CVEs") - - return external_data - - def _perform_external_enrichment( vulnerabilities: List[Dict[str, Any]], nvd_enrichment: bool, diff --git a/src/workbench_cli/main.py b/src/workbench_cli/main.py index 8525954..257fd9d 100644 --- a/src/workbench_cli/main.py +++ b/src/workbench_cli/main.py @@ -31,7 +31,6 @@ handle_evaluate_gates, handle_download_reports, handle_scan_git, - handle_export_sarif, handle_export_vulns, ) @@ -91,7 +90,6 @@ def main() -> int: "evaluate-gates": handle_evaluate_gates, "download-reports": handle_download_reports, "scan-git": handle_scan_git, - "export-sarif": handle_export_sarif, "export-vulns": handle_export_vulns, } diff --git a/src/workbench_cli/utilities/sbom_validator.py b/src/workbench_cli/utilities/sbom_validator.py index 9e340c2..4af1f20 100644 --- a/src/workbench_cli/utilities/sbom_validator.py +++ b/src/workbench_cli/utilities/sbom_validator.py @@ -160,7 +160,21 @@ def _detect_sbom_format(file_path: str) -> str: if (' Tuple[str, str, Dict[str, Any], Dict]: diff --git a/src/workbench_cli/utilities/vuln_report/component_enrichment.py b/src/workbench_cli/utilities/vuln_report/component_enrichment.py index bb699ef..b4f3d32 100644 --- a/src/workbench_cli/utilities/vuln_report/component_enrichment.py +++ b/src/workbench_cli/utilities/vuln_report/component_enrichment.py @@ -2,21 +2,23 @@ Workbench‐specific component enrichment helpers. This module centralises all logic required to enrich vulnerability results with -component-level metadata that can be fetched from a Workbench instance. The -functions were previously implemented in utilities.sarif_converter but have -been moved here for better separation of concerns. +component-level metadata that can be fetched from a Workbench instance. """ from __future__ import annotations import logging import os -from typing import Dict, Any, Optional, Tuple, List +from typing import Dict, Any, Optional, Tuple, List, TYPE_CHECKING +import argparse from concurrent.futures import ThreadPoolExecutor, as_completed from ...api.components_api import ComponentsAPI from ...exceptions import ApiError, NetworkError +if TYPE_CHECKING: + from ...api import WorkbenchAPI + logger = logging.getLogger(__name__) # Cache to avoid repeated API lookups per component-version @@ -226,6 +228,9 @@ def _detect_package_ecosystem( "_detect_package_ecosystem", "prefetch_component_info", # New function for pre-fetching "cache_components_from_cyclonedx", # Populate cache from SBOM + # New generic helpers (format-dispatching) + "fetch_sbom", + "cache_components_from_sbom", ] @@ -288,6 +293,10 @@ def cache_components_from_cyclonedx(sbom_path: str, quiet: bool = False) -> int: "purl_namespace": comp.get("purl_namespace"), "purl_name": comp.get("purl_name"), "purl_version": comp.get("purl_version"), + # NEW – cache additional metadata useful for later enrichment + "licenses": comp.get("licenses"), + "author": comp.get("author") or (comp.get("supplier") or {}).get("name"), + "publisher": comp.get("publisher"), } _COMPONENT_INFO_CACHE[key] = cache_entry @@ -296,4 +305,179 @@ def cache_components_from_cyclonedx(sbom_path: str, quiet: bool = False) -> int: if added and not quiet: print(f" ✅ Loaded component metadata for {added} components from CycloneDX SBOM") - return added \ No newline at end of file + return added + + +# --------------------------------------------------------------------------- +# CycloneDX SBOM download helper (reused by handlers) +# --------------------------------------------------------------------------- + + +def download_cyclonedx_sbom( + workbench: "WorkbenchAPI", + scan_code: str, + *, + include_vex: bool = True, + params: Optional[argparse.Namespace] = None, + quiet: bool = False, +) -> Optional[str]: + """Generate & download a scan-level CycloneDX SBOM from Workbench. + + Returns a path to a temporary JSON file on success, or *None* on failure. + + The logic mirrors the report-generation flow in *download_reports.py* but is + packaged as a standalone utility to avoid code duplication across + handlers. + """ + + import tempfile + + report_type = "cyclone_dx" + + try: + is_async = report_type in workbench.ASYNC_REPORT_TYPES + + if is_async and not quiet: + print(" Generating CycloneDX SBOM asynchronously…") + + if is_async: + process_id = workbench.generate_scan_report( + scan_code, + report_type=report_type, + include_vex=include_vex, + ) + + # Adopt the same waiting strategy as *download_reports* for + # consistency (3-second interval, up to scan_number_of_tries) + workbench._wait_for_process( + process_description=f"CycloneDX report generation (Process ID: {process_id})", + check_function=workbench.check_scan_report_status, + check_args={"process_id": process_id, "scan_code": scan_code}, + status_accessor=lambda d: d.get("progress_state", "UNKNOWN"), + success_values={"FINISHED"}, + failure_values={"FAILED", "CANCELLED", "ERROR"}, + max_tries=getattr(params, "scan_number_of_tries", 60) if params else 60, + wait_interval=3, + progress_indicator=not quiet, + ) + + response = workbench.download_scan_report(process_id) + else: + if not quiet: + print(" Generating CycloneDX SBOM (synchronous)…") + response = workbench.generate_scan_report( + scan_code, + report_type=report_type, + include_vex=include_vex, + ) + + # Save to temporary file + with tempfile.NamedTemporaryFile(mode="w", suffix=".json", delete=False, encoding="utf-8") as tmp: + if hasattr(response, "content") and response.content is not None: + tmp.write(response.content.decode("utf-8")) + else: + tmp.write(getattr(response, "text", str(response))) + + if not quiet: + print(f" ✅ SBOM downloaded → {tmp.name}") + + return tmp.name + + except Exception as exc: + logger.debug(f"CycloneDX SBOM download failed: {exc}") + return None + + +# --------------------------------------------------------------------------- +# Generic SBOM helpers (format-dispatching) +# --------------------------------------------------------------------------- + + +def fetch_sbom( + workbench: "WorkbenchAPI", + scan_code: str, + *, + sbom_format: str = "cyclonedx", + include_vex: bool = True, + params: Optional[argparse.Namespace] = None, + quiet: bool = False, +) -> Optional[str]: + """Download a scan-level SBOM in *sbom_format* from Workbench. + + At present only the *cyclonedx* format is fully supported. Additional + formats (e.g. *spdx3*) will be added incrementally – callers should be + prepared for the function to return *None* when the requested format is + not yet implemented. + + The returned value is a path to a temporary file holding the SBOM JSON + content (or *None* on failure). + """ + + fmt_normalised = sbom_format.lower() + + if fmt_normalised in {"cyclonedx", "cyclone_dx", "cdx"}: + # Delegate to the existing CycloneDX helper for now – we keep the + # original function so that other modules remain backwards compatible. + path = download_cyclonedx_sbom( + workbench, + scan_code, + include_vex=include_vex, + params=params, + quiet=quiet, + ) + + # Expose on *params* for downstream reuse (optional) + if path and params is not None: + setattr(params, "_cyclonedx_sbom_path", path) + + return path + + elif fmt_normalised in {"spdx3", "spdx"}: + if not quiet: + print(" ℹ️ SPDX SBOM download not yet implemented – skipping") + return None + + else: + raise ValueError(f"Unsupported SBOM format '{sbom_format}' requested") + + +def cache_components_from_sbom( + sbom_path: str, + *, + sbom_format: str = "cyclonedx", + quiet: bool = False, +) -> int: + """Populate the component-info cache from *sbom_path*. + + The helper dispatches to format-specific caching functions. It returns the + number of component records added to the cache. + """ + + fmt_normalised = sbom_format.lower() + + if fmt_normalised in {"cyclonedx", "cyclone_dx", "cdx"}: + return cache_components_from_cyclonedx(sbom_path, quiet=quiet) + + elif fmt_normalised in {"spdx3", "spdx", "spdx_json"}: + return cache_components_from_spdx(sbom_path, quiet=quiet) + + else: + raise ValueError(f"Unsupported SBOM format '{sbom_format}' for caching") + + +# --------------------------------------------------------------------------- +# SPDX helper – *stub* implementation (to be expanded in follow-up work) +# --------------------------------------------------------------------------- + + +def cache_components_from_spdx(sbom_path: str, quiet: bool = False) -> int: # pragma: no cover – stub + """Parse an SPDX 3.0 JSON SBOM and cache components. + + The current implementation is a *stub* that simply returns 0 so that the + rest of the export pipeline functions even when SPDX support is not yet + available. + """ + + if not quiet: + logger.debug("SPDX SBOM parsing not yet implemented – nothing cached") + return 0 \ No newline at end of file diff --git a/src/workbench_cli/utilities/vuln_report/cyclonedx_generator.py b/src/workbench_cli/utilities/vuln_report/cyclonedx_generator.py index b8f7589..e2f3891 100644 --- a/src/workbench_cli/utilities/vuln_report/cyclonedx_generator.py +++ b/src/workbench_cli/utilities/vuln_report/cyclonedx_generator.py @@ -240,10 +240,10 @@ def build_cyclonedx_from_components( cisa_kev_enrichment: bool = False, enable_vex_suppression: bool = True ) -> Bom: - """Build a brand-new CycloneDX 1.6 BOM while retaining component list & dependency graph from - a pre-existing Workbench SBOM (typically 1.5). This is the preferred middle-ground refactor – - we ignore legacy metadata quirks and simply copy components & edges, then inject enriched - vulnerability data. + """ + Build a brand-new CycloneDX 1.6 BOM while retaining component list & dependency graph from + a pre-existing Workbench SBOM (typically 1.5). This helps ignore legacy metadata quirks and + simply copies components & edges, then injects enriched vulnerability data. """ if not CYCLONEDX_AVAILABLE: @@ -297,16 +297,42 @@ def build_cyclonedx_from_components( bom_ref=bom_ref_val, ) - # Best-effort: copy licenses if an SPDX id is present + # Copy author/publisher information when present (NEW) + author_val = comp_data.get("author") + publisher_val = comp_data.get("publisher") + supplier_data = comp_data.get("supplier") or {} + supplier_name = supplier_data.get("name") + if author_val: + component.author = author_val # type: ignore[attr-defined] + if publisher_val: + component.publisher = publisher_val # type: ignore[attr-defined] + if supplier_name: + try: + from cyclonedx.model.component import OrganizationalEntity + component.supplier = OrganizationalEntity(name=supplier_name) # type: ignore[attr-defined] + except Exception: + # Fallback: store supplier as author if supplier field not supported + if not author_val: + component.author = supplier_name # type: ignore[attr-defined] + + # Best-effort: copy licenses if an SPDX id or expression is present (improved) if comp_data.get("licenses"): try: - from cyclonedx.model.license import LicenseChoice, DisjunctiveLicenseSet, License, SpdxLicense + from cyclonedx.model.license import ( + LicenseChoice, + DisjunctiveLicenseSet, + SpdxLicense, + LicenseExpression, + ) lic_objs = [] for lic in comp_data["licenses"]: - lic_id = lic.get("license", {}).get("id") - if lic_id: - lic_objs.append(SpdxLicense(lic_id)) + lic_info = lic.get("license") + if lic_info and lic_info.get("id"): + lic_objs.append(SpdxLicense(lic_info["id"])) + elif lic.get("expression"): + lic_objs.append(LicenseExpression(value=lic["expression"])) + if lic_objs: component.licenses = LicenseChoice(DisjunctiveLicenseSet(licenses=lic_objs)) except Exception: @@ -378,249 +404,6 @@ def build_cyclonedx_from_components( return new_bom - -def augment_existing_cyclonedx_sbom( - base_sbom_path: str, - vulnerabilities: List[Dict[str, Any]], - scan_code: str, - external_data: Optional[Dict[str, Dict[str, Any]]] = None, - nvd_enrichment: bool = False, - epss_enrichment: bool = False, - cisa_kev_enrichment: bool = False, - enable_vex_suppression: bool = True -) -> Bom: - """ - Augment an existing CycloneDX SBOM with vulnerability data. - - This approach preserves all the rich component metadata from the existing SBOM - (licenses, suppliers, dependencies, etc.) while adding vulnerability information. - - Args: - base_sbom_path: Path to the existing CycloneDX SBOM file - vulnerabilities: List of vulnerability dictionaries from the API - scan_code: The scan code for reference - external_data: Pre-fetched external enrichment data (optional) - nvd_enrichment: Whether NVD enrichment was enabled - epss_enrichment: Whether EPSS enrichment was enabled - cisa_kev_enrichment: Whether CISA KEV enrichment was enabled - enable_vex_suppression: Whether VEX suppression is enabled - - Returns: - Augmented CycloneDX BOM object with vulnerability information - - Raises: - FileNotFoundError: If the base SBOM file doesn't exist - ValueError: If the base SBOM cannot be parsed - """ - if not CYCLONEDX_AVAILABLE: - raise ImportError("CycloneDX support requires the 'cyclonedx-python-lib' package") - - if external_data is None: - external_data = {} - - # Load existing SBOM - try: - with open(base_sbom_path, 'r', encoding='utf-8') as f: - json_data = json.load(f) - - # Create a new BOM and populate it with existing data - existing_bom = Bom() - - # Set metadata from existing SBOM - if 'metadata' in json_data: - metadata = json_data['metadata'] - if 'timestamp' in metadata: - try: - existing_bom.metadata.timestamp = datetime.fromisoformat(metadata['timestamp'].replace('Z', '+00:00')) - except: - existing_bom.metadata.timestamp = datetime.utcnow() - else: - existing_bom.metadata.timestamp = datetime.utcnow() - - # Add existing components - if 'components' in json_data: - for comp_data in json_data['components']: - try: - component = Component( - name=comp_data.get('name', 'Unknown'), - version=comp_data.get('version', ''), - type=ComponentType.LIBRARY, - bom_ref=comp_data.get('bom-ref') or None, - ) - - # Set PURL if available - if 'purl' in comp_data: - try: - component.purl = PackageURL.from_string(comp_data['purl']) - except: - pass # Skip invalid PURLs - - # Set bom-ref if available - if 'bom-ref' in comp_data: - component.bom_ref = comp_data['bom-ref'] - - existing_bom.components.add(component) - except: - # Skip components that can't be parsed - continue - - # Add existing vulnerabilities - if 'vulnerabilities' in json_data: - for vuln_data in json_data['vulnerabilities']: - try: - vulnerability = Vulnerability( - bom_ref=vuln_data.get('bom-ref', f"vuln-{vuln_data.get('id', 'unknown')}"), - id=vuln_data.get('id', 'UNKNOWN') - ) - - # Set description - if 'description' in vuln_data: - vulnerability.description = vuln_data['description'] - - # Add affects relationships - if 'affects' in vuln_data: - affects = [] - for affect in vuln_data['affects']: - if 'ref' in affect: - affects.append(BomTarget(ref=affect['ref'])) - if affects: - vulnerability.affects = affects - - existing_bom.vulnerabilities.add(vulnerability) - except: - # Skip vulnerabilities that can't be parsed - continue - - except FileNotFoundError: - raise FileNotFoundError(f"Base SBOM file not found: {base_sbom_path}") - except json.JSONDecodeError as e: - raise ValueError(f"Invalid JSON in base SBOM file: {e}") - except Exception as e: - raise ValueError(f"Failed to parse base SBOM file: {e}") - - # Create component lookup for matching vulnerabilities to existing components - component_lookup = {} - for component in existing_bom.components: - # Create multiple lookup keys for flexible matching - keys = [ - component.name, # Simple name match - f"{component.name}@{component.version}" if component.version else component.name, # Name@version - ] - - # Add PURL-based matching if available - if component.purl: - keys.append(str(component.purl)) - keys.append(component.purl.name) # Just the name part of PURL - - for key in keys: - if key: - component_lookup[key.lower()] = component - - # Process vulnerabilities and match to existing components - vulnerabilities_to_add = [] - unmatched_vulnerabilities = [] - - for vuln in vulnerabilities: - component_name = vuln.get("component_name", "Unknown") - component_version = vuln.get("component_version", "Unknown") - cve = vuln.get("cve", "UNKNOWN") - - # Try to match vulnerability to existing component - matched_component = None - - # Try different matching strategies - match_keys = [ - component_name.lower(), - f"{component_name}@{component_version}".lower(), - f"{component_name}-{component_version}".lower(), - ] - - for key in match_keys: - if key in component_lookup: - matched_component = component_lookup[key] - break - - if matched_component: - # Create vulnerability and link to existing component - vulnerability = _create_cyclonedx_vulnerability(vuln, external_data.get(cve, {})) - - # Ensure the bom-ref is a plain string for JSON serialization - ref_id = matched_component.bom_ref - if not isinstance(ref_id, str): - ref_id = str(ref_id) - - # Add BOM target to link vulnerability to component - vulnerability.affects = [BomTarget(ref=ref_id)] - - vulnerabilities_to_add.append(vulnerability) - else: - # Component not found in existing SBOM - unmatched_vulnerabilities.append(vuln) - - # Add matched vulnerabilities to the BOM - for vulnerability in vulnerabilities_to_add: - existing_bom.vulnerabilities.add(vulnerability) - - # Handle unmatched vulnerabilities by creating minimal components - if unmatched_vulnerabilities: - logger.warning(f"Found {len(unmatched_vulnerabilities)} vulnerabilities for components not in base SBOM") - - for vuln in unmatched_vulnerabilities: - component_name = vuln.get("component_name", "Unknown") - component_version = vuln.get("component_version", "Unknown") - cve = vuln.get("cve", "UNKNOWN") - - # Create minimal component for unmatched vulnerability - ecosystem = _detect_package_ecosystem(component_name, component_version) - - try: - purl = PackageURL( - type=ecosystem, - name=component_name, - version=component_version - ) - component = Component( - name=component_name, - version=component_version, - type=ComponentType.LIBRARY, - purl=purl - ) - except Exception: - component = Component( - name=component_name, - version=component_version, - type=ComponentType.LIBRARY - ) - - # Add component to BOM - existing_bom.components.add(component) - - # Create and add vulnerability - vulnerability = _create_cyclonedx_vulnerability(vuln, external_data.get(cve, {})) - - # Ensure bom-ref serializes as a string - ref_id = component.bom_ref if isinstance(component.bom_ref, str) else str(component.bom_ref) - vulnerability.affects = [BomTarget(ref=ref_id)] - existing_bom.vulnerabilities.add(vulnerability) - - # Update BOM metadata to reflect augmentation - existing_bom.metadata.timestamp = datetime.utcnow() - - # Add properties to indicate this is an augmented SBOM - # Note: existing_bom.metadata.properties is a SortedSet, so we use update() with Property objects - properties_to_add = [ - Property(name="augmented_with_vulnerabilities", value="true"), - Property(name="augmentation_timestamp", value=datetime.utcnow().isoformat() + "Z"), - Property(name="vulnerability_count", value=str(len(vulnerabilities))), - Property(name="unmatched_vulnerabilities", value=str(len(unmatched_vulnerabilities))), - Property(name="scan_code", value=scan_code), - ] - - existing_bom.metadata.properties.update(properties_to_add) - - return existing_bom - - def _create_cyclonedx_vulnerability( vuln: Dict[str, Any], ext_data: Dict[str, Any] @@ -683,10 +466,10 @@ def _create_cyclonedx_vulnerability( ratings.append(dynamic_rating) - # EPSS rating + # EPSS rating (explicit source so ingest tools recognise it) if ext_data.get("epss_score") is not None: epss_rating = VulnerabilityRating( - source=None, + source=VulnerabilitySource(name="EPSS", url="https://www.first.org/epss"), score=ext_data["epss_score"], method=VulnerabilityScoreSource.OTHER, ) @@ -748,41 +531,93 @@ def _create_cyclonedx_vulnerability( # ------------------------------------------------------------------ # References & Metadata # ------------------------------------------------------------------ - # Add references - references = [] + # Add references (initialised above but we will continue to append) + # Map NVD tags to ExternalReferenceType for richer context + tag_map = { + "Vendor Advisory": ExternalReferenceType.ADVISORIES, + "Patch": ExternalReferenceType.PATCH if hasattr(ExternalReferenceType, "PATCH") else ExternalReferenceType.OTHER, + "Exploit": ExternalReferenceType.EXPLOITABILITY_STATEMENT, + "Release Notes": ExternalReferenceType.RELEASE_NOTES, + } - # NVD reference + # Ensure external_references structure exists + from sortedcontainers import SortedSet + if not getattr(vulnerability, "external_references", None): + vulnerability.external_references = SortedSet() + + # Primary NVD advisory if cve != "UNKNOWN": - nvd_ref = VulnerabilityReference( - id=cve, - source=VulnerabilitySource(name="NVD", url=f"https://nvd.nist.gov/vuln/detail/{cve}") - ) - references.append(nvd_ref) - - # Additional NVD references - if ext_data.get("nvd_references"): - for ref in ext_data["nvd_references"][:5]: # Limit to 5 references - ref_obj = VulnerabilityReference( - source=VulnerabilitySource( - name=ref.get("source", "Unknown"), - url=ref.get("url", "") + try: + vulnerability.external_references.add( + ExternalReference( + type=ExternalReferenceType.ADVISORIES, + url=f"https://nvd.nist.gov/vuln/detail/{cve}", + comment="NVD" ) ) - references.append(ref_obj) - - vulnerability.references = references - + except Exception: + pass + + if ext_data.get("nvd_references"): + from sortedcontainers import SortedSet + for idx, ref in enumerate(ext_data["nvd_references"]): + url = ref.get("url") + if not url: + continue + tags = ref.get("tags", []) + matched_type = None + for t in tags: + if t in tag_map: + matched_type = tag_map[t] + break + if not matched_type: + matched_type = ExternalReferenceType.OTHER + try: + vulnerability.external_references.add( + ExternalReference( + type=matched_type, + url=url, + comment=ref.get("source", "") + ) + ) # type: ignore[attr-defined] + except Exception: + pass + # Add CWE information if ext_data.get("nvd_cwe"): vulnerability.cwes = [int(cwe.replace("CWE-", "")) for cwe in ext_data["nvd_cwe"] if cwe.startswith("CWE-")] # Add properties for additional metadata properties = [] - + + # CISA KEV flag if ext_data.get("cisa_kev"): properties.append({"name": "cisa_known_exploited", "value": "true"}) - - if ext_data.get("epss_percentile"): + + # Ensure vulnerability is marked exploitable if not already + try: + from cyclonedx.model.impact_analysis import ImpactAnalysisState + if not vulnerability.analysis: + from cyclonedx.model.vulnerability import VulnerabilityAnalysis + vulnerability.analysis = VulnerabilityAnalysis(state=ImpactAnalysisState.EXPLOITABLE) + else: + vulnerability.analysis.state = ImpactAnalysisState.EXPLOITABLE # type: ignore[attr-defined] + except Exception: + pass # non-critical + + # Add advisory reference + try: + kev_ref = ExternalReference( + type=ExternalReferenceType.ADVISORIES, + url="https://www.cisa.gov/known-exploited-vulnerabilities", + comment="CISA Known Exploited Vulnerabilities catalog" + ) + vulnerability.external_references.add(kev_ref) # type: ignore[attr-defined] + except Exception: + pass + + # EPSS percentile property + if ext_data.get("epss_percentile") is not None: properties.append({"name": "epss_percentile", "value": str(ext_data["epss_percentile"])}) # VEX properties @@ -806,8 +641,49 @@ def _create_cyclonedx_vulnerability( if risk_adjustment.priority_context: properties.append({"name": "risk_priority_context", "value": risk_adjustment.priority_context}) - # Note: CycloneDX doesn't have a direct properties field on Vulnerability - # These would typically be added as external references or in the BOM metadata + # ------------------------------------------------------------------ + # Publication & temporal data (from NVD) + # ------------------------------------------------------------------ + from datetime import datetime, timezone + if ext_data.get("nvd_published") and not getattr(vulnerability, "published", None): + try: + vulnerability.published = datetime.fromisoformat(ext_data["nvd_published"].replace("Z", "+00:00")) # type: ignore[attr-defined] + except Exception: + pass + + if ext_data.get("nvd_last_modified") and not getattr(vulnerability, "updated", None): + try: + vulnerability.updated = datetime.fromisoformat(ext_data["nvd_last_modified"].replace("Z", "+00:00")) # type: ignore[attr-defined] + except Exception: + pass + + # ------------------------------------------------------------------ + # Exploitability / impact sub-scores + # ------------------------------------------------------------------ + if ext_data.get("exploitability_score") is not None: + try: + vulnerability.ratings.add( + VulnerabilityRating( + source=VulnerabilitySource(name="NVD Exploitability"), + score=float(ext_data["exploitability_score"]), + method=VulnerabilityScoreSource.OTHER, + ) + ) # type: ignore[attr-defined] + except Exception: + pass + + if ext_data.get("impact_score") is not None: + properties.append({"name": "nvd_impact_score", "value": str(ext_data["impact_score"])}) + + # ------------------------------------------------------------------ + # Detailed CVSS v3 metrics as properties + # ------------------------------------------------------------------ + if ext_data.get("cvss3_metrics"): + for m_key, m_val in ext_data["cvss3_metrics"].items(): + properties.append({"name": f"cvss3_{m_key}", "value": m_val}) + + # Assign accumulated properties + vulnerability.properties = [Property(name=p["name"], value=p["value"]) for p in properties] return vulnerability diff --git a/src/workbench_cli/utilities/vuln_report/vulnerability_enricher.py b/src/workbench_cli/utilities/vuln_report/vulnerability_enricher.py index a775aeb..cd94bcb 100644 --- a/src/workbench_cli/utilities/vuln_report/vulnerability_enricher.py +++ b/src/workbench_cli/utilities/vuln_report/vulnerability_enricher.py @@ -341,22 +341,51 @@ def _parse_nvd_vulnerability(vuln_data: Dict[str, Any]) -> Dict[str, Any]: # Extract full CVSS vector full_cvss_vector = None cvss_score = None + exploitability_score = None + impact_score = None + cvss3_metrics = {} + if "metrics" in vuln_data: for metric_type in ["cvssMetricV31", "cvssMetricV30", "cvssMetricV2"]: if metric_type in vuln_data["metrics"]: metrics = vuln_data["metrics"][metric_type] - if metrics and len(metrics) > 0: - cvss_data = metrics[0].get("cvssData", {}) + if metrics: + metric_entry = metrics[0] + cvss_data = metric_entry.get("cvssData", {}) full_cvss_vector = cvss_data.get("vectorString") cvss_score = cvss_data.get("baseScore") - break + + # Collect detailed metrics for v3 / v3.1 + if metric_type.startswith("cvssMetricV3"): + keys_map = { + "attackVector": "attack_vector", + "attackComplexity": "attack_complexity", + "privilegesRequired": "privileges_required", + "userInteraction": "user_interaction", + "scope": "scope", + "confidentialityImpact": "confidentiality", + "integrityImpact": "integrity", + "availabilityImpact": "availability", + } + for k_src, k_dst in keys_map.items(): + if cvss_data.get(k_src): + cvss3_metrics[k_dst] = cvss_data[k_src] + + exploitability_score = metric_entry.get("exploitabilityScore") or exploitability_score + impact_score = metric_entry.get("impactScore") or impact_score + break return { "nvd_description": description, "nvd_cwe": cwe_ids, "nvd_references": references, "full_cvss_vector": full_cvss_vector, - "cvss_score": cvss_score + "cvss_score": cvss_score, + "nvd_published": vuln_data.get("published"), + "nvd_last_modified": vuln_data.get("lastModified"), + "exploitability_score": exploitability_score, + "impact_score": impact_score, + "cvss3_metrics": cvss3_metrics } diff --git a/vuln-report-epss.json b/vuln-report-epss.json index 9fb401e..d3204b7 100644 --- a/vuln-report-epss.json +++ b/vuln-report-epss.json @@ -1 +1 @@ -{"components": [{"bom-ref": "BomRef.5015867418398539.5529893063021064", "name": "Flask", "purl": "pkg:pypi/flask@1.1.2", "type": "library", "version": "1.1.2"}, {"bom-ref": "BomRef.9410242564228095.34944569487824817", "name": "Jaxer", "purl": "pkg:github/jaxer@1.0.3", "type": "library", "version": "1.0.3"}, {"bom-ref": "BomRef.9883471750381841.7466662592964213", "name": "Werkzeug", "purl": "pkg:pypi/werkzeug@1.0.1", "type": "library", "version": "1.0.1"}, {"bom-ref": "BomRef.673543781581126.1839168456417254", "name": "async", "purl": "pkg:npm/async@2.6.3", "type": "library", "version": "2.6.3"}, {"bom-ref": "BomRef.728053427688792.5378136988069724", "name": "body-parser", "purl": "pkg:npm/body-parser@1.19.0", "type": "library", "version": "1.19.0"}, {"bom-ref": "BomRef.8487697603637333.4730879948474398", "name": "certifi", "purl": "pkg:pypi/certifi@2018.11.29", "type": "library", "version": "2018.11.29"}, {"bom-ref": "BomRef.22433138186869872.8560950398655969", "name": "com.google.crypto.tink/tink", "purl": "pkg:maven/com.google.crypto.tink/tink@1.3.0-rc2", "type": "library", "version": "1.3.0-rc2"}, {"bom-ref": "BomRef.6804180962281385.13176555549611935", "name": "com.google.protobuf/protobuf-java", "purl": "pkg:maven/com.google.protobuf/protobuf-java@3.10.0", "type": "library", "version": "3.10.0"}, {"bom-ref": "BomRef.01341803731587321.2123770698572679", "name": "core", "purl": "pkg:github/core@23.1", "type": "library", "version": "23.1"}, {"bom-ref": "BomRef.1474893841097934.4949872678438342", "name": "debug", "purl": "pkg:npm/debug@2.2.0", "type": "library", "version": "2.2.0"}, {"bom-ref": "BomRef.7377350103591641.9999959620672784", "name": "decode-uri-component", "purl": "pkg:npm/decode-uri-component@0.2.0", "type": "library", "version": "0.2.0"}, {"bom-ref": "BomRef.32603828750058794.13944987388968155", "name": "dottie", "purl": "pkg:npm/dottie@2.0.2", "type": "library", "version": "2.0.2"}, {"bom-ref": "BomRef.9958908726427385.41640262961572616", "name": "express", "purl": "pkg:npm/express@4.17.1", "type": "library", "version": "4.17.1"}, {"bom-ref": "BomRef.16248057238852376.11894782673472637", "name": "gitpython", "purl": "pkg:pypi/gitpython@2.1.11", "type": "library", "version": "2.1.11"}, {"bom-ref": "BomRef.38172497497161795.022580157295507552", "name": "glob-parent", "purl": "pkg:npm/glob-parent@3.1.0", "type": "library", "version": "3.1.0"}, {"bom-ref": "BomRef.26125065962048877.006979537446065942", "name": "handlebars", "purl": "pkg:npm/handlebars@2.0.0", "type": "library", "version": "2.0.0"}, {"bom-ref": "BomRef.5587360668863955.3901355586579408", "name": "httpd", "purl": "pkg:github/httpd@2.1.5", "type": "library", "version": "2.1.5"}, {"bom-ref": "BomRef.0671755541171144.9281861038312356", "name": "jsonwebtoken", "purl": "pkg:npm/jsonwebtoken@8.5.1", "type": "library", "version": "8.5.1"}, {"bom-ref": "BomRef.19165222568146623.13818775783266168", "name": "junit/junit", "purl": "pkg:maven/junit/junit@4.12", "type": "library", "version": "4.12"}, {"bom-ref": "BomRef.5016908150967304.04660173011288682", "name": "lodash", "purl": "pkg:npm/lodash@4.17.20", "type": "library", "version": "4.17.20"}, {"bom-ref": "BomRef.9672349152734327.2572747503716969", "name": "minimatch", "purl": "pkg:npm/minimatch@3.0.4", "type": "library", "version": "3.0.4"}, {"bom-ref": "BomRef.20473345059877013.9811815430820026", "name": "minimist", "purl": "pkg:npm/minimist@0.0.8", "type": "library", "version": "0.0.8"}, {"bom-ref": "BomRef.10101367219257584.8276993172182099", "name": "moment", "purl": "pkg:npm/moment@2.28.0", "type": "library", "version": "2.28.0"}, {"bom-ref": "BomRef.8220319534931615.5732818757286379", "name": "ms", "purl": "pkg:npm/ms@0.7.1", "type": "library", "version": "0.7.1"}, {"bom-ref": "BomRef.5919948334602787.9912958500788254", "name": "mysql-server", "purl": "pkg:github/mysql-server@mysql-5.0.52", "type": "library", "version": "mysql-5.0.52"}, {"bom-ref": "BomRef.6470797888368227.8823503558806409", "name": "opencart", "purl": "pkg:github/opencart@3.0.3.9", "type": "library", "version": "3.0.3.9"}, {"bom-ref": "BomRef.9849441235973053.9905469000440621", "name": "org.apache.derby/derby", "purl": "pkg:maven/org.apache.derby/derby@10.8.2.2", "type": "library", "version": "10.8.2.2"}, {"bom-ref": "BomRef.5027080234434728.663798481118192", "name": "path-parse", "purl": "pkg:npm/path-parse@1.0.6", "type": "library", "version": "1.0.6"}, {"bom-ref": "BomRef.5084068118501069.2920661410204173", "name": "pyjwt", "purl": "pkg:pypi/pyjwt@1.6.4", "type": "library", "version": "1.6.4"}, {"bom-ref": "BomRef.7926947193899209.2736944734351441", "name": "qs", "purl": "pkg:npm/qs@6.7.0", "type": "library", "version": "6.7.0"}, {"bom-ref": "BomRef.2852608381709688.3192075891818317", "name": "requests", "purl": "pkg:pypi/requests@2.21.0", "type": "library", "version": "2.21.0"}, {"bom-ref": "BomRef.34100267956153885.052308719330987685", "name": "revel/revel", "purl": "pkg:golang/revel/revel@v0.21.0", "type": "library", "version": "v0.21.0"}, {"bom-ref": "BomRef.3158569679011557.9291257878786697", "name": "safety", "purl": "pkg:pypi/safety@1.8.4", "type": "library", "version": "1.8.4"}, {"bom-ref": "BomRef.30667251441621235.9950025739109604", "name": "semver", "purl": "pkg:npm/semver@5.7.1", "type": "library", "version": "5.7.1"}, {"bom-ref": "BomRef.35274273626357255.9602057346237564", "name": "semver", "purl": "pkg:npm/semver@7.3.2", "type": "library", "version": "7.3.2"}, {"bom-ref": "BomRef.34445063472709214.44310022635101853", "name": "send", "purl": "pkg:npm/send@0.17.1", "type": "library", "version": "0.17.1"}, {"bom-ref": "BomRef.7220939765471375.37886797857186616", "name": "sequelize", "purl": "pkg:npm/sequelize@6.3.5", "type": "library", "version": "6.3.5"}, {"bom-ref": "BomRef.8167051593528316.5339527606923408", "name": "serve-static", "purl": "pkg:npm/serve-static@1.14.1", "type": "library", "version": "1.14.1"}, {"bom-ref": "BomRef.8316312714127189.4105365732006804", "name": "shelljs", "purl": "pkg:npm/shelljs@0.7.8", "type": "library", "version": "0.7.8"}, {"bom-ref": "BomRef.02646854172307067.6197331165603063", "name": "swagger-ui", "purl": "pkg:github/swagger-ui@3.19.3", "type": "library", "version": "3.19.3"}, {"bom-ref": "BomRef.966334455593416.9532032122253387", "name": "textpattern", "purl": "pkg:github/textpattern@4.3.0", "type": "library", "version": "4.3.0"}, {"bom-ref": "BomRef.6500836204522693.34253115076410534", "name": "underscore", "purl": "pkg:github/underscore@1.7.0", "type": "library", "version": "1.7.0"}, {"bom-ref": "BomRef.9377925526969101.017428398274038637", "name": "urllib3", "purl": "pkg:pypi/urllib3@1.24.1", "type": "library", "version": "1.24.1"}, {"bom-ref": "BomRef.6998936851785492.30381529048995426", "name": "validator", "purl": "pkg:npm/validator@10.11.0", "type": "library", "version": "10.11.0"}, {"bom-ref": "BomRef.7738192653583078.45062690508264314", "name": "web", "purl": "pkg:maven/web@2.0.0", "type": "library", "version": "2.0.0"}, {"bom-ref": "BomRef.2641455631118449.5895151060591177", "name": "wheel", "purl": "pkg:pypi/wheel@0.32.3", "type": "library", "version": "0.32.3"}], "dependencies": [{"ref": "BomRef.5015867418398539.5529893063021064"}, {"ref": "BomRef.9410242564228095.34944569487824817"}, {"ref": "BomRef.9883471750381841.7466662592964213"}, {"ref": "BomRef.673543781581126.1839168456417254"}, {"ref": "BomRef.728053427688792.5378136988069724"}, {"ref": "BomRef.8487697603637333.4730879948474398"}, {"ref": "BomRef.22433138186869872.8560950398655969"}, {"ref": "BomRef.6804180962281385.13176555549611935"}, {"ref": "BomRef.01341803731587321.2123770698572679"}, {"ref": "BomRef.1474893841097934.4949872678438342"}, {"ref": "BomRef.7377350103591641.9999959620672784"}, {"ref": "BomRef.32603828750058794.13944987388968155"}, {"ref": "BomRef.9958908726427385.41640262961572616"}, {"ref": "BomRef.16248057238852376.11894782673472637"}, {"ref": "BomRef.38172497497161795.022580157295507552"}, {"ref": "BomRef.26125065962048877.006979537446065942"}, {"ref": "BomRef.5587360668863955.3901355586579408"}, {"ref": "BomRef.0671755541171144.9281861038312356"}, {"ref": "BomRef.19165222568146623.13818775783266168"}, {"ref": "BomRef.5016908150967304.04660173011288682"}, {"ref": "BomRef.9672349152734327.2572747503716969"}, {"ref": "BomRef.20473345059877013.9811815430820026"}, {"ref": "BomRef.10101367219257584.8276993172182099"}, {"ref": "BomRef.8220319534931615.5732818757286379"}, {"ref": "BomRef.5919948334602787.9912958500788254"}, {"ref": "BomRef.6470797888368227.8823503558806409"}, {"ref": "BomRef.9849441235973053.9905469000440621"}, {"ref": "BomRef.5027080234434728.663798481118192"}, {"ref": "BomRef.5084068118501069.2920661410204173"}, {"ref": "BomRef.7926947193899209.2736944734351441"}, {"ref": "BomRef.2852608381709688.3192075891818317"}, {"ref": "BomRef.34100267956153885.052308719330987685"}, {"ref": "BomRef.3158569679011557.9291257878786697"}, {"ref": "BomRef.30667251441621235.9950025739109604"}, {"ref": "BomRef.35274273626357255.9602057346237564"}, {"ref": "BomRef.34445063472709214.44310022635101853"}, {"ref": "BomRef.7220939765471375.37886797857186616"}, {"ref": "BomRef.8167051593528316.5339527606923408"}, {"ref": "BomRef.8316312714127189.4105365732006804"}, {"ref": "BomRef.02646854172307067.6197331165603063"}, {"ref": "BomRef.966334455593416.9532032122253387"}, {"ref": "BomRef.6500836204522693.34253115076410534"}, {"ref": "BomRef.9377925526969101.017428398274038637"}, {"ref": "BomRef.6998936851785492.30381529048995426"}, {"ref": "BomRef.7738192653583078.45062690508264314"}, {"ref": "BomRef.2641455631118449.5895151060591177"}], "metadata": {"timestamp": "2025-07-05T16:13:37.108960-04:00"}, "serialNumber": "urn:uuid:4780e153-7f38-4c21-a026-d4b13eb195a9", "version": 1, "vulnerabilities": [{"bom-ref": "vuln-CVE-2006-20001-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2006-20001", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2006-20001", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-20001"}}]}, {"bom-ref": "vuln-CVE-2016-8612-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2016-8612", "ratings": [{"method": "CVSSv3", "score": "4.3", "severity": "medium", "vector": "CVSS:3.0/AV:A/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2016-8612", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8612"}}]}, {"bom-ref": "vuln-CVE-2016-8750-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2016-8750", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2016-8750", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8750"}}]}, {"bom-ref": "vuln-CVE-2017-16137-debug-2.2.0", "description": "Security vulnerability affecting debug version 2.2.0", "id": "CVE-2017-16137", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2017-16137", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16137"}}]}, {"bom-ref": "vuln-CVE-2017-20162-ms-0.7.1", "description": "Security vulnerability affecting ms version 0.7.1", "id": "CVE-2017-20162", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2017-20162", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-20162"}}]}, {"bom-ref": "vuln-CVE-2017-20165-debug-2.2.0", "description": "Security vulnerability affecting debug version 2.2.0", "id": "CVE-2017-20165", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2017-20165", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-20165"}}]}, {"bom-ref": "vuln-CVE-2018-0735-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2018-0735", "ratings": [{"method": "CVSSv3", "score": "5.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}, {"method": "other", "score": "0.1"}], "references": [{"id": "CVE-2018-0735", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0735"}}]}, {"bom-ref": "vuln-CVE-2018-11786-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2018-11786", "ratings": [{"method": "CVSSv3", "score": "8.8", "severity": "high", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2018-11786", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11786"}}]}, {"bom-ref": "vuln-CVE-2018-11787-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2018-11787", "ratings": [{"method": "CVSSv3", "score": "8.1", "severity": "high", "vector": "CVSS:3.0/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2018-11787", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11787"}}]}, {"bom-ref": "vuln-CVE-2018-11788-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2018-11788", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.2"}], "references": [{"id": "CVE-2018-11788", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11788"}}]}, {"bom-ref": "vuln-CVE-2018-1301-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2018-1301", "ratings": [{"method": "CVSSv3", "score": "5.9", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.1"}], "references": [{"id": "CVE-2018-1301", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1301"}}]}, {"bom-ref": "vuln-CVE-2018-1302-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2018-1302", "ratings": [{"method": "CVSSv3", "score": "5.9", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.1"}], "references": [{"id": "CVE-2018-1302", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1302"}}]}, {"bom-ref": "vuln-CVE-2018-1303-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2018-1303", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.3"}], "references": [{"id": "CVE-2018-1303", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1303"}}]}, {"bom-ref": "vuln-CVE-2018-1313-org.apache.derby/derby-10.8.2.2", "description": "Security vulnerability affecting org.apache.derby/derby version 10.8.2.2", "id": "CVE-2018-1313", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2018-1313", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1313"}}]}, {"bom-ref": "vuln-CVE-2018-25031-swagger-ui-3.19.3", "description": "Security vulnerability affecting swagger-ui version 3.19.3", "id": "CVE-2018-25031", "ratings": [{"method": "other", "score": "8.0", "severity": "high"}, {"method": "CVSSv3", "score": "4.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.8"}], "references": [{"id": "CVE-2018-25031", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25031"}}]}, {"bom-ref": "vuln-CVE-2018-25091-urllib3-1.24.1", "description": "Security vulnerability affecting urllib3 version 1.24.1", "id": "CVE-2018-25091", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2018-25091", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25091"}}]}, {"bom-ref": "vuln-CVE-2018-3061-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2018-3061", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2018-3061", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3061"}}]}, {"bom-ref": "vuln-CVE-2018-3071-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2018-3071", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2018-3071", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3071"}}]}, {"bom-ref": "vuln-CVE-2018-7474-textpattern-4.3.0", "description": "Security vulnerability affecting textpattern version 4.3.0", "id": "CVE-2018-7474", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.2"}], "references": [{"id": "CVE-2018-7474", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7474"}}]}, {"bom-ref": "vuln-CVE-2019-0191-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2019-0191", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.1"}], "references": [{"id": "CVE-2019-0191", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0191"}}]}, {"bom-ref": "vuln-CVE-2019-0226-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2019-0226", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2019-0226", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0226"}}]}, {"bom-ref": "vuln-CVE-2019-11236-urllib3-1.24.1", "description": "Security vulnerability affecting urllib3 version 1.24.1", "id": "CVE-2019-11236", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2019-11236", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11236"}}]}, {"bom-ref": "vuln-CVE-2019-11324-urllib3-1.24.1", "description": "Security vulnerability affecting urllib3 version 1.24.1", "id": "CVE-2019-11324", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.0/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2019-11324", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11324"}}]}, {"bom-ref": "vuln-CVE-2019-14312-Jaxer-1.0.3", "description": "Security vulnerability affecting Jaxer version 1.0.3", "id": "CVE-2019-14312", "ratings": [{"method": "other", "score": "8.0", "severity": "high"}, {"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.4"}], "references": [{"id": "CVE-2019-14312", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14312"}}]}, {"bom-ref": "vuln-CVE-2019-17495-swagger-ui-3.19.3", "description": "Security vulnerability affecting swagger-ui version 3.19.3", "id": "CVE-2019-17495", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.2"}], "references": [{"id": "CVE-2019-17495", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17495"}}]}, {"bom-ref": "vuln-CVE-2019-20920-handlebars-2.0.0", "description": "Security vulnerability affecting handlebars version 2.0.0", "id": "CVE-2019-20920", "ratings": [{"method": "CVSSv3", "score": "8.1", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:H/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2019-20920", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20920"}}]}, {"bom-ref": "vuln-CVE-2019-2731-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2019-2731", "ratings": [{"method": "CVSSv3", "score": "5.4", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2019-2731", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2731"}}]}, {"bom-ref": "vuln-CVE-2019-2741-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2019-2741", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2019-2741", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2741"}}]}, {"bom-ref": "vuln-CVE-2019-2755-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2019-2755", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2019-2755", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2755"}}]}, {"bom-ref": "vuln-CVE-2019-2757-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2019-2757", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2019-2757", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2757"}}]}, {"bom-ref": "vuln-CVE-2019-7317-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2019-7317", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2019-7317", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317"}}]}, {"bom-ref": "vuln-CVE-2020-11980-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2020-11980", "ratings": [{"method": "CVSSv3", "score": "6.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-11980", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11980"}}]}, {"bom-ref": "vuln-CVE-2020-14760-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14760", "ratings": [{"method": "CVSSv3", "score": "5.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-14760", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14760"}}]}, {"bom-ref": "vuln-CVE-2020-14814-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14814", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-14814", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14814"}}]}, {"bom-ref": "vuln-CVE-2020-14830-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14830", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-14830", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14830"}}]}, {"bom-ref": "vuln-CVE-2020-14837-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14837", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-14837", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14837"}}]}, {"bom-ref": "vuln-CVE-2020-14839-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14839", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-14839", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14839"}}]}, {"bom-ref": "vuln-CVE-2020-14845-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14845", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-14845", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14845"}}]}, {"bom-ref": "vuln-CVE-2020-14846-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14846", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-14846", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14846"}}]}, {"bom-ref": "vuln-CVE-2020-14852-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14852", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-14852", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14852"}}]}, {"bom-ref": "vuln-CVE-2020-15250-junit/junit-4.12", "description": "Security vulnerability affecting junit/junit version 4.12", "id": "CVE-2020-15250", "ratings": [{"method": "CVSSv3", "score": "5.5", "severity": "medium", "vector": "CVSS:3.1/AV:L/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-15250", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15250"}}]}, {"bom-ref": "vuln-CVE-2020-15358-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-15358", "ratings": [{"method": "CVSSv3", "score": "5.5", "severity": "medium", "vector": "CVSS:3.1/AV:L/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-15358", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15358"}}]}, {"analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2020-1967-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-1967", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.6"}], "references": [{"id": "CVE-2020-1967", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1967"}}]}, {"bom-ref": "vuln-CVE-2020-1971-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-1971", "ratings": [{"method": "CVSSv3", "score": "5.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-1971", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1971"}}]}, {"bom-ref": "vuln-CVE-2020-26137-urllib3-1.24.1", "description": "Security vulnerability affecting urllib3 version 1.24.1", "id": "CVE-2020-26137", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-26137", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26137"}}]}, {"bom-ref": "vuln-CVE-2020-28469-glob-parent-3.1.0", "description": "Security vulnerability affecting glob-parent version 3.1.0", "id": "CVE-2020-28469", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-28469", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28469"}}]}, {"bom-ref": "vuln-CVE-2020-28500-lodash-4.17.20", "description": "Security vulnerability affecting lodash version 4.17.20", "id": "CVE-2020-28500", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-28500", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28500"}}]}, {"bom-ref": "vuln-CVE-2020-36568-revel/revel-v0.21.0", "description": "Security vulnerability affecting revel/revel version v0.21.0", "id": "CVE-2020-36568", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-36568", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36568"}}]}, {"bom-ref": "vuln-CVE-2020-5252-safety-1.8.4", "description": "Security vulnerability affecting safety version 1.8.4", "id": "CVE-2020-5252", "ratings": [{"method": "CVSSv3", "score": "4.1", "severity": "medium", "vector": "CVSS:3.1/AV:L/AC:H/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-5252", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5252"}}]}, {"bom-ref": "vuln-CVE-2020-7598-minimist-0.0.8", "description": "Security vulnerability affecting minimist version 0.0.8", "id": "CVE-2020-7598", "ratings": [{"method": "CVSSv3", "score": "5.6", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-7598", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7598"}}]}, {"bom-ref": "vuln-CVE-2020-8929-com.google.crypto.tink/tink-1.3.0-rc2", "description": "Security vulnerability affecting com.google.crypto.tink/tink version 1.3.0-rc2", "id": "CVE-2020-8929", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-8929", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8929"}}]}, {"bom-ref": "vuln-CVE-2021-22569-com.google.protobuf/protobuf-java-3.10.0", "description": "Security vulnerability affecting com.google.protobuf/protobuf-java version 3.10.0", "id": "CVE-2021-22569", "ratings": [{"method": "CVSSv3", "score": "5.5", "severity": "medium", "vector": "CVSS:3.1/AV:L/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-22569", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22569"}}]}, {"bom-ref": "vuln-CVE-2021-22570-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2021-22570", "ratings": [{"method": "CVSSv3", "score": "5.5", "severity": "medium", "vector": "CVSS:3.1/AV:L/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-22570", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22570"}}]}, {"bom-ref": "vuln-CVE-2021-23337-lodash-4.17.20", "description": "Security vulnerability affecting lodash version 4.17.20", "id": "CVE-2021-23337", "ratings": [{"method": "CVSSv3", "score": "7.2", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-23337", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23337"}}]}, {"bom-ref": "vuln-CVE-2021-23343-path-parse-1.0.6", "description": "Security vulnerability affecting path-parse version 1.0.6", "id": "CVE-2021-23343", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-23343", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23343"}}]}, {"bom-ref": "vuln-CVE-2021-23358-underscore-1.7.0", "description": "Security vulnerability affecting underscore version 1.7.0", "id": "CVE-2021-23358", "ratings": [{"method": "CVSSv3", "score": "7.2", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-23358", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23358"}}]}, {"bom-ref": "vuln-CVE-2021-23369-handlebars-2.0.0", "description": "Security vulnerability affecting handlebars version 2.0.0", "id": "CVE-2021-23369", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-23369", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23369"}}]}, {"bom-ref": "vuln-CVE-2021-23383-handlebars-2.0.0", "description": "Security vulnerability affecting handlebars version 2.0.0", "id": "CVE-2021-23383", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.1"}], "references": [{"id": "CVE-2021-23383", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23383"}}]}, {"bom-ref": "vuln-CVE-2021-2356-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2021-2356", "ratings": [{"method": "CVSSv3", "score": "5.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-2356", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-2356"}}]}, {"bom-ref": "vuln-CVE-2021-32785-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-32785", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-32785", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32785"}}]}, {"bom-ref": "vuln-CVE-2021-32786-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-32786", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-32786", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32786"}}]}, {"bom-ref": "vuln-CVE-2021-32791-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-32791", "ratings": [{"method": "CVSSv3", "score": "5.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-32791", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32791"}}]}, {"bom-ref": "vuln-CVE-2021-32792-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-32792", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-32792", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32792"}}]}, {"bom-ref": "vuln-CVE-2021-34798-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-34798", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.1"}], "references": [{"id": "CVE-2021-34798", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34798"}}]}, {"bom-ref": "vuln-CVE-2021-3765-validator-10.11.0", "description": "Security vulnerability affecting validator version 10.11.0", "id": "CVE-2021-3765", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-3765", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3765"}}]}, {"analysis": {"state": "exploitable"}, "bom-ref": "vuln-CVE-2021-39275-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-39275", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.5"}], "references": [{"id": "CVE-2021-39275", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39275"}}]}, {"bom-ref": "vuln-CVE-2021-40438-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-40438", "ratings": [{"method": "CVSSv3", "score": "9.0", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.9"}], "references": [{"id": "CVE-2021-40438", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40438"}}]}, {"bom-ref": "vuln-CVE-2021-40642-textpattern-4.3.0", "description": "Security vulnerability affecting textpattern version 4.3.0", "id": "CVE-2021-40642", "ratings": [{"method": "CVSSv3", "score": "4.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-40642", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40642"}}]}, {"bom-ref": "vuln-CVE-2021-41766-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2021-41766", "ratings": [{"method": "CVSSv3", "score": "8.1", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-41766", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41766"}}]}, {"bom-ref": "vuln-CVE-2021-43138-async-2.6.3", "description": "Security vulnerability affecting async version 2.6.3", "id": "CVE-2021-43138", "ratings": [{"method": "CVSSv3", "score": "7.8", "severity": "high", "vector": "CVSS:3.1/AV:L/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-43138", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43138"}}]}, {"bom-ref": "vuln-CVE-2021-44906-minimist-0.0.8", "description": "Security vulnerability affecting minimist version 0.0.8", "id": "CVE-2021-44906", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-44906", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906"}}]}, {"bom-ref": "vuln-CVE-2022-0144-shelljs-0.7.8", "description": "Security vulnerability affecting shelljs version 0.7.8", "id": "CVE-2022-0144", "ratings": [{"method": "CVSSv3", "score": "7.1", "severity": "high", "vector": "CVSS:3.0/AV:L/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-0144", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0144"}}]}, {"bom-ref": "vuln-CVE-2022-21417-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2022-21417", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-21417", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21417"}}]}, {"bom-ref": "vuln-CVE-2022-21444-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2022-21444", "ratings": [{"method": "CVSSv3", "score": "4.4", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-21444", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21444"}}]}, {"bom-ref": "vuln-CVE-2022-22719-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-22719", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.4"}], "references": [{"id": "CVE-2022-22719", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22719"}}]}, {"bom-ref": "vuln-CVE-2022-22720-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-22720", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.3"}], "references": [{"id": "CVE-2022-22720", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22720"}}]}, {"bom-ref": "vuln-CVE-2022-22721-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-22721", "ratings": [{"method": "CVSSv3", "score": "9.1", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.2"}], "references": [{"id": "CVE-2022-22721", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22721"}}]}, {"bom-ref": "vuln-CVE-2022-22932-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2022-22932", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-22932", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22932"}}]}, {"bom-ref": "vuln-CVE-2022-23491-certifi-2018.11.29", "description": "Security vulnerability affecting certifi version 2018.11.29", "id": "CVE-2022-23491", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-23491", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23491"}}]}, {"bom-ref": "vuln-CVE-2022-23539-jsonwebtoken-8.5.1", "description": "Security vulnerability affecting jsonwebtoken version 8.5.1", "id": "CVE-2022-23539", "ratings": [{"method": "CVSSv3", "score": "8.1", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-23539", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23539"}}]}, {"bom-ref": "vuln-CVE-2022-23540-jsonwebtoken-8.5.1", "description": "Security vulnerability affecting jsonwebtoken version 8.5.1", "id": "CVE-2022-23540", "ratings": [{"method": "CVSSv3", "score": "7.6", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-23540", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23540"}}]}, {"bom-ref": "vuln-CVE-2022-23541-jsonwebtoken-8.5.1", "description": "Security vulnerability affecting jsonwebtoken version 8.5.1", "id": "CVE-2022-23541", "ratings": [{"method": "CVSSv3", "score": "6.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-23541", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23541"}}]}, {"bom-ref": "vuln-CVE-2022-24439-gitpython-2.1.11", "description": "Security vulnerability affecting gitpython version 2.1.11", "id": "CVE-2022-24439", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.7"}], "references": [{"id": "CVE-2022-24439", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24439"}}]}, {"bom-ref": "vuln-CVE-2022-24785-moment-2.28.0", "description": "Security vulnerability affecting moment version 2.28.0", "id": "CVE-2022-24785", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-24785", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24785"}}]}, {"bom-ref": "vuln-CVE-2022-24999-express-4.17.1", "description": "Security vulnerability affecting express version 4.17.1", "id": "CVE-2022-24999", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-24999", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24999"}}]}, {"bom-ref": "vuln-CVE-2022-24999-qs-6.7.0", "description": "Security vulnerability affecting qs version 6.7.0", "id": "CVE-2022-24999", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-24999", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24999"}}]}, {"bom-ref": "vuln-CVE-2022-25883-semver-5.7.1", "description": "Security vulnerability affecting semver version 5.7.1", "id": "CVE-2022-25883", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-25883", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25883"}}]}, {"bom-ref": "vuln-CVE-2022-25883-semver-7.3.2", "description": "Security vulnerability affecting semver version 7.3.2", "id": "CVE-2022-25883", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-25883", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25883"}}]}, {"bom-ref": "vuln-CVE-2022-28330-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-28330", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-28330", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28330"}}]}, {"bom-ref": "vuln-CVE-2022-28614-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-28614", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-28614", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28614"}}]}, {"bom-ref": "vuln-CVE-2022-28615-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-28615", "ratings": [{"method": "CVSSv3", "score": "9.1", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-28615", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28615"}}]}, {"bom-ref": "vuln-CVE-2022-29217-pyjwt-1.6.4", "description": "Security vulnerability affecting pyjwt version 1.6.4", "id": "CVE-2022-29217", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-29217", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29217"}}]}, {"bom-ref": "vuln-CVE-2022-29361-Werkzeug-1.0.1", "description": "Security vulnerability affecting Werkzeug version 1.0.1", "id": "CVE-2022-29361", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.3"}], "references": [{"id": "CVE-2022-29361", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29361"}}]}, {"bom-ref": "vuln-CVE-2022-29404-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-29404", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-29404", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29404"}}]}, {"bom-ref": "vuln-CVE-2022-30556-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-30556", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-30556", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30556"}}]}, {"bom-ref": "vuln-CVE-2022-31129-moment-2.28.0", "description": "Security vulnerability affecting moment version 2.28.0", "id": "CVE-2022-31129", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-31129", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31129"}}]}, {"bom-ref": "vuln-CVE-2022-3171-com.google.protobuf/protobuf-java-3.10.0", "description": "Security vulnerability affecting com.google.protobuf/protobuf-java version 3.10.0", "id": "CVE-2022-3171", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-3171", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3171"}}]}, {"bom-ref": "vuln-CVE-2022-31813-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-31813", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-31813", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31813"}}]}, {"bom-ref": "vuln-CVE-2022-3517-minimatch-3.0.4", "description": "Security vulnerability affecting minimatch version 3.0.4", "id": "CVE-2022-3517", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-3517", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517"}}]}, {"bom-ref": "vuln-CVE-2022-37436-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-37436", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-37436", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37436"}}]}, {"bom-ref": "vuln-CVE-2022-38778-decode-uri-component-0.2.0", "description": "Security vulnerability affecting decode-uri-component version 0.2.0", "id": "CVE-2022-38778", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-38778", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38778"}}]}, {"analysis": {"response": ["will_not_fix"], "state": "exploitable"}, "bom-ref": "vuln-CVE-2022-40145-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2022-40145", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-40145", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40145"}}]}, {"bom-ref": "vuln-CVE-2022-40898-wheel-0.32.3", "description": "Security vulnerability affecting wheel version 0.32.3", "id": "CVE-2022-40898", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-40898", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40898"}}]}, {"analysis": {"response": ["can_not_fix"], "state": "exploitable"}, "bom-ref": "vuln-CVE-2022-46337-org.apache.derby/derby-10.8.2.2", "description": "Security vulnerability affecting org.apache.derby/derby version 10.8.2.2", "id": "CVE-2022-46337", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-46337", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46337"}}]}, {"bom-ref": "vuln-CVE-2023-21977-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2023-21977", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-21977", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21977"}}]}, {"analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2023-21980-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2023-21980", "ratings": [{"method": "CVSSv3", "score": "7.1", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-21980", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21980"}}]}, {"bom-ref": "vuln-CVE-2023-22007-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2023-22007", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-22007", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22007"}}]}, {"bom-ref": "vuln-CVE-2023-22015-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2023-22015", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-22015", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22015"}}]}, {"bom-ref": "vuln-CVE-2023-22026-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2023-22026", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-22026", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22026"}}]}, {"bom-ref": "vuln-CVE-2023-22028-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2023-22028", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-22028", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22028"}}]}, {"bom-ref": "vuln-CVE-2023-22578-sequelize-6.3.5", "description": "Security vulnerability affecting sequelize version 6.3.5", "id": "CVE-2023-22578", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-22578", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22578"}}]}, {"bom-ref": "vuln-CVE-2023-22579-sequelize-6.3.5", "description": "Security vulnerability affecting sequelize version 6.3.5", "id": "CVE-2023-22579", "ratings": [{"method": "CVSSv3", "score": "8.8", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-22579", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22579"}}]}, {"bom-ref": "vuln-CVE-2023-22580-sequelize-6.3.5", "description": "Security vulnerability affecting sequelize version 6.3.5", "id": "CVE-2023-22580", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-22580", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22580"}}]}, {"bom-ref": "vuln-CVE-2023-23934-Werkzeug-1.0.1", "description": "Security vulnerability affecting Werkzeug version 1.0.1", "id": "CVE-2023-23934", "ratings": [{"method": "CVSSv3", "score": "3.5", "severity": "low", "vector": "CVSS:3.1/AV:A/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-23934", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23934"}}]}, {"bom-ref": "vuln-CVE-2023-25577-Werkzeug-1.0.1", "description": "Security vulnerability affecting Werkzeug version 1.0.1", "id": "CVE-2023-25577", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-25577", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25577"}}]}, {"bom-ref": "vuln-CVE-2023-25813-sequelize-6.3.5", "description": "Security vulnerability affecting sequelize version 6.3.5", "id": "CVE-2023-25813", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-25813", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25813"}}]}, {"bom-ref": "vuln-CVE-2023-26132-dottie-2.0.2", "description": "Security vulnerability affecting dottie version 2.0.2", "id": "CVE-2023-26132", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-26132", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26132"}}]}, {"bom-ref": "vuln-CVE-2023-26852-textpattern-4.3.0", "description": "Security vulnerability affecting textpattern version 4.3.0", "id": "CVE-2023-26852", "ratings": [{"method": "CVSSv3", "score": "7.2", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.1"}], "references": [{"id": "CVE-2023-26852", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26852"}}]}, {"bom-ref": "vuln-CVE-2023-27152-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-27152", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-27152", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27152"}}]}, {"bom-ref": "vuln-CVE-2023-30861-Flask-1.1.2", "description": "Security vulnerability affecting Flask version 1.1.2", "id": "CVE-2023-30861", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-30861", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30861"}}]}, {"bom-ref": "vuln-CVE-2023-31122-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2023-31122", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-31122", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31122"}}]}, {"bom-ref": "vuln-CVE-2023-32681-requests-2.21.0", "description": "Security vulnerability affecting requests version 2.21.0", "id": "CVE-2023-32681", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}, {"method": "other", "score": "0.1"}], "references": [{"id": "CVE-2023-32681", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32681"}}]}, {"bom-ref": "vuln-CVE-2023-37920-certifi-2018.11.29", "description": "Security vulnerability affecting certifi version 2018.11.29", "id": "CVE-2023-37920", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-37920", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37920"}}]}, {"bom-ref": "vuln-CVE-2023-38997-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-38997", "ratings": [{"method": "CVSSv3", "score": "7.2", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-38997", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38997"}}]}, {"bom-ref": "vuln-CVE-2023-38998-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-38998", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-38998", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38998"}}]}, {"bom-ref": "vuln-CVE-2023-38999-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-38999", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-38999", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38999"}}]}, {"bom-ref": "vuln-CVE-2023-39000-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39000", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-39000", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39000"}}]}, {"bom-ref": "vuln-CVE-2023-39001-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39001", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-39001", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39001"}}]}, {"bom-ref": "vuln-CVE-2023-39002-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39002", "ratings": [{"method": "other", "score": "8.0", "severity": "high"}, {"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.2"}], "references": [{"id": "CVE-2023-39002", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39002"}}]}, {"bom-ref": "vuln-CVE-2023-39003-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39003", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-39003", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39003"}}]}, {"bom-ref": "vuln-CVE-2023-39004-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39004", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-39004", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39004"}}]}, {"bom-ref": "vuln-CVE-2023-39005-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39005", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-39005", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39005"}}]}, {"bom-ref": "vuln-CVE-2023-39006-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39006", "ratings": [{"method": "CVSSv3", "score": "5.4", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-39006", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39006"}}]}, {"bom-ref": "vuln-CVE-2023-39007-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39007", "ratings": [{"method": "CVSSv3", "score": "9.6", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.5"}], "references": [{"id": "CVE-2023-39007", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39007"}}]}, {"bom-ref": "vuln-CVE-2023-39008-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39008", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-39008", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39008"}}]}, {"bom-ref": "vuln-CVE-2023-40267-gitpython-2.1.11", "description": "Security vulnerability affecting gitpython version 2.1.11", "id": "CVE-2023-40267", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-40267", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40267"}}]}, {"bom-ref": "vuln-CVE-2023-40590-gitpython-2.1.11", "description": "Security vulnerability affecting gitpython version 2.1.11", "id": "CVE-2023-40590", "ratings": [{"method": "CVSSv3", "score": "7.8", "severity": "high", "vector": "CVSS:3.1/AV:L/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-40590", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40590"}}]}, {"bom-ref": "vuln-CVE-2023-41040-gitpython-2.1.11", "description": "Security vulnerability affecting gitpython version 2.1.11", "id": "CVE-2023-41040", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-41040", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41040"}}]}, {"bom-ref": "vuln-CVE-2023-43804-urllib3-1.24.1", "description": "Security vulnerability affecting urllib3 version 1.24.1", "id": "CVE-2023-43804", "ratings": [{"method": "CVSSv3", "score": "8.1", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-43804", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43804"}}]}, {"bom-ref": "vuln-CVE-2023-44275-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-44275", "ratings": [{"method": "CVSSv3", "score": "5.4", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-44275", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44275"}}]}, {"bom-ref": "vuln-CVE-2023-44276-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-44276", "ratings": [{"method": "CVSSv3", "score": "5.4", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-44276", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44276"}}]}, {"bom-ref": "vuln-CVE-2023-45803-urllib3-1.24.1", "description": "Security vulnerability affecting urllib3 version 1.24.1", "id": "CVE-2023-45803", "ratings": [{"method": "CVSSv3", "score": "4.2", "severity": "medium", "vector": "CVSS:3.1/AV:A/AC:H/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-45803", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45803"}}]}, {"bom-ref": "vuln-CVE-2023-46136-Werkzeug-1.0.1", "description": "Security vulnerability affecting Werkzeug version 1.0.1", "id": "CVE-2023-46136", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-46136", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46136"}}]}, {"bom-ref": "vuln-CVE-2024-21514-opencart-3.0.3.9", "description": "Security vulnerability affecting opencart version 3.0.3.9", "id": "CVE-2024-21514", "ratings": [{"method": "CVSSv3", "score": "8.1", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.4"}], "references": [{"id": "CVE-2024-21514", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21514"}}]}, {"bom-ref": "vuln-CVE-2024-22190-gitpython-2.1.11", "description": "Security vulnerability affecting gitpython version 2.1.11", "id": "CVE-2024-22190", "ratings": [{"method": "CVSSv3", "score": "7.8", "severity": "high", "vector": "CVSS:3.1/AV:L/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2024-22190", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22190"}}]}, {"bom-ref": "vuln-CVE-2024-40898-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2024-40898", "ratings": [{"method": "CVSSv3", "score": "9.1", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2024-40898", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40898"}}]}, {"bom-ref": "vuln-CVE-2024-43796-express-4.17.1", "description": "Security vulnerability affecting express version 4.17.1", "id": "CVE-2024-43796", "ratings": [{"method": "CVSSv3", "score": "4.7", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2024-43796", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43796"}}]}, {"bom-ref": "vuln-CVE-2024-43799-send-0.17.1", "description": "Security vulnerability affecting send version 0.17.1", "id": "CVE-2024-43799", "ratings": [{"method": "CVSSv3", "score": "4.7", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2024-43799", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43799"}}]}, {"bom-ref": "vuln-CVE-2024-43800-serve-static-1.14.1", "description": "Security vulnerability affecting serve-static version 1.14.1", "id": "CVE-2024-43800", "ratings": [{"method": "CVSSv3", "score": "4.7", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2024-43800", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43800"}}]}, {"bom-ref": "vuln-CVE-2024-45590-body-parser-1.19.0", "description": "Security vulnerability affecting body-parser version 1.19.0", "id": "CVE-2024-45590", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2024-45590", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45590"}}]}, {"bom-ref": "vuln-CVE-2024-49767-Werkzeug-1.0.1", "description": "Security vulnerability affecting Werkzeug version 1.0.1", "id": "CVE-2024-49767", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2024-49767", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49767"}}]}, {"bom-ref": "vuln-CVE-2025-1746-opencart-3.0.3.9", "description": "Security vulnerability affecting opencart version 3.0.3.9", "id": "CVE-2025-1746", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2025-1746", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1746"}}]}, {"bom-ref": "vuln-CVE-2025-1747-opencart-3.0.3.9", "description": "Security vulnerability affecting opencart version 3.0.3.9", "id": "CVE-2025-1747", "ratings": [{"method": "CVSSv3", "score": "4.7", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2025-1747", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1747"}}]}, {"bom-ref": "vuln-CVE-2025-1748-opencart-3.0.3.9", "description": "Security vulnerability affecting opencart version 3.0.3.9", "id": "CVE-2025-1748", "ratings": [{"method": "CVSSv3", "score": "4.7", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2025-1748", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1748"}}]}, {"bom-ref": "vuln-CVE-2025-1749-opencart-3.0.3.9", "description": "Security vulnerability affecting opencart version 3.0.3.9", "id": "CVE-2025-1749", "ratings": [{"method": "CVSSv3", "score": "4.7", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2025-1749", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1749"}}]}], "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6"} \ No newline at end of file +{"components": [{"bom-ref": "BomRef.07902036517767141.24571970828864698", "name": "Flask", "purl": "pkg:pypi/flask@1.1.2", "type": "library", "version": "1.1.2"}, {"bom-ref": "BomRef.5824128966182286.6047011865101808", "name": "Jaxer", "purl": "pkg:github/jaxer@1.0.3", "type": "library", "version": "1.0.3"}, {"bom-ref": "BomRef.01659985180256962.7191466427841917", "name": "Werkzeug", "purl": "pkg:pypi/werkzeug@1.0.1", "type": "library", "version": "1.0.1"}, {"bom-ref": "BomRef.19784519685000412.5750909291934992", "name": "async", "purl": "pkg:npm/async@2.6.3", "type": "library", "version": "2.6.3"}, {"bom-ref": "BomRef.24270695653314167.8196875740152854", "name": "body-parser", "purl": "pkg:npm/body-parser@1.19.0", "type": "library", "version": "1.19.0"}, {"bom-ref": "BomRef.9507889523495499.16968412478049966", "name": "certifi", "purl": "pkg:pypi/certifi@2018.11.29", "type": "library", "version": "2018.11.29"}, {"bom-ref": "BomRef.4443334167437234.813711865339822", "name": "com.google.crypto.tink/tink", "purl": "pkg:maven/com.google.crypto.tink/tink@1.3.0-rc2", "type": "library", "version": "1.3.0-rc2"}, {"bom-ref": "BomRef.8024034947559952.9466285866322801", "name": "com.google.protobuf/protobuf-java", "purl": "pkg:maven/com.google.protobuf/protobuf-java@3.10.0", "type": "library", "version": "3.10.0"}, {"bom-ref": "BomRef.3448481900514685.7863409403103829", "name": "core", "purl": "pkg:github/core@23.1", "type": "library", "version": "23.1"}, {"bom-ref": "BomRef.3345272696079772.3204653792331038", "name": "debug", "purl": "pkg:npm/debug@2.2.0", "type": "library", "version": "2.2.0"}, {"bom-ref": "BomRef.05914612845544864.5106446859056835", "name": "decode-uri-component", "purl": "pkg:npm/decode-uri-component@0.2.0", "type": "library", "version": "0.2.0"}, {"bom-ref": "BomRef.09334550110129525.6267501887066546", "name": "dottie", "purl": "pkg:npm/dottie@2.0.2", "type": "library", "version": "2.0.2"}, {"bom-ref": "BomRef.33477807102167667.5305642170967946", "name": "express", "purl": "pkg:npm/express@4.17.1", "type": "library", "version": "4.17.1"}, {"bom-ref": "BomRef.5608016440257102.8815335541684918", "name": "gitpython", "purl": "pkg:pypi/gitpython@2.1.11", "type": "library", "version": "2.1.11"}, {"bom-ref": "BomRef.6872187856606309.2871414634041266", "name": "glob-parent", "purl": "pkg:npm/glob-parent@3.1.0", "type": "library", "version": "3.1.0"}, {"bom-ref": "BomRef.7967202870346428.9692876166165221", "name": "handlebars", "purl": "pkg:npm/handlebars@2.0.0", "type": "library", "version": "2.0.0"}, {"bom-ref": "BomRef.9014543229561549.521636554305923", "name": "httpd", "purl": "pkg:github/httpd@2.1.5", "type": "library", "version": "2.1.5"}, {"bom-ref": "BomRef.3451827754567497.8302077174997259", "name": "jsonwebtoken", "purl": "pkg:npm/jsonwebtoken@8.5.1", "type": "library", "version": "8.5.1"}, {"bom-ref": "BomRef.9243617652068874.5311052997971805", "name": "junit/junit", "purl": "pkg:maven/junit/junit@4.12", "type": "library", "version": "4.12"}, {"bom-ref": "BomRef.791262354839746.8473487983709176", "name": "lodash", "purl": "pkg:npm/lodash@4.17.20", "type": "library", "version": "4.17.20"}, {"bom-ref": "BomRef.15569878682282234.7989458667402305", "name": "minimatch", "purl": "pkg:npm/minimatch@3.0.4", "type": "library", "version": "3.0.4"}, {"bom-ref": "BomRef.7984773064332058.5496688250327907", "name": "minimist", "purl": "pkg:npm/minimist@0.0.8", "type": "library", "version": "0.0.8"}, {"bom-ref": "BomRef.9573469552446796.6663293468714621", "name": "moment", "purl": "pkg:npm/moment@2.28.0", "type": "library", "version": "2.28.0"}, {"bom-ref": "BomRef.720478374097643.6334814856500748", "name": "ms", "purl": "pkg:npm/ms@0.7.1", "type": "library", "version": "0.7.1"}, {"bom-ref": "BomRef.72899691585258.08368991187002484", "name": "mysql-server", "purl": "pkg:github/mysql-server@mysql-5.0.52", "type": "library", "version": "mysql-5.0.52"}, {"bom-ref": "BomRef.056504415473854985.18566689647176615", "name": "opencart", "purl": "pkg:github/opencart@3.0.3.9", "type": "library", "version": "3.0.3.9"}, {"bom-ref": "BomRef.9159131775079127.15788292028949336", "name": "org.apache.derby/derby", "purl": "pkg:maven/org.apache.derby/derby@10.8.2.2", "type": "library", "version": "10.8.2.2"}, {"bom-ref": "BomRef.12179375709304796.5582662873016082", "name": "path-parse", "purl": "pkg:npm/path-parse@1.0.6", "type": "library", "version": "1.0.6"}, {"bom-ref": "BomRef.3173302853027027.27863512386341693", "name": "pyjwt", "purl": "pkg:pypi/pyjwt@1.6.4", "type": "library", "version": "1.6.4"}, {"bom-ref": "BomRef.048112472661001604.986713010607432", "name": "qs", "purl": "pkg:npm/qs@6.7.0", "type": "library", "version": "6.7.0"}, {"bom-ref": "BomRef.12166461452421728.3314040981693145", "name": "requests", "purl": "pkg:pypi/requests@2.21.0", "type": "library", "version": "2.21.0"}, {"bom-ref": "BomRef.9830840960184765.0527431856405689", "name": "revel/revel", "purl": "pkg:golang/revel/revel@v0.21.0", "type": "library", "version": "v0.21.0"}, {"bom-ref": "BomRef.8546445310147401.3508612070350894", "name": "safety", "purl": "pkg:pypi/safety@1.8.4", "type": "library", "version": "1.8.4"}, {"bom-ref": "BomRef.8602592569699345.8070597689885138", "name": "semver", "purl": "pkg:npm/semver@5.7.1", "type": "library", "version": "5.7.1"}, {"bom-ref": "BomRef.5389952283330698.598016728122946", "name": "semver", "purl": "pkg:npm/semver@7.3.2", "type": "library", "version": "7.3.2"}, {"bom-ref": "BomRef.7660295092107477.5261478004870953", "name": "send", "purl": "pkg:npm/send@0.17.1", "type": "library", "version": "0.17.1"}, {"bom-ref": "BomRef.00500453684486013.4714272222154814", "name": "sequelize", "purl": "pkg:npm/sequelize@6.3.5", "type": "library", "version": "6.3.5"}, {"bom-ref": "BomRef.6566641120336517.10685220739082246", "name": "serve-static", "purl": "pkg:npm/serve-static@1.14.1", "type": "library", "version": "1.14.1"}, {"bom-ref": "BomRef.3484646217626196.997812168472682", "name": "shelljs", "purl": "pkg:npm/shelljs@0.7.8", "type": "library", "version": "0.7.8"}, {"bom-ref": "BomRef.8623403987020994.7581346564027058", "name": "swagger-ui", "purl": "pkg:github/swagger-ui@3.19.3", "type": "library", "version": "3.19.3"}, {"bom-ref": "BomRef.5170245386053519.10009920278546458", "name": "textpattern", "purl": "pkg:github/textpattern@4.3.0", "type": "library", "version": "4.3.0"}, {"bom-ref": "BomRef.936241179887015.9785094341743851", "name": "underscore", "purl": "pkg:github/underscore@1.7.0", "type": "library", "version": "1.7.0"}, {"bom-ref": "BomRef.6242530646198149.7252411660155567", "name": "urllib3", "purl": "pkg:pypi/urllib3@1.24.1", "type": "library", "version": "1.24.1"}, {"bom-ref": "BomRef.36886844423947807.7199536653902093", "name": "validator", "purl": "pkg:npm/validator@10.11.0", "type": "library", "version": "10.11.0"}, {"bom-ref": "BomRef.8618719540797991.6409378668264705", "name": "web", "purl": "pkg:maven/web@2.0.0", "type": "library", "version": "2.0.0"}, {"bom-ref": "BomRef.41737386515634367.4746130795762943", "name": "wheel", "purl": "pkg:pypi/wheel@0.32.3", "type": "library", "version": "0.32.3"}], "dependencies": [{"ref": "BomRef.07902036517767141.24571970828864698"}, {"ref": "BomRef.5824128966182286.6047011865101808"}, {"ref": "BomRef.01659985180256962.7191466427841917"}, {"ref": "BomRef.19784519685000412.5750909291934992"}, {"ref": "BomRef.24270695653314167.8196875740152854"}, {"ref": "BomRef.9507889523495499.16968412478049966"}, {"ref": "BomRef.4443334167437234.813711865339822"}, {"ref": "BomRef.8024034947559952.9466285866322801"}, {"ref": "BomRef.3448481900514685.7863409403103829"}, {"ref": "BomRef.3345272696079772.3204653792331038"}, {"ref": "BomRef.05914612845544864.5106446859056835"}, {"ref": "BomRef.09334550110129525.6267501887066546"}, {"ref": "BomRef.33477807102167667.5305642170967946"}, {"ref": "BomRef.5608016440257102.8815335541684918"}, {"ref": "BomRef.6872187856606309.2871414634041266"}, {"ref": "BomRef.7967202870346428.9692876166165221"}, {"ref": "BomRef.9014543229561549.521636554305923"}, {"ref": "BomRef.3451827754567497.8302077174997259"}, {"ref": "BomRef.9243617652068874.5311052997971805"}, {"ref": "BomRef.791262354839746.8473487983709176"}, {"ref": "BomRef.15569878682282234.7989458667402305"}, {"ref": "BomRef.7984773064332058.5496688250327907"}, {"ref": "BomRef.9573469552446796.6663293468714621"}, {"ref": "BomRef.720478374097643.6334814856500748"}, {"ref": "BomRef.72899691585258.08368991187002484"}, {"ref": "BomRef.056504415473854985.18566689647176615"}, {"ref": "BomRef.9159131775079127.15788292028949336"}, {"ref": "BomRef.12179375709304796.5582662873016082"}, {"ref": "BomRef.3173302853027027.27863512386341693"}, {"ref": "BomRef.048112472661001604.986713010607432"}, {"ref": "BomRef.12166461452421728.3314040981693145"}, {"ref": "BomRef.9830840960184765.0527431856405689"}, {"ref": "BomRef.8546445310147401.3508612070350894"}, {"ref": "BomRef.8602592569699345.8070597689885138"}, {"ref": "BomRef.5389952283330698.598016728122946"}, {"ref": "BomRef.7660295092107477.5261478004870953"}, {"ref": "BomRef.00500453684486013.4714272222154814"}, {"ref": "BomRef.6566641120336517.10685220739082246"}, {"ref": "BomRef.3484646217626196.997812168472682"}, {"ref": "BomRef.8623403987020994.7581346564027058"}, {"ref": "BomRef.5170245386053519.10009920278546458"}, {"ref": "BomRef.936241179887015.9785094341743851"}, {"ref": "BomRef.6242530646198149.7252411660155567"}, {"ref": "BomRef.36886844423947807.7199536653902093"}, {"ref": "BomRef.8618719540797991.6409378668264705"}, {"ref": "BomRef.41737386515634367.4746130795762943"}], "metadata": {"timestamp": "2025-07-05T17:08:22.139685-04:00"}, "serialNumber": "urn:uuid:ef2acf16-42bd-4915-b0e3-2ed45b07d174", "version": 1, "vulnerabilities": [{"bom-ref": "vuln-CVE-2006-20001-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2006-20001", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2006-20001", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-20001"}}]}, {"bom-ref": "vuln-CVE-2016-8612-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2016-8612", "ratings": [{"method": "CVSSv3", "score": "4.3", "severity": "medium", "vector": "CVSS:3.0/AV:A/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2016-8612", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8612"}}]}, {"bom-ref": "vuln-CVE-2016-8750-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2016-8750", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2016-8750", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8750"}}]}, {"bom-ref": "vuln-CVE-2017-16137-debug-2.2.0", "description": "Security vulnerability affecting debug version 2.2.0", "id": "CVE-2017-16137", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2017-16137", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16137"}}]}, {"bom-ref": "vuln-CVE-2017-20162-ms-0.7.1", "description": "Security vulnerability affecting ms version 0.7.1", "id": "CVE-2017-20162", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2017-20162", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-20162"}}]}, {"bom-ref": "vuln-CVE-2017-20165-debug-2.2.0", "description": "Security vulnerability affecting debug version 2.2.0", "id": "CVE-2017-20165", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2017-20165", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-20165"}}]}, {"bom-ref": "vuln-CVE-2018-0735-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2018-0735", "ratings": [{"method": "CVSSv3", "score": "5.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}, {"method": "other", "score": "0.1"}], "references": [{"id": "CVE-2018-0735", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0735"}}]}, {"bom-ref": "vuln-CVE-2018-11786-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2018-11786", "ratings": [{"method": "CVSSv3", "score": "8.8", "severity": "high", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2018-11786", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11786"}}]}, {"bom-ref": "vuln-CVE-2018-11787-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2018-11787", "ratings": [{"method": "CVSSv3", "score": "8.1", "severity": "high", "vector": "CVSS:3.0/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2018-11787", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11787"}}]}, {"bom-ref": "vuln-CVE-2018-11788-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2018-11788", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.2"}], "references": [{"id": "CVE-2018-11788", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11788"}}]}, {"bom-ref": "vuln-CVE-2018-1301-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2018-1301", "ratings": [{"method": "CVSSv3", "score": "5.9", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.1"}], "references": [{"id": "CVE-2018-1301", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1301"}}]}, {"bom-ref": "vuln-CVE-2018-1302-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2018-1302", "ratings": [{"method": "CVSSv3", "score": "5.9", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.1"}], "references": [{"id": "CVE-2018-1302", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1302"}}]}, {"bom-ref": "vuln-CVE-2018-1303-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2018-1303", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.3"}], "references": [{"id": "CVE-2018-1303", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1303"}}]}, {"bom-ref": "vuln-CVE-2018-1313-org.apache.derby/derby-10.8.2.2", "description": "Security vulnerability affecting org.apache.derby/derby version 10.8.2.2", "id": "CVE-2018-1313", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2018-1313", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1313"}}]}, {"bom-ref": "vuln-CVE-2018-25031-swagger-ui-3.19.3", "description": "Security vulnerability affecting swagger-ui version 3.19.3", "id": "CVE-2018-25031", "ratings": [{"method": "other", "score": "8.0", "severity": "high"}, {"method": "CVSSv3", "score": "4.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.8"}], "references": [{"id": "CVE-2018-25031", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25031"}}]}, {"bom-ref": "vuln-CVE-2018-25091-urllib3-1.24.1", "description": "Security vulnerability affecting urllib3 version 1.24.1", "id": "CVE-2018-25091", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2018-25091", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25091"}}]}, {"bom-ref": "vuln-CVE-2018-3061-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2018-3061", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2018-3061", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3061"}}]}, {"bom-ref": "vuln-CVE-2018-3071-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2018-3071", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2018-3071", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3071"}}]}, {"bom-ref": "vuln-CVE-2018-7474-textpattern-4.3.0", "description": "Security vulnerability affecting textpattern version 4.3.0", "id": "CVE-2018-7474", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.2"}], "references": [{"id": "CVE-2018-7474", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7474"}}]}, {"bom-ref": "vuln-CVE-2019-0191-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2019-0191", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.1"}], "references": [{"id": "CVE-2019-0191", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0191"}}]}, {"bom-ref": "vuln-CVE-2019-0226-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2019-0226", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2019-0226", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0226"}}]}, {"bom-ref": "vuln-CVE-2019-11236-urllib3-1.24.1", "description": "Security vulnerability affecting urllib3 version 1.24.1", "id": "CVE-2019-11236", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2019-11236", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11236"}}]}, {"bom-ref": "vuln-CVE-2019-11324-urllib3-1.24.1", "description": "Security vulnerability affecting urllib3 version 1.24.1", "id": "CVE-2019-11324", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.0/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2019-11324", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11324"}}]}, {"bom-ref": "vuln-CVE-2019-14312-Jaxer-1.0.3", "description": "Security vulnerability affecting Jaxer version 1.0.3", "id": "CVE-2019-14312", "ratings": [{"method": "other", "score": "8.0", "severity": "high"}, {"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.4"}], "references": [{"id": "CVE-2019-14312", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14312"}}]}, {"bom-ref": "vuln-CVE-2019-17495-swagger-ui-3.19.3", "description": "Security vulnerability affecting swagger-ui version 3.19.3", "id": "CVE-2019-17495", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.2"}], "references": [{"id": "CVE-2019-17495", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17495"}}]}, {"bom-ref": "vuln-CVE-2019-20920-handlebars-2.0.0", "description": "Security vulnerability affecting handlebars version 2.0.0", "id": "CVE-2019-20920", "ratings": [{"method": "CVSSv3", "score": "8.1", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:H/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2019-20920", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20920"}}]}, {"bom-ref": "vuln-CVE-2019-2731-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2019-2731", "ratings": [{"method": "CVSSv3", "score": "5.4", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2019-2731", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2731"}}]}, {"bom-ref": "vuln-CVE-2019-2741-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2019-2741", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2019-2741", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2741"}}]}, {"bom-ref": "vuln-CVE-2019-2755-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2019-2755", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2019-2755", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2755"}}]}, {"bom-ref": "vuln-CVE-2019-2757-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2019-2757", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2019-2757", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2757"}}]}, {"bom-ref": "vuln-CVE-2019-7317-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2019-7317", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2019-7317", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317"}}]}, {"bom-ref": "vuln-CVE-2020-11980-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2020-11980", "ratings": [{"method": "CVSSv3", "score": "6.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-11980", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11980"}}]}, {"bom-ref": "vuln-CVE-2020-14760-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14760", "ratings": [{"method": "CVSSv3", "score": "5.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-14760", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14760"}}]}, {"bom-ref": "vuln-CVE-2020-14814-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14814", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-14814", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14814"}}]}, {"bom-ref": "vuln-CVE-2020-14830-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14830", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-14830", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14830"}}]}, {"bom-ref": "vuln-CVE-2020-14837-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14837", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-14837", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14837"}}]}, {"bom-ref": "vuln-CVE-2020-14839-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14839", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-14839", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14839"}}]}, {"bom-ref": "vuln-CVE-2020-14845-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14845", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-14845", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14845"}}]}, {"bom-ref": "vuln-CVE-2020-14846-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14846", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-14846", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14846"}}]}, {"bom-ref": "vuln-CVE-2020-14852-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14852", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-14852", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14852"}}]}, {"bom-ref": "vuln-CVE-2020-15250-junit/junit-4.12", "description": "Security vulnerability affecting junit/junit version 4.12", "id": "CVE-2020-15250", "ratings": [{"method": "CVSSv3", "score": "5.5", "severity": "medium", "vector": "CVSS:3.1/AV:L/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-15250", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15250"}}]}, {"bom-ref": "vuln-CVE-2020-15358-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-15358", "ratings": [{"method": "CVSSv3", "score": "5.5", "severity": "medium", "vector": "CVSS:3.1/AV:L/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-15358", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15358"}}]}, {"analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2020-1967-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-1967", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.6"}], "references": [{"id": "CVE-2020-1967", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1967"}}]}, {"bom-ref": "vuln-CVE-2020-1971-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-1971", "ratings": [{"method": "CVSSv3", "score": "5.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-1971", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1971"}}]}, {"bom-ref": "vuln-CVE-2020-26137-urllib3-1.24.1", "description": "Security vulnerability affecting urllib3 version 1.24.1", "id": "CVE-2020-26137", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-26137", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26137"}}]}, {"bom-ref": "vuln-CVE-2020-28469-glob-parent-3.1.0", "description": "Security vulnerability affecting glob-parent version 3.1.0", "id": "CVE-2020-28469", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-28469", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28469"}}]}, {"bom-ref": "vuln-CVE-2020-28500-lodash-4.17.20", "description": "Security vulnerability affecting lodash version 4.17.20", "id": "CVE-2020-28500", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-28500", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28500"}}]}, {"bom-ref": "vuln-CVE-2020-36568-revel/revel-v0.21.0", "description": "Security vulnerability affecting revel/revel version v0.21.0", "id": "CVE-2020-36568", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-36568", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36568"}}]}, {"bom-ref": "vuln-CVE-2020-5252-safety-1.8.4", "description": "Security vulnerability affecting safety version 1.8.4", "id": "CVE-2020-5252", "ratings": [{"method": "CVSSv3", "score": "4.1", "severity": "medium", "vector": "CVSS:3.1/AV:L/AC:H/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-5252", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5252"}}]}, {"bom-ref": "vuln-CVE-2020-7598-minimist-0.0.8", "description": "Security vulnerability affecting minimist version 0.0.8", "id": "CVE-2020-7598", "ratings": [{"method": "CVSSv3", "score": "5.6", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-7598", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7598"}}]}, {"bom-ref": "vuln-CVE-2020-8929-com.google.crypto.tink/tink-1.3.0-rc2", "description": "Security vulnerability affecting com.google.crypto.tink/tink version 1.3.0-rc2", "id": "CVE-2020-8929", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2020-8929", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8929"}}]}, {"bom-ref": "vuln-CVE-2021-22569-com.google.protobuf/protobuf-java-3.10.0", "description": "Security vulnerability affecting com.google.protobuf/protobuf-java version 3.10.0", "id": "CVE-2021-22569", "ratings": [{"method": "CVSSv3", "score": "5.5", "severity": "medium", "vector": "CVSS:3.1/AV:L/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-22569", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22569"}}]}, {"bom-ref": "vuln-CVE-2021-22570-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2021-22570", "ratings": [{"method": "CVSSv3", "score": "5.5", "severity": "medium", "vector": "CVSS:3.1/AV:L/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-22570", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22570"}}]}, {"bom-ref": "vuln-CVE-2021-23337-lodash-4.17.20", "description": "Security vulnerability affecting lodash version 4.17.20", "id": "CVE-2021-23337", "ratings": [{"method": "CVSSv3", "score": "7.2", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-23337", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23337"}}]}, {"bom-ref": "vuln-CVE-2021-23343-path-parse-1.0.6", "description": "Security vulnerability affecting path-parse version 1.0.6", "id": "CVE-2021-23343", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-23343", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23343"}}]}, {"bom-ref": "vuln-CVE-2021-23358-underscore-1.7.0", "description": "Security vulnerability affecting underscore version 1.7.0", "id": "CVE-2021-23358", "ratings": [{"method": "CVSSv3", "score": "7.2", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-23358", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23358"}}]}, {"bom-ref": "vuln-CVE-2021-23369-handlebars-2.0.0", "description": "Security vulnerability affecting handlebars version 2.0.0", "id": "CVE-2021-23369", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-23369", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23369"}}]}, {"bom-ref": "vuln-CVE-2021-23383-handlebars-2.0.0", "description": "Security vulnerability affecting handlebars version 2.0.0", "id": "CVE-2021-23383", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.1"}], "references": [{"id": "CVE-2021-23383", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23383"}}]}, {"bom-ref": "vuln-CVE-2021-2356-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2021-2356", "ratings": [{"method": "CVSSv3", "score": "5.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-2356", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-2356"}}]}, {"bom-ref": "vuln-CVE-2021-32785-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-32785", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-32785", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32785"}}]}, {"bom-ref": "vuln-CVE-2021-32786-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-32786", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-32786", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32786"}}]}, {"bom-ref": "vuln-CVE-2021-32791-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-32791", "ratings": [{"method": "CVSSv3", "score": "5.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-32791", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32791"}}]}, {"bom-ref": "vuln-CVE-2021-32792-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-32792", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-32792", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32792"}}]}, {"bom-ref": "vuln-CVE-2021-34798-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-34798", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.1"}], "references": [{"id": "CVE-2021-34798", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34798"}}]}, {"bom-ref": "vuln-CVE-2021-3765-validator-10.11.0", "description": "Security vulnerability affecting validator version 10.11.0", "id": "CVE-2021-3765", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-3765", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3765"}}]}, {"analysis": {"state": "exploitable"}, "bom-ref": "vuln-CVE-2021-39275-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-39275", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.5"}], "references": [{"id": "CVE-2021-39275", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39275"}}]}, {"bom-ref": "vuln-CVE-2021-40438-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-40438", "ratings": [{"method": "CVSSv3", "score": "9.0", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.9"}], "references": [{"id": "CVE-2021-40438", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40438"}}]}, {"bom-ref": "vuln-CVE-2021-40642-textpattern-4.3.0", "description": "Security vulnerability affecting textpattern version 4.3.0", "id": "CVE-2021-40642", "ratings": [{"method": "CVSSv3", "score": "4.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-40642", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40642"}}]}, {"bom-ref": "vuln-CVE-2021-41766-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2021-41766", "ratings": [{"method": "CVSSv3", "score": "8.1", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-41766", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41766"}}]}, {"bom-ref": "vuln-CVE-2021-43138-async-2.6.3", "description": "Security vulnerability affecting async version 2.6.3", "id": "CVE-2021-43138", "ratings": [{"method": "CVSSv3", "score": "7.8", "severity": "high", "vector": "CVSS:3.1/AV:L/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-43138", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43138"}}]}, {"bom-ref": "vuln-CVE-2021-44906-minimist-0.0.8", "description": "Security vulnerability affecting minimist version 0.0.8", "id": "CVE-2021-44906", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2021-44906", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906"}}]}, {"bom-ref": "vuln-CVE-2022-0144-shelljs-0.7.8", "description": "Security vulnerability affecting shelljs version 0.7.8", "id": "CVE-2022-0144", "ratings": [{"method": "CVSSv3", "score": "7.1", "severity": "high", "vector": "CVSS:3.0/AV:L/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-0144", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0144"}}]}, {"bom-ref": "vuln-CVE-2022-21417-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2022-21417", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-21417", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21417"}}]}, {"bom-ref": "vuln-CVE-2022-21444-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2022-21444", "ratings": [{"method": "CVSSv3", "score": "4.4", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-21444", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21444"}}]}, {"bom-ref": "vuln-CVE-2022-22719-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-22719", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.4"}], "references": [{"id": "CVE-2022-22719", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22719"}}]}, {"bom-ref": "vuln-CVE-2022-22720-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-22720", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.3"}], "references": [{"id": "CVE-2022-22720", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22720"}}]}, {"bom-ref": "vuln-CVE-2022-22721-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-22721", "ratings": [{"method": "CVSSv3", "score": "9.1", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.2"}], "references": [{"id": "CVE-2022-22721", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22721"}}]}, {"bom-ref": "vuln-CVE-2022-22932-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2022-22932", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-22932", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22932"}}]}, {"bom-ref": "vuln-CVE-2022-23491-certifi-2018.11.29", "description": "Security vulnerability affecting certifi version 2018.11.29", "id": "CVE-2022-23491", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-23491", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23491"}}]}, {"bom-ref": "vuln-CVE-2022-23539-jsonwebtoken-8.5.1", "description": "Security vulnerability affecting jsonwebtoken version 8.5.1", "id": "CVE-2022-23539", "ratings": [{"method": "CVSSv3", "score": "8.1", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-23539", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23539"}}]}, {"bom-ref": "vuln-CVE-2022-23540-jsonwebtoken-8.5.1", "description": "Security vulnerability affecting jsonwebtoken version 8.5.1", "id": "CVE-2022-23540", "ratings": [{"method": "CVSSv3", "score": "7.6", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-23540", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23540"}}]}, {"bom-ref": "vuln-CVE-2022-23541-jsonwebtoken-8.5.1", "description": "Security vulnerability affecting jsonwebtoken version 8.5.1", "id": "CVE-2022-23541", "ratings": [{"method": "CVSSv3", "score": "6.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-23541", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23541"}}]}, {"bom-ref": "vuln-CVE-2022-24439-gitpython-2.1.11", "description": "Security vulnerability affecting gitpython version 2.1.11", "id": "CVE-2022-24439", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.7"}], "references": [{"id": "CVE-2022-24439", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24439"}}]}, {"bom-ref": "vuln-CVE-2022-24785-moment-2.28.0", "description": "Security vulnerability affecting moment version 2.28.0", "id": "CVE-2022-24785", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-24785", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24785"}}]}, {"bom-ref": "vuln-CVE-2022-24999-express-4.17.1", "description": "Security vulnerability affecting express version 4.17.1", "id": "CVE-2022-24999", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-24999", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24999"}}]}, {"bom-ref": "vuln-CVE-2022-24999-qs-6.7.0", "description": "Security vulnerability affecting qs version 6.7.0", "id": "CVE-2022-24999", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-24999", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24999"}}]}, {"bom-ref": "vuln-CVE-2022-25883-semver-5.7.1", "description": "Security vulnerability affecting semver version 5.7.1", "id": "CVE-2022-25883", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-25883", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25883"}}]}, {"bom-ref": "vuln-CVE-2022-25883-semver-7.3.2", "description": "Security vulnerability affecting semver version 7.3.2", "id": "CVE-2022-25883", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-25883", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25883"}}]}, {"bom-ref": "vuln-CVE-2022-28330-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-28330", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-28330", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28330"}}]}, {"bom-ref": "vuln-CVE-2022-28614-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-28614", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-28614", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28614"}}]}, {"bom-ref": "vuln-CVE-2022-28615-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-28615", "ratings": [{"method": "CVSSv3", "score": "9.1", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-28615", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28615"}}]}, {"bom-ref": "vuln-CVE-2022-29217-pyjwt-1.6.4", "description": "Security vulnerability affecting pyjwt version 1.6.4", "id": "CVE-2022-29217", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-29217", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29217"}}]}, {"bom-ref": "vuln-CVE-2022-29361-Werkzeug-1.0.1", "description": "Security vulnerability affecting Werkzeug version 1.0.1", "id": "CVE-2022-29361", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.3"}], "references": [{"id": "CVE-2022-29361", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29361"}}]}, {"bom-ref": "vuln-CVE-2022-29404-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-29404", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-29404", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29404"}}]}, {"bom-ref": "vuln-CVE-2022-30556-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-30556", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-30556", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30556"}}]}, {"bom-ref": "vuln-CVE-2022-31129-moment-2.28.0", "description": "Security vulnerability affecting moment version 2.28.0", "id": "CVE-2022-31129", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-31129", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31129"}}]}, {"bom-ref": "vuln-CVE-2022-3171-com.google.protobuf/protobuf-java-3.10.0", "description": "Security vulnerability affecting com.google.protobuf/protobuf-java version 3.10.0", "id": "CVE-2022-3171", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-3171", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3171"}}]}, {"bom-ref": "vuln-CVE-2022-31813-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-31813", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-31813", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31813"}}]}, {"bom-ref": "vuln-CVE-2022-3517-minimatch-3.0.4", "description": "Security vulnerability affecting minimatch version 3.0.4", "id": "CVE-2022-3517", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-3517", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517"}}]}, {"bom-ref": "vuln-CVE-2022-37436-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-37436", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-37436", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37436"}}]}, {"bom-ref": "vuln-CVE-2022-38778-decode-uri-component-0.2.0", "description": "Security vulnerability affecting decode-uri-component version 0.2.0", "id": "CVE-2022-38778", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-38778", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38778"}}]}, {"analysis": {"response": ["will_not_fix"], "state": "exploitable"}, "bom-ref": "vuln-CVE-2022-40145-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2022-40145", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-40145", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40145"}}]}, {"bom-ref": "vuln-CVE-2022-40898-wheel-0.32.3", "description": "Security vulnerability affecting wheel version 0.32.3", "id": "CVE-2022-40898", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-40898", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40898"}}]}, {"analysis": {"response": ["can_not_fix"], "state": "exploitable"}, "bom-ref": "vuln-CVE-2022-46337-org.apache.derby/derby-10.8.2.2", "description": "Security vulnerability affecting org.apache.derby/derby version 10.8.2.2", "id": "CVE-2022-46337", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2022-46337", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46337"}}]}, {"bom-ref": "vuln-CVE-2023-21977-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2023-21977", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-21977", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21977"}}]}, {"analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2023-21980-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2023-21980", "ratings": [{"method": "CVSSv3", "score": "7.1", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-21980", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21980"}}]}, {"bom-ref": "vuln-CVE-2023-22007-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2023-22007", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-22007", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22007"}}]}, {"bom-ref": "vuln-CVE-2023-22015-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2023-22015", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-22015", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22015"}}]}, {"bom-ref": "vuln-CVE-2023-22026-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2023-22026", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-22026", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22026"}}]}, {"bom-ref": "vuln-CVE-2023-22028-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2023-22028", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-22028", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22028"}}]}, {"bom-ref": "vuln-CVE-2023-22578-sequelize-6.3.5", "description": "Security vulnerability affecting sequelize version 6.3.5", "id": "CVE-2023-22578", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-22578", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22578"}}]}, {"bom-ref": "vuln-CVE-2023-22579-sequelize-6.3.5", "description": "Security vulnerability affecting sequelize version 6.3.5", "id": "CVE-2023-22579", "ratings": [{"method": "CVSSv3", "score": "8.8", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-22579", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22579"}}]}, {"bom-ref": "vuln-CVE-2023-22580-sequelize-6.3.5", "description": "Security vulnerability affecting sequelize version 6.3.5", "id": "CVE-2023-22580", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-22580", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22580"}}]}, {"bom-ref": "vuln-CVE-2023-23934-Werkzeug-1.0.1", "description": "Security vulnerability affecting Werkzeug version 1.0.1", "id": "CVE-2023-23934", "ratings": [{"method": "CVSSv3", "score": "3.5", "severity": "low", "vector": "CVSS:3.1/AV:A/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-23934", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23934"}}]}, {"bom-ref": "vuln-CVE-2023-25577-Werkzeug-1.0.1", "description": "Security vulnerability affecting Werkzeug version 1.0.1", "id": "CVE-2023-25577", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-25577", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25577"}}]}, {"bom-ref": "vuln-CVE-2023-25813-sequelize-6.3.5", "description": "Security vulnerability affecting sequelize version 6.3.5", "id": "CVE-2023-25813", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-25813", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25813"}}]}, {"bom-ref": "vuln-CVE-2023-26132-dottie-2.0.2", "description": "Security vulnerability affecting dottie version 2.0.2", "id": "CVE-2023-26132", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-26132", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26132"}}]}, {"bom-ref": "vuln-CVE-2023-26852-textpattern-4.3.0", "description": "Security vulnerability affecting textpattern version 4.3.0", "id": "CVE-2023-26852", "ratings": [{"method": "CVSSv3", "score": "7.2", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.1"}], "references": [{"id": "CVE-2023-26852", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26852"}}]}, {"bom-ref": "vuln-CVE-2023-27152-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-27152", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-27152", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27152"}}]}, {"bom-ref": "vuln-CVE-2023-30861-Flask-1.1.2", "description": "Security vulnerability affecting Flask version 1.1.2", "id": "CVE-2023-30861", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-30861", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30861"}}]}, {"bom-ref": "vuln-CVE-2023-31122-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2023-31122", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-31122", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31122"}}]}, {"bom-ref": "vuln-CVE-2023-32681-requests-2.21.0", "description": "Security vulnerability affecting requests version 2.21.0", "id": "CVE-2023-32681", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}, {"method": "other", "score": "0.1"}], "references": [{"id": "CVE-2023-32681", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32681"}}]}, {"bom-ref": "vuln-CVE-2023-37920-certifi-2018.11.29", "description": "Security vulnerability affecting certifi version 2018.11.29", "id": "CVE-2023-37920", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-37920", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37920"}}]}, {"bom-ref": "vuln-CVE-2023-38997-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-38997", "ratings": [{"method": "CVSSv3", "score": "7.2", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-38997", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38997"}}]}, {"bom-ref": "vuln-CVE-2023-38998-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-38998", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-38998", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38998"}}]}, {"bom-ref": "vuln-CVE-2023-38999-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-38999", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-38999", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38999"}}]}, {"bom-ref": "vuln-CVE-2023-39000-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39000", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-39000", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39000"}}]}, {"bom-ref": "vuln-CVE-2023-39001-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39001", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-39001", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39001"}}]}, {"bom-ref": "vuln-CVE-2023-39002-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39002", "ratings": [{"method": "other", "score": "8.0", "severity": "high"}, {"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.2"}], "references": [{"id": "CVE-2023-39002", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39002"}}]}, {"bom-ref": "vuln-CVE-2023-39003-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39003", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-39003", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39003"}}]}, {"bom-ref": "vuln-CVE-2023-39004-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39004", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-39004", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39004"}}]}, {"bom-ref": "vuln-CVE-2023-39005-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39005", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-39005", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39005"}}]}, {"bom-ref": "vuln-CVE-2023-39006-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39006", "ratings": [{"method": "CVSSv3", "score": "5.4", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-39006", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39006"}}]}, {"bom-ref": "vuln-CVE-2023-39007-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39007", "ratings": [{"method": "CVSSv3", "score": "9.6", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}, {"method": "other", "score": "0.5"}], "references": [{"id": "CVE-2023-39007", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39007"}}]}, {"bom-ref": "vuln-CVE-2023-39008-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39008", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-39008", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39008"}}]}, {"bom-ref": "vuln-CVE-2023-40267-gitpython-2.1.11", "description": "Security vulnerability affecting gitpython version 2.1.11", "id": "CVE-2023-40267", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-40267", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40267"}}]}, {"bom-ref": "vuln-CVE-2023-40590-gitpython-2.1.11", "description": "Security vulnerability affecting gitpython version 2.1.11", "id": "CVE-2023-40590", "ratings": [{"method": "CVSSv3", "score": "7.8", "severity": "high", "vector": "CVSS:3.1/AV:L/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-40590", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40590"}}]}, {"bom-ref": "vuln-CVE-2023-41040-gitpython-2.1.11", "description": "Security vulnerability affecting gitpython version 2.1.11", "id": "CVE-2023-41040", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-41040", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41040"}}]}, {"bom-ref": "vuln-CVE-2023-43804-urllib3-1.24.1", "description": "Security vulnerability affecting urllib3 version 1.24.1", "id": "CVE-2023-43804", "ratings": [{"method": "CVSSv3", "score": "8.1", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-43804", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43804"}}]}, {"bom-ref": "vuln-CVE-2023-44275-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-44275", "ratings": [{"method": "CVSSv3", "score": "5.4", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-44275", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44275"}}]}, {"bom-ref": "vuln-CVE-2023-44276-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-44276", "ratings": [{"method": "CVSSv3", "score": "5.4", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-44276", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44276"}}]}, {"bom-ref": "vuln-CVE-2023-45803-urllib3-1.24.1", "description": "Security vulnerability affecting urllib3 version 1.24.1", "id": "CVE-2023-45803", "ratings": [{"method": "CVSSv3", "score": "4.2", "severity": "medium", "vector": "CVSS:3.1/AV:A/AC:H/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-45803", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45803"}}]}, {"bom-ref": "vuln-CVE-2023-46136-Werkzeug-1.0.1", "description": "Security vulnerability affecting Werkzeug version 1.0.1", "id": "CVE-2023-46136", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2023-46136", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46136"}}]}, {"bom-ref": "vuln-CVE-2024-21514-opencart-3.0.3.9", "description": "Security vulnerability affecting opencart version 3.0.3.9", "id": "CVE-2024-21514", "ratings": [{"method": "CVSSv3", "score": "8.1", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}, {"method": "other", "score": "0.4"}], "references": [{"id": "CVE-2024-21514", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21514"}}]}, {"bom-ref": "vuln-CVE-2024-22190-gitpython-2.1.11", "description": "Security vulnerability affecting gitpython version 2.1.11", "id": "CVE-2024-22190", "ratings": [{"method": "CVSSv3", "score": "7.8", "severity": "high", "vector": "CVSS:3.1/AV:L/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2024-22190", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22190"}}]}, {"bom-ref": "vuln-CVE-2024-40898-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2024-40898", "ratings": [{"method": "CVSSv3", "score": "9.1", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2024-40898", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40898"}}]}, {"bom-ref": "vuln-CVE-2024-43796-express-4.17.1", "description": "Security vulnerability affecting express version 4.17.1", "id": "CVE-2024-43796", "ratings": [{"method": "CVSSv3", "score": "4.7", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2024-43796", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43796"}}]}, {"bom-ref": "vuln-CVE-2024-43799-send-0.17.1", "description": "Security vulnerability affecting send version 0.17.1", "id": "CVE-2024-43799", "ratings": [{"method": "CVSSv3", "score": "4.7", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2024-43799", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43799"}}]}, {"bom-ref": "vuln-CVE-2024-43800-serve-static-1.14.1", "description": "Security vulnerability affecting serve-static version 1.14.1", "id": "CVE-2024-43800", "ratings": [{"method": "CVSSv3", "score": "4.7", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2024-43800", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43800"}}]}, {"bom-ref": "vuln-CVE-2024-45590-body-parser-1.19.0", "description": "Security vulnerability affecting body-parser version 1.19.0", "id": "CVE-2024-45590", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2024-45590", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45590"}}]}, {"bom-ref": "vuln-CVE-2024-49767-Werkzeug-1.0.1", "description": "Security vulnerability affecting Werkzeug version 1.0.1", "id": "CVE-2024-49767", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2024-49767", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49767"}}]}, {"bom-ref": "vuln-CVE-2025-1746-opencart-3.0.3.9", "description": "Security vulnerability affecting opencart version 3.0.3.9", "id": "CVE-2025-1746", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2025-1746", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1746"}}]}, {"bom-ref": "vuln-CVE-2025-1747-opencart-3.0.3.9", "description": "Security vulnerability affecting opencart version 3.0.3.9", "id": "CVE-2025-1747", "ratings": [{"method": "CVSSv3", "score": "4.7", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2025-1747", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1747"}}]}, {"bom-ref": "vuln-CVE-2025-1748-opencart-3.0.3.9", "description": "Security vulnerability affecting opencart version 3.0.3.9", "id": "CVE-2025-1748", "ratings": [{"method": "CVSSv3", "score": "4.7", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2025-1748", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1748"}}]}, {"bom-ref": "vuln-CVE-2025-1749-opencart-3.0.3.9", "description": "Security vulnerability affecting opencart version 3.0.3.9", "id": "CVE-2025-1749", "ratings": [{"method": "CVSSv3", "score": "4.7", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "0.0"}], "references": [{"id": "CVE-2025-1749", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1749"}}]}], "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6"} \ No newline at end of file diff --git a/vuln-report.json b/vuln-report.json index 3c05d5c..5d0b926 100644 --- a/vuln-report.json +++ b/vuln-report.json @@ -1 +1 @@ -{"components": [{"bom-ref": "13781114_6_5921a168-b2f9-433b-8fc7-c571149626cd", "name": "13781114", "purl": "pkg:janus%20troelsen/13781114@6", "type": "library", "version": "6"}, {"bom-ref": "9082892_1_7a436aaf-79c0-420a-858a-dd66fbac7593", "name": "9082892", "purl": "pkg:milan%20mendpara/9082892@1", "type": "library", "version": "1"}, {"bom-ref": "android_frameworks_base_android-n-mr1-preview-1_ba08e169-e972-43f9-bd63-c41a6af0203c", "name": "android_frameworks_base", "purl": "pkg:github/crdroidandroid/android_frameworks_base@android-n-mr1-preview-1", "type": "library", "version": "android-n-mr1-preview-1"}, {"bom-ref": "blaze-material-ui_0.1.9_7094ad42-9743-4aea-9061-221b208c4672", "name": "blaze-material-ui", "purl": "pkg:github/codesignal/blaze-material-ui@0.1.9", "type": "library", "version": "0.1.9"}, {"bom-ref": "jszip_2.6.0_b9eaec93-b563-4fbf-9faf-58579c366643", "name": "jszip", "purl": "pkg:github/stuk/jszip@2.6.0", "type": "library", "version": "2.6.0"}, {"bom-ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d", "name": "libxml2", "purl": "pkg:github/gnome/libxml2@2.9.2-rc1", "type": "library", "version": "2.9.2-rc1"}, {"bom-ref": "nclick_0.0.0_63777c38-bbbc-49b5-8f03-9b7f6a58cafa", "name": "nclick", "purl": "pkg:pypi/nclick@0.0.0", "type": "library", "version": "0.0.0"}, {"bom-ref": "node-forge_1.0.0_21925db1-71e0-4277-95c4-d3e6f1d9e5c8", "name": "node-forge", "purl": "pkg:npm/npmjs/node-forge@1.0.0", "type": "library", "version": "1.0.0"}, {"bom-ref": "ofp_1.1_01407baf-dd04-4e91-b641-784792cb9ff9", "name": "ofp", "type": "library", "version": "1.1"}, {"bom-ref": "ruby-domain_name_0.5.20160826_df0a1fd4-b948-402f-ab26-ceeeaa28fab1", "name": "ruby-domain_name", "purl": "pkg:github/knu/ruby-domain_name@0.5.20160826", "type": "library", "version": "0.5.20160826"}, {"bom-ref": "samba_tevent-0.9.34_47fbcd4f-a9ac-43c2-aa40-9c064bdcbbc8", "name": "samba", "purl": "pkg:github/samba-team/samba@0.9.34", "type": "library", "version": "tevent-0.9.34"}], "dependencies": [{"ref": "13781114_6_5921a168-b2f9-433b-8fc7-c571149626cd"}, {"ref": "9082892_1_7a436aaf-79c0-420a-858a-dd66fbac7593"}, {"ref": "android_frameworks_base_android-n-mr1-preview-1_ba08e169-e972-43f9-bd63-c41a6af0203c"}, {"ref": "blaze-material-ui_0.1.9_7094ad42-9743-4aea-9061-221b208c4672"}, {"ref": "jszip_2.6.0_b9eaec93-b563-4fbf-9faf-58579c366643"}, {"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}, {"ref": "nclick_0.0.0_63777c38-bbbc-49b5-8f03-9b7f6a58cafa"}, {"ref": "node-forge_1.0.0_21925db1-71e0-4277-95c4-d3e6f1d9e5c8"}, {"ref": "ofp_1.1_01407baf-dd04-4e91-b641-784792cb9ff9"}, {"ref": "ruby-domain_name_0.5.20160826_df0a1fd4-b948-402f-ab26-ceeeaa28fab1"}, {"ref": "samba_tevent-0.9.34_47fbcd4f-a9ac-43c2-aa40-9c064bdcbbc8"}], "metadata": {"properties": [{"name": "augmentation_timestamp", "value": "2025-07-05T16:02:25.607108Z"}, {"name": "augmented_with_vulnerabilities", "value": "true"}, {"name": "scan_code", "value": "ScanZIPwithShinobiAutoID_772"}, {"name": "vulnerability_count", "value": "30"}], "timestamp": "2025-07-05T16:02:25.591401-04:00"}, "serialNumber": "urn:uuid:5dc3ef61-2a12-4806-9e44-80481506a83c", "version": 1, "vulnerabilities": [{"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2016-3709-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2016-3709", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2016-3709", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3709"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2016-9596-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2016-9596", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2016-9596", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9596"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2016-9598-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2016-9598", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2016-9598", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-9598"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"response": ["can_not_fix"], "state": "exploitable"}, "bom-ref": "vuln-CVE-2017-15412-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2017-15412", "ratings": [{"method": "CVSSv3", "score": "8.8", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:N/A:N"}], "references": [{"id": "CVE-2017-15412", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15412"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2017-18258-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2017-18258", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:N/A:N"}], "references": [{"id": "CVE-2017-18258", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18258"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"response": ["can_not_fix"], "state": "exploitable"}, "bom-ref": "vuln-CVE-2017-5130-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2017-5130", "ratings": [{"method": "CVSSv3", "score": "8.8", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:N/A:N"}], "references": [{"id": "CVE-2017-5130", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5130"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2017-7375-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2017-7375", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "unknown", "vector": "CVSS:3.1/AV:N/AC:N/A:N"}], "references": [{"id": "CVE-2017-7375", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7375"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2017-7376-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2017-7376", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "unknown", "vector": "CVSS:3.1/AV:N/AC:N/A:N"}], "references": [{"id": "CVE-2017-7376", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7376"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2018-14404-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2018-14404", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:N/A:N"}], "references": [{"id": "CVE-2018-14404", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14404"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2019-19956-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2019-19956", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2019-19956", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19956"}}]}, {"affects": [{"ref": "jszip_2.6.0_b9eaec93-b563-4fbf-9faf-58579c366643"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2021-23413-jszip-2.6.0", "description": "Security vulnerability affecting jszip version 2.6.0", "id": "CVE-2021-23413", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}], "references": [{"id": "CVE-2021-23413", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23413"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2021-3517-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2021-3517", "ratings": [{"method": "CVSSv3", "score": "8.6", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2021-3517", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3517"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "exploitable"}, "bom-ref": "vuln-CVE-2021-3518-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2021-3518", "ratings": [{"method": "CVSSv3", "score": "8.8", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2021-3518", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3518"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"justification": "code_not_present", "state": "resolved"}, "bom-ref": "vuln-CVE-2021-3537-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2021-3537", "ratings": [{"method": "other", "score": "1.0", "severity": "info"}, {"method": "CVSSv3", "score": "5.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}], "references": [{"id": "CVE-2021-3537", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3537"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2021-3541-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2021-3541", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2021-3541", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3541"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "bom-ref": "vuln-CVE-2022-23308-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2022-23308", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2022-23308", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23308"}}]}, {"affects": [{"ref": "node-forge_1.0.0_21925db1-71e0-4277-95c4-d3e6f1d9e5c8"}], "analysis": {"response": ["update"], "state": "resolved"}, "bom-ref": "vuln-CVE-2022-24771-node-forge-1.0.0", "description": "Security vulnerability affecting node-forge version 1.0.0", "id": "CVE-2022-24771", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}, {"method": "other", "score": "1.0", "severity": "info"}], "references": [{"id": "CVE-2022-24771", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24771"}}]}, {"affects": [{"ref": "node-forge_1.0.0_21925db1-71e0-4277-95c4-d3e6f1d9e5c8"}], "bom-ref": "vuln-CVE-2022-24772-node-forge-1.0.0", "description": "Security vulnerability affecting node-forge version 1.0.0", "id": "CVE-2022-24772", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2022-24772", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24772"}}]}, {"affects": [{"ref": "node-forge_1.0.0_21925db1-71e0-4277-95c4-d3e6f1d9e5c8"}], "bom-ref": "vuln-CVE-2022-24773-node-forge-1.0.0", "description": "Security vulnerability affecting node-forge version 1.0.0", "id": "CVE-2022-24773", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2022-24773", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24773"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2022-29824-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2022-29824", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2022-29824", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29824"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "bom-ref": "vuln-CVE-2022-40303-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2022-40303", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2022-40303", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40303"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2022-40304-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2022-40304", "ratings": [{"method": "CVSSv3", "score": "7.8", "severity": "high", "vector": "CVSS:3.1/AV:L/AC:L/A:H"}], "references": [{"id": "CVE-2022-40304", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40304"}}]}, {"affects": [{"ref": "jszip_2.6.0_b9eaec93-b563-4fbf-9faf-58579c366643"}], "analysis": {"response": ["will_not_fix"], "state": "false_positive"}, "bom-ref": "vuln-CVE-2022-48285-jszip-2.6.0", "description": "Security vulnerability affecting jszip version 2.6.0", "id": "CVE-2022-48285", "ratings": [{"method": "CVSSv3", "score": "7.3", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}, {"method": "other", "score": "1.0", "severity": "info"}], "references": [{"id": "CVE-2022-48285", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48285"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"justification": "code_not_reachable", "response": ["will_not_fix"], "state": "not_affected"}, "bom-ref": "vuln-CVE-2023-28484-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2023-28484", "ratings": [{"method": "other", "score": "1.0", "severity": "info"}, {"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-28484", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28484"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"justification": "code_not_reachable", "response": ["will_not_fix"], "state": "not_affected"}, "bom-ref": "vuln-CVE-2023-29469-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2023-29469", "ratings": [{"method": "other", "score": "1.0", "severity": "info"}, {"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-29469", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29469"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"justification": "code_not_present", "response": ["will_not_fix"], "state": "false_positive"}, "bom-ref": "vuln-CVE-2023-45322-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2023-45322", "ratings": [{"method": "other", "score": "1.0", "severity": "info"}, {"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-45322", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45322"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2024-25062-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2024-25062", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2024-25062", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25062"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2025-27113-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2025-27113", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2025-27113", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27113"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2025-32414-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2025-32414", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2025-32414", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32414"}}]}, {"affects": [{"ref": "libxml2_2.9.2-rc1_fa69892f-abbb-4bc2-82e4-70b256ffab5d"}], "bom-ref": "vuln-CVE-2025-32415-libxml2-2.9.2-rc1", "description": "Security vulnerability affecting libxml2 version 2.9.2-rc1", "id": "CVE-2025-32415", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2025-32415", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32415"}}]}], "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6"} \ No newline at end of file +{"components": [{"bom-ref": "BomRef.2159983129876778.6263436027473791", "name": "Flask", "purl": "pkg:pypi/flask@1.1.2", "type": "library", "version": "1.1.2"}, {"bom-ref": "BomRef.18910197540316243.9698487108918346", "name": "Jaxer", "purl": "pkg:github/jaxer@1.0.3", "type": "library", "version": "1.0.3"}, {"bom-ref": "BomRef.361554798325204.30065293377303415", "name": "Werkzeug", "purl": "pkg:pypi/werkzeug@1.0.1", "type": "library", "version": "1.0.1"}, {"bom-ref": "BomRef.17053302933213865.007564160329536773", "name": "async", "purl": "pkg:npm/async@2.6.3", "type": "library", "version": "2.6.3"}, {"bom-ref": "BomRef.7522058400494672.9660898607043584", "name": "body-parser", "purl": "pkg:npm/body-parser@1.19.0", "type": "library", "version": "1.19.0"}, {"bom-ref": "BomRef.6594648293371648.9608860641261379", "name": "certifi", "purl": "pkg:pypi/certifi@2018.11.29", "type": "library", "version": "2018.11.29"}, {"bom-ref": "BomRef.47134068190122547.4819333921107225", "name": "com.google.crypto.tink/tink", "purl": "pkg:maven/com.google.crypto.tink/tink@1.3.0-rc2", "type": "library", "version": "1.3.0-rc2"}, {"bom-ref": "BomRef.7473476126610068.09471880639202113", "name": "com.google.protobuf/protobuf-java", "purl": "pkg:maven/com.google.protobuf/protobuf-java@3.10.0", "type": "library", "version": "3.10.0"}, {"bom-ref": "BomRef.030947770208670122.08102969590856379", "name": "core", "purl": "pkg:github/core@23.1", "type": "library", "version": "23.1"}, {"bom-ref": "BomRef.025343881487390307.5696678823947524", "name": "debug", "purl": "pkg:npm/debug@2.2.0", "type": "library", "version": "2.2.0"}, {"bom-ref": "BomRef.399745295047898.5756348458559252", "name": "decode-uri-component", "purl": "pkg:npm/decode-uri-component@0.2.0", "type": "library", "version": "0.2.0"}, {"bom-ref": "BomRef.05600419260033962.9085462252193757", "name": "dottie", "purl": "pkg:npm/dottie@2.0.2", "type": "library", "version": "2.0.2"}, {"bom-ref": "BomRef.8711531275581232.45491422534361203", "name": "express", "purl": "pkg:npm/express@4.17.1", "type": "library", "version": "4.17.1"}, {"bom-ref": "BomRef.14855116245882283.47482660284131506", "name": "gitpython", "purl": "pkg:pypi/gitpython@2.1.11", "type": "library", "version": "2.1.11"}, {"bom-ref": "BomRef.6182099752448199.8453226445510409", "name": "glob-parent", "purl": "pkg:npm/glob-parent@3.1.0", "type": "library", "version": "3.1.0"}, {"bom-ref": "BomRef.22634849734654816.8019000425702962", "name": "handlebars", "purl": "pkg:npm/handlebars@2.0.0", "type": "library", "version": "2.0.0"}, {"bom-ref": "BomRef.9259663594427016.6334711588257277", "name": "httpd", "purl": "pkg:github/httpd@2.1.5", "type": "library", "version": "2.1.5"}, {"bom-ref": "BomRef.6878174995118836.26936331537552294", "name": "jsonwebtoken", "purl": "pkg:npm/jsonwebtoken@8.5.1", "type": "library", "version": "8.5.1"}, {"bom-ref": "BomRef.41456115751105094.5254626376687803", "name": "junit/junit", "purl": "pkg:maven/junit/junit@4.12", "type": "library", "version": "4.12"}, {"bom-ref": "BomRef.004921666221373799.4321891264292089", "name": "lodash", "purl": "pkg:npm/lodash@4.17.20", "type": "library", "version": "4.17.20"}, {"bom-ref": "BomRef.671363641237765.2144840439928869", "name": "minimatch", "purl": "pkg:npm/minimatch@3.0.4", "type": "library", "version": "3.0.4"}, {"bom-ref": "BomRef.3932589127433793.5109202638067444", "name": "minimist", "purl": "pkg:npm/minimist@0.0.8", "type": "library", "version": "0.0.8"}, {"bom-ref": "BomRef.5134462682499916.7485078555752523", "name": "moment", "purl": "pkg:npm/moment@2.28.0", "type": "library", "version": "2.28.0"}, {"bom-ref": "BomRef.7067949446077331.9288103955243882", "name": "ms", "purl": "pkg:npm/ms@0.7.1", "type": "library", "version": "0.7.1"}, {"bom-ref": "BomRef.2925362762729299.2785488534568177", "name": "mysql-server", "purl": "pkg:github/mysql-server@mysql-5.0.52", "type": "library", "version": "mysql-5.0.52"}, {"bom-ref": "BomRef.3743224300855692.0765369802864454", "name": "opencart", "purl": "pkg:github/opencart@3.0.3.9", "type": "library", "version": "3.0.3.9"}, {"bom-ref": "BomRef.9635049013967025.9484549707554434", "name": "org.apache.derby/derby", "purl": "pkg:maven/org.apache.derby/derby@10.8.2.2", "type": "library", "version": "10.8.2.2"}, {"bom-ref": "BomRef.9927425749972455.5869945320625751", "name": "path-parse", "purl": "pkg:npm/path-parse@1.0.6", "type": "library", "version": "1.0.6"}, {"bom-ref": "BomRef.03234562512185113.9444347790811559", "name": "pyjwt", "purl": "pkg:pypi/pyjwt@1.6.4", "type": "library", "version": "1.6.4"}, {"bom-ref": "BomRef.8581681109486263.9876548487535932", "name": "qs", "purl": "pkg:npm/qs@6.7.0", "type": "library", "version": "6.7.0"}, {"bom-ref": "BomRef.8211049176495571.5864448741305823", "name": "requests", "purl": "pkg:pypi/requests@2.21.0", "type": "library", "version": "2.21.0"}, {"bom-ref": "BomRef.10441689358768813.21871822213630854", "name": "revel/revel", "purl": "pkg:golang/revel/revel@v0.21.0", "type": "library", "version": "v0.21.0"}, {"bom-ref": "BomRef.7011684986381823.8584015013122471", "name": "safety", "purl": "pkg:pypi/safety@1.8.4", "type": "library", "version": "1.8.4"}, {"bom-ref": "BomRef.8326531461590775.4233076396277473", "name": "semver", "purl": "pkg:npm/semver@5.7.1", "type": "library", "version": "5.7.1"}, {"bom-ref": "BomRef.3206169473502892.7049736504132676", "name": "semver", "purl": "pkg:npm/semver@7.3.2", "type": "library", "version": "7.3.2"}, {"bom-ref": "BomRef.8656912398005825.6046396261283814", "name": "send", "purl": "pkg:npm/send@0.17.1", "type": "library", "version": "0.17.1"}, {"bom-ref": "BomRef.6390056849175947.3556184364586834", "name": "sequelize", "purl": "pkg:npm/sequelize@6.3.5", "type": "library", "version": "6.3.5"}, {"bom-ref": "BomRef.6977326932166876.8047676075204343", "name": "serve-static", "purl": "pkg:npm/serve-static@1.14.1", "type": "library", "version": "1.14.1"}, {"bom-ref": "BomRef.6248381677817776.09509309884213468", "name": "shelljs", "purl": "pkg:npm/shelljs@0.7.8", "type": "library", "version": "0.7.8"}, {"bom-ref": "BomRef.23573708482452493.9633808799655288", "name": "swagger-ui", "purl": "pkg:github/swagger-ui@3.19.3", "type": "library", "version": "3.19.3"}, {"bom-ref": "BomRef.481247880276228.663553763293324", "name": "textpattern", "purl": "pkg:github/textpattern@4.3.0", "type": "library", "version": "4.3.0"}, {"bom-ref": "BomRef.8124002889672848.6908761611781271", "name": "underscore", "purl": "pkg:github/underscore@1.7.0", "type": "library", "version": "1.7.0"}, {"bom-ref": "BomRef.09637163612218025.20949423432907632", "name": "urllib3", "purl": "pkg:pypi/urllib3@1.24.1", "type": "library", "version": "1.24.1"}, {"bom-ref": "BomRef.2625860060845807.9760161343783439", "name": "validator", "purl": "pkg:npm/validator@10.11.0", "type": "library", "version": "10.11.0"}, {"bom-ref": "BomRef.20527113184106593.42557811302898396", "name": "web", "purl": "pkg:maven/web@2.0.0", "type": "library", "version": "2.0.0"}, {"bom-ref": "BomRef.4629729775102227.8295458165589326", "name": "wheel", "purl": "pkg:pypi/wheel@0.32.3", "type": "library", "version": "0.32.3"}], "dependencies": [{"ref": "BomRef.2159983129876778.6263436027473791"}, {"ref": "BomRef.18910197540316243.9698487108918346"}, {"ref": "BomRef.361554798325204.30065293377303415"}, {"ref": "BomRef.17053302933213865.007564160329536773"}, {"ref": "BomRef.7522058400494672.9660898607043584"}, {"ref": "BomRef.6594648293371648.9608860641261379"}, {"ref": "BomRef.47134068190122547.4819333921107225"}, {"ref": "BomRef.7473476126610068.09471880639202113"}, {"ref": "BomRef.030947770208670122.08102969590856379"}, {"ref": "BomRef.025343881487390307.5696678823947524"}, {"ref": "BomRef.399745295047898.5756348458559252"}, {"ref": "BomRef.05600419260033962.9085462252193757"}, {"ref": "BomRef.8711531275581232.45491422534361203"}, {"ref": "BomRef.14855116245882283.47482660284131506"}, {"ref": "BomRef.6182099752448199.8453226445510409"}, {"ref": "BomRef.22634849734654816.8019000425702962"}, {"ref": "BomRef.9259663594427016.6334711588257277"}, {"ref": "BomRef.6878174995118836.26936331537552294"}, {"ref": "BomRef.41456115751105094.5254626376687803"}, {"ref": "BomRef.004921666221373799.4321891264292089"}, {"ref": "BomRef.671363641237765.2144840439928869"}, {"ref": "BomRef.3932589127433793.5109202638067444"}, {"ref": "BomRef.5134462682499916.7485078555752523"}, {"ref": "BomRef.7067949446077331.9288103955243882"}, {"ref": "BomRef.2925362762729299.2785488534568177"}, {"ref": "BomRef.3743224300855692.0765369802864454"}, {"ref": "BomRef.9635049013967025.9484549707554434"}, {"ref": "BomRef.9927425749972455.5869945320625751"}, {"ref": "BomRef.03234562512185113.9444347790811559"}, {"ref": "BomRef.8581681109486263.9876548487535932"}, {"ref": "BomRef.8211049176495571.5864448741305823"}, {"ref": "BomRef.10441689358768813.21871822213630854"}, {"ref": "BomRef.7011684986381823.8584015013122471"}, {"ref": "BomRef.8326531461590775.4233076396277473"}, {"ref": "BomRef.3206169473502892.7049736504132676"}, {"ref": "BomRef.8656912398005825.6046396261283814"}, {"ref": "BomRef.6390056849175947.3556184364586834"}, {"ref": "BomRef.6977326932166876.8047676075204343"}, {"ref": "BomRef.6248381677817776.09509309884213468"}, {"ref": "BomRef.23573708482452493.9633808799655288"}, {"ref": "BomRef.481247880276228.663553763293324"}, {"ref": "BomRef.8124002889672848.6908761611781271"}, {"ref": "BomRef.09637163612218025.20949423432907632"}, {"ref": "BomRef.2625860060845807.9760161343783439"}, {"ref": "BomRef.20527113184106593.42557811302898396"}, {"ref": "BomRef.4629729775102227.8295458165589326"}], "metadata": {"timestamp": "2025-07-05T17:03:30.027365-04:00"}, "serialNumber": "urn:uuid:1579df25-3f05-4690-a6f7-0496f144f02c", "version": 1, "vulnerabilities": [{"bom-ref": "vuln-CVE-2006-20001-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2006-20001", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2006-20001", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-20001"}}]}, {"bom-ref": "vuln-CVE-2016-8612-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2016-8612", "ratings": [{"method": "CVSSv3", "score": "4.3", "severity": "medium", "vector": "CVSS:3.0/AV:A/AC:L/A:L"}], "references": [{"id": "CVE-2016-8612", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8612"}}]}, {"bom-ref": "vuln-CVE-2016-8750-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2016-8750", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2016-8750", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8750"}}]}, {"bom-ref": "vuln-CVE-2017-16137-debug-2.2.0", "description": "Security vulnerability affecting debug version 2.2.0", "id": "CVE-2017-16137", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:L"}], "references": [{"id": "CVE-2017-16137", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16137"}}]}, {"bom-ref": "vuln-CVE-2017-20162-ms-0.7.1", "description": "Security vulnerability affecting ms version 0.7.1", "id": "CVE-2017-20162", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}], "references": [{"id": "CVE-2017-20162", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-20162"}}]}, {"bom-ref": "vuln-CVE-2017-20165-debug-2.2.0", "description": "Security vulnerability affecting debug version 2.2.0", "id": "CVE-2017-20165", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2017-20165", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-20165"}}]}, {"bom-ref": "vuln-CVE-2018-0735-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2018-0735", "ratings": [{"method": "CVSSv3", "score": "5.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}], "references": [{"id": "CVE-2018-0735", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0735"}}]}, {"bom-ref": "vuln-CVE-2018-11786-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2018-11786", "ratings": [{"method": "CVSSv3", "score": "8.8", "severity": "high", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2018-11786", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11786"}}]}, {"bom-ref": "vuln-CVE-2018-11787-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2018-11787", "ratings": [{"method": "CVSSv3", "score": "8.1", "severity": "high", "vector": "CVSS:3.0/AV:N/AC:H/A:H"}], "references": [{"id": "CVE-2018-11787", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11787"}}]}, {"bom-ref": "vuln-CVE-2018-11788-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2018-11788", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2018-11788", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11788"}}]}, {"bom-ref": "vuln-CVE-2018-1301-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2018-1301", "ratings": [{"method": "CVSSv3", "score": "5.9", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:H/A:H"}], "references": [{"id": "CVE-2018-1301", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1301"}}]}, {"bom-ref": "vuln-CVE-2018-1302-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2018-1302", "ratings": [{"method": "CVSSv3", "score": "5.9", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:H/A:H"}], "references": [{"id": "CVE-2018-1302", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1302"}}]}, {"bom-ref": "vuln-CVE-2018-1303-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2018-1303", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2018-1303", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1303"}}]}, {"bom-ref": "vuln-CVE-2018-1313-org.apache.derby/derby-10.8.2.2", "description": "Security vulnerability affecting org.apache.derby/derby version 10.8.2.2", "id": "CVE-2018-1313", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}], "references": [{"id": "CVE-2018-1313", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1313"}}]}, {"bom-ref": "vuln-CVE-2018-25031-swagger-ui-3.19.3", "description": "Security vulnerability affecting swagger-ui version 3.19.3", "id": "CVE-2018-25031", "ratings": [{"method": "CVSSv3", "score": "4.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2018-25031", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25031"}}]}, {"bom-ref": "vuln-CVE-2018-25091-urllib3-1.24.1", "description": "Security vulnerability affecting urllib3 version 1.24.1", "id": "CVE-2018-25091", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2018-25091", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25091"}}]}, {"bom-ref": "vuln-CVE-2018-3061-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2018-3061", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2018-3061", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3061"}}]}, {"bom-ref": "vuln-CVE-2018-3071-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2018-3071", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2018-3071", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3071"}}]}, {"bom-ref": "vuln-CVE-2018-7474-textpattern-4.3.0", "description": "Security vulnerability affecting textpattern version 4.3.0", "id": "CVE-2018-7474", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.0/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2018-7474", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7474"}}]}, {"bom-ref": "vuln-CVE-2019-0191-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2019-0191", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2019-0191", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0191"}}]}, {"bom-ref": "vuln-CVE-2019-0226-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2019-0226", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2019-0226", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0226"}}]}, {"bom-ref": "vuln-CVE-2019-11236-urllib3-1.24.1", "description": "Security vulnerability affecting urllib3 version 1.24.1", "id": "CVE-2019-11236", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2019-11236", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11236"}}]}, {"bom-ref": "vuln-CVE-2019-11324-urllib3-1.24.1", "description": "Security vulnerability affecting urllib3 version 1.24.1", "id": "CVE-2019-11324", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.0/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2019-11324", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11324"}}]}, {"bom-ref": "vuln-CVE-2019-14312-Jaxer-1.0.3", "description": "Security vulnerability affecting Jaxer version 1.0.3", "id": "CVE-2019-14312", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2019-14312", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14312"}}]}, {"bom-ref": "vuln-CVE-2019-17495-swagger-ui-3.19.3", "description": "Security vulnerability affecting swagger-ui version 3.19.3", "id": "CVE-2019-17495", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2019-17495", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17495"}}]}, {"bom-ref": "vuln-CVE-2019-20920-handlebars-2.0.0", "description": "Security vulnerability affecting handlebars version 2.0.0", "id": "CVE-2019-20920", "ratings": [{"method": "CVSSv3", "score": "8.1", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:H/A:L"}], "references": [{"id": "CVE-2019-20920", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20920"}}]}, {"bom-ref": "vuln-CVE-2019-2731-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2019-2731", "ratings": [{"method": "CVSSv3", "score": "5.4", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:L"}], "references": [{"id": "CVE-2019-2731", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2731"}}]}, {"bom-ref": "vuln-CVE-2019-2741-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2019-2741", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:H/A:H"}], "references": [{"id": "CVE-2019-2741", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2741"}}]}, {"bom-ref": "vuln-CVE-2019-2755-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2019-2755", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2019-2755", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2755"}}]}, {"bom-ref": "vuln-CVE-2019-2757-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2019-2757", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2019-2757", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-2757"}}]}, {"bom-ref": "vuln-CVE-2019-7317-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2019-7317", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}], "references": [{"id": "CVE-2019-7317", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317"}}]}, {"bom-ref": "vuln-CVE-2020-11980-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2020-11980", "ratings": [{"method": "CVSSv3", "score": "6.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}], "references": [{"id": "CVE-2020-11980", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11980"}}]}, {"bom-ref": "vuln-CVE-2020-14760-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14760", "ratings": [{"method": "CVSSv3", "score": "5.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2020-14760", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14760"}}]}, {"bom-ref": "vuln-CVE-2020-14814-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14814", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2020-14814", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14814"}}]}, {"bom-ref": "vuln-CVE-2020-14830-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14830", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2020-14830", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14830"}}]}, {"bom-ref": "vuln-CVE-2020-14837-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14837", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2020-14837", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14837"}}]}, {"bom-ref": "vuln-CVE-2020-14839-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14839", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2020-14839", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14839"}}]}, {"bom-ref": "vuln-CVE-2020-14845-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14845", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2020-14845", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14845"}}]}, {"bom-ref": "vuln-CVE-2020-14846-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14846", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2020-14846", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14846"}}]}, {"bom-ref": "vuln-CVE-2020-14852-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-14852", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2020-14852", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14852"}}]}, {"bom-ref": "vuln-CVE-2020-15250-junit/junit-4.12", "description": "Security vulnerability affecting junit/junit version 4.12", "id": "CVE-2020-15250", "ratings": [{"method": "CVSSv3", "score": "5.5", "severity": "medium", "vector": "CVSS:3.1/AV:L/AC:L/A:N"}], "references": [{"id": "CVE-2020-15250", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15250"}}]}, {"bom-ref": "vuln-CVE-2020-15358-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-15358", "ratings": [{"method": "CVSSv3", "score": "5.5", "severity": "medium", "vector": "CVSS:3.1/AV:L/AC:L/A:H"}], "references": [{"id": "CVE-2020-15358", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15358"}}]}, {"analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2020-1967-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-1967", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2020-1967", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1967"}}]}, {"bom-ref": "vuln-CVE-2020-1971-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2020-1971", "ratings": [{"method": "CVSSv3", "score": "5.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}], "references": [{"id": "CVE-2020-1971", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1971"}}]}, {"bom-ref": "vuln-CVE-2020-26137-urllib3-1.24.1", "description": "Security vulnerability affecting urllib3 version 1.24.1", "id": "CVE-2020-26137", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2020-26137", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26137"}}]}, {"bom-ref": "vuln-CVE-2020-28469-glob-parent-3.1.0", "description": "Security vulnerability affecting glob-parent version 3.1.0", "id": "CVE-2020-28469", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2020-28469", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28469"}}]}, {"bom-ref": "vuln-CVE-2020-28500-lodash-4.17.20", "description": "Security vulnerability affecting lodash version 4.17.20", "id": "CVE-2020-28500", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}], "references": [{"id": "CVE-2020-28500", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28500"}}]}, {"bom-ref": "vuln-CVE-2020-36568-revel/revel-v0.21.0", "description": "Security vulnerability affecting revel/revel version v0.21.0", "id": "CVE-2020-36568", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2020-36568", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36568"}}]}, {"bom-ref": "vuln-CVE-2020-5252-safety-1.8.4", "description": "Security vulnerability affecting safety version 1.8.4", "id": "CVE-2020-5252", "ratings": [{"method": "CVSSv3", "score": "4.1", "severity": "medium", "vector": "CVSS:3.1/AV:L/AC:H/A:N"}], "references": [{"id": "CVE-2020-5252", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5252"}}]}, {"bom-ref": "vuln-CVE-2020-7598-minimist-0.0.8", "description": "Security vulnerability affecting minimist version 0.0.8", "id": "CVE-2020-7598", "ratings": [{"method": "CVSSv3", "score": "5.6", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:L"}], "references": [{"id": "CVE-2020-7598", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7598"}}]}, {"bom-ref": "vuln-CVE-2020-8929-com.google.crypto.tink/tink-1.3.0-rc2", "description": "Security vulnerability affecting com.google.crypto.tink/tink version 1.3.0-rc2", "id": "CVE-2020-8929", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2020-8929", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8929"}}]}, {"bom-ref": "vuln-CVE-2021-22569-com.google.protobuf/protobuf-java-3.10.0", "description": "Security vulnerability affecting com.google.protobuf/protobuf-java version 3.10.0", "id": "CVE-2021-22569", "ratings": [{"method": "CVSSv3", "score": "5.5", "severity": "medium", "vector": "CVSS:3.1/AV:L/AC:L/A:H"}], "references": [{"id": "CVE-2021-22569", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22569"}}]}, {"bom-ref": "vuln-CVE-2021-22570-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2021-22570", "ratings": [{"method": "CVSSv3", "score": "5.5", "severity": "medium", "vector": "CVSS:3.1/AV:L/AC:L/A:H"}], "references": [{"id": "CVE-2021-22570", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22570"}}]}, {"bom-ref": "vuln-CVE-2021-23337-lodash-4.17.20", "description": "Security vulnerability affecting lodash version 4.17.20", "id": "CVE-2021-23337", "ratings": [{"method": "CVSSv3", "score": "7.2", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2021-23337", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23337"}}]}, {"bom-ref": "vuln-CVE-2021-23343-path-parse-1.0.6", "description": "Security vulnerability affecting path-parse version 1.0.6", "id": "CVE-2021-23343", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2021-23343", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23343"}}]}, {"bom-ref": "vuln-CVE-2021-23358-underscore-1.7.0", "description": "Security vulnerability affecting underscore version 1.7.0", "id": "CVE-2021-23358", "ratings": [{"method": "CVSSv3", "score": "7.2", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2021-23358", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23358"}}]}, {"bom-ref": "vuln-CVE-2021-23369-handlebars-2.0.0", "description": "Security vulnerability affecting handlebars version 2.0.0", "id": "CVE-2021-23369", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2021-23369", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23369"}}]}, {"bom-ref": "vuln-CVE-2021-23383-handlebars-2.0.0", "description": "Security vulnerability affecting handlebars version 2.0.0", "id": "CVE-2021-23383", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2021-23383", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23383"}}]}, {"bom-ref": "vuln-CVE-2021-2356-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2021-2356", "ratings": [{"method": "CVSSv3", "score": "5.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}], "references": [{"id": "CVE-2021-2356", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-2356"}}]}, {"bom-ref": "vuln-CVE-2021-32785-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-32785", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2021-32785", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32785"}}]}, {"bom-ref": "vuln-CVE-2021-32786-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-32786", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2021-32786", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32786"}}]}, {"bom-ref": "vuln-CVE-2021-32791-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-32791", "ratings": [{"method": "CVSSv3", "score": "5.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}], "references": [{"id": "CVE-2021-32791", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32791"}}]}, {"bom-ref": "vuln-CVE-2021-32792-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-32792", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2021-32792", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32792"}}]}, {"bom-ref": "vuln-CVE-2021-34798-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-34798", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2021-34798", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34798"}}]}, {"bom-ref": "vuln-CVE-2021-3765-validator-10.11.0", "description": "Security vulnerability affecting validator version 10.11.0", "id": "CVE-2021-3765", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.0/AV:N/AC:L/A:L"}], "references": [{"id": "CVE-2021-3765", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3765"}}]}, {"analysis": {"state": "exploitable"}, "bom-ref": "vuln-CVE-2021-39275-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-39275", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}], "references": [{"id": "CVE-2021-39275", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39275"}}]}, {"bom-ref": "vuln-CVE-2021-40438-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2021-40438", "ratings": [{"method": "CVSSv3", "score": "9.0", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}], "references": [{"id": "CVE-2021-40438", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40438"}}]}, {"bom-ref": "vuln-CVE-2021-40642-textpattern-4.3.0", "description": "Security vulnerability affecting textpattern version 4.3.0", "id": "CVE-2021-40642", "ratings": [{"method": "CVSSv3", "score": "4.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2021-40642", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40642"}}]}, {"bom-ref": "vuln-CVE-2021-41766-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2021-41766", "ratings": [{"method": "CVSSv3", "score": "8.1", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}], "references": [{"id": "CVE-2021-41766", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41766"}}]}, {"bom-ref": "vuln-CVE-2021-43138-async-2.6.3", "description": "Security vulnerability affecting async version 2.6.3", "id": "CVE-2021-43138", "ratings": [{"method": "CVSSv3", "score": "7.8", "severity": "high", "vector": "CVSS:3.1/AV:L/AC:L/A:H"}], "references": [{"id": "CVE-2021-43138", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43138"}}]}, {"bom-ref": "vuln-CVE-2021-44906-minimist-0.0.8", "description": "Security vulnerability affecting minimist version 0.0.8", "id": "CVE-2021-44906", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2021-44906", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906"}}]}, {"bom-ref": "vuln-CVE-2022-0144-shelljs-0.7.8", "description": "Security vulnerability affecting shelljs version 0.7.8", "id": "CVE-2022-0144", "ratings": [{"method": "CVSSv3", "score": "7.1", "severity": "high", "vector": "CVSS:3.0/AV:L/AC:L/A:H"}], "references": [{"id": "CVE-2022-0144", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0144"}}]}, {"bom-ref": "vuln-CVE-2022-21417-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2022-21417", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2022-21417", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21417"}}]}, {"bom-ref": "vuln-CVE-2022-21444-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2022-21444", "ratings": [{"method": "CVSSv3", "score": "4.4", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}], "references": [{"id": "CVE-2022-21444", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21444"}}]}, {"bom-ref": "vuln-CVE-2022-22719-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-22719", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2022-22719", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22719"}}]}, {"bom-ref": "vuln-CVE-2022-22720-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-22720", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2022-22720", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22720"}}]}, {"bom-ref": "vuln-CVE-2022-22721-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-22721", "ratings": [{"method": "CVSSv3", "score": "9.1", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2022-22721", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22721"}}]}, {"bom-ref": "vuln-CVE-2022-22932-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2022-22932", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2022-22932", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22932"}}]}, {"bom-ref": "vuln-CVE-2022-23491-certifi-2018.11.29", "description": "Security vulnerability affecting certifi version 2018.11.29", "id": "CVE-2022-23491", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2022-23491", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23491"}}]}, {"bom-ref": "vuln-CVE-2022-23539-jsonwebtoken-8.5.1", "description": "Security vulnerability affecting jsonwebtoken version 8.5.1", "id": "CVE-2022-23539", "ratings": [{"method": "CVSSv3", "score": "8.1", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2022-23539", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23539"}}]}, {"bom-ref": "vuln-CVE-2022-23540-jsonwebtoken-8.5.1", "description": "Security vulnerability affecting jsonwebtoken version 8.5.1", "id": "CVE-2022-23540", "ratings": [{"method": "CVSSv3", "score": "7.6", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}], "references": [{"id": "CVE-2022-23540", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23540"}}]}, {"bom-ref": "vuln-CVE-2022-23541-jsonwebtoken-8.5.1", "description": "Security vulnerability affecting jsonwebtoken version 8.5.1", "id": "CVE-2022-23541", "ratings": [{"method": "CVSSv3", "score": "6.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}], "references": [{"id": "CVE-2022-23541", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23541"}}]}, {"bom-ref": "vuln-CVE-2022-24439-gitpython-2.1.11", "description": "Security vulnerability affecting gitpython version 2.1.11", "id": "CVE-2022-24439", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2022-24439", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24439"}}]}, {"bom-ref": "vuln-CVE-2022-24785-moment-2.28.0", "description": "Security vulnerability affecting moment version 2.28.0", "id": "CVE-2022-24785", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2022-24785", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24785"}}]}, {"bom-ref": "vuln-CVE-2022-24999-express-4.17.1", "description": "Security vulnerability affecting express version 4.17.1", "id": "CVE-2022-24999", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2022-24999", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24999"}}]}, {"bom-ref": "vuln-CVE-2022-24999-qs-6.7.0", "description": "Security vulnerability affecting qs version 6.7.0", "id": "CVE-2022-24999", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2022-24999", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24999"}}]}, {"bom-ref": "vuln-CVE-2022-25883-semver-5.7.1", "description": "Security vulnerability affecting semver version 5.7.1", "id": "CVE-2022-25883", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2022-25883", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25883"}}]}, {"bom-ref": "vuln-CVE-2022-25883-semver-7.3.2", "description": "Security vulnerability affecting semver version 7.3.2", "id": "CVE-2022-25883", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2022-25883", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25883"}}]}, {"bom-ref": "vuln-CVE-2022-28330-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-28330", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2022-28330", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28330"}}]}, {"bom-ref": "vuln-CVE-2022-28614-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-28614", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2022-28614", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28614"}}]}, {"bom-ref": "vuln-CVE-2022-28615-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-28615", "ratings": [{"method": "CVSSv3", "score": "9.1", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2022-28615", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28615"}}]}, {"bom-ref": "vuln-CVE-2022-29217-pyjwt-1.6.4", "description": "Security vulnerability affecting pyjwt version 1.6.4", "id": "CVE-2022-29217", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2022-29217", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29217"}}]}, {"bom-ref": "vuln-CVE-2022-29361-Werkzeug-1.0.1", "description": "Security vulnerability affecting Werkzeug version 1.0.1", "id": "CVE-2022-29361", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2022-29361", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29361"}}]}, {"bom-ref": "vuln-CVE-2022-29404-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-29404", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2022-29404", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29404"}}]}, {"bom-ref": "vuln-CVE-2022-30556-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-30556", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2022-30556", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30556"}}]}, {"bom-ref": "vuln-CVE-2022-31129-moment-2.28.0", "description": "Security vulnerability affecting moment version 2.28.0", "id": "CVE-2022-31129", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2022-31129", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31129"}}]}, {"bom-ref": "vuln-CVE-2022-3171-com.google.protobuf/protobuf-java-3.10.0", "description": "Security vulnerability affecting com.google.protobuf/protobuf-java version 3.10.0", "id": "CVE-2022-3171", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2022-3171", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3171"}}]}, {"bom-ref": "vuln-CVE-2022-31813-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-31813", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2022-31813", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31813"}}]}, {"bom-ref": "vuln-CVE-2022-3517-minimatch-3.0.4", "description": "Security vulnerability affecting minimatch version 3.0.4", "id": "CVE-2022-3517", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2022-3517", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3517"}}]}, {"bom-ref": "vuln-CVE-2022-37436-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2022-37436", "ratings": [{"method": "CVSSv3", "score": "5.3", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2022-37436", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37436"}}]}, {"bom-ref": "vuln-CVE-2022-38778-decode-uri-component-0.2.0", "description": "Security vulnerability affecting decode-uri-component version 0.2.0", "id": "CVE-2022-38778", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2022-38778", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38778"}}]}, {"analysis": {"response": ["will_not_fix"], "state": "exploitable"}, "bom-ref": "vuln-CVE-2022-40145-web-2.0.0", "description": "Security vulnerability affecting web version 2.0.0", "id": "CVE-2022-40145", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}], "references": [{"id": "CVE-2022-40145", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40145"}}]}, {"bom-ref": "vuln-CVE-2022-40898-wheel-0.32.3", "description": "Security vulnerability affecting wheel version 0.32.3", "id": "CVE-2022-40898", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2022-40898", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40898"}}]}, {"analysis": {"response": ["can_not_fix"], "state": "exploitable"}, "bom-ref": "vuln-CVE-2022-46337-org.apache.derby/derby-10.8.2.2", "description": "Security vulnerability affecting org.apache.derby/derby version 10.8.2.2", "id": "CVE-2022-46337", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}, {"method": "other", "score": "8.0", "severity": "high"}], "references": [{"id": "CVE-2022-46337", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46337"}}]}, {"bom-ref": "vuln-CVE-2023-21977-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2023-21977", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-21977", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21977"}}]}, {"analysis": {"state": "in_triage"}, "bom-ref": "vuln-CVE-2023-21980-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2023-21980", "ratings": [{"method": "CVSSv3", "score": "7.1", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}], "references": [{"id": "CVE-2023-21980", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21980"}}]}, {"bom-ref": "vuln-CVE-2023-22007-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2023-22007", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-22007", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22007"}}]}, {"bom-ref": "vuln-CVE-2023-22015-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2023-22015", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-22015", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22015"}}]}, {"bom-ref": "vuln-CVE-2023-22026-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2023-22026", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-22026", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22026"}}]}, {"bom-ref": "vuln-CVE-2023-22028-mysql-server-mysql-5.0.52", "description": "Security vulnerability affecting mysql-server version mysql-5.0.52", "id": "CVE-2023-22028", "ratings": [{"method": "CVSSv3", "score": "4.9", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-22028", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22028"}}]}, {"bom-ref": "vuln-CVE-2023-22578-sequelize-6.3.5", "description": "Security vulnerability affecting sequelize version 6.3.5", "id": "CVE-2023-22578", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-22578", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22578"}}]}, {"bom-ref": "vuln-CVE-2023-22579-sequelize-6.3.5", "description": "Security vulnerability affecting sequelize version 6.3.5", "id": "CVE-2023-22579", "ratings": [{"method": "CVSSv3", "score": "8.8", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-22579", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22579"}}]}, {"bom-ref": "vuln-CVE-2023-22580-sequelize-6.3.5", "description": "Security vulnerability affecting sequelize version 6.3.5", "id": "CVE-2023-22580", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2023-22580", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22580"}}]}, {"bom-ref": "vuln-CVE-2023-23934-Werkzeug-1.0.1", "description": "Security vulnerability affecting Werkzeug version 1.0.1", "id": "CVE-2023-23934", "ratings": [{"method": "CVSSv3", "score": "3.5", "severity": "low", "vector": "CVSS:3.1/AV:A/AC:L/A:N"}], "references": [{"id": "CVE-2023-23934", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23934"}}]}, {"bom-ref": "vuln-CVE-2023-25577-Werkzeug-1.0.1", "description": "Security vulnerability affecting Werkzeug version 1.0.1", "id": "CVE-2023-25577", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-25577", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25577"}}]}, {"bom-ref": "vuln-CVE-2023-25813-sequelize-6.3.5", "description": "Security vulnerability affecting sequelize version 6.3.5", "id": "CVE-2023-25813", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-25813", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25813"}}]}, {"bom-ref": "vuln-CVE-2023-26132-dottie-2.0.2", "description": "Security vulnerability affecting dottie version 2.0.2", "id": "CVE-2023-26132", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-26132", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26132"}}]}, {"bom-ref": "vuln-CVE-2023-26852-textpattern-4.3.0", "description": "Security vulnerability affecting textpattern version 4.3.0", "id": "CVE-2023-26852", "ratings": [{"method": "CVSSv3", "score": "7.2", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-26852", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26852"}}]}, {"bom-ref": "vuln-CVE-2023-27152-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-27152", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-27152", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27152"}}]}, {"bom-ref": "vuln-CVE-2023-30861-Flask-1.1.2", "description": "Security vulnerability affecting Flask version 1.1.2", "id": "CVE-2023-30861", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2023-30861", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30861"}}]}, {"bom-ref": "vuln-CVE-2023-31122-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2023-31122", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-31122", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31122"}}]}, {"bom-ref": "vuln-CVE-2023-32681-requests-2.21.0", "description": "Security vulnerability affecting requests version 2.21.0", "id": "CVE-2023-32681", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}], "references": [{"id": "CVE-2023-32681", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32681"}}]}, {"bom-ref": "vuln-CVE-2023-37920-certifi-2018.11.29", "description": "Security vulnerability affecting certifi version 2018.11.29", "id": "CVE-2023-37920", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-37920", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37920"}}]}, {"bom-ref": "vuln-CVE-2023-38997-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-38997", "ratings": [{"method": "CVSSv3", "score": "7.2", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-38997", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38997"}}]}, {"bom-ref": "vuln-CVE-2023-38998-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-38998", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2023-38998", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38998"}}]}, {"bom-ref": "vuln-CVE-2023-38999-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-38999", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-38999", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38999"}}]}, {"bom-ref": "vuln-CVE-2023-39000-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39000", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2023-39000", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39000"}}]}, {"bom-ref": "vuln-CVE-2023-39001-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39001", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-39001", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39001"}}]}, {"bom-ref": "vuln-CVE-2023-39002-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39002", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2023-39002", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39002"}}]}, {"bom-ref": "vuln-CVE-2023-39003-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39003", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2023-39003", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39003"}}]}, {"bom-ref": "vuln-CVE-2023-39004-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39004", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-39004", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39004"}}]}, {"bom-ref": "vuln-CVE-2023-39005-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39005", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2023-39005", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39005"}}]}, {"bom-ref": "vuln-CVE-2023-39006-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39006", "ratings": [{"method": "CVSSv3", "score": "5.4", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2023-39006", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39006"}}]}, {"bom-ref": "vuln-CVE-2023-39007-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39007", "ratings": [{"method": "CVSSv3", "score": "9.6", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-39007", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39007"}}]}, {"bom-ref": "vuln-CVE-2023-39008-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-39008", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-39008", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39008"}}]}, {"bom-ref": "vuln-CVE-2023-40267-gitpython-2.1.11", "description": "Security vulnerability affecting gitpython version 2.1.11", "id": "CVE-2023-40267", "ratings": [{"method": "CVSSv3", "score": "9.8", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-40267", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40267"}}]}, {"bom-ref": "vuln-CVE-2023-40590-gitpython-2.1.11", "description": "Security vulnerability affecting gitpython version 2.1.11", "id": "CVE-2023-40590", "ratings": [{"method": "CVSSv3", "score": "7.8", "severity": "high", "vector": "CVSS:3.1/AV:L/AC:L/A:H"}], "references": [{"id": "CVE-2023-40590", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40590"}}]}, {"bom-ref": "vuln-CVE-2023-41040-gitpython-2.1.11", "description": "Security vulnerability affecting gitpython version 2.1.11", "id": "CVE-2023-41040", "ratings": [{"method": "CVSSv3", "score": "6.5", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:L"}], "references": [{"id": "CVE-2023-41040", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41040"}}]}, {"bom-ref": "vuln-CVE-2023-43804-urllib3-1.24.1", "description": "Security vulnerability affecting urllib3 version 1.24.1", "id": "CVE-2023-43804", "ratings": [{"method": "CVSSv3", "score": "8.1", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2023-43804", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43804"}}]}, {"bom-ref": "vuln-CVE-2023-44275-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-44275", "ratings": [{"method": "CVSSv3", "score": "5.4", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2023-44275", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44275"}}]}, {"bom-ref": "vuln-CVE-2023-44276-core-23.1", "description": "Security vulnerability affecting core version 23.1", "id": "CVE-2023-44276", "ratings": [{"method": "CVSSv3", "score": "5.4", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2023-44276", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44276"}}]}, {"bom-ref": "vuln-CVE-2023-45803-urllib3-1.24.1", "description": "Security vulnerability affecting urllib3 version 1.24.1", "id": "CVE-2023-45803", "ratings": [{"method": "CVSSv3", "score": "4.2", "severity": "medium", "vector": "CVSS:3.1/AV:A/AC:H/A:N"}], "references": [{"id": "CVE-2023-45803", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45803"}}]}, {"bom-ref": "vuln-CVE-2023-46136-Werkzeug-1.0.1", "description": "Security vulnerability affecting Werkzeug version 1.0.1", "id": "CVE-2023-46136", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2023-46136", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46136"}}]}, {"bom-ref": "vuln-CVE-2024-21514-opencart-3.0.3.9", "description": "Security vulnerability affecting opencart version 3.0.3.9", "id": "CVE-2024-21514", "ratings": [{"method": "CVSSv3", "score": "8.1", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:H/A:H"}], "references": [{"id": "CVE-2024-21514", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21514"}}]}, {"bom-ref": "vuln-CVE-2024-22190-gitpython-2.1.11", "description": "Security vulnerability affecting gitpython version 2.1.11", "id": "CVE-2024-22190", "ratings": [{"method": "CVSSv3", "score": "7.8", "severity": "high", "vector": "CVSS:3.1/AV:L/AC:L/A:H"}], "references": [{"id": "CVE-2024-22190", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22190"}}]}, {"bom-ref": "vuln-CVE-2024-40898-httpd-2.1.5", "description": "Security vulnerability affecting httpd version 2.1.5", "id": "CVE-2024-40898", "ratings": [{"method": "CVSSv3", "score": "9.1", "severity": "critical", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2024-40898", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40898"}}]}, {"bom-ref": "vuln-CVE-2024-43796-express-4.17.1", "description": "Security vulnerability affecting express version 4.17.1", "id": "CVE-2024-43796", "ratings": [{"method": "CVSSv3", "score": "4.7", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}], "references": [{"id": "CVE-2024-43796", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43796"}}]}, {"bom-ref": "vuln-CVE-2024-43799-send-0.17.1", "description": "Security vulnerability affecting send version 0.17.1", "id": "CVE-2024-43799", "ratings": [{"method": "CVSSv3", "score": "4.7", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}], "references": [{"id": "CVE-2024-43799", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43799"}}]}, {"bom-ref": "vuln-CVE-2024-43800-serve-static-1.14.1", "description": "Security vulnerability affecting serve-static version 1.14.1", "id": "CVE-2024-43800", "ratings": [{"method": "CVSSv3", "score": "4.7", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:H/A:N"}], "references": [{"id": "CVE-2024-43800", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43800"}}]}, {"bom-ref": "vuln-CVE-2024-45590-body-parser-1.19.0", "description": "Security vulnerability affecting body-parser version 1.19.0", "id": "CVE-2024-45590", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2024-45590", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45590"}}]}, {"bom-ref": "vuln-CVE-2024-49767-Werkzeug-1.0.1", "description": "Security vulnerability affecting Werkzeug version 1.0.1", "id": "CVE-2024-49767", "ratings": [{"method": "CVSSv3", "score": "7.5", "severity": "high", "vector": "CVSS:3.1/AV:N/AC:L/A:H"}], "references": [{"id": "CVE-2024-49767", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49767"}}]}, {"bom-ref": "vuln-CVE-2025-1746-opencart-3.0.3.9", "description": "Security vulnerability affecting opencart version 3.0.3.9", "id": "CVE-2025-1746", "ratings": [{"method": "CVSSv3", "score": "6.1", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2025-1746", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1746"}}]}, {"bom-ref": "vuln-CVE-2025-1747-opencart-3.0.3.9", "description": "Security vulnerability affecting opencart version 3.0.3.9", "id": "CVE-2025-1747", "ratings": [{"method": "CVSSv3", "score": "4.7", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2025-1747", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1747"}}]}, {"bom-ref": "vuln-CVE-2025-1748-opencart-3.0.3.9", "description": "Security vulnerability affecting opencart version 3.0.3.9", "id": "CVE-2025-1748", "ratings": [{"method": "CVSSv3", "score": "4.7", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2025-1748", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1748"}}]}, {"bom-ref": "vuln-CVE-2025-1749-opencart-3.0.3.9", "description": "Security vulnerability affecting opencart version 3.0.3.9", "id": "CVE-2025-1749", "ratings": [{"method": "CVSSv3", "score": "4.7", "severity": "medium", "vector": "CVSS:3.1/AV:N/AC:L/A:N"}], "references": [{"id": "CVE-2025-1749", "source": {"name": "NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1749"}}]}], "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6"} \ No newline at end of file From b4e5ca8caf4b3314dfc7081518ea14365346c2e2 Mon Sep 17 00:00:00 2001 From: Tomas Gonzalez Date: Mon, 7 Jul 2025 19:15:35 -0400 Subject: [PATCH 6/9] cyclonedx flows operational --- api.cdx.json | 4267 ++ augment-epss.cdx.json | 34546 ++++++++++++++++ augment.cdx.json | 33339 +++++++++++++++ generate-epss-cisakev.cdx.json | 4342 ++ generate-epss.cdx.json | 4335 ++ generate.cdx.json | 34546 ++++++++++++++++ .../api/helpers/component_info_normalizer.py | 26 +- src/workbench_cli/cli.py | 47 +- src/workbench_cli/handlers/export_vulns.py | 409 +- .../utilities/sarif_generation.py | 1048 - .../utilities/vuln_report/__init__.py | 4 +- .../utilities/vuln_report/bootstrap_bom.py | 269 + .../vuln_report/component_enrichment.py | 483 - ...lity_enricher.py => cve_data_gathering.py} | 276 +- .../vuln_report/cyclonedx_enrichment.py | 538 + .../vuln_report/cyclonedx_generator.py | 966 +- .../utilities/vuln_report/risk_adjustments.py | 271 +- .../utilities/vuln_report/sarif_generator.py | 211 +- .../utilities/vuln_report/sbom_utils.py | 147 + .../utilities/vuln_report/spdx_enrichment.py | 0 .../utilities/vuln_report/spdx_generator.py | 134 +- tests/unit/handlers/test_export_sarif.py | 297 - tests/unit/utilities/test_sarif_converter.py | 55 +- .../utilities/test_vulnerability_enricher.py | 349 +- vuln-report-epss.json | 1 - vuln-report.json | 1 - 26 files changed, 117805 insertions(+), 3102 deletions(-) create mode 100644 api.cdx.json create mode 100644 augment-epss.cdx.json create mode 100644 augment.cdx.json create mode 100644 generate-epss-cisakev.cdx.json create mode 100644 generate-epss.cdx.json create mode 100644 generate.cdx.json delete mode 100644 src/workbench_cli/utilities/sarif_generation.py create mode 100644 src/workbench_cli/utilities/vuln_report/bootstrap_bom.py delete mode 100644 src/workbench_cli/utilities/vuln_report/component_enrichment.py rename src/workbench_cli/utilities/vuln_report/{vulnerability_enricher.py => cve_data_gathering.py} (65%) create mode 100644 src/workbench_cli/utilities/vuln_report/cyclonedx_enrichment.py create mode 100644 src/workbench_cli/utilities/vuln_report/sbom_utils.py create mode 100644 src/workbench_cli/utilities/vuln_report/spdx_enrichment.py delete mode 100644 tests/unit/handlers/test_export_sarif.py delete mode 100644 vuln-report-epss.json delete mode 100644 vuln-report.json diff --git a/api.cdx.json b/api.cdx.json new file mode 100644 index 0000000..6b83e6f --- /dev/null +++ b/api.cdx.json @@ -0,0 +1,4267 @@ +{ + "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", + "bomFormat": "CycloneDX", + "specVersion": "1.6", + "components": [ + { + "bom-ref": "pkg:adm-zip@0.4.7", + "cpe": "cpe:2.3:a:adm-zip_project:adm-zip:0.4.7:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "name": "adm-zip", + "purl": "pkg:npm/adm-zip@0.4.7", + "type": "library", + "version": "0.4.7" + }, + { + "bom-ref": "pkg:ansi-regex@3.0.0", + "cpe": "cpe:2.3:a:ansi-regex_project:ansi-regex:3.0.0:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "name": "ansi-regex", + "purl": "pkg:npm/ansi-regex@3.0.0", + "type": "library", + "version": "3.0.0" + }, + { + "bom-ref": "pkg:bootstrap@3.0.0", + "cpe": "cpe:2.3:a:getbootstrap:bootstrap:3.0.0:-:*:*:*:*:*:*", + "licenses": [ + { + "license": { + "id": "Apache-2.0" + } + } + ], + "name": "bootstrap", + "purl": "pkg:github/twbs/bootstrap@3.0.0", + "type": "library", + "version": "3.0.0" + }, + { + "bom-ref": "pkg:bson@0.4.23", + "cpe": "cpe:2.3:a:mongodb:js-bson:0.4.23:*:*:*:*:*:*:*", + "licenses": [ + { + "license": { + "id": "Apache-2.0" + } + } + ], + "name": "bson", + "purl": "pkg:npm/bson@0.4.23", + "type": "library", + "version": "0.4.23" + }, + { + "bom-ref": "pkg:debug@2.2.0", + "cpe": "cpe:2.3:a:debug_project:debug:2.2.0:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "name": "debug", + "purl": "pkg:npm/debug@2.2.0", + "type": "library", + "version": "2.2.0" + }, + { + "bom-ref": "pkg:decode-uri-component@0.2.0", + "cpe": "cpe:2.3:a:decode-uri-component_project:decode-uri-component:0.2.0:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "name": "decode-uri-component", + "purl": "pkg:npm/decode-uri-component@0.2.0", + "type": "library", + "version": "0.2.0" + }, + { + "bom-ref": "pkg:express@4.12.4", + "cpe": "cpe:2.3:a:openjsf:express:4.12.4:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "name": "express", + "purl": "pkg:npm/express@4.12.4", + "type": "library", + "version": "4.12.4" + }, + { + "bom-ref": "pkg:file-type@8.1.0", + "cpe": "cpe:2.3:a:file-type_project:file-type:8.1.0:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "name": "file-type", + "purl": "pkg:npm/file-type@8.1.0", + "type": "library", + "version": "8.1.0" + }, + { + "bom-ref": "pkg:fresh@0.2.4", + "cpe": "cpe:2.3:a:fresh_project:fresh:0.2.4:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "name": "fresh", + "purl": "pkg:npm/fresh@0.2.4", + "type": "library", + "version": "0.2.4" + }, + { + "bom-ref": "pkg:handlebars@4.0.11", + "cpe": "cpe:2.3:a:handlebars.js_project:handlebars.js:4.0.11:-:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "name": "handlebars", + "purl": "pkg:npm/handlebars@4.0.11", + "type": "library", + "version": "4.0.11" + }, + { + "bom-ref": "pkg:ini@1.1.0", + "cpe": "cpe:2.3:a:ini_project:ini:1.1.0:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "N/A" + } + } + ], + "name": "ini", + "purl": "pkg:npm/ini@1.1.0", + "type": "library", + "version": "1.1.0" + }, + { + "bom-ref": "pkg:jquery@2.2.4", + "cpe": "cpe:2.3:a:jquery:jquery:2.2.4:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "name": "jquery", + "purl": "pkg:npm/jquery@2.2.4", + "type": "library", + "version": "2.2.4" + }, + { + "bom-ref": "pkg:kerberos@0.0.24", + "cpe": "cpe:2.3:a:kerberos_project:kerberos:0.0.24:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "Apache-2.0" + } + } + ], + "name": "kerberos", + "purl": "pkg:npm/kerberos@0.0.24", + "type": "library", + "version": "0.0.24" + }, + { + "bom-ref": "pkg:lodash@4.17.10", + "cpe": "cpe:2.3:a:lodash:lodash:4.17.10:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "name": "lodash", + "purl": "pkg:npm/lodash@4.17.10", + "type": "library", + "version": "4.17.10" + }, + { + "bom-ref": "pkg:lodash@4.17.4", + "cpe": "cpe:2.3:a:lodash:lodash:4.17.4:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "name": "lodash", + "purl": "pkg:npm/lodash@4.17.4", + "type": "library", + "version": "4.17.4" + }, + { + "bom-ref": "pkg:marked@0.3.5", + "cpe": "cpe:2.3:a:marked_project:marked:0.3.5:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "name": "marked", + "purl": "pkg:npm/marked@0.3.5", + "type": "library", + "version": "0.3.5" + }, + { + "bom-ref": "pkg:mime@1.2.11", + "cpe": "cpe:2.3:a:mime_project:mime:1.2.11:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "N/A" + } + } + ], + "name": "mime", + "purl": "pkg:npm/mime@1.2.11", + "type": "library", + "version": "1.2.11" + }, + { + "bom-ref": "pkg:mime@1.3.4", + "cpe": "cpe:2.3:a:mime_project:mime:1.3.4:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "name": "mime", + "purl": "pkg:npm/mime@1.3.4", + "type": "library", + "version": "1.3.4" + }, + { + "bom-ref": "pkg:minimatch@3.0.4", + "cpe": "cpe:2.3:a:minimatch_project:minimatch:3.0.4:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "ISC" + } + } + ], + "name": "minimatch", + "purl": "pkg:npm/minimatch@3.0.4", + "type": "library", + "version": "3.0.4" + }, + { + "bom-ref": "pkg:minimist@0.0.8", + "cpe": "cpe:2.3:a:substack:minimist:0.0.8:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "name": "minimist", + "purl": "pkg:npm/minimist@0.0.8", + "type": "library", + "version": "0.0.8" + }, + { + "bom-ref": "pkg:mixin-deep@1.3.1", + "cpe": "cpe:2.3:a:mixin-deep_project:mixin-deep:1.3.1:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "name": "mixin-deep", + "purl": "pkg:npm/mixin-deep@1.3.1", + "type": "library", + "version": "1.3.1" + }, + { + "bom-ref": "pkg:moment@2.15.1", + "cpe": "cpe:2.3:a:momentjs:moment:2.15.1:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "name": "moment", + "purl": "pkg:npm/moment@2.15.1", + "type": "library", + "version": "2.15.1" + }, + { + "bom-ref": "pkg:mongoose@4.2.4", + "cpe": "cpe:2.3:a:mongoosejs:mongoose:4.2.4:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "name": "mongoose", + "purl": "pkg:npm/mongoose@4.2.4", + "type": "library", + "version": "4.2.4" + }, + { + "bom-ref": "pkg:mpath@0.1.1", + "cpe": "cpe:2.3:a:mpath_project:mpath:0.1.1:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "name": "mpath", + "purl": "pkg:npm/mpath@0.1.1", + "type": "library", + "version": "0.1.1" + }, + { + "bom-ref": "pkg:mquery@1.6.3", + "cpe": "cpe:2.3:a:mquery_project:mquery:1.6.3:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "name": "mquery", + "purl": "pkg:npm/mquery@1.6.3", + "type": "library", + "version": "1.6.3" + }, + { + "bom-ref": "pkg:ms@0.6.2", + "cpe": "cpe:2.3:a:vercel:ms:0.6.2:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "N/A" + } + } + ], + "name": "ms", + "purl": "pkg:npm/ms@0.6.2", + "type": "library", + "version": "0.6.2" + }, + { + "bom-ref": "pkg:ms@0.7.1", + "cpe": "cpe:2.3:a:vercel:ms:0.7.1:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "N/A" + } + } + ], + "name": "ms", + "purl": "pkg:npm/ms@0.7.1", + "type": "library", + "version": "0.7.1" + }, + { + "bom-ref": "pkg:ms@0.7.3", + "cpe": "cpe:2.3:a:vercel:ms:0.7.3:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "name": "ms", + "purl": "pkg:npm/ms@0.7.3", + "type": "library", + "version": "0.7.3" + }, + { + "bom-ref": "pkg:negotiator@0.4.9", + "cpe": "cpe:2.3:a:negotiator_project:negotiator:0.4.9:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "name": "negotiator", + "purl": "pkg:npm/negotiator@0.4.9", + "type": "library", + "version": "0.4.9" + }, + { + "bom-ref": "pkg:negotiator@0.5.3", + "cpe": "cpe:2.3:a:negotiator_project:negotiator:0.5.3:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "name": "negotiator", + "purl": "pkg:npm/negotiator@0.5.3", + "type": "library", + "version": "0.5.3" + }, + { + "bom-ref": "pkg:path-parse@1.0.5", + "cpe": "cpe:2.3:a:path-parse_project:path-parse:1.0.5:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "name": "path-parse", + "purl": "pkg:npm/path-parse@1.0.5", + "type": "library", + "version": "1.0.5" + }, + { + "bom-ref": "pkg:qs@2.2.4", + "cpe": "cpe:2.3:a:qs_project:qs:2.2.4:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "BSD-3-Clause" + } + } + ], + "name": "qs", + "purl": "pkg:npm/qs@2.2.4", + "type": "library", + "version": "2.2.4" + }, + { + "bom-ref": "pkg:qs@2.4.2", + "cpe": "cpe:2.3:a:qs_project:qs:2.4.2:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "BSD-3-Clause" + } + } + ], + "name": "qs", + "purl": "pkg:npm/qs@2.4.2", + "type": "library", + "version": "2.4.2" + }, + { + "bom-ref": "pkg:semver@1.1.4", + "cpe": "cpe:2.3:a:npmjs:semver:1.1.4:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "name": "semver", + "purl": "pkg:npm/semver@1.1.4", + "type": "library", + "version": "1.1.4" + }, + { + "bom-ref": "pkg:semver@5.5.0", + "cpe": "cpe:2.3:a:npmjs:semver:5.5.0:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "ISC" + } + } + ], + "name": "semver", + "purl": "pkg:npm/semver@5.5.0", + "type": "library", + "version": "5.5.0" + }, + { + "bom-ref": "pkg:semver@7.0.0", + "cpe": "cpe:2.3:a:npmjs:semver:7.0.0:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "ISC" + } + } + ], + "name": "semver", + "purl": "pkg:npm/semver@7.0.0", + "type": "library", + "version": "7.0.0" + }, + { + "bom-ref": "pkg:set-value@0.4.3", + "cpe": "cpe:2.3:a:set-value_project:set-value:0.4.3:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "name": "set-value", + "purl": "pkg:npm/set-value@0.4.3", + "type": "library", + "version": "0.4.3" + }, + { + "bom-ref": "pkg:set-value@2.0.0", + "cpe": "cpe:2.3:a:set-value_project:set-value:2.0.0:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "MIT" + } + } + ], + "name": "set-value", + "purl": "pkg:npm/set-value@2.0.0", + "type": "library", + "version": "2.0.0" + }, + { + "bom-ref": "pkg:st@0.2.4", + "cpe": "cpe:2.3:a:st_project:st:0.2.4:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "BSD-3-Clause" + } + } + ], + "name": "st", + "purl": "pkg:npm/st@0.2.4", + "type": "library", + "version": "0.2.4" + }, + { + "bom-ref": "pkg:tough-cookie@2.5.0", + "cpe": "cpe:2.3:a:salesforce:tough-cookie:2.5.0:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "BSD-3-Clause" + } + } + ], + "name": "tough-cookie", + "purl": "pkg:npm/tough-cookie@2.5.0", + "type": "library", + "version": "2.5.0" + }, + { + "bom-ref": "pkg:y18n@3.2.1", + "cpe": "cpe:2.3:a:y18n_project:y18n:3.2.1:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "ISC" + } + } + ], + "name": "y18n", + "purl": "pkg:npm/y18n@3.2.1", + "type": "library", + "version": "3.2.1" + }, + { + "bom-ref": "pkg:yargs-parser@8.1.0", + "cpe": "cpe:2.3:a:yargs:yargs-parser:8.1.0:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "ISC" + } + } + ], + "name": "yargs-parser", + "purl": "pkg:npm/yargs-parser@8.1.0", + "type": "library", + "version": "8.1.0" + }, + { + "bom-ref": "pkg:yargs-parser@9.0.2", + "cpe": "cpe:2.3:a:yargs:yargs-parser:9.0.2:*:*:*:*:node.js:*:*", + "licenses": [ + { + "license": { + "id": "ISC" + } + } + ], + "name": "yargs-parser", + "purl": "pkg:npm/yargs-parser@9.0.2", + "type": "library", + "version": "9.0.2" + } + ], + "dependencies": [ + { + "ref": "pkg:adm-zip@0.4.7" + }, + { + "ref": "pkg:ansi-regex@3.0.0" + }, + { + "ref": "pkg:bootstrap@3.0.0" + }, + { + "ref": "pkg:bson@0.4.23" + }, + { + "ref": "pkg:debug@2.2.0" + }, + { + "ref": "pkg:decode-uri-component@0.2.0" + }, + { + "ref": "pkg:express@4.12.4" + }, + { + "ref": "pkg:file-type@8.1.0" + }, + { + "ref": "pkg:fresh@0.2.4" + }, + { + "ref": "pkg:handlebars@4.0.11" + }, + { + "ref": "pkg:ini@1.1.0" + }, + { + "ref": "pkg:jquery@2.2.4" + }, + { + "ref": "pkg:kerberos@0.0.24" + }, + { + "ref": "pkg:lodash@4.17.10" + }, + { + "ref": "pkg:lodash@4.17.4" + }, + { + "ref": "pkg:marked@0.3.5" + }, + { + "ref": "pkg:mime@1.2.11" + }, + { + "ref": "pkg:mime@1.3.4" + }, + { + "ref": "pkg:minimatch@3.0.4" + }, + { + "ref": "pkg:minimist@0.0.8" + }, + { + "ref": "pkg:mixin-deep@1.3.1" + }, + { + "ref": "pkg:moment@2.15.1" + }, + { + "ref": "pkg:mongoose@4.2.4" + }, + { + "ref": "pkg:mpath@0.1.1" + }, + { + "ref": "pkg:mquery@1.6.3" + }, + { + "ref": "pkg:ms@0.6.2" + }, + { + "ref": "pkg:ms@0.7.1" + }, + { + "ref": "pkg:ms@0.7.3" + }, + { + "ref": "pkg:negotiator@0.4.9" + }, + { + "ref": "pkg:negotiator@0.5.3" + }, + { + "ref": "pkg:path-parse@1.0.5" + }, + { + "ref": "pkg:qs@2.2.4" + }, + { + "ref": "pkg:qs@2.4.2" + }, + { + "ref": "pkg:semver@1.1.4" + }, + { + "ref": "pkg:semver@5.5.0" + }, + { + "ref": "pkg:semver@7.0.0" + }, + { + "ref": "pkg:set-value@0.4.3" + }, + { + "ref": "pkg:set-value@2.0.0" + }, + { + "ref": "pkg:st@0.2.4" + }, + { + "ref": "pkg:tough-cookie@2.5.0" + }, + { + "ref": "pkg:y18n@3.2.1" + }, + { + "ref": "pkg:yargs-parser@8.1.0" + }, + { + "ref": "pkg:yargs-parser@9.0.2" + } + ], + "metadata": { + "timestamp": "2025-07-07T21:39:23.526496+00:00" + }, + "properties": [ + { + "name": "cisa_kev_enrichment", + "value": "True" + }, + { + "name": "cyclonedx_generator_version", + "value": "2.0" + }, + { + "name": "epss_enrichment", + "value": "True" + }, + { + "name": "generation_method", + "value": "api_powered" + }, + { + "name": "generation_timestamp", + "value": "2025-07-07T21:39:23.554241Z" + }, + { + "name": "nvd_enrichment", + "value": "False" + }, + { + "name": "vulnerability_count", + "value": "75" + }, + { + "name": "workbench_scan_code", + "value": "fossid-ab/js-sample-demo/main" + } + ], + "serialNumber": "urn:uuid:e5f2b8b1-6e52-4acb-9d0c-d7b1a311fe00", + "version": 1, + "vulnerabilities": [ + { + "affects": [ + { + "ref": "pkg:jquery@2.2.4" + } + ], + "bom-ref": "vuln-CVE-2015-9251-jquery-2.2.4", + "description": "Security vulnerability affecting jquery version 2.2.4", + "id": "CVE-2015-9251", + "properties": [ + { + "name": "epss_percentile", + "value": "0.92601" + }, + { + "name": "epss_score", + "value": "0.09842" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "6.1", + "severity": "medium" + }, + { + "method": "other", + "score": "0.1", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:marked@0.3.5" + } + ], + "bom-ref": "vuln-CVE-2016-10531-marked-0.3.5", + "description": "Security vulnerability affecting marked version 0.3.5", + "id": "CVE-2016-10531", + "properties": [ + { + "name": "epss_percentile", + "value": "0.51982" + }, + { + "name": "epss_score", + "value": "0.00289" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "6.1", + "severity": "medium" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:negotiator@0.4.9" + } + ], + "bom-ref": "vuln-CVE-2016-10539-negotiator-0.4.9", + "description": "Security vulnerability affecting negotiator version 0.4.9", + "id": "CVE-2016-10539", + "properties": [ + { + "name": "epss_percentile", + "value": "0.55067" + }, + { + "name": "epss_score", + "value": "0.00328" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "7.5", + "severity": "high" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:negotiator@0.5.3" + } + ], + "bom-ref": "vuln-CVE-2016-10539-negotiator-0.5.3", + "description": "Security vulnerability affecting negotiator version 0.5.3", + "id": "CVE-2016-10539", + "properties": [ + { + "name": "epss_percentile", + "value": "0.55067" + }, + { + "name": "epss_score", + "value": "0.00328" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "7.5", + "severity": "high" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:bootstrap@3.0.0" + } + ], + "bom-ref": "vuln-CVE-2016-10735-bootstrap-3.0.0", + "description": "Security vulnerability affecting bootstrap version 3.0.0", + "id": "CVE-2016-10735", + "properties": [ + { + "name": "epss_percentile", + "value": "0.90357" + }, + { + "name": "epss_score", + "value": "0.06152" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "6.1", + "severity": "medium" + }, + { + "method": "other", + "score": "0.1", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:marked@0.3.5" + } + ], + "bom-ref": "vuln-CVE-2017-1000427-marked-0.3.5", + "description": "Security vulnerability affecting marked version 0.3.5", + "id": "CVE-2017-1000427", + "properties": [ + { + "name": "epss_percentile", + "value": "0.5911" + }, + { + "name": "epss_score", + "value": "0.00388" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "6.1", + "severity": "medium" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:marked@0.3.5" + } + ], + "bom-ref": "vuln-CVE-2017-16114-marked-0.3.5", + "description": "Security vulnerability affecting marked version 0.3.5", + "id": "CVE-2017-16114", + "properties": [ + { + "name": "epss_percentile", + "value": "0.5056" + }, + { + "name": "epss_score", + "value": "0.00274" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "7.5", + "severity": "high" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:fresh@0.2.4" + } + ], + "bom-ref": "vuln-CVE-2017-16119-fresh-0.2.4", + "description": "Security vulnerability affecting fresh version 0.2.4", + "id": "CVE-2017-16119", + "properties": [ + { + "name": "epss_percentile", + "value": "0.55067" + }, + { + "name": "epss_score", + "value": "0.00328" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "7.5", + "severity": "high" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:debug@2.2.0" + } + ], + "bom-ref": "vuln-CVE-2017-16137-debug-2.2.0", + "description": "Security vulnerability affecting debug version 2.2.0", + "id": "CVE-2017-16137", + "properties": [ + { + "name": "epss_percentile", + "value": "0.27897" + }, + { + "name": "epss_score", + "value": "0.00097" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "5.3", + "severity": "medium" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:mime@1.2.11" + } + ], + "bom-ref": "vuln-CVE-2017-16138-mime-1.2.11", + "description": "Security vulnerability affecting mime version 1.2.11", + "id": "CVE-2017-16138", + "properties": [ + { + "name": "epss_percentile", + "value": "0.61858" + }, + { + "name": "epss_score", + "value": "0.00433" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "7.5", + "severity": "high" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:mime@1.3.4" + } + ], + "bom-ref": "vuln-CVE-2017-16138-mime-1.3.4", + "description": "Security vulnerability affecting mime version 1.3.4", + "id": "CVE-2017-16138", + "properties": [ + { + "name": "epss_percentile", + "value": "0.61858" + }, + { + "name": "epss_score", + "value": "0.00433" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "7.5", + "severity": "high" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:st@0.2.4" + } + ], + "bom-ref": "vuln-CVE-2017-16224-st-0.2.4", + "description": "Security vulnerability affecting st version 0.2.4", + "id": "CVE-2017-16224", + "properties": [ + { + "name": "epss_percentile", + "value": "0.44195" + }, + { + "name": "epss_score", + "value": "0.00215" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "6.1", + "severity": "medium" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:moment@2.15.1" + } + ], + "bom-ref": "vuln-CVE-2017-18214-moment-2.15.1", + "description": "Security vulnerability affecting moment version 2.15.1", + "id": "CVE-2017-18214", + "properties": [ + { + "name": "epss_percentile", + "value": "0.54664" + }, + { + "name": "epss_score", + "value": "0.00322" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "7.5", + "severity": "high" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:ms@0.6.2" + } + ], + "bom-ref": "vuln-CVE-2017-20162-ms-0.6.2", + "description": "Security vulnerability affecting ms version 0.6.2", + "id": "CVE-2017-20162", + "properties": [ + { + "name": "epss_percentile", + "value": "0.13977" + }, + { + "name": "epss_score", + "value": "0.00046" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "5.3", + "severity": "medium" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:ms@0.7.1" + } + ], + "bom-ref": "vuln-CVE-2017-20162-ms-0.7.1", + "description": "Security vulnerability affecting ms version 0.7.1", + "id": "CVE-2017-20162", + "properties": [ + { + "name": "epss_percentile", + "value": "0.13977" + }, + { + "name": "epss_score", + "value": "0.00046" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "5.3", + "severity": "medium" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:ms@0.7.3" + } + ], + "bom-ref": "vuln-CVE-2017-20162-ms-0.7.3", + "description": "Security vulnerability affecting ms version 0.7.3", + "id": "CVE-2017-20162", + "properties": [ + { + "name": "epss_percentile", + "value": "0.13977" + }, + { + "name": "epss_score", + "value": "0.00046" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "5.3", + "severity": "medium" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:debug@2.2.0" + } + ], + "bom-ref": "vuln-CVE-2017-20165-debug-2.2.0", + "description": "Security vulnerability affecting debug version 2.2.0", + "id": "CVE-2017-20165", + "properties": [ + { + "name": "epss_percentile", + "value": "0.77715" + }, + { + "name": "epss_score", + "value": "0.0117" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "7.5", + "severity": "high" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:adm-zip@0.4.7" + } + ], + "bom-ref": "vuln-CVE-2018-1002204-adm-zip-0.4.7", + "description": "Security vulnerability affecting adm-zip version 0.4.7", + "id": "CVE-2018-1002204", + "properties": [ + { + "name": "epss_percentile", + "value": "0.94292" + }, + { + "name": "epss_score", + "value": "0.15291" + }, + { + "name": "high_risk_evidence", + "value": "High EPSS score: 0.153" + }, + { + "name": "high_risk_indicator", + "value": "Yes" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "5.5", + "severity": "medium" + }, + { + "method": "other", + "score": "0.2", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:bootstrap@3.0.0" + } + ], + "bom-ref": "vuln-CVE-2018-14040-bootstrap-3.0.0", + "description": "Security vulnerability affecting bootstrap version 3.0.0", + "id": "CVE-2018-14040", + "properties": [ + { + "name": "epss_percentile", + "value": "0.81076" + }, + { + "name": "epss_score", + "value": "0.01633" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "6.1", + "severity": "medium" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:bootstrap@3.0.0" + } + ], + "bom-ref": "vuln-CVE-2018-14042-bootstrap-3.0.0", + "description": "Security vulnerability affecting bootstrap version 3.0.0", + "id": "CVE-2018-14042", + "properties": [ + { + "name": "epss_percentile", + "value": "0.8146" + }, + { + "name": "epss_score", + "value": "0.017" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "6.1", + "severity": "medium" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:lodash@4.17.10" + } + ], + "bom-ref": "vuln-CVE-2018-16487-lodash-4.17.10", + "description": "Security vulnerability affecting lodash version 4.17.10", + "id": "CVE-2018-16487", + "properties": [ + { + "name": "epss_percentile", + "value": "0.58123" + }, + { + "name": "epss_score", + "value": "0.00371" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "5.6", + "severity": "medium" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:lodash@4.17.4" + } + ], + "bom-ref": "vuln-CVE-2018-16487-lodash-4.17.4", + "description": "Security vulnerability affecting lodash version 4.17.4", + "id": "CVE-2018-16487", + "properties": [ + { + "name": "epss_percentile", + "value": "0.58123" + }, + { + "name": "epss_score", + "value": "0.00371" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "5.6", + "severity": "medium" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:mpath@0.1.1" + } + ], + "bom-ref": "vuln-CVE-2018-16490-mpath-0.1.1", + "description": "Security vulnerability affecting mpath version 0.1.1", + "id": "CVE-2018-16490", + "properties": [ + { + "name": "epss_percentile", + "value": "0.40833" + }, + { + "name": "epss_score", + "value": "0.00186" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "7.5", + "severity": "high" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:bootstrap@3.0.0" + } + ], + "bom-ref": "vuln-CVE-2018-20676-bootstrap-3.0.0", + "description": "Security vulnerability affecting bootstrap version 3.0.0", + "id": "CVE-2018-20676", + "properties": [ + { + "name": "epss_percentile", + "value": "0.9044" + }, + { + "name": "epss_score", + "value": "0.06255" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "6.1", + "severity": "medium" + }, + { + "method": "other", + "score": "0.1", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:bootstrap@3.0.0" + } + ], + "bom-ref": "vuln-CVE-2018-20677-bootstrap-3.0.0", + "description": "Security vulnerability affecting bootstrap version 3.0.0", + "id": "CVE-2018-20677", + "properties": [ + { + "name": "epss_percentile", + "value": "0.94181" + }, + { + "name": "epss_score", + "value": "0.14795" + }, + { + "name": "high_risk_evidence", + "value": "High EPSS score: 0.148" + }, + { + "name": "high_risk_indicator", + "value": "Yes" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "6.1", + "severity": "medium" + }, + { + "method": "other", + "score": "0.1", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:lodash@4.17.4" + } + ], + "bom-ref": "vuln-CVE-2018-3721-lodash-4.17.4", + "description": "Security vulnerability affecting lodash version 4.17.4", + "id": "CVE-2018-3721", + "properties": [ + { + "name": "epss_percentile", + "value": "0.40936" + }, + { + "name": "epss_score", + "value": "0.00187" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "6.5", + "severity": "medium" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:lodash@4.17.10" + } + ], + "bom-ref": "vuln-CVE-2019-1010266-lodash-4.17.10", + "description": "Security vulnerability affecting lodash version 4.17.10", + "id": "CVE-2019-1010266", + "properties": [ + { + "name": "epss_percentile", + "value": "0.42018" + }, + { + "name": "epss_score", + "value": "0.00196" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "6.5", + "severity": "medium" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:lodash@4.17.4" + } + ], + "bom-ref": "vuln-CVE-2019-1010266-lodash-4.17.4", + "description": "Security vulnerability affecting lodash version 4.17.4", + "id": "CVE-2019-1010266", + "properties": [ + { + "name": "epss_percentile", + "value": "0.42018" + }, + { + "name": "epss_score", + "value": "0.00196" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "6.5", + "severity": "medium" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:lodash@4.17.10" + } + ], + "bom-ref": "vuln-CVE-2019-10744-lodash-4.17.10", + "description": "Security vulnerability affecting lodash version 4.17.10", + "id": "CVE-2019-10744", + "properties": [ + { + "name": "epss_percentile", + "value": "0.8691" + }, + { + "name": "epss_score", + "value": "0.0341" + }, + { + "name": "high_risk_evidence", + "value": "Critical CVSS severity" + }, + { + "name": "high_risk_indicator", + "value": "Yes" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "9.1", + "severity": "critical" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:lodash@4.17.4" + } + ], + "bom-ref": "vuln-CVE-2019-10744-lodash-4.17.4", + "description": "Security vulnerability affecting lodash version 4.17.4", + "id": "CVE-2019-10744", + "properties": [ + { + "name": "epss_percentile", + "value": "0.8691" + }, + { + "name": "epss_score", + "value": "0.0341" + }, + { + "name": "high_risk_evidence", + "value": "Critical CVSS severity" + }, + { + "name": "high_risk_indicator", + "value": "Yes" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "9.1", + "severity": "critical" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:mixin-deep@1.3.1" + } + ], + "analysis": { + "justification": "requires_configuration", + "state": "not_affected" + }, + "bom-ref": "vuln-CVE-2019-10746-mixin-deep-1.3.1", + "description": "Security vulnerability affecting mixin-deep version 1.3.1", + "id": "CVE-2019-10746", + "properties": [ + { + "name": "epss_percentile", + "value": "0.64991" + }, + { + "name": "epss_score", + "value": "0.00502" + }, + { + "name": "high_risk_evidence", + "value": "VEX suppressed: not_affected" + }, + { + "name": "high_risk_indicator", + "value": "No" + }, + { + "name": "vex_analysis_created", + "value": "2025-07-06 22:48:05" + }, + { + "name": "vex_analysis_created_by", + "value": "tomas.gonzalez@fossid.com" + }, + { + "name": "vex_analysis_updated", + "value": "2025-07-07 00:48:15" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "9.8", + "severity": "critical" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:set-value@0.4.3" + } + ], + "analysis": { + "detail": "more control context", + "justification": "protected_by_mitigating_control", + "response": [ + "workaround_available" + ], + "state": "resolved" + }, + "bom-ref": "vuln-CVE-2019-10747-set-value-0.4.3", + "description": "Security vulnerability affecting set-value version 0.4.3", + "id": "CVE-2019-10747", + "properties": [ + { + "name": "epss_percentile", + "value": "0.40599" + }, + { + "name": "epss_score", + "value": "0.00184" + }, + { + "name": "high_risk_evidence", + "value": "VEX suppressed: resolved" + }, + { + "name": "high_risk_indicator", + "value": "No" + }, + { + "name": "vex_analysis_created", + "value": "2025-07-06 22:47:29" + }, + { + "name": "vex_analysis_created_by", + "value": "tomas.gonzalez@fossid.com" + }, + { + "name": "vex_analysis_updated", + "value": "2025-07-07 00:47:50" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "9.8", + "severity": "critical" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:set-value@2.0.0" + } + ], + "analysis": { + "response": [ + "will_not_fix" + ], + "state": "false_positive" + }, + "bom-ref": "vuln-CVE-2019-10747-set-value-2.0.0", + "description": "Security vulnerability affecting set-value version 2.0.0", + "id": "CVE-2019-10747", + "properties": [ + { + "name": "epss_percentile", + "value": "0.40599" + }, + { + "name": "epss_score", + "value": "0.00184" + }, + { + "name": "high_risk_evidence", + "value": "VEX suppressed: false_positive" + }, + { + "name": "high_risk_indicator", + "value": "No" + }, + { + "name": "vex_analysis_created", + "value": "2025-07-06 22:46:35" + }, + { + "name": "vex_analysis_created_by", + "value": "tomas.gonzalez@fossid.com" + }, + { + "name": "vex_analysis_updated", + "value": "2025-07-07 00:46:56" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "9.8", + "severity": "critical" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:jquery@2.2.4" + } + ], + "bom-ref": "vuln-CVE-2019-11358-jquery-2.2.4", + "description": "Security vulnerability affecting jquery version 2.2.4", + "id": "CVE-2019-11358", + "properties": [ + { + "name": "epss_percentile", + "value": "0.85602" + }, + { + "name": "epss_score", + "value": "0.0284" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "6.1", + "severity": "medium" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:mongoose@4.2.4" + } + ], + "bom-ref": "vuln-CVE-2019-17426-mongoose-4.2.4", + "description": "Security vulnerability affecting mongoose version 4.2.4", + "id": "CVE-2019-17426", + "properties": [ + { + "name": "epss_percentile", + "value": "0.46763" + }, + { + "name": "epss_score", + "value": "0.00237" + }, + { + "name": "high_risk_evidence", + "value": "Critical CVSS severity" + }, + { + "name": "high_risk_indicator", + "value": "Yes" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "9.1", + "severity": "critical" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:handlebars@4.0.11" + } + ], + "analysis": { + "justification": "code_not_present", + "state": "false_positive" + }, + "bom-ref": "vuln-CVE-2019-19919-handlebars-4.0.11", + "description": "Security vulnerability affecting handlebars version 4.0.11", + "id": "CVE-2019-19919", + "properties": [ + { + "name": "epss_percentile", + "value": "0.94487" + }, + { + "name": "epss_score", + "value": "0.16106" + }, + { + "name": "high_risk_evidence", + "value": "VEX suppressed: false_positive" + }, + { + "name": "high_risk_indicator", + "value": "No" + }, + { + "name": "vex_analysis_created", + "value": "2025-07-06 22:48:17" + }, + { + "name": "vex_analysis_created_by", + "value": "tomas.gonzalez@fossid.com" + }, + { + "name": "vex_analysis_updated", + "value": "2025-07-07 00:48:22" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "9.8", + "severity": "critical" + }, + { + "method": "other", + "score": "0.2", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:bson@0.4.23" + } + ], + "bom-ref": "vuln-CVE-2019-2391-bson-0.4.23", + "description": "Security vulnerability affecting bson version 0.4.23", + "id": "CVE-2019-2391", + "properties": [ + { + "name": "epss_percentile", + "value": "0.58626" + }, + { + "name": "epss_score", + "value": "0.00379" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "5.4", + "severity": "medium" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:bootstrap@3.0.0" + } + ], + "bom-ref": "vuln-CVE-2019-8331-bootstrap-3.0.0", + "description": "Security vulnerability affecting bootstrap version 3.0.0", + "id": "CVE-2019-8331", + "properties": [ + { + "name": "epss_percentile", + "value": "0.84006" + }, + { + "name": "epss_score", + "value": "0.02292" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "6.1", + "severity": "medium" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:jquery@2.2.4" + } + ], + "bom-ref": "vuln-CVE-2020-11022-jquery-2.2.4", + "description": "Security vulnerability affecting jquery version 2.2.4", + "id": "CVE-2020-11022", + "properties": [ + { + "name": "epss_percentile", + "value": "0.85075" + }, + { + "name": "epss_score", + "value": "0.02636" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "6.1", + "severity": "medium" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:jquery@2.2.4" + } + ], + "analysis": { + "state": "exploitable" + }, + "bom-ref": "vuln-CVE-2020-11023-jquery-2.2.4", + "description": "Security vulnerability affecting jquery version 2.2.4", + "id": "CVE-2020-11023", + "properties": [ + { + "name": "cisa_known_exploited", + "value": "true" + }, + { + "name": "epss_percentile", + "value": "0.95402" + }, + { + "name": "epss_score", + "value": "0.21392" + }, + { + "name": "high_risk_evidence", + "value": "CISA Known Exploited Vulnerability; High EPSS score: 0.214" + }, + { + "name": "high_risk_indicator", + "value": "Yes" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "6.1", + "severity": "medium" + }, + { + "method": "other", + "score": "0.2", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:kerberos@0.0.24" + } + ], + "bom-ref": "vuln-CVE-2020-13110-kerberos-0.0.24", + "description": "Security vulnerability affecting kerberos version 0.0.24", + "id": "CVE-2020-13110", + "properties": [ + { + "name": "epss_percentile", + "value": "0.21358" + }, + { + "name": "epss_score", + "value": "0.00068" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "7.8", + "severity": "high" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:lodash@4.17.10" + } + ], + "bom-ref": "vuln-CVE-2020-28500-lodash-4.17.10", + "description": "Security vulnerability affecting lodash version 4.17.10", + "id": "CVE-2020-28500", + "properties": [ + { + "name": "epss_percentile", + "value": "0.50618" + }, + { + "name": "epss_score", + "value": "0.00275" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "5.3", + "severity": "medium" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:lodash@4.17.4" + } + ], + "bom-ref": "vuln-CVE-2020-28500-lodash-4.17.4", + "description": "Security vulnerability affecting lodash version 4.17.4", + "id": "CVE-2020-28500", + "properties": [ + { + "name": "epss_percentile", + "value": "0.50618" + }, + { + "name": "epss_score", + "value": "0.00275" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "5.3", + "severity": "medium" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:mquery@1.6.3" + } + ], + "bom-ref": "vuln-CVE-2020-35149-mquery-1.6.3", + "description": "Security vulnerability affecting mquery version 1.6.3", + "id": "CVE-2020-35149", + "properties": [ + { + "name": "epss_percentile", + "value": "0.491" + }, + { + "name": "epss_score", + "value": "0.00259" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "5.3", + "severity": "medium" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:minimist@0.0.8" + } + ], + "bom-ref": "vuln-CVE-2020-7598-minimist-0.0.8", + "description": "Security vulnerability affecting minimist version 0.0.8", + "id": "CVE-2020-7598", + "properties": [ + { + "name": "epss_percentile", + "value": "0.48511" + }, + { + "name": "epss_score", + "value": "0.00253" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "5.6", + "severity": "medium" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:yargs-parser@8.1.0" + } + ], + "bom-ref": "vuln-CVE-2020-7608-yargs-parser-8.1.0", + "description": "Security vulnerability affecting yargs-parser version 8.1.0", + "id": "CVE-2020-7608", + "properties": [ + { + "name": "epss_percentile", + "value": "0.30306" + }, + { + "name": "epss_score", + "value": "0.0011" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "5.3", + "severity": "medium" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:yargs-parser@9.0.2" + } + ], + "bom-ref": "vuln-CVE-2020-7608-yargs-parser-9.0.2", + "description": "Security vulnerability affecting yargs-parser version 9.0.2", + "id": "CVE-2020-7608", + "properties": [ + { + "name": "epss_percentile", + "value": "0.30306" + }, + { + "name": "epss_score", + "value": "0.0011" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "5.3", + "severity": "medium" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:y18n@3.2.1" + } + ], + "analysis": { + "justification": "protected_at_runtime", + "state": "resolved_with_pedigree" + }, + "bom-ref": "vuln-CVE-2020-7774-y18n-3.2.1", + "description": "Security vulnerability affecting y18n version 3.2.1", + "id": "CVE-2020-7774", + "properties": [ + { + "name": "epss_percentile", + "value": "0.70533" + }, + { + "name": "epss_score", + "value": "0.00676" + }, + { + "name": "high_risk_evidence", + "value": "VEX suppressed: resolved_with_pedigree" + }, + { + "name": "high_risk_indicator", + "value": "No" + }, + { + "name": "vex_analysis_created", + "value": "2025-07-06 22:46:29" + }, + { + "name": "vex_analysis_created_by", + "value": "tomas.gonzalez@fossid.com" + }, + { + "name": "vex_analysis_updated", + "value": "2025-07-07 00:47:20" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "9.8", + "severity": "critical" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:ini@1.1.0" + } + ], + "analysis": { + "detail": "more workaround info", + "response": [ + "workaround_available" + ], + "state": "resolved" + }, + "bom-ref": "vuln-CVE-2020-7788-ini-1.1.0", + "description": "Security vulnerability affecting ini version 1.1.0", + "id": "CVE-2020-7788", + "properties": [ + { + "name": "epss_percentile", + "value": "0.52102" + }, + { + "name": "epss_score", + "value": "0.00291" + }, + { + "name": "high_risk_evidence", + "value": "VEX suppressed: resolved" + }, + { + "name": "high_risk_indicator", + "value": "No" + }, + { + "name": "vex_analysis_created", + "value": "2025-07-06 22:48:24" + }, + { + "name": "vex_analysis_created_by", + "value": "tomas.gonzalez@fossid.com" + }, + { + "name": "vex_analysis_updated", + "value": "2025-07-07 00:48:40" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "9.8", + "severity": "critical" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:lodash@4.17.10" + } + ], + "bom-ref": "vuln-CVE-2020-8203-lodash-4.17.10", + "description": "Security vulnerability affecting lodash version 4.17.10", + "id": "CVE-2020-8203", + "properties": [ + { + "name": "epss_percentile", + "value": "0.86626" + }, + { + "name": "epss_score", + "value": "0.03276" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "7.4", + "severity": "high" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:lodash@4.17.4" + } + ], + "bom-ref": "vuln-CVE-2020-8203-lodash-4.17.4", + "description": "Security vulnerability affecting lodash version 4.17.4", + "id": "CVE-2020-8203", + "properties": [ + { + "name": "epss_percentile", + "value": "0.86626" + }, + { + "name": "epss_score", + "value": "0.03276" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "7.4", + "severity": "high" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:lodash@4.17.10" + } + ], + "bom-ref": "vuln-CVE-2021-23337-lodash-4.17.10", + "description": "Security vulnerability affecting lodash version 4.17.10", + "id": "CVE-2021-23337", + "properties": [ + { + "name": "epss_percentile", + "value": "0.74033" + }, + { + "name": "epss_score", + "value": "0.00859" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "7.2", + "severity": "high" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:lodash@4.17.4" + } + ], + "bom-ref": "vuln-CVE-2021-23337-lodash-4.17.4", + "description": "Security vulnerability affecting lodash version 4.17.4", + "id": "CVE-2021-23337", + "properties": [ + { + "name": "epss_percentile", + "value": "0.74033" + }, + { + "name": "epss_score", + "value": "0.00859" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "7.2", + "severity": "high" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:path-parse@1.0.5" + } + ], + "bom-ref": "vuln-CVE-2021-23343-path-parse-1.0.5", + "description": "Security vulnerability affecting path-parse version 1.0.5", + "id": "CVE-2021-23343", + "properties": [ + { + "name": "epss_percentile", + "value": "0.65253" + }, + { + "name": "epss_score", + "value": "0.00506" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "7.5", + "severity": "high" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:mpath@0.1.1" + } + ], + "analysis": { + "response": [ + "can_not_fix" + ], + "state": "exploitable" + }, + "bom-ref": "vuln-CVE-2021-23438-mpath-0.1.1", + "description": "Security vulnerability affecting mpath version 0.1.1", + "id": "CVE-2021-23438", + "properties": [ + { + "name": "epss_percentile", + "value": "0.3703" + }, + { + "name": "epss_score", + "value": "0.00154" + }, + { + "name": "high_risk_evidence", + "value": "VEX assessment: exploitable; VEX response: unfixable (can_not_fix)" + }, + { + "name": "high_risk_indicator", + "value": "Yes" + }, + { + "name": "vex_analysis_created", + "value": "2025-07-06 22:47:56" + }, + { + "name": "vex_analysis_created_by", + "value": "tomas.gonzalez@fossid.com" + }, + { + "name": "vex_analysis_updated", + "value": "2025-07-07 00:48:02" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "9.8", + "severity": "critical" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:set-value@0.4.3" + } + ], + "analysis": { + "justification": "code_not_reachable", + "response": [ + "will_not_fix" + ], + "state": "not_affected" + }, + "bom-ref": "vuln-CVE-2021-23440-set-value-0.4.3", + "description": "Security vulnerability affecting set-value version 0.4.3", + "id": "CVE-2021-23440", + "properties": [ + { + "name": "epss_percentile", + "value": "0.20352" + }, + { + "name": "epss_score", + "value": "0.00064" + }, + { + "name": "high_risk_evidence", + "value": "VEX suppressed: not_affected" + }, + { + "name": "high_risk_indicator", + "value": "No" + }, + { + "name": "vex_analysis_created", + "value": "2025-07-06 22:46:37" + }, + { + "name": "vex_analysis_created_by", + "value": "tomas.gonzalez@fossid.com" + }, + { + "name": "vex_analysis_updated", + "value": "2025-07-07 00:46:49" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "9.8", + "severity": "critical" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:set-value@2.0.0" + } + ], + "analysis": { + "state": "in_triage" + }, + "bom-ref": "vuln-CVE-2021-23440-set-value-2.0.0", + "description": "Security vulnerability affecting set-value version 2.0.0", + "id": "CVE-2021-23440", + "properties": [ + { + "name": "epss_percentile", + "value": "0.20352" + }, + { + "name": "epss_score", + "value": "0.00064" + }, + { + "name": "high_risk_evidence", + "value": "Critical CVSS severity" + }, + { + "name": "high_risk_indicator", + "value": "Yes" + }, + { + "name": "vex_analysis_created", + "value": "2025-07-06 22:46:33" + }, + { + "name": "vex_analysis_created_by", + "value": "tomas.gonzalez@fossid.com" + }, + { + "name": "vex_analysis_updated", + "value": "2025-07-07 00:46:33" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "9.8", + "severity": "critical" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:ansi-regex@3.0.0" + } + ], + "bom-ref": "vuln-CVE-2021-3807-ansi-regex-3.0.0", + "description": "Security vulnerability affecting ansi-regex version 3.0.0", + "id": "CVE-2021-3807", + "properties": [ + { + "name": "epss_percentile", + "value": "0.42313" + }, + { + "name": "epss_score", + "value": "0.00198" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "7.5", + "severity": "high" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:minimist@0.0.8" + } + ], + "analysis": { + "response": [ + "can_not_fix" + ], + "state": "exploitable" + }, + "bom-ref": "vuln-CVE-2021-44906-minimist-0.0.8", + "description": "Security vulnerability affecting minimist version 0.0.8", + "id": "CVE-2021-44906", + "properties": [ + { + "name": "epss_percentile", + "value": "0.77382" + }, + { + "name": "epss_score", + "value": "0.01134" + }, + { + "name": "high_risk_evidence", + "value": "VEX assessment: exploitable; VEX response: unfixable (can_not_fix)" + }, + { + "name": "high_risk_indicator", + "value": "Yes" + }, + { + "name": "vex_analysis_created", + "value": "2025-07-06 22:46:31" + }, + { + "name": "vex_analysis_created_by", + "value": "tomas.gonzalez@fossid.com" + }, + { + "name": "vex_analysis_updated", + "value": "2025-07-07 00:47:01" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "9.8", + "severity": "critical" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:marked@0.3.5" + } + ], + "bom-ref": "vuln-CVE-2022-21680-marked-0.3.5", + "description": "Security vulnerability affecting marked version 0.3.5", + "id": "CVE-2022-21680", + "properties": [ + { + "name": "epss_percentile", + "value": "0.63367" + }, + { + "name": "epss_score", + "value": "0.00464" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "7.5", + "severity": "high" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:marked@0.3.5" + } + ], + "bom-ref": "vuln-CVE-2022-21681-marked-0.3.5", + "description": "Security vulnerability affecting marked version 0.3.5", + "id": "CVE-2022-21681", + "properties": [ + { + "name": "epss_percentile", + "value": "0.63086" + }, + { + "name": "epss_score", + "value": "0.00458" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "7.5", + "severity": "high" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:moment@2.15.1" + } + ], + "bom-ref": "vuln-CVE-2022-24785-moment-2.15.1", + "description": "Security vulnerability affecting moment version 2.15.1", + "id": "CVE-2022-24785", + "properties": [ + { + "name": "epss_percentile", + "value": "0.66597" + }, + { + "name": "epss_score", + "value": "0.00539" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "7.5", + "severity": "high" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:express@4.12.4" + } + ], + "bom-ref": "vuln-CVE-2022-24999-express-4.12.4", + "description": "Security vulnerability affecting express version 4.12.4", + "id": "CVE-2022-24999", + "properties": [ + { + "name": "epss_percentile", + "value": "0.86243" + }, + { + "name": "epss_score", + "value": "0.03115" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "7.5", + "severity": "high" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:qs@2.2.4" + } + ], + "bom-ref": "vuln-CVE-2022-24999-qs-2.2.4", + "description": "Security vulnerability affecting qs version 2.2.4", + "id": "CVE-2022-24999", + "properties": [ + { + "name": "epss_percentile", + "value": "0.86243" + }, + { + "name": "epss_score", + "value": "0.03115" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "7.5", + "severity": "high" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:qs@2.4.2" + } + ], + "bom-ref": "vuln-CVE-2022-24999-qs-2.4.2", + "description": "Security vulnerability affecting qs version 2.4.2", + "id": "CVE-2022-24999", + "properties": [ + { + "name": "epss_percentile", + "value": "0.86243" + }, + { + "name": "epss_score", + "value": "0.03115" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "7.5", + "severity": "high" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:mongoose@4.2.4" + } + ], + "bom-ref": "vuln-CVE-2022-2564-mongoose-4.2.4", + "description": "Security vulnerability affecting mongoose version 4.2.4", + "id": "CVE-2022-2564", + "properties": [ + { + "name": "epss_percentile", + "value": "0.81702" + }, + { + "name": "epss_score", + "value": "0.01747" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "7.0", + "severity": "high" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:semver@1.1.4" + } + ], + "bom-ref": "vuln-CVE-2022-25883-semver-1.1.4", + "description": "Security vulnerability affecting semver version 1.1.4", + "id": "CVE-2022-25883", + "properties": [ + { + "name": "epss_percentile", + "value": "0.535" + }, + { + "name": "epss_score", + "value": "0.00308" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "7.5", + "severity": "high" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:semver@5.5.0" + } + ], + "bom-ref": "vuln-CVE-2022-25883-semver-5.5.0", + "description": "Security vulnerability affecting semver version 5.5.0", + "id": "CVE-2022-25883", + "properties": [ + { + "name": "epss_percentile", + "value": "0.535" + }, + { + "name": "epss_score", + "value": "0.00308" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "7.5", + "severity": "high" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:semver@7.0.0" + } + ], + "bom-ref": "vuln-CVE-2022-25883-semver-7.0.0", + "description": "Security vulnerability affecting semver version 7.0.0", + "id": "CVE-2022-25883", + "properties": [ + { + "name": "epss_percentile", + "value": "0.535" + }, + { + "name": "epss_score", + "value": "0.00308" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "7.5", + "severity": "high" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:minimatch@3.0.4" + } + ], + "bom-ref": "vuln-CVE-2022-3517-minimatch-3.0.4", + "description": "Security vulnerability affecting minimatch version 3.0.4", + "id": "CVE-2022-3517", + "properties": [ + { + "name": "epss_percentile", + "value": "0.61816" + }, + { + "name": "epss_score", + "value": "0.00432" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "7.5", + "severity": "high" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:file-type@8.1.0" + } + ], + "bom-ref": "vuln-CVE-2022-36313-file-type-8.1.0", + "description": "Security vulnerability affecting file-type version 8.1.0", + "id": "CVE-2022-36313", + "properties": [ + { + "name": "epss_percentile", + "value": "0.2683" + }, + { + "name": "epss_score", + "value": "0.00091" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "5.5", + "severity": "medium" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:decode-uri-component@0.2.0" + } + ], + "bom-ref": "vuln-CVE-2022-38778-decode-uri-component-0.2.0", + "description": "Security vulnerability affecting decode-uri-component version 0.2.0", + "id": "CVE-2022-38778", + "properties": [ + { + "name": "epss_percentile", + "value": "0.71815" + }, + { + "name": "epss_score", + "value": "0.00734" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "6.5", + "severity": "medium" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:tough-cookie@2.5.0" + } + ], + "analysis": { + "response": [ + "can_not_fix" + ], + "state": "exploitable" + }, + "bom-ref": "vuln-CVE-2023-26136-tough-cookie-2.5.0", + "description": "Security vulnerability affecting tough-cookie version 2.5.0", + "id": "CVE-2023-26136", + "properties": [ + { + "name": "epss_percentile", + "value": "0.89437" + }, + { + "name": "epss_score", + "value": "0.05191" + }, + { + "name": "high_risk_evidence", + "value": "VEX assessment: exploitable; VEX response: unfixable (can_not_fix)" + }, + { + "name": "high_risk_indicator", + "value": "Yes" + }, + { + "name": "vex_analysis_created", + "value": "2025-07-06 22:47:54" + }, + { + "name": "vex_analysis_created_by", + "value": "tomas.gonzalez@fossid.com" + }, + { + "name": "vex_analysis_updated", + "value": "2025-07-07 00:48:00" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "9.8", + "severity": "critical" + }, + { + "method": "other", + "score": "0.1", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:mongoose@4.2.4" + } + ], + "analysis": { + "response": [ + "update" + ], + "state": "resolved" + }, + "bom-ref": "vuln-CVE-2023-3696-mongoose-4.2.4", + "description": "Security vulnerability affecting mongoose version 4.2.4", + "id": "CVE-2023-3696", + "properties": [ + { + "name": "epss_percentile", + "value": "0.42751" + }, + { + "name": "epss_score", + "value": "0.00202" + }, + { + "name": "high_risk_evidence", + "value": "VEX suppressed: resolved" + }, + { + "name": "high_risk_indicator", + "value": "No" + }, + { + "name": "vex_analysis_created", + "value": "2025-07-06 22:46:27" + }, + { + "name": "vex_analysis_created_by", + "value": "tomas.gonzalez@fossid.com" + }, + { + "name": "vex_analysis_updated", + "value": "2025-07-07 00:47:24" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "10.0", + "severity": "critical" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + }, + { + "affects": [ + { + "ref": "pkg:express@4.12.4" + } + ], + "bom-ref": "vuln-CVE-2024-43796-express-4.12.4", + "description": "Security vulnerability affecting express version 4.12.4", + "id": "CVE-2024-43796", + "properties": [ + { + "name": "epss_percentile", + "value": "0.18136" + }, + { + "name": "epss_score", + "value": "0.00058" + }, + { + "name": "high_risk_evidence", + "value": "No additional risk context available" + }, + { + "name": "high_risk_indicator", + "value": "Unknown" + } + ], + "ratings": [ + { + "method": "CVSSv3", + "score": "4.7", + "severity": "medium" + }, + { + "method": "other", + "score": "0.0", + "source": { + "name": "EPSS", + "url": "https://www.first.org/epss" + } + } + ] + } + ] +} \ No newline at end of file diff --git a/augment-epss.cdx.json b/augment-epss.cdx.json new file mode 100644 index 0000000..1238abb --- /dev/null +++ b/augment-epss.cdx.json @@ -0,0 +1,34546 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.5", + "serialNumber": "urn:uuid:cd54f2d1-a258-490b-bf20-89415999c125", + "version": 1, + "metadata": { + "timestamp": "2025-07-08T00:40:55Z", + "authors": [ + { + "name": "tomas.gonzalez@fossid.com", + "email": "tomas.gonzalez@fossid.com", + "phone": "000-000-0000" + } + ], + "properties": [ + { + "name": "scan_code", + "value": "fossid-ab/js-sample-demo/main" + }, + { + "name": "scan_name", + "value": "fossid-ab/js-sample-demo/main" + }, + { + "name": "workbench_scan_code", + "value": "fossid-ab/js-sample-demo/main" + }, + { + "name": "nvd_enriched", + "value": "false" + }, + { + "name": "epss_enriched", + "value": "true" + }, + { + "name": "cisa_kev_enriched", + "value": "true" + }, + { + "name": "generation_timestamp", + "value": "2025-07-07T22:40:59.278218Z" + }, + { + "name": "generation_method", + "value": "sbom_augmentation" + }, + { + "name": "cyclonedx_generator_version", + "value": "workbench-cli-2.0" + }, + { + "name": "vulnerability_count", + "value": "75" + }, + { + "name": "augmented_vulnerabilities", + "value": "75" + }, + { + "name": "enriched_vulnerabilities", + "value": "75" + }, + { + "name": "risk_scored_vulnerabilities", + "value": "75" + }, + { + "name": "processing_errors", + "value": "0" + }, + { + "name": "validation_status", + "value": "passed" + } + ], + "tools": { + "components": [ + { + "name": "Workbench", + "type": "application", + "version": "2025.1.1#16055033721", + "supplier": { + "name": "FossID", + "url": [ + "https://fossid.com" + ] + }, + "bom-ref": "Workbench_2025.1.1#16055033721_05f18f0a-1e8d-4764-989c-55a34ddc23dd" + } + ] + } + }, + "components": [ + { + "name": "bootstrap", + "type": "library", + "licenses": [ + { + "license": { + "id": "Apache-2.0", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "QXBhY2hlIExpY2Vuc2UKVmVyc2lvbiAyLjAsIEphbnVhcnkgMjAwNApodHRwOi8vd3d3LmFwYWNoZS5vcmcvbGljZW5zZXMvCgpURVJNUyBBTkQgQ09ORElUSU9OUyBGT1IgVVNFLCBSRVBST0RVQ1RJT04sIEFORCBESVNUUklCVVRJT04KCjEuIERlZmluaXRpb25zLgoKIkxpY2Vuc2UiIHNoYWxsIG1lYW4gdGhlIHRlcm1zIGFuZCBjb25kaXRpb25zIGZvciB1c2UsIHJlcHJvZHVjdGlvbiwgYW5kIGRpc3RyaWJ1dGlvbiBhcyBkZWZpbmVkIGJ5IFNlY3Rpb25zIDEgdGhyb3VnaCA5IG9mIHRoaXMgZG9jdW1lbnQuCgoiTGljZW5zb3IiIHNoYWxsIG1lYW4gdGhlIGNvcHlyaWdodCBvd25lciBvciBlbnRpdHkgYXV0aG9yaXplZCBieSB0aGUgY29weXJpZ2h0IG93bmVyIHRoYXQgaXMgZ3JhbnRpbmcgdGhlIExpY2Vuc2UuCgoiTGVnYWwgRW50aXR5IiBzaGFsbCBtZWFuIHRoZSB1bmlvbiBvZiB0aGUgYWN0aW5nIGVudGl0eSBhbmQgYWxsIG90aGVyIGVudGl0aWVzIHRoYXQgY29udHJvbCwgYXJlIGNvbnRyb2xsZWQgYnksIG9yIGFyZSB1bmRlciBjb21tb24gY29udHJvbCB3aXRoIHRoYXQgZW50aXR5LiBGb3IgdGhlIHB1cnBvc2VzIG9mIHRoaXMgZGVmaW5pdGlvbiwgImNvbnRyb2wiIG1lYW5zIChpKSB0aGUgcG93ZXIsIGRpcmVjdCBvciBpbmRpcmVjdCwgdG8gY2F1c2UgdGhlIGRpcmVjdGlvbiBvciBtYW5hZ2VtZW50IG9mIHN1Y2ggZW50aXR5LCB3aGV0aGVyIGJ5IGNvbnRyYWN0IG9yIG90aGVyd2lzZSwgb3IgKGlpKSBvd25lcnNoaXAgb2YgZmlmdHkgcGVyY2VudCAoNTAlKSBvciBtb3JlIG9mIHRoZSBvdXRzdGFuZGluZyBzaGFyZXMsIG9yIChpaWkpIGJlbmVmaWNpYWwgb3duZXJzaGlwIG9mIHN1Y2ggZW50aXR5LgoKIllvdSIgKG9yICJZb3VyIikgc2hhbGwgbWVhbiBhbiBpbmRpdmlkdWFsIG9yIExlZ2FsIEVudGl0eSBleGVyY2lzaW5nIHBlcm1pc3Npb25zIGdyYW50ZWQgYnkgdGhpcyBMaWNlbnNlLgoKIlNvdXJjZSIgZm9ybSBzaGFsbCBtZWFuIHRoZSBwcmVmZXJyZWQgZm9ybSBmb3IgbWFraW5nIG1vZGlmaWNhdGlvbnMsIGluY2x1ZGluZyBidXQgbm90IGxpbWl0ZWQgdG8gc29mdHdhcmUgc291cmNlIGNvZGUsIGRvY3VtZW50YXRpb24gc291cmNlLCBhbmQgY29uZmlndXJhdGlvbiBmaWxlcy4KCiJPYmplY3QiIGZvcm0gc2hhbGwgbWVhbiBhbnkgZm9ybSByZXN1bHRpbmcgZnJvbSBtZWNoYW5pY2FsIHRyYW5zZm9ybWF0aW9uIG9yIHRyYW5zbGF0aW9uIG9mIGEgU291cmNlIGZvcm0sIGluY2x1ZGluZyBidXQgbm90IGxpbWl0ZWQgdG8gY29tcGlsZWQgb2JqZWN0IGNvZGUsIGdlbmVyYXRlZCBkb2N1bWVudGF0aW9uLCBhbmQgY29udmVyc2lvbnMgdG8gb3RoZXIgbWVkaWEgdHlwZXMuCgoiV29yayIgc2hhbGwgbWVhbiB0aGUgd29yayBvZiBhdXRob3JzaGlwLCB3aGV0aGVyIGluIFNvdXJjZSBvciBPYmplY3QgZm9ybSwgbWFkZSBhdmFpbGFibGUgdW5kZXIgdGhlIExpY2Vuc2UsIGFzIGluZGljYXRlZCBieSBhIGNvcHlyaWdodCBub3RpY2UgdGhhdCBpcyBpbmNsdWRlZCBpbiBvciBhdHRhY2hlZCB0byB0aGUgd29yayAoYW4gZXhhbXBsZSBpcyBwcm92aWRlZCBpbiB0aGUgQXBwZW5kaXggYmVsb3cpLgoKIkRlcml2YXRpdmUgV29ya3MiIHNoYWxsIG1lYW4gYW55IHdvcmssIHdoZXRoZXIgaW4gU291cmNlIG9yIE9iamVjdCBmb3JtLCB0aGF0IGlzIGJhc2VkIG9uIChvciBkZXJpdmVkIGZyb20pIHRoZSBXb3JrIGFuZCBmb3Igd2hpY2ggdGhlIGVkaXRvcmlhbCByZXZpc2lvbnMsIGFubm90YXRpb25zLCBlbGFib3JhdGlvbnMsIG9yIG90aGVyIG1vZGlmaWNhdGlvbnMgcmVwcmVzZW50LCBhcyBhIHdob2xlLCBhbiBvcmlnaW5hbCB3b3JrIG9mIGF1dGhvcnNoaXAuIEZvciB0aGUgcHVycG9zZXMgb2YgdGhpcyBMaWNlbnNlLCBEZXJpdmF0aXZlIFdvcmtzIHNoYWxsIG5vdCBpbmNsdWRlIHdvcmtzIHRoYXQgcmVtYWluIHNlcGFyYWJsZSBmcm9tLCBvciBtZXJlbHkgbGluayAob3IgYmluZCBieSBuYW1lKSB0byB0aGUgaW50ZXJmYWNlcyBvZiwgdGhlIFdvcmsgYW5kIERlcml2YXRpdmUgV29ya3MgdGhlcmVvZi4KCiJDb250cmlidXRpb24iIHNoYWxsIG1lYW4gYW55IHdvcmsgb2YgYXV0aG9yc2hpcCwgaW5jbHVkaW5nIHRoZSBvcmlnaW5hbCB2ZXJzaW9uIG9mIHRoZSBXb3JrIGFuZCBhbnkgbW9kaWZpY2F0aW9ucyBvciBhZGRpdGlvbnMgdG8gdGhhdCBXb3JrIG9yIERlcml2YXRpdmUgV29ya3MgdGhlcmVvZiwgdGhhdCBpcyBpbnRlbnRpb25hbGx5IHN1Ym1pdHRlZCB0byBMaWNlbnNvciBmb3IgaW5jbHVzaW9uIGluIHRoZSBXb3JrIGJ5IHRoZSBjb3B5cmlnaHQgb3duZXIgb3IgYnkgYW4gaW5kaXZpZHVhbCBvciBMZWdhbCBFbnRpdHkgYXV0aG9yaXplZCB0byBzdWJtaXQgb24gYmVoYWxmIG9mIHRoZSBjb3B5cmlnaHQgb3duZXIuIEZvciB0aGUgcHVycG9zZXMgb2YgdGhpcyBkZWZpbml0aW9uLCAic3VibWl0dGVkIiBtZWFucyBhbnkgZm9ybSBvZiBlbGVjdHJvbmljLCB2ZXJiYWwsIG9yIHdyaXR0ZW4gY29tbXVuaWNhdGlvbiBzZW50IHRvIHRoZSBMaWNlbnNvciBvciBpdHMgcmVwcmVzZW50YXRpdmVzLCBpbmNsdWRpbmcgYnV0IG5vdCBsaW1pdGVkIHRvIGNvbW11bmljYXRpb24gb24gZWxlY3Ryb25pYyBtYWlsaW5nIGxpc3RzLCBzb3VyY2UgY29kZSBjb250cm9sIHN5c3RlbXMsIGFuZCBpc3N1ZSB0cmFja2luZyBzeXN0ZW1zIHRoYXQgYXJlIG1hbmFnZWQgYnksIG9yIG9uIGJlaGFsZiBvZiwgdGhlIExpY2Vuc29yIGZvciB0aGUgcHVycG9zZSBvZiBkaXNjdXNzaW5nIGFuZCBpbXByb3ZpbmcgdGhlIFdvcmssIGJ1dCBleGNsdWRpbmcgY29tbXVuaWNhdGlvbiB0aGF0IGlzIGNvbnNwaWN1b3VzbHkgbWFya2VkIG9yIG90aGVyd2lzZSBkZXNpZ25hdGVkIGluIHdyaXRpbmcgYnkgdGhlIGNvcHlyaWdodCBvd25lciBhcyAiTm90IGEgQ29udHJpYnV0aW9uLiIKCiJDb250cmlidXRvciIgc2hhbGwgbWVhbiBMaWNlbnNvciBhbmQgYW55IGluZGl2aWR1YWwgb3IgTGVnYWwgRW50aXR5IG9uIGJlaGFsZiBvZiB3aG9tIGEgQ29udHJpYnV0aW9uIGhhcyBiZWVuIHJlY2VpdmVkIGJ5IExpY2Vuc29yIGFuZCBzdWJzZXF1ZW50bHkgaW5jb3Jwb3JhdGVkIHdpdGhpbiB0aGUgV29yay4KCjIuIEdyYW50IG9mIENvcHlyaWdodCBMaWNlbnNlLiBTdWJqZWN0IHRvIHRoZSB0ZXJtcyBhbmQgY29uZGl0aW9ucyBvZiB0aGlzIExpY2Vuc2UsIGVhY2ggQ29udHJpYnV0b3IgaGVyZWJ5IGdyYW50cyB0byBZb3UgYSBwZXJwZXR1YWwsIHdvcmxkd2lkZSwgbm9uLWV4Y2x1c2l2ZSwgbm8tY2hhcmdlLCByb3lhbHR5LWZyZWUsIGlycmV2b2NhYmxlIGNvcHlyaWdodCBsaWNlbnNlIHRvIHJlcHJvZHVjZSwgcHJlcGFyZSBEZXJpdmF0aXZlIFdvcmtzIG9mLCBwdWJsaWNseSBkaXNwbGF5LCBwdWJsaWNseSBwZXJmb3JtLCBzdWJsaWNlbnNlLCBhbmQgZGlzdHJpYnV0ZSB0aGUgV29yayBhbmQgc3VjaCBEZXJpdmF0aXZlIFdvcmtzIGluIFNvdXJjZSBvciBPYmplY3QgZm9ybS4KCjMuIEdyYW50IG9mIFBhdGVudCBMaWNlbnNlLiBTdWJqZWN0IHRvIHRoZSB0ZXJtcyBhbmQgY29uZGl0aW9ucyBvZiB0aGlzIExpY2Vuc2UsIGVhY2ggQ29udHJpYnV0b3IgaGVyZWJ5IGdyYW50cyB0byBZb3UgYSBwZXJwZXR1YWwsIHdvcmxkd2lkZSwgbm9uLWV4Y2x1c2l2ZSwgbm8tY2hhcmdlLCByb3lhbHR5LWZyZWUsIGlycmV2b2NhYmxlIChleGNlcHQgYXMgc3RhdGVkIGluIHRoaXMgc2VjdGlvbikgcGF0ZW50IGxpY2Vuc2UgdG8gbWFrZSwgaGF2ZSBtYWRlLCB1c2UsIG9mZmVyIHRvIHNlbGwsIHNlbGwsIGltcG9ydCwgYW5kIG90aGVyd2lzZSB0cmFuc2ZlciB0aGUgV29yaywgd2hlcmUgc3VjaCBsaWNlbnNlIGFwcGxpZXMgb25seSB0byB0aG9zZSBwYXRlbnQgY2xhaW1zIGxpY2Vuc2FibGUgYnkgc3VjaCBDb250cmlidXRvciB0aGF0IGFyZSBuZWNlc3NhcmlseSBpbmZyaW5nZWQgYnkgdGhlaXIgQ29udHJpYnV0aW9uKHMpIGFsb25lIG9yIGJ5IGNvbWJpbmF0aW9uIG9mIHRoZWlyIENvbnRyaWJ1dGlvbihzKSB3aXRoIHRoZSBXb3JrIHRvIHdoaWNoIHN1Y2ggQ29udHJpYnV0aW9uKHMpIHdhcyBzdWJtaXR0ZWQuIElmIFlvdSBpbnN0aXR1dGUgcGF0ZW50IGxpdGlnYXRpb24gYWdhaW5zdCBhbnkgZW50aXR5IChpbmNsdWRpbmcgYSBjcm9zcy1jbGFpbSBvciBjb3VudGVyY2xhaW0gaW4gYSBsYXdzdWl0KSBhbGxlZ2luZyB0aGF0IHRoZSBXb3JrIG9yIGEgQ29udHJpYnV0aW9uIGluY29ycG9yYXRlZCB3aXRoaW4gdGhlIFdvcmsgY29uc3RpdHV0ZXMgZGlyZWN0IG9yIGNvbnRyaWJ1dG9yeSBwYXRlbnQgaW5mcmluZ2VtZW50LCB0aGVuIGFueSBwYXRlbnQgbGljZW5zZXMgZ3JhbnRlZCB0byBZb3UgdW5kZXIgdGhpcyBMaWNlbnNlIGZvciB0aGF0IFdvcmsgc2hhbGwgdGVybWluYXRlIGFzIG9mIHRoZSBkYXRlIHN1Y2ggbGl0aWdhdGlvbiBpcyBmaWxlZC4KCjQuIFJlZGlzdHJpYnV0aW9uLiBZb3UgbWF5IHJlcHJvZHVjZSBhbmQgZGlzdHJpYnV0ZSBjb3BpZXMgb2YgdGhlIFdvcmsgb3IgRGVyaXZhdGl2ZSBXb3JrcyB0aGVyZW9mIGluIGFueSBtZWRpdW0sIHdpdGggb3Igd2l0aG91dCBtb2RpZmljYXRpb25zLCBhbmQgaW4gU291cmNlIG9yIE9iamVjdCBmb3JtLCBwcm92aWRlZCB0aGF0IFlvdSBtZWV0IHRoZSBmb2xsb3dpbmcgY29uZGl0aW9uczoKCiAgICAgKGEpIFlvdSBtdXN0IGdpdmUgYW55IG90aGVyIHJlY2lwaWVudHMgb2YgdGhlIFdvcmsgb3IgRGVyaXZhdGl2ZSBXb3JrcyBhIGNvcHkgb2YgdGhpcyBMaWNlbnNlOyBhbmQKCiAgICAgKGIpIFlvdSBtdXN0IGNhdXNlIGFueSBtb2RpZmllZCBmaWxlcyB0byBjYXJyeSBwcm9taW5lbnQgbm90aWNlcyBzdGF0aW5nIHRoYXQgWW91IGNoYW5nZWQgdGhlIGZpbGVzOyBhbmQKCiAgICAgKGMpIFlvdSBtdXN0IHJldGFpbiwgaW4gdGhlIFNvdXJjZSBmb3JtIG9mIGFueSBEZXJpdmF0aXZlIFdvcmtzIHRoYXQgWW91IGRpc3RyaWJ1dGUsIGFsbCBjb3B5cmlnaHQsIHBhdGVudCwgdHJhZGVtYXJrLCBhbmQgYXR0cmlidXRpb24gbm90aWNlcyBmcm9tIHRoZSBTb3VyY2UgZm9ybSBvZiB0aGUgV29yaywgZXhjbHVkaW5nIHRob3NlIG5vdGljZXMgdGhhdCBkbyBub3QgcGVydGFpbiB0byBhbnkgcGFydCBvZiB0aGUgRGVyaXZhdGl2ZSBXb3JrczsgYW5kCgogICAgIChkKSBJZiB0aGUgV29yayBpbmNsdWRlcyBhICJOT1RJQ0UiIHRleHQgZmlsZSBhcyBwYXJ0IG9mIGl0cyBkaXN0cmlidXRpb24sIHRoZW4gYW55IERlcml2YXRpdmUgV29ya3MgdGhhdCBZb3UgZGlzdHJpYnV0ZSBtdXN0IGluY2x1ZGUgYSByZWFkYWJsZSBjb3B5IG9mIHRoZSBhdHRyaWJ1dGlvbiBub3RpY2VzIGNvbnRhaW5lZCB3aXRoaW4gc3VjaCBOT1RJQ0UgZmlsZSwgZXhjbHVkaW5nIHRob3NlIG5vdGljZXMgdGhhdCBkbyBub3QgcGVydGFpbiB0byBhbnkgcGFydCBvZiB0aGUgRGVyaXZhdGl2ZSBXb3JrcywgaW4gYXQgbGVhc3Qgb25lIG9mIHRoZSBmb2xsb3dpbmcgcGxhY2VzOiB3aXRoaW4gYSBOT1RJQ0UgdGV4dCBmaWxlIGRpc3RyaWJ1dGVkIGFzIHBhcnQgb2YgdGhlIERlcml2YXRpdmUgV29ya3M7IHdpdGhpbiB0aGUgU291cmNlIGZvcm0gb3IgZG9jdW1lbnRhdGlvbiwgaWYgcHJvdmlkZWQgYWxvbmcgd2l0aCB0aGUgRGVyaXZhdGl2ZSBXb3Jrczsgb3IsIHdpdGhpbiBhIGRpc3BsYXkgZ2VuZXJhdGVkIGJ5IHRoZSBEZXJpdmF0aXZlIFdvcmtzLCBpZiBhbmQgd2hlcmV2ZXIgc3VjaCB0aGlyZC1wYXJ0eSBub3RpY2VzIG5vcm1hbGx5IGFwcGVhci4gVGhlIGNvbnRlbnRzIG9mIHRoZSBOT1RJQ0UgZmlsZSBhcmUgZm9yIGluZm9ybWF0aW9uYWwgcHVycG9zZXMgb25seSBhbmQgZG8gbm90IG1vZGlmeSB0aGUgTGljZW5zZS4gWW91IG1heSBhZGQgWW91ciBvd24gYXR0cmlidXRpb24gbm90aWNlcyB3aXRoaW4gRGVyaXZhdGl2ZSBXb3JrcyB0aGF0IFlvdSBkaXN0cmlidXRlLCBhbG9uZ3NpZGUgb3IgYXMgYW4gYWRkZW5kdW0gdG8gdGhlIE5PVElDRSB0ZXh0IGZyb20gdGhlIFdvcmssIHByb3ZpZGVkIHRoYXQgc3VjaCBhZGRpdGlvbmFsIGF0dHJpYnV0aW9uIG5vdGljZXMgY2Fubm90IGJlIGNvbnN0cnVlZCBhcyBtb2RpZnlpbmcgdGhlIExpY2Vuc2UuCgogICAgIFlvdSBtYXkgYWRkIFlvdXIgb3duIGNvcHlyaWdodCBzdGF0ZW1lbnQgdG8gWW91ciBtb2RpZmljYXRpb25zIGFuZCBtYXkgcHJvdmlkZSBhZGRpdGlvbmFsIG9yIGRpZmZlcmVudCBsaWNlbnNlIHRlcm1zIGFuZCBjb25kaXRpb25zIGZvciB1c2UsIHJlcHJvZHVjdGlvbiwgb3IgZGlzdHJpYnV0aW9uIG9mIFlvdXIgbW9kaWZpY2F0aW9ucywgb3IgZm9yIGFueSBzdWNoIERlcml2YXRpdmUgV29ya3MgYXMgYSB3aG9sZSwgcHJvdmlkZWQgWW91ciB1c2UsIHJlcHJvZHVjdGlvbiwgYW5kIGRpc3RyaWJ1dGlvbiBvZiB0aGUgV29yayBvdGhlcndpc2UgY29tcGxpZXMgd2l0aCB0aGUgY29uZGl0aW9ucyBzdGF0ZWQgaW4gdGhpcyBMaWNlbnNlLgoKNS4gU3VibWlzc2lvbiBvZiBDb250cmlidXRpb25zLiBVbmxlc3MgWW91IGV4cGxpY2l0bHkgc3RhdGUgb3RoZXJ3aXNlLCBhbnkgQ29udHJpYnV0aW9uIGludGVudGlvbmFsbHkgc3VibWl0dGVkIGZvciBpbmNsdXNpb24gaW4gdGhlIFdvcmsgYnkgWW91IHRvIHRoZSBMaWNlbnNvciBzaGFsbCBiZSB1bmRlciB0aGUgdGVybXMgYW5kIGNvbmRpdGlvbnMgb2YgdGhpcyBMaWNlbnNlLCB3aXRob3V0IGFueSBhZGRpdGlvbmFsIHRlcm1zIG9yIGNvbmRpdGlvbnMuIE5vdHdpdGhzdGFuZGluZyB0aGUgYWJvdmUsIG5vdGhpbmcgaGVyZWluIHNoYWxsIHN1cGVyc2VkZSBvciBtb2RpZnkgdGhlIHRlcm1zIG9mIGFueSBzZXBhcmF0ZSBsaWNlbnNlIGFncmVlbWVudCB5b3UgbWF5IGhhdmUgZXhlY3V0ZWQgd2l0aCBMaWNlbnNvciByZWdhcmRpbmcgc3VjaCBDb250cmlidXRpb25zLgoKNi4gVHJhZGVtYXJrcy4gVGhpcyBMaWNlbnNlIGRvZXMgbm90IGdyYW50IHBlcm1pc3Npb24gdG8gdXNlIHRoZSB0cmFkZSBuYW1lcywgdHJhZGVtYXJrcywgc2VydmljZSBtYXJrcywgb3IgcHJvZHVjdCBuYW1lcyBvZiB0aGUgTGljZW5zb3IsIGV4Y2VwdCBhcyByZXF1aXJlZCBmb3IgcmVhc29uYWJsZSBhbmQgY3VzdG9tYXJ5IHVzZSBpbiBkZXNjcmliaW5nIHRoZSBvcmlnaW4gb2YgdGhlIFdvcmsgYW5kIHJlcHJvZHVjaW5nIHRoZSBjb250ZW50IG9mIHRoZSBOT1RJQ0UgZmlsZS4KCjcuIERpc2NsYWltZXIgb2YgV2FycmFudHkuIFVubGVzcyByZXF1aXJlZCBieSBhcHBsaWNhYmxlIGxhdyBvciBhZ3JlZWQgdG8gaW4gd3JpdGluZywgTGljZW5zb3IgcHJvdmlkZXMgdGhlIFdvcmsgKGFuZCBlYWNoIENvbnRyaWJ1dG9yIHByb3ZpZGVzIGl0cyBDb250cmlidXRpb25zKSBvbiBhbiAiQVMgSVMiIEJBU0lTLCBXSVRIT1VUIFdBUlJBTlRJRVMgT1IgQ09ORElUSU9OUyBPRiBBTlkgS0lORCwgZWl0aGVyIGV4cHJlc3Mgb3IgaW1wbGllZCwgaW5jbHVkaW5nLCB3aXRob3V0IGxpbWl0YXRpb24sIGFueSB3YXJyYW50aWVzIG9yIGNvbmRpdGlvbnMgb2YgVElUTEUsIE5PTi1JTkZSSU5HRU1FTlQsIE1FUkNIQU5UQUJJTElUWSwgb3IgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UuIFlvdSBhcmUgc29sZWx5IHJlc3BvbnNpYmxlIGZvciBkZXRlcm1pbmluZyB0aGUgYXBwcm9wcmlhdGVuZXNzIG9mIHVzaW5nIG9yIHJlZGlzdHJpYnV0aW5nIHRoZSBXb3JrIGFuZCBhc3N1bWUgYW55IHJpc2tzIGFzc29jaWF0ZWQgd2l0aCBZb3VyIGV4ZXJjaXNlIG9mIHBlcm1pc3Npb25zIHVuZGVyIHRoaXMgTGljZW5zZS4KCjguIExpbWl0YXRpb24gb2YgTGlhYmlsaXR5LiBJbiBubyBldmVudCBhbmQgdW5kZXIgbm8gbGVnYWwgdGhlb3J5LCB3aGV0aGVyIGluIHRvcnQgKGluY2x1ZGluZyBuZWdsaWdlbmNlKSwgY29udHJhY3QsIG9yIG90aGVyd2lzZSwgdW5sZXNzIHJlcXVpcmVkIGJ5IGFwcGxpY2FibGUgbGF3IChzdWNoIGFzIGRlbGliZXJhdGUgYW5kIGdyb3NzbHkgbmVnbGlnZW50IGFjdHMpIG9yIGFncmVlZCB0byBpbiB3cml0aW5nLCBzaGFsbCBhbnkgQ29udHJpYnV0b3IgYmUgbGlhYmxlIHRvIFlvdSBmb3IgZGFtYWdlcywgaW5jbHVkaW5nIGFueSBkaXJlY3QsIGluZGlyZWN0LCBzcGVjaWFsLCBpbmNpZGVudGFsLCBvciBjb25zZXF1ZW50aWFsIGRhbWFnZXMgb2YgYW55IGNoYXJhY3RlciBhcmlzaW5nIGFzIGEgcmVzdWx0IG9mIHRoaXMgTGljZW5zZSBvciBvdXQgb2YgdGhlIHVzZSBvciBpbmFiaWxpdHkgdG8gdXNlIHRoZSBXb3JrIChpbmNsdWRpbmcgYnV0IG5vdCBsaW1pdGVkIHRvIGRhbWFnZXMgZm9yIGxvc3Mgb2YgZ29vZHdpbGwsIHdvcmsgc3RvcHBhZ2UsIGNvbXB1dGVyIGZhaWx1cmUgb3IgbWFsZnVuY3Rpb24sIG9yIGFueSBhbmQgYWxsIG90aGVyIGNvbW1lcmNpYWwgZGFtYWdlcyBvciBsb3NzZXMpLCBldmVuIGlmIHN1Y2ggQ29udHJpYnV0b3IgaGFzIGJlZW4gYWR2aXNlZCBvZiB0aGUgcG9zc2liaWxpdHkgb2Ygc3VjaCBkYW1hZ2VzLgoKOS4gQWNjZXB0aW5nIFdhcnJhbnR5IG9yIEFkZGl0aW9uYWwgTGlhYmlsaXR5LiBXaGlsZSByZWRpc3RyaWJ1dGluZyB0aGUgV29yayBvciBEZXJpdmF0aXZlIFdvcmtzIHRoZXJlb2YsIFlvdSBtYXkgY2hvb3NlIHRvIG9mZmVyLCBhbmQgY2hhcmdlIGEgZmVlIGZvciwgYWNjZXB0YW5jZSBvZiBzdXBwb3J0LCB3YXJyYW50eSwgaW5kZW1uaXR5LCBvciBvdGhlciBsaWFiaWxpdHkgb2JsaWdhdGlvbnMgYW5kL29yIHJpZ2h0cyBjb25zaXN0ZW50IHdpdGggdGhpcyBMaWNlbnNlLiBIb3dldmVyLCBpbiBhY2NlcHRpbmcgc3VjaCBvYmxpZ2F0aW9ucywgWW91IG1heSBhY3Qgb25seSBvbiBZb3VyIG93biBiZWhhbGYgYW5kIG9uIFlvdXIgc29sZSByZXNwb25zaWJpbGl0eSwgbm90IG9uIGJlaGFsZiBvZiBhbnkgb3RoZXIgQ29udHJpYnV0b3IsIGFuZCBvbmx5IGlmIFlvdSBhZ3JlZSB0byBpbmRlbW5pZnksIGRlZmVuZCwgYW5kIGhvbGQgZWFjaCBDb250cmlidXRvciBoYXJtbGVzcyBmb3IgYW55IGxpYWJpbGl0eSBpbmN1cnJlZCBieSwgb3IgY2xhaW1zIGFzc2VydGVkIGFnYWluc3QsIHN1Y2ggQ29udHJpYnV0b3IgYnkgcmVhc29uIG9mIHlvdXIgYWNjZXB0aW5nIGFueSBzdWNoIHdhcnJhbnR5IG9yIGFkZGl0aW9uYWwgbGlhYmlsaXR5LgoKRU5EIE9GIFRFUk1TIEFORCBDT05ESVRJT05TCgpBUFBFTkRJWDogSG93IHRvIGFwcGx5IHRoZSBBcGFjaGUgTGljZW5zZSB0byB5b3VyIHdvcmsuCgpUbyBhcHBseSB0aGUgQXBhY2hlIExpY2Vuc2UgdG8geW91ciB3b3JrLCBhdHRhY2ggdGhlIGZvbGxvd2luZyBib2lsZXJwbGF0ZSBub3RpY2UsIHdpdGggdGhlIGZpZWxkcyBlbmNsb3NlZCBieSBicmFja2V0cyAiW10iIHJlcGxhY2VkIHdpdGggeW91ciBvd24gaWRlbnRpZnlpbmcgaW5mb3JtYXRpb24uIChEb24ndCBpbmNsdWRlIHRoZSBicmFja2V0cyEpICBUaGUgdGV4dCBzaG91bGQgYmUgZW5jbG9zZWQgaW4gdGhlIGFwcHJvcHJpYXRlIGNvbW1lbnQgc3ludGF4IGZvciB0aGUgZmlsZSBmb3JtYXQuIFdlIGFsc28gcmVjb21tZW5kIHRoYXQgYSBmaWxlIG9yIGNsYXNzIG5hbWUgYW5kIGRlc2NyaXB0aW9uIG9mIHB1cnBvc2UgYmUgaW5jbHVkZWQgb24gdGhlIHNhbWUgInByaW50ZWQgcGFnZSIgYXMgdGhlIGNvcHlyaWdodCBub3RpY2UgZm9yIGVhc2llciBpZGVudGlmaWNhdGlvbiB3aXRoaW4gdGhpcmQtcGFydHkgYXJjaGl2ZXMuCgpDb3B5cmlnaHQgW3l5eXldIFtuYW1lIG9mIGNvcHlyaWdodCBvd25lcl0KCkxpY2Vuc2VkIHVuZGVyIHRoZSBBcGFjaGUgTGljZW5zZSwgVmVyc2lvbiAyLjAgKHRoZSAiTGljZW5zZSIpOwp5b3UgbWF5IG5vdCB1c2UgdGhpcyBmaWxlIGV4Y2VwdCBpbiBjb21wbGlhbmNlIHdpdGggdGhlIExpY2Vuc2UuCllvdSBtYXkgb2J0YWluIGEgY29weSBvZiB0aGUgTGljZW5zZSBhdAoKaHR0cDovL3d3dy5hcGFjaGUub3JnL2xpY2Vuc2VzL0xJQ0VOU0UtMi4wCgpVbmxlc3MgcmVxdWlyZWQgYnkgYXBwbGljYWJsZSBsYXcgb3IgYWdyZWVkIHRvIGluIHdyaXRpbmcsIHNvZnR3YXJlCmRpc3RyaWJ1dGVkIHVuZGVyIHRoZSBMaWNlbnNlIGlzIGRpc3RyaWJ1dGVkIG9uIGFuICJBUyBJUyIgQkFTSVMsCldJVEhPVVQgV0FSUkFOVElFUyBPUiBDT05ESVRJT05TIE9GIEFOWSBLSU5ELCBlaXRoZXIgZXhwcmVzcyBvciBpbXBsaWVkLgpTZWUgdGhlIExpY2Vuc2UgZm9yIHRoZSBzcGVjaWZpYyBsYW5ndWFnZSBnb3Zlcm5pbmcgcGVybWlzc2lvbnMgYW5kCmxpbWl0YXRpb25zIHVuZGVyIHRoZSBMaWNlbnNlLg==" + }, + "url": "https://www.apache.org/licenses/LICENSE-2.0" + } + } + ], + "version": "3.0.0", + "cpe": "cpe:2.3:a:getbootstrap:bootstrap:3.0.0:-:*:*:*:*:*:*", + "purl": "pkg:github/twbs/bootstrap@3.0.0", + "supplier": { + "name": "twbs" + }, + "bom-ref": "bootstrap_3.0.0_147d3014-34b3-48f7-aa7f-2173911ebc51", + "description": "", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "6455" + } + ] + }, + { + "name": "bootstrap", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "5.3.0-alpha3", + "purl": "pkg:github/twbs/bootstrap@v5.3.0-alpha3", + "supplier": { + "name": "twbs" + }, + "bom-ref": "bootstrap_5.3.0-alpha3_2cacad59-3109-4717-918c-553ee018accd", + "description": "", + "copyright": "• The Bootstrap Authors (2011-2023)\n", + "properties": [ + { + "name": "component_id", + "value": "12310" + } + ] + }, + { + "name": "husky", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "9.1.1", + "bom-ref": "husky_9.1.1_7a151364-3964-4490-8783-e9e62f7e4c4b", + "description": "", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "1888" + } + ] + }, + { + "name": "rivets", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "0.9.6", + "bom-ref": "rivets_0.9.6_0961fad9-0def-4894-ac3b-98053d3d3d9a", + "description": "", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "1890" + } + ] + }, + { + "name": "56116554", + "type": "library", + "licenses": [ + { + "license": { + "id": "CC-BY-SA-4.0", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "Q3JlYXRpdmUgQ29tbW9ucyBBdHRyaWJ1dGlvbi1TaGFyZUFsaWtlIDQuMCBJbnRlcm5hdGlvbmFsCgogQ3JlYXRpdmUgQ29tbW9ucyBDb3Jwb3JhdGlvbiAo4oCcQ3JlYXRpdmUgQ29tbW9uc+KAnSkgaXMgbm90IGEgbGF3IGZpcm0gYW5kIGRvZXMgbm90IHByb3ZpZGUgbGVnYWwgc2VydmljZXMgb3IgbGVnYWwgYWR2aWNlLiBEaXN0cmlidXRpb24gb2YgQ3JlYXRpdmUgQ29tbW9ucyBwdWJsaWMgbGljZW5zZXMgZG9lcyBub3QgY3JlYXRlIGEgbGF3eWVyLWNsaWVudCBvciBvdGhlciByZWxhdGlvbnNoaXAuIENyZWF0aXZlIENvbW1vbnMgbWFrZXMgaXRzIGxpY2Vuc2VzIGFuZCByZWxhdGVkIGluZm9ybWF0aW9uIGF2YWlsYWJsZSBvbiBhbiDigJxhcy1pc+KAnSBiYXNpcy4gQ3JlYXRpdmUgQ29tbW9ucyBnaXZlcyBubyB3YXJyYW50aWVzIHJlZ2FyZGluZyBpdHMgbGljZW5zZXMsIGFueSBtYXRlcmlhbCBsaWNlbnNlZCB1bmRlciB0aGVpciB0ZXJtcyBhbmQgY29uZGl0aW9ucywgb3IgYW55IHJlbGF0ZWQgaW5mb3JtYXRpb24uIENyZWF0aXZlIENvbW1vbnMgZGlzY2xhaW1zIGFsbCBsaWFiaWxpdHkgZm9yIGRhbWFnZXMgcmVzdWx0aW5nIGZyb20gdGhlaXIgdXNlIHRvIHRoZSBmdWxsZXN0IGV4dGVudCBwb3NzaWJsZS4KClVzaW5nIENyZWF0aXZlIENvbW1vbnMgUHVibGljIExpY2Vuc2VzCgpDcmVhdGl2ZSBDb21tb25zIHB1YmxpYyBsaWNlbnNlcyBwcm92aWRlIGEgc3RhbmRhcmQgc2V0IG9mIHRlcm1zIGFuZCBjb25kaXRpb25zIHRoYXQgY3JlYXRvcnMgYW5kIG90aGVyIHJpZ2h0cyBob2xkZXJzIG1heSB1c2UgdG8gc2hhcmUgb3JpZ2luYWwgd29ya3Mgb2YgYXV0aG9yc2hpcCBhbmQgb3RoZXIgbWF0ZXJpYWwgc3ViamVjdCB0byBjb3B5cmlnaHQgYW5kIGNlcnRhaW4gb3RoZXIgcmlnaHRzIHNwZWNpZmllZCBpbiB0aGUgcHVibGljIGxpY2Vuc2UgYmVsb3cuIFRoZSBmb2xsb3dpbmcgY29uc2lkZXJhdGlvbnMgYXJlIGZvciBpbmZvcm1hdGlvbmFsIHB1cnBvc2VzIG9ubHksIGFyZSBub3QgZXhoYXVzdGl2ZSwgYW5kIGRvIG5vdCBmb3JtIHBhcnQgb2Ygb3VyIGxpY2Vuc2VzLgoKQ29uc2lkZXJhdGlvbnMgZm9yIGxpY2Vuc29yczogT3VyIHB1YmxpYyBsaWNlbnNlcyBhcmUgaW50ZW5kZWQgZm9yIHVzZSBieSB0aG9zZSBhdXRob3JpemVkIHRvIGdpdmUgdGhlIHB1YmxpYyBwZXJtaXNzaW9uIHRvIHVzZSBtYXRlcmlhbCBpbiB3YXlzIG90aGVyd2lzZSByZXN0cmljdGVkIGJ5IGNvcHlyaWdodCBhbmQgY2VydGFpbiBvdGhlciByaWdodHMuIE91ciBsaWNlbnNlcyBhcmUgaXJyZXZvY2FibGUuIExpY2Vuc29ycyBzaG91bGQgcmVhZCBhbmQgdW5kZXJzdGFuZCB0aGUgdGVybXMgYW5kIGNvbmRpdGlvbnMgb2YgdGhlIGxpY2Vuc2UgdGhleSBjaG9vc2UgYmVmb3JlIGFwcGx5aW5nIGl0LiBMaWNlbnNvcnMgc2hvdWxkIGFsc28gc2VjdXJlIGFsbCByaWdodHMgbmVjZXNzYXJ5IGJlZm9yZSBhcHBseWluZyBvdXIgbGljZW5zZXMgc28gdGhhdCB0aGUgcHVibGljIGNhbiByZXVzZSB0aGUgbWF0ZXJpYWwgYXMgZXhwZWN0ZWQuIExpY2Vuc29ycyBzaG91bGQgY2xlYXJseSBtYXJrIGFueSBtYXRlcmlhbCBub3Qgc3ViamVjdCB0byB0aGUgbGljZW5zZS4gVGhpcyBpbmNsdWRlcyBvdGhlciBDQy1saWNlbnNlZCBtYXRlcmlhbCwgb3IgbWF0ZXJpYWwgdXNlZCB1bmRlciBhbiBleGNlcHRpb24gb3IgbGltaXRhdGlvbiB0byBjb3B5cmlnaHQuIE1vcmUgY29uc2lkZXJhdGlvbnMgZm9yIGxpY2Vuc29ycy4KCkNvbnNpZGVyYXRpb25zIGZvciB0aGUgcHVibGljOiBCeSB1c2luZyBvbmUgb2Ygb3VyIHB1YmxpYyBsaWNlbnNlcywgYSBsaWNlbnNvciBncmFudHMgdGhlIHB1YmxpYyBwZXJtaXNzaW9uIHRvIHVzZSB0aGUgbGljZW5zZWQgbWF0ZXJpYWwgdW5kZXIgc3BlY2lmaWVkIHRlcm1zIGFuZCBjb25kaXRpb25zLiBJZiB0aGUgbGljZW5zb3LigJlzIHBlcm1pc3Npb24gaXMgbm90IG5lY2Vzc2FyeSBmb3IgYW55IHJlYXNvbuKAk2ZvciBleGFtcGxlLCBiZWNhdXNlIG9mIGFueSBhcHBsaWNhYmxlIGV4Y2VwdGlvbiBvciBsaW1pdGF0aW9uIHRvIGNvcHlyaWdodOKAk3RoZW4gdGhhdCB1c2UgaXMgbm90IHJlZ3VsYXRlZCBieSB0aGUgbGljZW5zZS4gT3VyIGxpY2Vuc2VzIGdyYW50IG9ubHkgcGVybWlzc2lvbnMgdW5kZXIgY29weXJpZ2h0IGFuZCBjZXJ0YWluIG90aGVyIHJpZ2h0cyB0aGF0IGEgbGljZW5zb3IgaGFzIGF1dGhvcml0eSB0byBncmFudC4gVXNlIG9mIHRoZSBsaWNlbnNlZCBtYXRlcmlhbCBtYXkgc3RpbGwgYmUgcmVzdHJpY3RlZCBmb3Igb3RoZXIgcmVhc29ucywgaW5jbHVkaW5nIGJlY2F1c2Ugb3RoZXJzIGhhdmUgY29weXJpZ2h0IG9yIG90aGVyIHJpZ2h0cyBpbiB0aGUgbWF0ZXJpYWwuIEEgbGljZW5zb3IgbWF5IG1ha2Ugc3BlY2lhbCByZXF1ZXN0cywgc3VjaCBhcyBhc2tpbmcgdGhhdCBhbGwgY2hhbmdlcyBiZSBtYXJrZWQgb3IgZGVzY3JpYmVkLgoKQWx0aG91Z2ggbm90IHJlcXVpcmVkIGJ5IG91ciBsaWNlbnNlcywgeW91IGFyZSBlbmNvdXJhZ2VkIHRvIHJlc3BlY3QgdGhvc2UgcmVxdWVzdHMgd2hlcmUgcmVhc29uYWJsZS4gTW9yZSBjb25zaWRlcmF0aW9ucyBmb3IgdGhlIHB1YmxpYy4KCkNyZWF0aXZlIENvbW1vbnMgQXR0cmlidXRpb24tU2hhcmVBbGlrZSA0LjAgSW50ZXJuYXRpb25hbCBQdWJsaWMgTGljZW5zZQoKQnkgZXhlcmNpc2luZyB0aGUgTGljZW5zZWQgUmlnaHRzIChkZWZpbmVkIGJlbG93KSwgWW91IGFjY2VwdCBhbmQgYWdyZWUgdG8gYmUgYm91bmQgYnkgdGhlIHRlcm1zIGFuZCBjb25kaXRpb25zIG9mIHRoaXMgQ3JlYXRpdmUgQ29tbW9ucyBBdHRyaWJ1dGlvbi1TaGFyZUFsaWtlIDQuMCBJbnRlcm5hdGlvbmFsIFB1YmxpYyBMaWNlbnNlICgiUHVibGljIExpY2Vuc2UiKS4gVG8gdGhlIGV4dGVudCB0aGlzIFB1YmxpYyBMaWNlbnNlIG1heSBiZSBpbnRlcnByZXRlZCBhcyBhIGNvbnRyYWN0LCBZb3UgYXJlIGdyYW50ZWQgdGhlIExpY2Vuc2VkIFJpZ2h0cyBpbiBjb25zaWRlcmF0aW9uIG9mIFlvdXIgYWNjZXB0YW5jZSBvZiB0aGVzZSB0ZXJtcyBhbmQgY29uZGl0aW9ucywgYW5kIHRoZSBMaWNlbnNvciBncmFudHMgWW91IHN1Y2ggcmlnaHRzIGluIGNvbnNpZGVyYXRpb24gb2YgYmVuZWZpdHMgdGhlIExpY2Vuc29yIHJlY2VpdmVzIGZyb20gbWFraW5nIHRoZSBMaWNlbnNlZCBNYXRlcmlhbCBhdmFpbGFibGUgdW5kZXIgdGhlc2UgdGVybXMgYW5kIGNvbmRpdGlvbnMuCgpTZWN0aW9uIDEg4oCTIERlZmluaXRpb25zLgoKICAgICBhLglBZGFwdGVkIE1hdGVyaWFsIG1lYW5zIG1hdGVyaWFsIHN1YmplY3QgdG8gQ29weXJpZ2h0IGFuZCBTaW1pbGFyIFJpZ2h0cyB0aGF0IGlzIGRlcml2ZWQgZnJvbSBvciBiYXNlZCB1cG9uIHRoZSBMaWNlbnNlZCBNYXRlcmlhbCBhbmQgaW4gd2hpY2ggdGhlIExpY2Vuc2VkIE1hdGVyaWFsIGlzIHRyYW5zbGF0ZWQsIGFsdGVyZWQsIGFycmFuZ2VkLCB0cmFuc2Zvcm1lZCwgb3Igb3RoZXJ3aXNlIG1vZGlmaWVkIGluIGEgbWFubmVyIHJlcXVpcmluZyBwZXJtaXNzaW9uIHVuZGVyIHRoZSBDb3B5cmlnaHQgYW5kIFNpbWlsYXIgUmlnaHRzIGhlbGQgYnkgdGhlIExpY2Vuc29yLiBGb3IgcHVycG9zZXMgb2YgdGhpcyBQdWJsaWMgTGljZW5zZSwgd2hlcmUgdGhlIExpY2Vuc2VkIE1hdGVyaWFsIGlzIGEgbXVzaWNhbCB3b3JrLCBwZXJmb3JtYW5jZSwgb3Igc291bmQgcmVjb3JkaW5nLCBBZGFwdGVkIE1hdGVyaWFsIGlzIGFsd2F5cyBwcm9kdWNlZCB3aGVyZSB0aGUgTGljZW5zZWQgTWF0ZXJpYWwgaXMgc3luY2hlZCBpbiB0aW1lZCByZWxhdGlvbiB3aXRoIGEgbW92aW5nIGltYWdlLgoKICAgICBiLglBZGFwdGVyJ3MgTGljZW5zZSBtZWFucyB0aGUgbGljZW5zZSBZb3UgYXBwbHkgdG8gWW91ciBDb3B5cmlnaHQgYW5kIFNpbWlsYXIgUmlnaHRzIGluIFlvdXIgY29udHJpYnV0aW9ucyB0byBBZGFwdGVkIE1hdGVyaWFsIGluIGFjY29yZGFuY2Ugd2l0aCB0aGUgdGVybXMgYW5kIGNvbmRpdGlvbnMgb2YgdGhpcyBQdWJsaWMgTGljZW5zZS4KCiAgICAgYy4JQlktU0EgQ29tcGF0aWJsZSBMaWNlbnNlIG1lYW5zIGEgbGljZW5zZSBsaXN0ZWQgYXQgY3JlYXRpdmVjb21tb25zLm9yZy9jb21wYXRpYmxlbGljZW5zZXMsIGFwcHJvdmVkIGJ5IENyZWF0aXZlIENvbW1vbnMgYXMgZXNzZW50aWFsbHkgdGhlIGVxdWl2YWxlbnQgb2YgdGhpcyBQdWJsaWMgTGljZW5zZS4KCiAgICAgZC4JQ29weXJpZ2h0IGFuZCBTaW1pbGFyIFJpZ2h0cyBtZWFucyBjb3B5cmlnaHQgYW5kL29yIHNpbWlsYXIgcmlnaHRzIGNsb3NlbHkgcmVsYXRlZCB0byBjb3B5cmlnaHQgaW5jbHVkaW5nLCB3aXRob3V0IGxpbWl0YXRpb24sIHBlcmZvcm1hbmNlLCBicm9hZGNhc3QsIHNvdW5kIHJlY29yZGluZywgYW5kIFN1aSBHZW5lcmlzIERhdGFiYXNlIFJpZ2h0cywgd2l0aG91dCByZWdhcmQgdG8gaG93IHRoZSByaWdodHMgYXJlIGxhYmVsZWQgb3IgY2F0ZWdvcml6ZWQuIEZvciBwdXJwb3NlcyBvZiB0aGlzIFB1YmxpYyBMaWNlbnNlLCB0aGUgcmlnaHRzIHNwZWNpZmllZCBpbiBTZWN0aW9uIDIoYikoMSktKDIpIGFyZSBub3QgQ29weXJpZ2h0IGFuZCBTaW1pbGFyIFJpZ2h0cy4KCiAgICAgZS4JRWZmZWN0aXZlIFRlY2hub2xvZ2ljYWwgTWVhc3VyZXMgbWVhbnMgdGhvc2UgbWVhc3VyZXMgdGhhdCwgaW4gdGhlIGFic2VuY2Ugb2YgcHJvcGVyIGF1dGhvcml0eSwgbWF5IG5vdCBiZSBjaXJjdW12ZW50ZWQgdW5kZXIgbGF3cyBmdWxmaWxsaW5nIG9ibGlnYXRpb25zIHVuZGVyIEFydGljbGUgMTEgb2YgdGhlIFdJUE8gQ29weXJpZ2h0IFRyZWF0eSBhZG9wdGVkIG9uIERlY2VtYmVyIDIwLCAxOTk2LCBhbmQvb3Igc2ltaWxhciBpbnRlcm5hdGlvbmFsIGFncmVlbWVudHMuCgogICAgIGYuCUV4Y2VwdGlvbnMgYW5kIExpbWl0YXRpb25zIG1lYW5zIGZhaXIgdXNlLCBmYWlyIGRlYWxpbmcsIGFuZC9vciBhbnkgb3RoZXIgZXhjZXB0aW9uIG9yIGxpbWl0YXRpb24gdG8gQ29weXJpZ2h0IGFuZCBTaW1pbGFyIFJpZ2h0cyB0aGF0IGFwcGxpZXMgdG8gWW91ciB1c2Ugb2YgdGhlIExpY2Vuc2VkIE1hdGVyaWFsLgoKICAgICBnLglMaWNlbnNlIEVsZW1lbnRzIG1lYW5zIHRoZSBsaWNlbnNlIGF0dHJpYnV0ZXMgbGlzdGVkIGluIHRoZSBuYW1lIG9mIGEgQ3JlYXRpdmUgQ29tbW9ucyBQdWJsaWMgTGljZW5zZS4gVGhlIExpY2Vuc2UgRWxlbWVudHMgb2YgdGhpcyBQdWJsaWMgTGljZW5zZSBhcmUgQXR0cmlidXRpb24gYW5kIFNoYXJlQWxpa2UuCgogICAgIGguCUxpY2Vuc2VkIE1hdGVyaWFsIG1lYW5zIHRoZSBhcnRpc3RpYyBvciBsaXRlcmFyeSB3b3JrLCBkYXRhYmFzZSwgb3Igb3RoZXIgbWF0ZXJpYWwgdG8gd2hpY2ggdGhlIExpY2Vuc29yIGFwcGxpZWQgdGhpcyBQdWJsaWMgTGljZW5zZS4KCiAgICAgaS4JTGljZW5zZWQgUmlnaHRzIG1lYW5zIHRoZSByaWdodHMgZ3JhbnRlZCB0byBZb3Ugc3ViamVjdCB0byB0aGUgdGVybXMgYW5kIGNvbmRpdGlvbnMgb2YgdGhpcyBQdWJsaWMgTGljZW5zZSwgd2hpY2ggYXJlIGxpbWl0ZWQgdG8gYWxsIENvcHlyaWdodCBhbmQgU2ltaWxhciBSaWdodHMgdGhhdCBhcHBseSB0byBZb3VyIHVzZSBvZiB0aGUgTGljZW5zZWQgTWF0ZXJpYWwgYW5kIHRoYXQgdGhlIExpY2Vuc29yIGhhcyBhdXRob3JpdHkgdG8gbGljZW5zZS4KCiAgICAgai4JTGljZW5zb3IgbWVhbnMgdGhlIGluZGl2aWR1YWwocykgb3IgZW50aXR5KGllcykgZ3JhbnRpbmcgcmlnaHRzIHVuZGVyIHRoaXMgUHVibGljIExpY2Vuc2UuCgogICAgIGsuCVNoYXJlIG1lYW5zIHRvIHByb3ZpZGUgbWF0ZXJpYWwgdG8gdGhlIHB1YmxpYyBieSBhbnkgbWVhbnMgb3IgcHJvY2VzcyB0aGF0IHJlcXVpcmVzIHBlcm1pc3Npb24gdW5kZXIgdGhlIExpY2Vuc2VkIFJpZ2h0cywgc3VjaCBhcyByZXByb2R1Y3Rpb24sIHB1YmxpYyBkaXNwbGF5LCBwdWJsaWMgcGVyZm9ybWFuY2UsIGRpc3RyaWJ1dGlvbiwgZGlzc2VtaW5hdGlvbiwgY29tbXVuaWNhdGlvbiwgb3IgaW1wb3J0YXRpb24sIGFuZCB0byBtYWtlIG1hdGVyaWFsIGF2YWlsYWJsZSB0byB0aGUgcHVibGljIGluY2x1ZGluZyBpbiB3YXlzIHRoYXQgbWVtYmVycyBvZiB0aGUgcHVibGljIG1heSBhY2Nlc3MgdGhlIG1hdGVyaWFsIGZyb20gYSBwbGFjZSBhbmQgYXQgYSB0aW1lIGluZGl2aWR1YWxseSBjaG9zZW4gYnkgdGhlbS4KCiAgICAgbC4JU3VpIEdlbmVyaXMgRGF0YWJhc2UgUmlnaHRzIG1lYW5zIHJpZ2h0cyBvdGhlciB0aGFuIGNvcHlyaWdodCByZXN1bHRpbmcgZnJvbSBEaXJlY3RpdmUgOTYvOS9FQyBvZiB0aGUgRXVyb3BlYW4gUGFybGlhbWVudCBhbmQgb2YgdGhlIENvdW5jaWwgb2YgMTEgTWFyY2ggMTk5NiBvbiB0aGUgbGVnYWwgcHJvdGVjdGlvbiBvZiBkYXRhYmFzZXMsIGFzIGFtZW5kZWQgYW5kL29yIHN1Y2NlZWRlZCwgYXMgd2VsbCBhcyBvdGhlciBlc3NlbnRpYWxseSBlcXVpdmFsZW50IHJpZ2h0cyBhbnl3aGVyZSBpbiB0aGUgd29ybGQuCgogICAgIG0uCVlvdSBtZWFucyB0aGUgaW5kaXZpZHVhbCBvciBlbnRpdHkgZXhlcmNpc2luZyB0aGUgTGljZW5zZWQgUmlnaHRzIHVuZGVyIHRoaXMgUHVibGljIExpY2Vuc2UuIFlvdXIgaGFzIGEgY29ycmVzcG9uZGluZyBtZWFuaW5nLgoKU2VjdGlvbiAyIOKAkyBTY29wZS4KCiAgICAgYS4JTGljZW5zZSBncmFudC4KCiAgICAgICAgICAxLiBTdWJqZWN0IHRvIHRoZSB0ZXJtcyBhbmQgY29uZGl0aW9ucyBvZiB0aGlzIFB1YmxpYyBMaWNlbnNlLCB0aGUgTGljZW5zb3IgaGVyZWJ5IGdyYW50cyBZb3UgYSB3b3JsZHdpZGUsIHJveWFsdHktZnJlZSwgbm9uLXN1YmxpY2Vuc2FibGUsIG5vbi1leGNsdXNpdmUsIGlycmV2b2NhYmxlIGxpY2Vuc2UgdG8gZXhlcmNpc2UgdGhlIExpY2Vuc2VkIFJpZ2h0cyBpbiB0aGUgTGljZW5zZWQgTWF0ZXJpYWwgdG86CgogICAgICAgICAgICAgICBBLiByZXByb2R1Y2UgYW5kIFNoYXJlIHRoZSBMaWNlbnNlZCBNYXRlcmlhbCwgaW4gd2hvbGUgb3IgaW4gcGFydDsgYW5kCgogICAgICAgICAgICAgICBCLiBwcm9kdWNlLCByZXByb2R1Y2UsIGFuZCBTaGFyZSBBZGFwdGVkIE1hdGVyaWFsLgoKICAgICAgICAgIDIuIEV4Y2VwdGlvbnMgYW5kIExpbWl0YXRpb25zLiBGb3IgdGhlIGF2b2lkYW5jZSBvZiBkb3VidCwgd2hlcmUgRXhjZXB0aW9ucyBhbmQgTGltaXRhdGlvbnMgYXBwbHkgdG8gWW91ciB1c2UsIHRoaXMgUHVibGljIExpY2Vuc2UgZG9lcyBub3QgYXBwbHksIGFuZCBZb3UgZG8gbm90IG5lZWQgdG8gY29tcGx5IHdpdGggaXRzIHRlcm1zIGFuZCBjb25kaXRpb25zLgoKICAgICAgICAgIDMuIFRlcm0uIFRoZSB0ZXJtIG9mIHRoaXMgUHVibGljIExpY2Vuc2UgaXMgc3BlY2lmaWVkIGluIFNlY3Rpb24gNihhKS4KCiAgICAgICAgICA0LiBNZWRpYSBhbmQgZm9ybWF0czsgdGVjaG5pY2FsIG1vZGlmaWNhdGlvbnMgYWxsb3dlZC4gVGhlIExpY2Vuc29yIGF1dGhvcml6ZXMgWW91IHRvIGV4ZXJjaXNlIHRoZSBMaWNlbnNlZCBSaWdodHMgaW4gYWxsIG1lZGlhIGFuZCBmb3JtYXRzIHdoZXRoZXIgbm93IGtub3duIG9yIGhlcmVhZnRlciBjcmVhdGVkLCBhbmQgdG8gbWFrZSB0ZWNobmljYWwgbW9kaWZpY2F0aW9ucyBuZWNlc3NhcnkgdG8gZG8gc28uIFRoZSBMaWNlbnNvciB3YWl2ZXMgYW5kL29yIGFncmVlcyBub3QgdG8gYXNzZXJ0IGFueSByaWdodCBvciBhdXRob3JpdHkgdG8gZm9yYmlkIFlvdSBmcm9tIG1ha2luZyB0ZWNobmljYWwgbW9kaWZpY2F0aW9ucyBuZWNlc3NhcnkgdG8gZXhlcmNpc2UgdGhlIExpY2Vuc2VkIFJpZ2h0cywgaW5jbHVkaW5nIHRlY2huaWNhbCBtb2RpZmljYXRpb25zIG5lY2Vzc2FyeSB0byBjaXJjdW12ZW50IEVmZmVjdGl2ZSBUZWNobm9sb2dpY2FsIE1lYXN1cmVzLiBGb3IgcHVycG9zZXMgb2YgdGhpcyBQdWJsaWMgTGljZW5zZSwgc2ltcGx5IG1ha2luZyBtb2RpZmljYXRpb25zIGF1dGhvcml6ZWQgYnkgdGhpcyBTZWN0aW9uIDIoYSkoNCkgbmV2ZXIgcHJvZHVjZXMgQWRhcHRlZCBNYXRlcmlhbC4KCiAgICAgICAgICA1LiBEb3duc3RyZWFtIHJlY2lwaWVudHMuCgogICAgICAgICAgICAgICBBLiBPZmZlciBmcm9tIHRoZSBMaWNlbnNvciDigJMgTGljZW5zZWQgTWF0ZXJpYWwuIEV2ZXJ5IHJlY2lwaWVudCBvZiB0aGUgTGljZW5zZWQgTWF0ZXJpYWwgYXV0b21hdGljYWxseSByZWNlaXZlcyBhbiBvZmZlciBmcm9tIHRoZSBMaWNlbnNvciB0byBleGVyY2lzZSB0aGUgTGljZW5zZWQgUmlnaHRzIHVuZGVyIHRoZSB0ZXJtcyBhbmQgY29uZGl0aW9ucyBvZiB0aGlzIFB1YmxpYyBMaWNlbnNlLgoKICAgICAgICAgICAgICAgQi4gQWRkaXRpb25hbCBvZmZlciBmcm9tIHRoZSBMaWNlbnNvciDigJMgQWRhcHRlZCBNYXRlcmlhbC4gRXZlcnkgcmVjaXBpZW50IG9mIEFkYXB0ZWQgTWF0ZXJpYWwgZnJvbSBZb3UgYXV0b21hdGljYWxseSByZWNlaXZlcyBhbiBvZmZlciBmcm9tIHRoZSBMaWNlbnNvciB0byBleGVyY2lzZSB0aGUgTGljZW5zZWQgUmlnaHRzIGluIHRoZSBBZGFwdGVkIE1hdGVyaWFsIHVuZGVyIHRoZSBjb25kaXRpb25zIG9mIHRoZSBBZGFwdGVy4oCZcyBMaWNlbnNlIFlvdSBhcHBseS4KCiAgICAgICAgICAgICAgIEMuIE5vIGRvd25zdHJlYW0gcmVzdHJpY3Rpb25zLiBZb3UgbWF5IG5vdCBvZmZlciBvciBpbXBvc2UgYW55IGFkZGl0aW9uYWwgb3IgZGlmZmVyZW50IHRlcm1zIG9yIGNvbmRpdGlvbnMgb24sIG9yIGFwcGx5IGFueSBFZmZlY3RpdmUgVGVjaG5vbG9naWNhbCBNZWFzdXJlcyB0bywgdGhlIExpY2Vuc2VkIE1hdGVyaWFsIGlmIGRvaW5nIHNvIHJlc3RyaWN0cyBleGVyY2lzZSBvZiB0aGUgTGljZW5zZWQgUmlnaHRzIGJ5IGFueSByZWNpcGllbnQgb2YgdGhlIExpY2Vuc2VkIE1hdGVyaWFsLgoKICAgICAgICAgIDYuIE5vIGVuZG9yc2VtZW50LiBOb3RoaW5nIGluIHRoaXMgUHVibGljIExpY2Vuc2UgY29uc3RpdHV0ZXMgb3IgbWF5IGJlIGNvbnN0cnVlZCBhcyBwZXJtaXNzaW9uIHRvIGFzc2VydCBvciBpbXBseSB0aGF0IFlvdSBhcmUsIG9yIHRoYXQgWW91ciB1c2Ugb2YgdGhlIExpY2Vuc2VkIE1hdGVyaWFsIGlzLCBjb25uZWN0ZWQgd2l0aCwgb3Igc3BvbnNvcmVkLCBlbmRvcnNlZCwgb3IgZ3JhbnRlZCBvZmZpY2lhbCBzdGF0dXMgYnksIHRoZSBMaWNlbnNvciBvciBvdGhlcnMgZGVzaWduYXRlZCB0byByZWNlaXZlIGF0dHJpYnV0aW9uIGFzIHByb3ZpZGVkIGluIFNlY3Rpb24gMyhhKSgxKShBKShpKS4KCiAgICAgYi4JT3RoZXIgcmlnaHRzLgoKICAgICAgICAgIDEuIE1vcmFsIHJpZ2h0cywgc3VjaCBhcyB0aGUgcmlnaHQgb2YgaW50ZWdyaXR5LCBhcmUgbm90IGxpY2Vuc2VkIHVuZGVyIHRoaXMgUHVibGljIExpY2Vuc2UsIG5vciBhcmUgcHVibGljaXR5LCBwcml2YWN5LCBhbmQvb3Igb3RoZXIgc2ltaWxhciBwZXJzb25hbGl0eSByaWdodHM7IGhvd2V2ZXIsIHRvIHRoZSBleHRlbnQgcG9zc2libGUsIHRoZSBMaWNlbnNvciB3YWl2ZXMgYW5kL29yIGFncmVlcyBub3QgdG8gYXNzZXJ0IGFueSBzdWNoIHJpZ2h0cyBoZWxkIGJ5IHRoZSBMaWNlbnNvciB0byB0aGUgbGltaXRlZCBleHRlbnQgbmVjZXNzYXJ5IHRvIGFsbG93IFlvdSB0byBleGVyY2lzZSB0aGUgTGljZW5zZWQgUmlnaHRzLCBidXQgbm90IG90aGVyd2lzZS4KCiAgICAgICAgICAyLiBQYXRlbnQgYW5kIHRyYWRlbWFyayByaWdodHMgYXJlIG5vdCBsaWNlbnNlZCB1bmRlciB0aGlzIFB1YmxpYyBMaWNlbnNlLgoKICAgICAgICAgIDMuIFRvIHRoZSBleHRlbnQgcG9zc2libGUsIHRoZSBMaWNlbnNvciB3YWl2ZXMgYW55IHJpZ2h0IHRvIGNvbGxlY3Qgcm95YWx0aWVzIGZyb20gWW91IGZvciB0aGUgZXhlcmNpc2Ugb2YgdGhlIExpY2Vuc2VkIFJpZ2h0cywgd2hldGhlciBkaXJlY3RseSBvciB0aHJvdWdoIGEgY29sbGVjdGluZyBzb2NpZXR5IHVuZGVyIGFueSB2b2x1bnRhcnkgb3Igd2FpdmFibGUgc3RhdHV0b3J5IG9yIGNvbXB1bHNvcnkgbGljZW5zaW5nIHNjaGVtZS4gSW4gYWxsIG90aGVyIGNhc2VzIHRoZSBMaWNlbnNvciBleHByZXNzbHkgcmVzZXJ2ZXMgYW55IHJpZ2h0IHRvIGNvbGxlY3Qgc3VjaCByb3lhbHRpZXMuCgpTZWN0aW9uIDMg4oCTIExpY2Vuc2UgQ29uZGl0aW9ucy4KCllvdXIgZXhlcmNpc2Ugb2YgdGhlIExpY2Vuc2VkIFJpZ2h0cyBpcyBleHByZXNzbHkgbWFkZSBzdWJqZWN0IHRvIHRoZSBmb2xsb3dpbmcgY29uZGl0aW9ucy4KCiAgICAgYS4JQXR0cmlidXRpb24uCgogICAgICAgICAgMS4gSWYgWW91IFNoYXJlIHRoZSBMaWNlbnNlZCBNYXRlcmlhbCAoaW5jbHVkaW5nIGluIG1vZGlmaWVkIGZvcm0pLCBZb3UgbXVzdDoKCiAgICAgICAgICAgICAgIEEuIHJldGFpbiB0aGUgZm9sbG93aW5nIGlmIGl0IGlzIHN1cHBsaWVkIGJ5IHRoZSBMaWNlbnNvciB3aXRoIHRoZSBMaWNlbnNlZCBNYXRlcmlhbDoKCiAgICAgICAgICAgICAgICAgICAgaS4JaWRlbnRpZmljYXRpb24gb2YgdGhlIGNyZWF0b3Iocykgb2YgdGhlIExpY2Vuc2VkIE1hdGVyaWFsIGFuZCBhbnkgb3RoZXJzIGRlc2lnbmF0ZWQgdG8gcmVjZWl2ZSBhdHRyaWJ1dGlvbiwgaW4gYW55IHJlYXNvbmFibGUgbWFubmVyIHJlcXVlc3RlZCBieSB0aGUgTGljZW5zb3IgKGluY2x1ZGluZyBieSBwc2V1ZG9ueW0gaWYgZGVzaWduYXRlZCk7CgogICAgICAgICAgICAgICAgICAgIGlpLglhIGNvcHlyaWdodCBub3RpY2U7CgogICAgICAgICAgICAgICAgICAgIGlpaS4gYSBub3RpY2UgdGhhdCByZWZlcnMgdG8gdGhpcyBQdWJsaWMgTGljZW5zZTsKCiAgICAgICAgICAgICAgICAgICAgaXYuCWEgbm90aWNlIHRoYXQgcmVmZXJzIHRvIHRoZSBkaXNjbGFpbWVyIG9mIHdhcnJhbnRpZXM7CgogICAgICAgICAgICAgICAgICAgIHYuCWEgVVJJIG9yIGh5cGVybGluayB0byB0aGUgTGljZW5zZWQgTWF0ZXJpYWwgdG8gdGhlIGV4dGVudCByZWFzb25hYmx5IHByYWN0aWNhYmxlOwoKICAgICAgICAgICAgICAgQi4gaW5kaWNhdGUgaWYgWW91IG1vZGlmaWVkIHRoZSBMaWNlbnNlZCBNYXRlcmlhbCBhbmQgcmV0YWluIGFuIGluZGljYXRpb24gb2YgYW55IHByZXZpb3VzIG1vZGlmaWNhdGlvbnM7IGFuZAoKICAgICAgICAgICAgICAgQy4gaW5kaWNhdGUgdGhlIExpY2Vuc2VkIE1hdGVyaWFsIGlzIGxpY2Vuc2VkIHVuZGVyIHRoaXMgUHVibGljIExpY2Vuc2UsIGFuZCBpbmNsdWRlIHRoZSB0ZXh0IG9mLCBvciB0aGUgVVJJIG9yIGh5cGVybGluayB0bywgdGhpcyBQdWJsaWMgTGljZW5zZS4KCiAgICAgICAgICAyLiBZb3UgbWF5IHNhdGlzZnkgdGhlIGNvbmRpdGlvbnMgaW4gU2VjdGlvbiAzKGEpKDEpIGluIGFueSByZWFzb25hYmxlIG1hbm5lciBiYXNlZCBvbiB0aGUgbWVkaXVtLCBtZWFucywgYW5kIGNvbnRleHQgaW4gd2hpY2ggWW91IFNoYXJlIHRoZSBMaWNlbnNlZCBNYXRlcmlhbC4gRm9yIGV4YW1wbGUsIGl0IG1heSBiZSByZWFzb25hYmxlIHRvIHNhdGlzZnkgdGhlIGNvbmRpdGlvbnMgYnkgcHJvdmlkaW5nIGEgVVJJIG9yIGh5cGVybGluayB0byBhIHJlc291cmNlIHRoYXQgaW5jbHVkZXMgdGhlIHJlcXVpcmVkIGluZm9ybWF0aW9uLgoKICAgICAgICAgIDMuIElmIHJlcXVlc3RlZCBieSB0aGUgTGljZW5zb3IsIFlvdSBtdXN0IHJlbW92ZSBhbnkgb2YgdGhlIGluZm9ybWF0aW9uIHJlcXVpcmVkIGJ5IFNlY3Rpb24gMyhhKSgxKShBKSB0byB0aGUgZXh0ZW50IHJlYXNvbmFibHkgcHJhY3RpY2FibGUuCgogICAgIGIuCVNoYXJlQWxpa2UuSW4gYWRkaXRpb24gdG8gdGhlIGNvbmRpdGlvbnMgaW4gU2VjdGlvbiAzKGEpLCBpZiBZb3UgU2hhcmUgQWRhcHRlZCBNYXRlcmlhbCBZb3UgcHJvZHVjZSwgdGhlIGZvbGxvd2luZyBjb25kaXRpb25zIGFsc28gYXBwbHkuCgogICAgICAgICAgMS4gVGhlIEFkYXB0ZXLigJlzIExpY2Vuc2UgWW91IGFwcGx5IG11c3QgYmUgYSBDcmVhdGl2ZSBDb21tb25zIGxpY2Vuc2Ugd2l0aCB0aGUgc2FtZSBMaWNlbnNlIEVsZW1lbnRzLCB0aGlzIHZlcnNpb24gb3IgbGF0ZXIsIG9yIGEgQlktU0EgQ29tcGF0aWJsZSBMaWNlbnNlLgoKICAgICAgICAgIDIuIFlvdSBtdXN0IGluY2x1ZGUgdGhlIHRleHQgb2YsIG9yIHRoZSBVUkkgb3IgaHlwZXJsaW5rIHRvLCB0aGUgQWRhcHRlcidzIExpY2Vuc2UgWW91IGFwcGx5LiBZb3UgbWF5IHNhdGlzZnkgdGhpcyBjb25kaXRpb24gaW4gYW55IHJlYXNvbmFibGUgbWFubmVyIGJhc2VkIG9uIHRoZSBtZWRpdW0sIG1lYW5zLCBhbmQgY29udGV4dCBpbiB3aGljaCBZb3UgU2hhcmUgQWRhcHRlZCBNYXRlcmlhbC4KCiAgICAgICAgICAzLiBZb3UgbWF5IG5vdCBvZmZlciBvciBpbXBvc2UgYW55IGFkZGl0aW9uYWwgb3IgZGlmZmVyZW50IHRlcm1zIG9yIGNvbmRpdGlvbnMgb24sIG9yIGFwcGx5IGFueSBFZmZlY3RpdmUgVGVjaG5vbG9naWNhbCBNZWFzdXJlcyB0bywgQWRhcHRlZCBNYXRlcmlhbCB0aGF0IHJlc3RyaWN0IGV4ZXJjaXNlIG9mIHRoZSByaWdodHMgZ3JhbnRlZCB1bmRlciB0aGUgQWRhcHRlcidzIExpY2Vuc2UgWW91IGFwcGx5LgoKU2VjdGlvbiA0IOKAkyBTdWkgR2VuZXJpcyBEYXRhYmFzZSBSaWdodHMuCgpXaGVyZSB0aGUgTGljZW5zZWQgUmlnaHRzIGluY2x1ZGUgU3VpIEdlbmVyaXMgRGF0YWJhc2UgUmlnaHRzIHRoYXQgYXBwbHkgdG8gWW91ciB1c2Ugb2YgdGhlIExpY2Vuc2VkIE1hdGVyaWFsOgoKICAgICBhLglmb3IgdGhlIGF2b2lkYW5jZSBvZiBkb3VidCwgU2VjdGlvbiAyKGEpKDEpIGdyYW50cyBZb3UgdGhlIHJpZ2h0IHRvIGV4dHJhY3QsIHJldXNlLCByZXByb2R1Y2UsIGFuZCBTaGFyZSBhbGwgb3IgYSBzdWJzdGFudGlhbCBwb3J0aW9uIG9mIHRoZSBjb250ZW50cyBvZiB0aGUgZGF0YWJhc2U7CgogICAgIGIuCWlmIFlvdSBpbmNsdWRlIGFsbCBvciBhIHN1YnN0YW50aWFsIHBvcnRpb24gb2YgdGhlIGRhdGFiYXNlIGNvbnRlbnRzIGluIGEgZGF0YWJhc2UgaW4gd2hpY2ggWW91IGhhdmUgU3VpIEdlbmVyaXMgRGF0YWJhc2UgUmlnaHRzLCB0aGVuIHRoZSBkYXRhYmFzZSBpbiB3aGljaCBZb3UgaGF2ZSBTdWkgR2VuZXJpcyBEYXRhYmFzZSBSaWdodHMgKGJ1dCBub3QgaXRzIGluZGl2aWR1YWwgY29udGVudHMpIGlzIEFkYXB0ZWQgTWF0ZXJpYWwsIGluY2x1ZGluZyBmb3IgcHVycG9zZXMgb2YgU2VjdGlvbiAzKGIpOyBhbmQKCiAgICAgYy4JWW91IG11c3QgY29tcGx5IHdpdGggdGhlIGNvbmRpdGlvbnMgaW4gU2VjdGlvbiAzKGEpIGlmIFlvdSBTaGFyZSBhbGwgb3IgYSBzdWJzdGFudGlhbCBwb3J0aW9uIG9mIHRoZSBjb250ZW50cyBvZiB0aGUgZGF0YWJhc2UuCkZvciB0aGUgYXZvaWRhbmNlIG9mIGRvdWJ0LCB0aGlzIFNlY3Rpb24gNCBzdXBwbGVtZW50cyBhbmQgZG9lcyBub3QgcmVwbGFjZSBZb3VyIG9ibGlnYXRpb25zIHVuZGVyIHRoaXMgUHVibGljIExpY2Vuc2Ugd2hlcmUgdGhlIExpY2Vuc2VkIFJpZ2h0cyBpbmNsdWRlIG90aGVyIENvcHlyaWdodCBhbmQgU2ltaWxhciBSaWdodHMuCgpTZWN0aW9uIDUg4oCTIERpc2NsYWltZXIgb2YgV2FycmFudGllcyBhbmQgTGltaXRhdGlvbiBvZiBMaWFiaWxpdHkuCgogICAgIGEuCVVubGVzcyBvdGhlcndpc2Ugc2VwYXJhdGVseSB1bmRlcnRha2VuIGJ5IHRoZSBMaWNlbnNvciwgdG8gdGhlIGV4dGVudCBwb3NzaWJsZSwgdGhlIExpY2Vuc29yIG9mZmVycyB0aGUgTGljZW5zZWQgTWF0ZXJpYWwgYXMtaXMgYW5kIGFzLWF2YWlsYWJsZSwgYW5kIG1ha2VzIG5vIHJlcHJlc2VudGF0aW9ucyBvciB3YXJyYW50aWVzIG9mIGFueSBraW5kIGNvbmNlcm5pbmcgdGhlIExpY2Vuc2VkIE1hdGVyaWFsLCB3aGV0aGVyIGV4cHJlc3MsIGltcGxpZWQsIHN0YXR1dG9yeSwgb3Igb3RoZXIuIFRoaXMgaW5jbHVkZXMsIHdpdGhvdXQgbGltaXRhdGlvbiwgd2FycmFudGllcyBvZiB0aXRsZSwgbWVyY2hhbnRhYmlsaXR5LCBmaXRuZXNzIGZvciBhIHBhcnRpY3VsYXIgcHVycG9zZSwgbm9uLWluZnJpbmdlbWVudCwgYWJzZW5jZSBvZiBsYXRlbnQgb3Igb3RoZXIgZGVmZWN0cywgYWNjdXJhY3ksIG9yIHRoZSBwcmVzZW5jZSBvciBhYnNlbmNlIG9mIGVycm9ycywgd2hldGhlciBvciBub3Qga25vd24gb3IgZGlzY292ZXJhYmxlLiBXaGVyZSBkaXNjbGFpbWVycyBvZiB3YXJyYW50aWVzIGFyZSBub3QgYWxsb3dlZCBpbiBmdWxsIG9yIGluIHBhcnQsIHRoaXMgZGlzY2xhaW1lciBtYXkgbm90IGFwcGx5IHRvIFlvdS4KCiAgICAgYi4JVG8gdGhlIGV4dGVudCBwb3NzaWJsZSwgaW4gbm8gZXZlbnQgd2lsbCB0aGUgTGljZW5zb3IgYmUgbGlhYmxlIHRvIFlvdSBvbiBhbnkgbGVnYWwgdGhlb3J5IChpbmNsdWRpbmcsIHdpdGhvdXQgbGltaXRhdGlvbiwgbmVnbGlnZW5jZSkgb3Igb3RoZXJ3aXNlIGZvciBhbnkgZGlyZWN0LCBzcGVjaWFsLCBpbmRpcmVjdCwgaW5jaWRlbnRhbCwgY29uc2VxdWVudGlhbCwgcHVuaXRpdmUsIGV4ZW1wbGFyeSwgb3Igb3RoZXIgbG9zc2VzLCBjb3N0cywgZXhwZW5zZXMsIG9yIGRhbWFnZXMgYXJpc2luZyBvdXQgb2YgdGhpcyBQdWJsaWMgTGljZW5zZSBvciB1c2Ugb2YgdGhlIExpY2Vuc2VkIE1hdGVyaWFsLCBldmVuIGlmIHRoZSBMaWNlbnNvciBoYXMgYmVlbiBhZHZpc2VkIG9mIHRoZSBwb3NzaWJpbGl0eSBvZiBzdWNoIGxvc3NlcywgY29zdHMsIGV4cGVuc2VzLCBvciBkYW1hZ2VzLiBXaGVyZSBhIGxpbWl0YXRpb24gb2YgbGlhYmlsaXR5IGlzIG5vdCBhbGxvd2VkIGluIGZ1bGwgb3IgaW4gcGFydCwgdGhpcyBsaW1pdGF0aW9uIG1heSBub3QgYXBwbHkgdG8gWW91LgoKICAgICBjLglUaGUgZGlzY2xhaW1lciBvZiB3YXJyYW50aWVzIGFuZCBsaW1pdGF0aW9uIG9mIGxpYWJpbGl0eSBwcm92aWRlZCBhYm92ZSBzaGFsbCBiZSBpbnRlcnByZXRlZCBpbiBhIG1hbm5lciB0aGF0LCB0byB0aGUgZXh0ZW50IHBvc3NpYmxlLCBtb3N0IGNsb3NlbHkgYXBwcm94aW1hdGVzIGFuIGFic29sdXRlIGRpc2NsYWltZXIgYW5kIHdhaXZlciBvZiBhbGwgbGlhYmlsaXR5LgoKU2VjdGlvbiA2IOKAkyBUZXJtIGFuZCBUZXJtaW5hdGlvbi4KCiAgICAgYS4JVGhpcyBQdWJsaWMgTGljZW5zZSBhcHBsaWVzIGZvciB0aGUgdGVybSBvZiB0aGUgQ29weXJpZ2h0IGFuZCBTaW1pbGFyIFJpZ2h0cyBsaWNlbnNlZCBoZXJlLiBIb3dldmVyLCBpZiBZb3UgZmFpbCB0byBjb21wbHkgd2l0aCB0aGlzIFB1YmxpYyBMaWNlbnNlLCB0aGVuIFlvdXIgcmlnaHRzIHVuZGVyIHRoaXMgUHVibGljIExpY2Vuc2UgdGVybWluYXRlIGF1dG9tYXRpY2FsbHkuCgogICAgIGIuCVdoZXJlIFlvdXIgcmlnaHQgdG8gdXNlIHRoZSBMaWNlbnNlZCBNYXRlcmlhbCBoYXMgdGVybWluYXRlZCB1bmRlciBTZWN0aW9uIDYoYSksIGl0IHJlaW5zdGF0ZXM6CgogICAgICAgICAgMS4gYXV0b21hdGljYWxseSBhcyBvZiB0aGUgZGF0ZSB0aGUgdmlvbGF0aW9uIGlzIGN1cmVkLCBwcm92aWRlZCBpdCBpcyBjdXJlZCB3aXRoaW4gMzAgZGF5cyBvZiBZb3VyIGRpc2NvdmVyeSBvZiB0aGUgdmlvbGF0aW9uOyBvcgoKICAgICAgICAgIDIuIHVwb24gZXhwcmVzcyByZWluc3RhdGVtZW50IGJ5IHRoZSBMaWNlbnNvci4KCiAgICAgYy4JRm9yIHRoZSBhdm9pZGFuY2Ugb2YgZG91YnQsIHRoaXMgU2VjdGlvbiA2KGIpIGRvZXMgbm90IGFmZmVjdCBhbnkgcmlnaHQgdGhlIExpY2Vuc29yIG1heSBoYXZlIHRvIHNlZWsgcmVtZWRpZXMgZm9yIFlvdXIgdmlvbGF0aW9ucyBvZiB0aGlzIFB1YmxpYyBMaWNlbnNlLgoKICAgICBkLglGb3IgdGhlIGF2b2lkYW5jZSBvZiBkb3VidCwgdGhlIExpY2Vuc29yIG1heSBhbHNvIG9mZmVyIHRoZSBMaWNlbnNlZCBNYXRlcmlhbCB1bmRlciBzZXBhcmF0ZSB0ZXJtcyBvciBjb25kaXRpb25zIG9yIHN0b3AgZGlzdHJpYnV0aW5nIHRoZSBMaWNlbnNlZCBNYXRlcmlhbCBhdCBhbnkgdGltZTsgaG93ZXZlciwgZG9pbmcgc28gd2lsbCBub3QgdGVybWluYXRlIHRoaXMgUHVibGljIExpY2Vuc2UuCgogICAgIGUuCVNlY3Rpb25zIDEsIDUsIDYsIDcsIGFuZCA4IHN1cnZpdmUgdGVybWluYXRpb24gb2YgdGhpcyBQdWJsaWMgTGljZW5zZS4KClNlY3Rpb24gNyDigJMgT3RoZXIgVGVybXMgYW5kIENvbmRpdGlvbnMuCgogICAgIGEuCVRoZSBMaWNlbnNvciBzaGFsbCBub3QgYmUgYm91bmQgYnkgYW55IGFkZGl0aW9uYWwgb3IgZGlmZmVyZW50IHRlcm1zIG9yIGNvbmRpdGlvbnMgY29tbXVuaWNhdGVkIGJ5IFlvdSB1bmxlc3MgZXhwcmVzc2x5IGFncmVlZC4KCiAgICAgYi4JQW55IGFycmFuZ2VtZW50cywgdW5kZXJzdGFuZGluZ3MsIG9yIGFncmVlbWVudHMgcmVnYXJkaW5nIHRoZSBMaWNlbnNlZCBNYXRlcmlhbCBub3Qgc3RhdGVkIGhlcmVpbiBhcmUgc2VwYXJhdGUgZnJvbSBhbmQgaW5kZXBlbmRlbnQgb2YgdGhlIHRlcm1zIGFuZCBjb25kaXRpb25zIG9mIHRoaXMgUHVibGljIExpY2Vuc2UuCgpTZWN0aW9uIDgg4oCTIEludGVycHJldGF0aW9uLgoKICAgICBhLglGb3IgdGhlIGF2b2lkYW5jZSBvZiBkb3VidCwgdGhpcyBQdWJsaWMgTGljZW5zZSBkb2VzIG5vdCwgYW5kIHNoYWxsIG5vdCBiZSBpbnRlcnByZXRlZCB0bywgcmVkdWNlLCBsaW1pdCwgcmVzdHJpY3QsIG9yIGltcG9zZSBjb25kaXRpb25zIG9uIGFueSB1c2Ugb2YgdGhlIExpY2Vuc2VkIE1hdGVyaWFsIHRoYXQgY291bGQgbGF3ZnVsbHkgYmUgbWFkZSB3aXRob3V0IHBlcm1pc3Npb24gdW5kZXIgdGhpcyBQdWJsaWMgTGljZW5zZS4KCiAgICAgYi4JVG8gdGhlIGV4dGVudCBwb3NzaWJsZSwgaWYgYW55IHByb3Zpc2lvbiBvZiB0aGlzIFB1YmxpYyBMaWNlbnNlIGlzIGRlZW1lZCB1bmVuZm9yY2VhYmxlLCBpdCBzaGFsbCBiZSBhdXRvbWF0aWNhbGx5IHJlZm9ybWVkIHRvIHRoZSBtaW5pbXVtIGV4dGVudCBuZWNlc3NhcnkgdG8gbWFrZSBpdCBlbmZvcmNlYWJsZS4gSWYgdGhlIHByb3Zpc2lvbiBjYW5ub3QgYmUgcmVmb3JtZWQsIGl0IHNoYWxsIGJlIHNldmVyZWQgZnJvbSB0aGlzIFB1YmxpYyBMaWNlbnNlIHdpdGhvdXQgYWZmZWN0aW5nIHRoZSBlbmZvcmNlYWJpbGl0eSBvZiB0aGUgcmVtYWluaW5nIHRlcm1zIGFuZCBjb25kaXRpb25zLgoKICAgICBjLglObyB0ZXJtIG9yIGNvbmRpdGlvbiBvZiB0aGlzIFB1YmxpYyBMaWNlbnNlIHdpbGwgYmUgd2FpdmVkIGFuZCBubyBmYWlsdXJlIHRvIGNvbXBseSBjb25zZW50ZWQgdG8gdW5sZXNzIGV4cHJlc3NseSBhZ3JlZWQgdG8gYnkgdGhlIExpY2Vuc29yLgoKICAgICBkLglOb3RoaW5nIGluIHRoaXMgUHVibGljIExpY2Vuc2UgY29uc3RpdHV0ZXMgb3IgbWF5IGJlIGludGVycHJldGVkIGFzIGEgbGltaXRhdGlvbiB1cG9uLCBvciB3YWl2ZXIgb2YsIGFueSBwcml2aWxlZ2VzIGFuZCBpbW11bml0aWVzIHRoYXQgYXBwbHkgdG8gdGhlIExpY2Vuc29yIG9yIFlvdSwgaW5jbHVkaW5nIGZyb20gdGhlIGxlZ2FsIHByb2Nlc3NlcyBvZiBhbnkganVyaXNkaWN0aW9uIG9yIGF1dGhvcml0eS4KCkNyZWF0aXZlIENvbW1vbnMgaXMgbm90IGEgcGFydHkgdG8gaXRzIHB1YmxpYyBsaWNlbnNlcy4gTm90d2l0aHN0YW5kaW5nLCBDcmVhdGl2ZSBDb21tb25zIG1heSBlbGVjdCB0byBhcHBseSBvbmUgb2YgaXRzIHB1YmxpYyBsaWNlbnNlcyB0byBtYXRlcmlhbCBpdCBwdWJsaXNoZXMgYW5kIGluIHRob3NlIGluc3RhbmNlcyB3aWxsIGJlIGNvbnNpZGVyZWQgdGhlIOKAnExpY2Vuc29yLuKAnSBFeGNlcHQgZm9yIHRoZSBsaW1pdGVkIHB1cnBvc2Ugb2YgaW5kaWNhdGluZyB0aGF0IG1hdGVyaWFsIGlzIHNoYXJlZCB1bmRlciBhIENyZWF0aXZlIENvbW1vbnMgcHVibGljIGxpY2Vuc2Ugb3IgYXMgb3RoZXJ3aXNlIHBlcm1pdHRlZCBieSB0aGUgQ3JlYXRpdmUgQ29tbW9ucyBwb2xpY2llcyBwdWJsaXNoZWQgYXQgY3JlYXRpdmVjb21tb25zLm9yZy9wb2xpY2llcywgQ3JlYXRpdmUgQ29tbW9ucyBkb2VzIG5vdCBhdXRob3JpemUgdGhlIHVzZSBvZiB0aGUgdHJhZGVtYXJrIOKAnENyZWF0aXZlIENvbW1vbnPigJ0gb3IgYW55IG90aGVyIHRyYWRlbWFyayBvciBsb2dvIG9mIENyZWF0aXZlIENvbW1vbnMgd2l0aG91dCBpdHMgcHJpb3Igd3JpdHRlbiBjb25zZW50IGluY2x1ZGluZywgd2l0aG91dCBsaW1pdGF0aW9uLCBpbiBjb25uZWN0aW9uIHdpdGggYW55IHVuYXV0aG9yaXplZCBtb2RpZmljYXRpb25zIHRvIGFueSBvZiBpdHMgcHVibGljIGxpY2Vuc2VzIG9yIGFueSBvdGhlciBhcnJhbmdlbWVudHMsIHVuZGVyc3RhbmRpbmdzLCBvciBhZ3JlZW1lbnRzIGNvbmNlcm5pbmcgdXNlIG9mIGxpY2Vuc2VkIG1hdGVyaWFsLiBGb3IgdGhlIGF2b2lkYW5jZSBvZiBkb3VidCwgdGhpcyBwYXJhZ3JhcGggZG9lcyBub3QgZm9ybSBwYXJ0IG9mIHRoZSBwdWJsaWMgbGljZW5zZXMuCgpDcmVhdGl2ZSBDb21tb25zIG1heSBiZSBjb250YWN0ZWQgYXQgY3JlYXRpdmVjb21tb25zLm9yZy4=" + }, + "url": "https://creativecommons.org/licenses/by-sa/4.0/legalcode" + } + } + ], + "version": "1", + "purl": "pkg:/Nina Scholz/56116554@1", + "supplier": { + "name": "Nina Scholz" + }, + "bom-ref": "56116554_1_2bdf7a6d-41f0-4ac6-95f2-95d025157818", + "description": "", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "3474" + } + ] + }, + { + "name": "aureooms-js-algorithms", + "type": "library", + "licenses": [ + { + "license": { + "name": "AGPL-3.0", + "url": "" + } + } + ], + "version": "3.0.6", + "purl": "pkg:npm/aureooms/aureooms-js-algorithms@3.0.6", + "supplier": { + "name": "aureooms" + }, + "bom-ref": "aureooms-js-algorithms_3.0.6_274fcf61-b14f-4fec-9ccb-9d007c45ef5c", + "description": "", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "2248" + } + ] + }, + { + "name": "JSONStream", + "type": "library", + "version": "1.3.5", + "purl": "pkg:npm/JSONStream@1.3.5", + "bom-ref": "JSONStream_1.3.5_a41fb49f-00b3-4f84-a133-c2905a5c620d", + "description": "rawStream.pipe(JSONStream.parse()).pipe(streamOfObjects)", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "20" + } + ] + }, + { + "name": "abbrev", + "type": "library", + "licenses": [ + { + "license": { + "id": "ISC", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "SVNDIExpY2Vuc2U6CgpDb3B5cmlnaHQgKGMpIDIwMDQtMjAxMCBieSBJbnRlcm5ldCBTeXN0ZW1zIENvbnNvcnRpdW0sIEluYy4gKCJJU0MiKQpDb3B5cmlnaHQgKGMpIDE5OTUtMjAwMyBieSBJbnRlcm5ldCBTb2Z0d2FyZSBDb25zb3J0aXVtCgpQZXJtaXNzaW9uIHRvIHVzZSwgY29weSwgbW9kaWZ5LCBhbmQvb3IgZGlzdHJpYnV0ZSB0aGlzIHNvZnR3YXJlIGZvciBhbnkgcHVycG9zZSB3aXRoIG9yIHdpdGhvdXQgZmVlIGlzIGhlcmVieSBncmFudGVkLCBwcm92aWRlZCB0aGF0IHRoZSBhYm92ZSBjb3B5cmlnaHQgbm90aWNlIGFuZCB0aGlzIHBlcm1pc3Npb24gbm90aWNlIGFwcGVhciBpbiBhbGwgY29waWVzLgoKVEhFIFNPRlRXQVJFIElTIFBST1ZJREVEICJBUyBJUyIgQU5EIElTQyBESVNDTEFJTVMgQUxMIFdBUlJBTlRJRVMgV0lUSCBSRUdBUkQgVE8gVEhJUyBTT0ZUV0FSRSBJTkNMVURJTkcgQUxMIElNUExJRUQgV0FSUkFOVElFUyBPRiBNRVJDSEFOVEFCSUxJVFkgQU5EIEZJVE5FU1MuIElOIE5PIEVWRU5UIFNIQUxMIElTQyBCRSBMSUFCTEUgRk9SIEFOWSBTUEVDSUFMLCBESVJFQ1QsIElORElSRUNULCBPUiBDT05TRVFVRU5USUFMIERBTUFHRVMgT1IgQU5ZIERBTUFHRVMgV0hBVFNPRVZFUiBSRVNVTFRJTkcgRlJPTSBMT1NTIE9GIFVTRSwgREFUQSBPUiBQUk9GSVRTLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgTkVHTElHRU5DRSBPUiBPVEhFUiBUT1JUSU9VUyBBQ1RJT04sIEFSSVNJTkcgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgVVNFIE9SIFBFUkZPUk1BTkNFIE9GIFRISVMgU09GVFdBUkUu" + }, + "url": "https://www.isc.org/licenses/" + } + } + ], + "version": "1.1.1", + "purl": "pkg:npm/abbrev@1.1.1", + "bom-ref": "abbrev_1.1.1_f38b8400-66d8-49d5-819c-f3d8c9881608", + "description": "Like ruby's abbrev module, but in js", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "22" + } + ] + }, + { + "name": "accepts", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.1.4", + "purl": "pkg:npm/accepts@1.1.4", + "bom-ref": "accepts_1.1.4_ea91e461-782a-4853-b544-d66dcf360480", + "description": "Higher-level content negotiation", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "23" + } + ] + }, + { + "name": "accepts", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.2.13", + "purl": "pkg:npm/accepts@1.2.13", + "bom-ref": "accepts_1.2.13_90c09115-662b-46be-81f1-4b1d29a929b7", + "description": "Higher-level content negotiation", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "24" + } + ] + }, + { + "name": "align-text", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "0.1.4", + "purl": "pkg:npm/align-text@0.1.4", + "bom-ref": "align-text_0.1.4_ab9cff2e-f904-43dd-aa20-2a0a4e552b05", + "description": "Align the text in a string.", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "33" + } + ] + }, + { + "name": "ansi-regex", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "2.1.1", + "cpe": "cpe:2.3:a:ansi-regex_project:ansi-regex:2.1.1:*:*:*:*:node.js:*:*", + "purl": "pkg:npm/ansi-regex@2.1.1", + "bom-ref": "ansi-regex_2.1.1_59f2541e-f470-4583-842d-8f466ed4fde8", + "description": "Regular expression for matching ANSI escape codes", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "38" + } + ] + }, + { + "name": "ansi-regex", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "3.0.0", + "cpe": "cpe:2.3:a:ansi-regex_project:ansi-regex:3.0.0:*:*:*:*:node.js:*:*", + "purl": "pkg:npm/ansi-regex@3.0.0", + "bom-ref": "ansi-regex_3.0.0_98b04d01-49e3-40bd-b979-e125c5f7f691", + "description": "Regular expression for matching ANSI escape codes", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "39" + } + ] + }, + { + "name": "ansi-styles", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "2.2.1", + "purl": "pkg:npm/ansi-styles@2.2.1", + "bom-ref": "ansi-styles_2.2.1_e8c65143-6427-443f-ab9e-c160a892faa9", + "description": "ANSI escape codes for styling strings in the terminal", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "41" + } + ] + }, + { + "name": "append-transform", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "0.4.0", + "purl": "pkg:npm/append-transform@0.4.0", + "bom-ref": "append-transform_0.4.0_b5eb9260-52a0-4da0-88ad-8a71d9e00586", + "description": "Install a transform to `require.extensions` that always runs last, even if additional extensions are added later.", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "44" + } + ] + }, + { + "name": "archy", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.0.0", + "purl": "pkg:npm/archy@1.0.0", + "bom-ref": "archy_1.0.0_f4d9a44c-03a7-4634-8f03-4a0019a1f3a1", + "description": "render nested hierarchies `npm ls` style with unicode pipes", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "45" + } + ] + }, + { + "name": "argparse", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.0.10", + "purl": "pkg:npm/argparse@1.0.10", + "bom-ref": "argparse_1.0.10_84475ab4-7adc-420d-9dbb-2fe311082c06", + "description": "Very powerful CLI arguments parser. Native port of argparse - python's options parsing library", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "47" + } + ] + }, + { + "name": "arrify", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.0.1", + "purl": "pkg:npm/arrify@1.0.1", + "bom-ref": "arrify_1.0.1_d3625b17-1fec-4e79-9953-a1de1194e18a", + "description": "Convert a value to an array", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "54" + } + ] + }, + { + "name": "asn1.js", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "4.10.1", + "purl": "pkg:npm/asn1.js@4.10.1", + "bom-ref": "asn1.js_4.10.1_2e000504-5251-4d66-8bd8-2cdae983cfc0", + "description": "ASN.1 encoder and decoder", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "58" + } + ] + }, + { + "name": "assert-plus", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.0.0", + "purl": "pkg:npm/assert-plus@1.0.0", + "bom-ref": "assert-plus_1.0.0_8e7211c5-8ed3-494d-8f02-37db067038aa", + "description": "Extra assertions on top of node's assert module", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "62" + } + ] + }, + { + "name": "async", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "0.9.0", + "purl": "pkg:npm/async@0.9.0", + "bom-ref": "async_0.9.0_92e5071d-3731-4d02-8693-e7381dfb83f4", + "description": "Higher-order functions and common patterns for asynchronous code", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "65" + } + ] + }, + { + "name": "async", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.5.2", + "purl": "pkg:npm/async@1.5.2", + "bom-ref": "async_1.5.2_1f60b30c-b2e9-48fd-b3c2-979bd88053d3", + "description": "Higher-order functions and common patterns for asynchronous code", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "66" + } + ] + }, + { + "name": "async-cache", + "type": "library", + "licenses": [ + { + "license": { + "id": "ISC", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "SVNDIExpY2Vuc2U6CgpDb3B5cmlnaHQgKGMpIDIwMDQtMjAxMCBieSBJbnRlcm5ldCBTeXN0ZW1zIENvbnNvcnRpdW0sIEluYy4gKCJJU0MiKQpDb3B5cmlnaHQgKGMpIDE5OTUtMjAwMyBieSBJbnRlcm5ldCBTb2Z0d2FyZSBDb25zb3J0aXVtCgpQZXJtaXNzaW9uIHRvIHVzZSwgY29weSwgbW9kaWZ5LCBhbmQvb3IgZGlzdHJpYnV0ZSB0aGlzIHNvZnR3YXJlIGZvciBhbnkgcHVycG9zZSB3aXRoIG9yIHdpdGhvdXQgZmVlIGlzIGhlcmVieSBncmFudGVkLCBwcm92aWRlZCB0aGF0IHRoZSBhYm92ZSBjb3B5cmlnaHQgbm90aWNlIGFuZCB0aGlzIHBlcm1pc3Npb24gbm90aWNlIGFwcGVhciBpbiBhbGwgY29waWVzLgoKVEhFIFNPRlRXQVJFIElTIFBST1ZJREVEICJBUyBJUyIgQU5EIElTQyBESVNDTEFJTVMgQUxMIFdBUlJBTlRJRVMgV0lUSCBSRUdBUkQgVE8gVEhJUyBTT0ZUV0FSRSBJTkNMVURJTkcgQUxMIElNUExJRUQgV0FSUkFOVElFUyBPRiBNRVJDSEFOVEFCSUxJVFkgQU5EIEZJVE5FU1MuIElOIE5PIEVWRU5UIFNIQUxMIElTQyBCRSBMSUFCTEUgRk9SIEFOWSBTUEVDSUFMLCBESVJFQ1QsIElORElSRUNULCBPUiBDT05TRVFVRU5USUFMIERBTUFHRVMgT1IgQU5ZIERBTUFHRVMgV0hBVFNPRVZFUiBSRVNVTFRJTkcgRlJPTSBMT1NTIE9GIFVTRSwgREFUQSBPUiBQUk9GSVRTLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgTkVHTElHRU5DRSBPUiBPVEhFUiBUT1JUSU9VUyBBQ1RJT04sIEFSSVNJTkcgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgVVNFIE9SIFBFUkZPUk1BTkNFIE9GIFRISVMgU09GVFdBUkUu" + }, + "url": "https://www.isc.org/licenses/" + } + } + ], + "version": "0.1.5", + "purl": "pkg:npm/async-cache@0.1.5", + "bom-ref": "async-cache_0.1.5_380e881f-ecad-4445-a9c6-7e08b61eedc8", + "description": "Cache your async lookups and don't fetch the same thing more than necessary.", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "67" + } + ] + }, + { + "name": "asynckit", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "0.4.0", + "purl": "pkg:npm/asynckit@0.4.0", + "bom-ref": "asynckit_0.4.0_e7982011-d670-4394-8c90-aba0345e5a2b", + "description": "Minimal async jobs utility library, with streams support", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "68" + } + ] + }, + { + "name": "balanced-match", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.0.0", + "purl": "pkg:npm/balanced-match@1.0.0", + "bom-ref": "balanced-match_1.0.0_c22c178e-da32-4e45-9db7-9cfda2a5e38e", + "description": "Match balanced character pairs, like \"{\" and \"}\"", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "73" + } + ] + }, + { + "name": "basic-auth", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "2.0.1", + "purl": "pkg:npm/basic-auth@2.0.1", + "bom-ref": "basic-auth_2.0.1_9b605e04-8673-480b-bd1a-0fad59c1dd8c", + "description": "node.js basic auth parser", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "75" + } + ] + }, + { + "name": "bcrypt-pbkdf", + "type": "library", + "licenses": [ + { + "license": { + "id": "BSD-3-Clause", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "Q29weXJpZ2h0IChjKSA8eWVhcj4gPG93bmVyPi4gCgpSZWRpc3RyaWJ1dGlvbiBhbmQgdXNlIGluIHNvdXJjZSBhbmQgYmluYXJ5IGZvcm1zLCB3aXRoIG9yIHdpdGhvdXQgbW9kaWZpY2F0aW9uLCBhcmUgcGVybWl0dGVkIHByb3ZpZGVkIHRoYXQgdGhlIGZvbGxvd2luZyBjb25kaXRpb25zIGFyZSBtZXQ6CgoxLiBSZWRpc3RyaWJ1dGlvbnMgb2Ygc291cmNlIGNvZGUgbXVzdCByZXRhaW4gdGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UsIHRoaXMgbGlzdCBvZiBjb25kaXRpb25zIGFuZCB0aGUgZm9sbG93aW5nIGRpc2NsYWltZXIuCgoyLiBSZWRpc3RyaWJ1dGlvbnMgaW4gYmluYXJ5IGZvcm0gbXVzdCByZXByb2R1Y2UgdGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UsIHRoaXMgbGlzdCBvZiBjb25kaXRpb25zIGFuZCB0aGUgZm9sbG93aW5nIGRpc2NsYWltZXIgaW4gdGhlIGRvY3VtZW50YXRpb24gYW5kL29yIG90aGVyIG1hdGVyaWFscyBwcm92aWRlZCB3aXRoIHRoZSBkaXN0cmlidXRpb24uCgozLiBOZWl0aGVyIHRoZSBuYW1lIG9mIHRoZSBjb3B5cmlnaHQgaG9sZGVyIG5vciB0aGUgbmFtZXMgb2YgaXRzIGNvbnRyaWJ1dG9ycyBtYXkgYmUgdXNlZCB0byBlbmRvcnNlIG9yIHByb21vdGUgcHJvZHVjdHMgZGVyaXZlZCBmcm9tIHRoaXMgc29mdHdhcmUgd2l0aG91dCBzcGVjaWZpYyBwcmlvciB3cml0dGVuIHBlcm1pc3Npb24uCgpUSElTIFNPRlRXQVJFIElTIFBST1ZJREVEIEJZIFRIRSBDT1BZUklHSFQgSE9MREVSUyBBTkQgQ09OVFJJQlVUT1JTICJBUyBJUyIgQU5EIEFOWSBFWFBSRVNTIE9SIElNUExJRUQgV0FSUkFOVElFUywgSU5DTFVESU5HLCBCVVQgTk9UIExJTUlURUQgVE8sIFRIRSBJTVBMSUVEIFdBUlJBTlRJRVMgT0YgTUVSQ0hBTlRBQklMSVRZIEFORCBGSVRORVNTIEZPUiBBIFBBUlRJQ1VMQVIgUFVSUE9TRSBBUkUgRElTQ0xBSU1FRC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIENPUFlSSUdIVCBIT0xERVIgT1IgQ09OVFJJQlVUT1JTIEJFIExJQUJMRSBGT1IgQU5ZIERJUkVDVCwgSU5ESVJFQ1QsIElOQ0lERU5UQUwsIFNQRUNJQUwsIEVYRU1QTEFSWSwgT1IgQ09OU0VRVUVOVElBTCBEQU1BR0VTIChJTkNMVURJTkcsIEJVVCBOT1QgTElNSVRFRCBUTywgUFJPQ1VSRU1FTlQgT0YgU1VCU1RJVFVURSBHT09EUyBPUiBTRVJWSUNFUzsgTE9TUyBPRiBVU0UsIERBVEEsIE9SIFBST0ZJVFM7IE9SIEJVU0lORVNTIElOVEVSUlVQVElPTikgSE9XRVZFUiBDQVVTRUQgQU5EIE9OIEFOWSBUSEVPUlkgT0YgTElBQklMSVRZLCBXSEVUSEVSIElOIENPTlRSQUNULCBTVFJJQ1QgTElBQklMSVRZLCBPUiBUT1JUIChJTkNMVURJTkcgTkVHTElHRU5DRSBPUiBPVEhFUldJU0UpIEFSSVNJTkcgSU4gQU5ZIFdBWSBPVVQgT0YgVEhFIFVTRSBPRiBUSElTIFNPRlRXQVJFLCBFVkVOIElGIEFEVklTRUQgT0YgVEhFIFBPU1NJQklMSVRZIE9GIFNVQ0ggREFNQUdFLg==" + }, + "url": "https://opensource.org/licenses/BSD-3-Clause" + } + } + ], + "version": "1.0.2", + "purl": "pkg:npm/bcrypt-pbkdf@1.0.2", + "bom-ref": "bcrypt-pbkdf_1.0.2_899952c6-b7b0-49b8-aa6a-38e655da9a1b", + "description": "Port of the OpenBSD bcrypt_pbkdf function to pure JS", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "76" + } + ] + }, + { + "name": "bluebird", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "2.9.26", + "purl": "pkg:npm/bluebird@2.9.26", + "bom-ref": "bluebird_2.9.26_00114ec7-5340-4de6-8894-bb168b17baee", + "description": "Full featured Promises/A+ implementation with exceptionally good performance", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "79" + } + ] + }, + { + "name": "body-parser", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.9.0", + "purl": "pkg:npm/body-parser@1.9.0", + "bom-ref": "body-parser_1.9.0_9df5b428-7d25-4985-b464-d019ddf1719f", + "description": "Node.js body parsing middleware", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "82" + } + ] + }, + { + "name": "brace-expansion", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.1.11", + "purl": "pkg:npm/brace-expansion@1.1.11", + "bom-ref": "brace-expansion_1.1.11_31bf53a9-ad2a-47f7-825f-7fb69f875a32", + "description": "Brace expansion as known from sh/bash", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "87" + } + ] + }, + { + "name": "brorand", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.1.0", + "purl": "pkg:npm/brorand@1.1.0", + "bom-ref": "brorand_1.1.0_e1b31fb8-9c9b-4ea9-aeaf-ec9192a6aaa8", + "description": "Random number generator for browsers and node.js", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "89" + } + ] + }, + { + "name": "browser-pack", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "6.1.0", + "purl": "pkg:npm/browser-pack@6.1.0", + "bom-ref": "browser-pack_6.1.0_beecfc3d-d11d-4bfc-ae8e-b5ee74c5c437", + "description": "pack node-style source files from a json stream into a browser bundle", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "90" + } + ] + }, + { + "name": "browser-resolve", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.11.3", + "purl": "pkg:npm/browser-resolve@1.11.3", + "bom-ref": "browser-resolve_1.11.3_fcfe2a20-c335-4253-ac06-aeb68852415c", + "description": "resolve which handles browser field support in package.json", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "91" + } + ] + }, + { + "name": "browserify", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "13.3.0", + "purl": "pkg:npm/browserify@13.3.0", + "bom-ref": "browserify_13.3.0_9a6d25f5-27ce-498e-8e37-9868e7d8f8ef", + "description": "browser-side require() the node way", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "92" + } + ] + }, + { + "name": "browserify-aes", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.2.0", + "purl": "pkg:npm/browserify-aes@1.2.0", + "bom-ref": "browserify-aes_1.2.0_2f586315-2bee-4c3d-afc0-75a943b0198a", + "description": "aes, for browserify", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "93" + } + ] + }, + { + "name": "browserify-cipher", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.0.1", + "purl": "pkg:npm/browserify-cipher@1.0.1", + "bom-ref": "browserify-cipher_1.0.1_cf46b8b4-304d-4bd8-890b-2f4d1f3a09ad", + "description": "ciphers for the browser", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "94" + } + ] + }, + { + "name": "browserify-des", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.0.2", + "purl": "pkg:npm/browserify-des@1.0.2", + "bom-ref": "browserify-des_1.0.2_8fa31ed3-9619-42c5-a040-11a370f22451", + "description": "browserify-des ===", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "95" + } + ] + }, + { + "name": "browserify-zlib", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "0.1.4", + "purl": "pkg:npm/browserify-zlib@0.1.4", + "bom-ref": "browserify-zlib_0.1.4_0cea2a63-2e25-4dbd-9a9a-b72fadbbae06", + "description": "Full zlib module for browserify", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "98" + } + ] + }, + { + "name": "bson", + "type": "library", + "licenses": [ + { + "license": { + "id": "Apache-2.0", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "QXBhY2hlIExpY2Vuc2UKVmVyc2lvbiAyLjAsIEphbnVhcnkgMjAwNApodHRwOi8vd3d3LmFwYWNoZS5vcmcvbGljZW5zZXMvCgpURVJNUyBBTkQgQ09ORElUSU9OUyBGT1IgVVNFLCBSRVBST0RVQ1RJT04sIEFORCBESVNUUklCVVRJT04KCjEuIERlZmluaXRpb25zLgoKIkxpY2Vuc2UiIHNoYWxsIG1lYW4gdGhlIHRlcm1zIGFuZCBjb25kaXRpb25zIGZvciB1c2UsIHJlcHJvZHVjdGlvbiwgYW5kIGRpc3RyaWJ1dGlvbiBhcyBkZWZpbmVkIGJ5IFNlY3Rpb25zIDEgdGhyb3VnaCA5IG9mIHRoaXMgZG9jdW1lbnQuCgoiTGljZW5zb3IiIHNoYWxsIG1lYW4gdGhlIGNvcHlyaWdodCBvd25lciBvciBlbnRpdHkgYXV0aG9yaXplZCBieSB0aGUgY29weXJpZ2h0IG93bmVyIHRoYXQgaXMgZ3JhbnRpbmcgdGhlIExpY2Vuc2UuCgoiTGVnYWwgRW50aXR5IiBzaGFsbCBtZWFuIHRoZSB1bmlvbiBvZiB0aGUgYWN0aW5nIGVudGl0eSBhbmQgYWxsIG90aGVyIGVudGl0aWVzIHRoYXQgY29udHJvbCwgYXJlIGNvbnRyb2xsZWQgYnksIG9yIGFyZSB1bmRlciBjb21tb24gY29udHJvbCB3aXRoIHRoYXQgZW50aXR5LiBGb3IgdGhlIHB1cnBvc2VzIG9mIHRoaXMgZGVmaW5pdGlvbiwgImNvbnRyb2wiIG1lYW5zIChpKSB0aGUgcG93ZXIsIGRpcmVjdCBvciBpbmRpcmVjdCwgdG8gY2F1c2UgdGhlIGRpcmVjdGlvbiBvciBtYW5hZ2VtZW50IG9mIHN1Y2ggZW50aXR5LCB3aGV0aGVyIGJ5IGNvbnRyYWN0IG9yIG90aGVyd2lzZSwgb3IgKGlpKSBvd25lcnNoaXAgb2YgZmlmdHkgcGVyY2VudCAoNTAlKSBvciBtb3JlIG9mIHRoZSBvdXRzdGFuZGluZyBzaGFyZXMsIG9yIChpaWkpIGJlbmVmaWNpYWwgb3duZXJzaGlwIG9mIHN1Y2ggZW50aXR5LgoKIllvdSIgKG9yICJZb3VyIikgc2hhbGwgbWVhbiBhbiBpbmRpdmlkdWFsIG9yIExlZ2FsIEVudGl0eSBleGVyY2lzaW5nIHBlcm1pc3Npb25zIGdyYW50ZWQgYnkgdGhpcyBMaWNlbnNlLgoKIlNvdXJjZSIgZm9ybSBzaGFsbCBtZWFuIHRoZSBwcmVmZXJyZWQgZm9ybSBmb3IgbWFraW5nIG1vZGlmaWNhdGlvbnMsIGluY2x1ZGluZyBidXQgbm90IGxpbWl0ZWQgdG8gc29mdHdhcmUgc291cmNlIGNvZGUsIGRvY3VtZW50YXRpb24gc291cmNlLCBhbmQgY29uZmlndXJhdGlvbiBmaWxlcy4KCiJPYmplY3QiIGZvcm0gc2hhbGwgbWVhbiBhbnkgZm9ybSByZXN1bHRpbmcgZnJvbSBtZWNoYW5pY2FsIHRyYW5zZm9ybWF0aW9uIG9yIHRyYW5zbGF0aW9uIG9mIGEgU291cmNlIGZvcm0sIGluY2x1ZGluZyBidXQgbm90IGxpbWl0ZWQgdG8gY29tcGlsZWQgb2JqZWN0IGNvZGUsIGdlbmVyYXRlZCBkb2N1bWVudGF0aW9uLCBhbmQgY29udmVyc2lvbnMgdG8gb3RoZXIgbWVkaWEgdHlwZXMuCgoiV29yayIgc2hhbGwgbWVhbiB0aGUgd29yayBvZiBhdXRob3JzaGlwLCB3aGV0aGVyIGluIFNvdXJjZSBvciBPYmplY3QgZm9ybSwgbWFkZSBhdmFpbGFibGUgdW5kZXIgdGhlIExpY2Vuc2UsIGFzIGluZGljYXRlZCBieSBhIGNvcHlyaWdodCBub3RpY2UgdGhhdCBpcyBpbmNsdWRlZCBpbiBvciBhdHRhY2hlZCB0byB0aGUgd29yayAoYW4gZXhhbXBsZSBpcyBwcm92aWRlZCBpbiB0aGUgQXBwZW5kaXggYmVsb3cpLgoKIkRlcml2YXRpdmUgV29ya3MiIHNoYWxsIG1lYW4gYW55IHdvcmssIHdoZXRoZXIgaW4gU291cmNlIG9yIE9iamVjdCBmb3JtLCB0aGF0IGlzIGJhc2VkIG9uIChvciBkZXJpdmVkIGZyb20pIHRoZSBXb3JrIGFuZCBmb3Igd2hpY2ggdGhlIGVkaXRvcmlhbCByZXZpc2lvbnMsIGFubm90YXRpb25zLCBlbGFib3JhdGlvbnMsIG9yIG90aGVyIG1vZGlmaWNhdGlvbnMgcmVwcmVzZW50LCBhcyBhIHdob2xlLCBhbiBvcmlnaW5hbCB3b3JrIG9mIGF1dGhvcnNoaXAuIEZvciB0aGUgcHVycG9zZXMgb2YgdGhpcyBMaWNlbnNlLCBEZXJpdmF0aXZlIFdvcmtzIHNoYWxsIG5vdCBpbmNsdWRlIHdvcmtzIHRoYXQgcmVtYWluIHNlcGFyYWJsZSBmcm9tLCBvciBtZXJlbHkgbGluayAob3IgYmluZCBieSBuYW1lKSB0byB0aGUgaW50ZXJmYWNlcyBvZiwgdGhlIFdvcmsgYW5kIERlcml2YXRpdmUgV29ya3MgdGhlcmVvZi4KCiJDb250cmlidXRpb24iIHNoYWxsIG1lYW4gYW55IHdvcmsgb2YgYXV0aG9yc2hpcCwgaW5jbHVkaW5nIHRoZSBvcmlnaW5hbCB2ZXJzaW9uIG9mIHRoZSBXb3JrIGFuZCBhbnkgbW9kaWZpY2F0aW9ucyBvciBhZGRpdGlvbnMgdG8gdGhhdCBXb3JrIG9yIERlcml2YXRpdmUgV29ya3MgdGhlcmVvZiwgdGhhdCBpcyBpbnRlbnRpb25hbGx5IHN1Ym1pdHRlZCB0byBMaWNlbnNvciBmb3IgaW5jbHVzaW9uIGluIHRoZSBXb3JrIGJ5IHRoZSBjb3B5cmlnaHQgb3duZXIgb3IgYnkgYW4gaW5kaXZpZHVhbCBvciBMZWdhbCBFbnRpdHkgYXV0aG9yaXplZCB0byBzdWJtaXQgb24gYmVoYWxmIG9mIHRoZSBjb3B5cmlnaHQgb3duZXIuIEZvciB0aGUgcHVycG9zZXMgb2YgdGhpcyBkZWZpbml0aW9uLCAic3VibWl0dGVkIiBtZWFucyBhbnkgZm9ybSBvZiBlbGVjdHJvbmljLCB2ZXJiYWwsIG9yIHdyaXR0ZW4gY29tbXVuaWNhdGlvbiBzZW50IHRvIHRoZSBMaWNlbnNvciBvciBpdHMgcmVwcmVzZW50YXRpdmVzLCBpbmNsdWRpbmcgYnV0IG5vdCBsaW1pdGVkIHRvIGNvbW11bmljYXRpb24gb24gZWxlY3Ryb25pYyBtYWlsaW5nIGxpc3RzLCBzb3VyY2UgY29kZSBjb250cm9sIHN5c3RlbXMsIGFuZCBpc3N1ZSB0cmFja2luZyBzeXN0ZW1zIHRoYXQgYXJlIG1hbmFnZWQgYnksIG9yIG9uIGJlaGFsZiBvZiwgdGhlIExpY2Vuc29yIGZvciB0aGUgcHVycG9zZSBvZiBkaXNjdXNzaW5nIGFuZCBpbXByb3ZpbmcgdGhlIFdvcmssIGJ1dCBleGNsdWRpbmcgY29tbXVuaWNhdGlvbiB0aGF0IGlzIGNvbnNwaWN1b3VzbHkgbWFya2VkIG9yIG90aGVyd2lzZSBkZXNpZ25hdGVkIGluIHdyaXRpbmcgYnkgdGhlIGNvcHlyaWdodCBvd25lciBhcyAiTm90IGEgQ29udHJpYnV0aW9uLiIKCiJDb250cmlidXRvciIgc2hhbGwgbWVhbiBMaWNlbnNvciBhbmQgYW55IGluZGl2aWR1YWwgb3IgTGVnYWwgRW50aXR5IG9uIGJlaGFsZiBvZiB3aG9tIGEgQ29udHJpYnV0aW9uIGhhcyBiZWVuIHJlY2VpdmVkIGJ5IExpY2Vuc29yIGFuZCBzdWJzZXF1ZW50bHkgaW5jb3Jwb3JhdGVkIHdpdGhpbiB0aGUgV29yay4KCjIuIEdyYW50IG9mIENvcHlyaWdodCBMaWNlbnNlLiBTdWJqZWN0IHRvIHRoZSB0ZXJtcyBhbmQgY29uZGl0aW9ucyBvZiB0aGlzIExpY2Vuc2UsIGVhY2ggQ29udHJpYnV0b3IgaGVyZWJ5IGdyYW50cyB0byBZb3UgYSBwZXJwZXR1YWwsIHdvcmxkd2lkZSwgbm9uLWV4Y2x1c2l2ZSwgbm8tY2hhcmdlLCByb3lhbHR5LWZyZWUsIGlycmV2b2NhYmxlIGNvcHlyaWdodCBsaWNlbnNlIHRvIHJlcHJvZHVjZSwgcHJlcGFyZSBEZXJpdmF0aXZlIFdvcmtzIG9mLCBwdWJsaWNseSBkaXNwbGF5LCBwdWJsaWNseSBwZXJmb3JtLCBzdWJsaWNlbnNlLCBhbmQgZGlzdHJpYnV0ZSB0aGUgV29yayBhbmQgc3VjaCBEZXJpdmF0aXZlIFdvcmtzIGluIFNvdXJjZSBvciBPYmplY3QgZm9ybS4KCjMuIEdyYW50IG9mIFBhdGVudCBMaWNlbnNlLiBTdWJqZWN0IHRvIHRoZSB0ZXJtcyBhbmQgY29uZGl0aW9ucyBvZiB0aGlzIExpY2Vuc2UsIGVhY2ggQ29udHJpYnV0b3IgaGVyZWJ5IGdyYW50cyB0byBZb3UgYSBwZXJwZXR1YWwsIHdvcmxkd2lkZSwgbm9uLWV4Y2x1c2l2ZSwgbm8tY2hhcmdlLCByb3lhbHR5LWZyZWUsIGlycmV2b2NhYmxlIChleGNlcHQgYXMgc3RhdGVkIGluIHRoaXMgc2VjdGlvbikgcGF0ZW50IGxpY2Vuc2UgdG8gbWFrZSwgaGF2ZSBtYWRlLCB1c2UsIG9mZmVyIHRvIHNlbGwsIHNlbGwsIGltcG9ydCwgYW5kIG90aGVyd2lzZSB0cmFuc2ZlciB0aGUgV29yaywgd2hlcmUgc3VjaCBsaWNlbnNlIGFwcGxpZXMgb25seSB0byB0aG9zZSBwYXRlbnQgY2xhaW1zIGxpY2Vuc2FibGUgYnkgc3VjaCBDb250cmlidXRvciB0aGF0IGFyZSBuZWNlc3NhcmlseSBpbmZyaW5nZWQgYnkgdGhlaXIgQ29udHJpYnV0aW9uKHMpIGFsb25lIG9yIGJ5IGNvbWJpbmF0aW9uIG9mIHRoZWlyIENvbnRyaWJ1dGlvbihzKSB3aXRoIHRoZSBXb3JrIHRvIHdoaWNoIHN1Y2ggQ29udHJpYnV0aW9uKHMpIHdhcyBzdWJtaXR0ZWQuIElmIFlvdSBpbnN0aXR1dGUgcGF0ZW50IGxpdGlnYXRpb24gYWdhaW5zdCBhbnkgZW50aXR5IChpbmNsdWRpbmcgYSBjcm9zcy1jbGFpbSBvciBjb3VudGVyY2xhaW0gaW4gYSBsYXdzdWl0KSBhbGxlZ2luZyB0aGF0IHRoZSBXb3JrIG9yIGEgQ29udHJpYnV0aW9uIGluY29ycG9yYXRlZCB3aXRoaW4gdGhlIFdvcmsgY29uc3RpdHV0ZXMgZGlyZWN0IG9yIGNvbnRyaWJ1dG9yeSBwYXRlbnQgaW5mcmluZ2VtZW50LCB0aGVuIGFueSBwYXRlbnQgbGljZW5zZXMgZ3JhbnRlZCB0byBZb3UgdW5kZXIgdGhpcyBMaWNlbnNlIGZvciB0aGF0IFdvcmsgc2hhbGwgdGVybWluYXRlIGFzIG9mIHRoZSBkYXRlIHN1Y2ggbGl0aWdhdGlvbiBpcyBmaWxlZC4KCjQuIFJlZGlzdHJpYnV0aW9uLiBZb3UgbWF5IHJlcHJvZHVjZSBhbmQgZGlzdHJpYnV0ZSBjb3BpZXMgb2YgdGhlIFdvcmsgb3IgRGVyaXZhdGl2ZSBXb3JrcyB0aGVyZW9mIGluIGFueSBtZWRpdW0sIHdpdGggb3Igd2l0aG91dCBtb2RpZmljYXRpb25zLCBhbmQgaW4gU291cmNlIG9yIE9iamVjdCBmb3JtLCBwcm92aWRlZCB0aGF0IFlvdSBtZWV0IHRoZSBmb2xsb3dpbmcgY29uZGl0aW9uczoKCiAgICAgKGEpIFlvdSBtdXN0IGdpdmUgYW55IG90aGVyIHJlY2lwaWVudHMgb2YgdGhlIFdvcmsgb3IgRGVyaXZhdGl2ZSBXb3JrcyBhIGNvcHkgb2YgdGhpcyBMaWNlbnNlOyBhbmQKCiAgICAgKGIpIFlvdSBtdXN0IGNhdXNlIGFueSBtb2RpZmllZCBmaWxlcyB0byBjYXJyeSBwcm9taW5lbnQgbm90aWNlcyBzdGF0aW5nIHRoYXQgWW91IGNoYW5nZWQgdGhlIGZpbGVzOyBhbmQKCiAgICAgKGMpIFlvdSBtdXN0IHJldGFpbiwgaW4gdGhlIFNvdXJjZSBmb3JtIG9mIGFueSBEZXJpdmF0aXZlIFdvcmtzIHRoYXQgWW91IGRpc3RyaWJ1dGUsIGFsbCBjb3B5cmlnaHQsIHBhdGVudCwgdHJhZGVtYXJrLCBhbmQgYXR0cmlidXRpb24gbm90aWNlcyBmcm9tIHRoZSBTb3VyY2UgZm9ybSBvZiB0aGUgV29yaywgZXhjbHVkaW5nIHRob3NlIG5vdGljZXMgdGhhdCBkbyBub3QgcGVydGFpbiB0byBhbnkgcGFydCBvZiB0aGUgRGVyaXZhdGl2ZSBXb3JrczsgYW5kCgogICAgIChkKSBJZiB0aGUgV29yayBpbmNsdWRlcyBhICJOT1RJQ0UiIHRleHQgZmlsZSBhcyBwYXJ0IG9mIGl0cyBkaXN0cmlidXRpb24sIHRoZW4gYW55IERlcml2YXRpdmUgV29ya3MgdGhhdCBZb3UgZGlzdHJpYnV0ZSBtdXN0IGluY2x1ZGUgYSByZWFkYWJsZSBjb3B5IG9mIHRoZSBhdHRyaWJ1dGlvbiBub3RpY2VzIGNvbnRhaW5lZCB3aXRoaW4gc3VjaCBOT1RJQ0UgZmlsZSwgZXhjbHVkaW5nIHRob3NlIG5vdGljZXMgdGhhdCBkbyBub3QgcGVydGFpbiB0byBhbnkgcGFydCBvZiB0aGUgRGVyaXZhdGl2ZSBXb3JrcywgaW4gYXQgbGVhc3Qgb25lIG9mIHRoZSBmb2xsb3dpbmcgcGxhY2VzOiB3aXRoaW4gYSBOT1RJQ0UgdGV4dCBmaWxlIGRpc3RyaWJ1dGVkIGFzIHBhcnQgb2YgdGhlIERlcml2YXRpdmUgV29ya3M7IHdpdGhpbiB0aGUgU291cmNlIGZvcm0gb3IgZG9jdW1lbnRhdGlvbiwgaWYgcHJvdmlkZWQgYWxvbmcgd2l0aCB0aGUgRGVyaXZhdGl2ZSBXb3Jrczsgb3IsIHdpdGhpbiBhIGRpc3BsYXkgZ2VuZXJhdGVkIGJ5IHRoZSBEZXJpdmF0aXZlIFdvcmtzLCBpZiBhbmQgd2hlcmV2ZXIgc3VjaCB0aGlyZC1wYXJ0eSBub3RpY2VzIG5vcm1hbGx5IGFwcGVhci4gVGhlIGNvbnRlbnRzIG9mIHRoZSBOT1RJQ0UgZmlsZSBhcmUgZm9yIGluZm9ybWF0aW9uYWwgcHVycG9zZXMgb25seSBhbmQgZG8gbm90IG1vZGlmeSB0aGUgTGljZW5zZS4gWW91IG1heSBhZGQgWW91ciBvd24gYXR0cmlidXRpb24gbm90aWNlcyB3aXRoaW4gRGVyaXZhdGl2ZSBXb3JrcyB0aGF0IFlvdSBkaXN0cmlidXRlLCBhbG9uZ3NpZGUgb3IgYXMgYW4gYWRkZW5kdW0gdG8gdGhlIE5PVElDRSB0ZXh0IGZyb20gdGhlIFdvcmssIHByb3ZpZGVkIHRoYXQgc3VjaCBhZGRpdGlvbmFsIGF0dHJpYnV0aW9uIG5vdGljZXMgY2Fubm90IGJlIGNvbnN0cnVlZCBhcyBtb2RpZnlpbmcgdGhlIExpY2Vuc2UuCgogICAgIFlvdSBtYXkgYWRkIFlvdXIgb3duIGNvcHlyaWdodCBzdGF0ZW1lbnQgdG8gWW91ciBtb2RpZmljYXRpb25zIGFuZCBtYXkgcHJvdmlkZSBhZGRpdGlvbmFsIG9yIGRpZmZlcmVudCBsaWNlbnNlIHRlcm1zIGFuZCBjb25kaXRpb25zIGZvciB1c2UsIHJlcHJvZHVjdGlvbiwgb3IgZGlzdHJpYnV0aW9uIG9mIFlvdXIgbW9kaWZpY2F0aW9ucywgb3IgZm9yIGFueSBzdWNoIERlcml2YXRpdmUgV29ya3MgYXMgYSB3aG9sZSwgcHJvdmlkZWQgWW91ciB1c2UsIHJlcHJvZHVjdGlvbiwgYW5kIGRpc3RyaWJ1dGlvbiBvZiB0aGUgV29yayBvdGhlcndpc2UgY29tcGxpZXMgd2l0aCB0aGUgY29uZGl0aW9ucyBzdGF0ZWQgaW4gdGhpcyBMaWNlbnNlLgoKNS4gU3VibWlzc2lvbiBvZiBDb250cmlidXRpb25zLiBVbmxlc3MgWW91IGV4cGxpY2l0bHkgc3RhdGUgb3RoZXJ3aXNlLCBhbnkgQ29udHJpYnV0aW9uIGludGVudGlvbmFsbHkgc3VibWl0dGVkIGZvciBpbmNsdXNpb24gaW4gdGhlIFdvcmsgYnkgWW91IHRvIHRoZSBMaWNlbnNvciBzaGFsbCBiZSB1bmRlciB0aGUgdGVybXMgYW5kIGNvbmRpdGlvbnMgb2YgdGhpcyBMaWNlbnNlLCB3aXRob3V0IGFueSBhZGRpdGlvbmFsIHRlcm1zIG9yIGNvbmRpdGlvbnMuIE5vdHdpdGhzdGFuZGluZyB0aGUgYWJvdmUsIG5vdGhpbmcgaGVyZWluIHNoYWxsIHN1cGVyc2VkZSBvciBtb2RpZnkgdGhlIHRlcm1zIG9mIGFueSBzZXBhcmF0ZSBsaWNlbnNlIGFncmVlbWVudCB5b3UgbWF5IGhhdmUgZXhlY3V0ZWQgd2l0aCBMaWNlbnNvciByZWdhcmRpbmcgc3VjaCBDb250cmlidXRpb25zLgoKNi4gVHJhZGVtYXJrcy4gVGhpcyBMaWNlbnNlIGRvZXMgbm90IGdyYW50IHBlcm1pc3Npb24gdG8gdXNlIHRoZSB0cmFkZSBuYW1lcywgdHJhZGVtYXJrcywgc2VydmljZSBtYXJrcywgb3IgcHJvZHVjdCBuYW1lcyBvZiB0aGUgTGljZW5zb3IsIGV4Y2VwdCBhcyByZXF1aXJlZCBmb3IgcmVhc29uYWJsZSBhbmQgY3VzdG9tYXJ5IHVzZSBpbiBkZXNjcmliaW5nIHRoZSBvcmlnaW4gb2YgdGhlIFdvcmsgYW5kIHJlcHJvZHVjaW5nIHRoZSBjb250ZW50IG9mIHRoZSBOT1RJQ0UgZmlsZS4KCjcuIERpc2NsYWltZXIgb2YgV2FycmFudHkuIFVubGVzcyByZXF1aXJlZCBieSBhcHBsaWNhYmxlIGxhdyBvciBhZ3JlZWQgdG8gaW4gd3JpdGluZywgTGljZW5zb3IgcHJvdmlkZXMgdGhlIFdvcmsgKGFuZCBlYWNoIENvbnRyaWJ1dG9yIHByb3ZpZGVzIGl0cyBDb250cmlidXRpb25zKSBvbiBhbiAiQVMgSVMiIEJBU0lTLCBXSVRIT1VUIFdBUlJBTlRJRVMgT1IgQ09ORElUSU9OUyBPRiBBTlkgS0lORCwgZWl0aGVyIGV4cHJlc3Mgb3IgaW1wbGllZCwgaW5jbHVkaW5nLCB3aXRob3V0IGxpbWl0YXRpb24sIGFueSB3YXJyYW50aWVzIG9yIGNvbmRpdGlvbnMgb2YgVElUTEUsIE5PTi1JTkZSSU5HRU1FTlQsIE1FUkNIQU5UQUJJTElUWSwgb3IgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UuIFlvdSBhcmUgc29sZWx5IHJlc3BvbnNpYmxlIGZvciBkZXRlcm1pbmluZyB0aGUgYXBwcm9wcmlhdGVuZXNzIG9mIHVzaW5nIG9yIHJlZGlzdHJpYnV0aW5nIHRoZSBXb3JrIGFuZCBhc3N1bWUgYW55IHJpc2tzIGFzc29jaWF0ZWQgd2l0aCBZb3VyIGV4ZXJjaXNlIG9mIHBlcm1pc3Npb25zIHVuZGVyIHRoaXMgTGljZW5zZS4KCjguIExpbWl0YXRpb24gb2YgTGlhYmlsaXR5LiBJbiBubyBldmVudCBhbmQgdW5kZXIgbm8gbGVnYWwgdGhlb3J5LCB3aGV0aGVyIGluIHRvcnQgKGluY2x1ZGluZyBuZWdsaWdlbmNlKSwgY29udHJhY3QsIG9yIG90aGVyd2lzZSwgdW5sZXNzIHJlcXVpcmVkIGJ5IGFwcGxpY2FibGUgbGF3IChzdWNoIGFzIGRlbGliZXJhdGUgYW5kIGdyb3NzbHkgbmVnbGlnZW50IGFjdHMpIG9yIGFncmVlZCB0byBpbiB3cml0aW5nLCBzaGFsbCBhbnkgQ29udHJpYnV0b3IgYmUgbGlhYmxlIHRvIFlvdSBmb3IgZGFtYWdlcywgaW5jbHVkaW5nIGFueSBkaXJlY3QsIGluZGlyZWN0LCBzcGVjaWFsLCBpbmNpZGVudGFsLCBvciBjb25zZXF1ZW50aWFsIGRhbWFnZXMgb2YgYW55IGNoYXJhY3RlciBhcmlzaW5nIGFzIGEgcmVzdWx0IG9mIHRoaXMgTGljZW5zZSBvciBvdXQgb2YgdGhlIHVzZSBvciBpbmFiaWxpdHkgdG8gdXNlIHRoZSBXb3JrIChpbmNsdWRpbmcgYnV0IG5vdCBsaW1pdGVkIHRvIGRhbWFnZXMgZm9yIGxvc3Mgb2YgZ29vZHdpbGwsIHdvcmsgc3RvcHBhZ2UsIGNvbXB1dGVyIGZhaWx1cmUgb3IgbWFsZnVuY3Rpb24sIG9yIGFueSBhbmQgYWxsIG90aGVyIGNvbW1lcmNpYWwgZGFtYWdlcyBvciBsb3NzZXMpLCBldmVuIGlmIHN1Y2ggQ29udHJpYnV0b3IgaGFzIGJlZW4gYWR2aXNlZCBvZiB0aGUgcG9zc2liaWxpdHkgb2Ygc3VjaCBkYW1hZ2VzLgoKOS4gQWNjZXB0aW5nIFdhcnJhbnR5IG9yIEFkZGl0aW9uYWwgTGlhYmlsaXR5LiBXaGlsZSByZWRpc3RyaWJ1dGluZyB0aGUgV29yayBvciBEZXJpdmF0aXZlIFdvcmtzIHRoZXJlb2YsIFlvdSBtYXkgY2hvb3NlIHRvIG9mZmVyLCBhbmQgY2hhcmdlIGEgZmVlIGZvciwgYWNjZXB0YW5jZSBvZiBzdXBwb3J0LCB3YXJyYW50eSwgaW5kZW1uaXR5LCBvciBvdGhlciBsaWFiaWxpdHkgb2JsaWdhdGlvbnMgYW5kL29yIHJpZ2h0cyBjb25zaXN0ZW50IHdpdGggdGhpcyBMaWNlbnNlLiBIb3dldmVyLCBpbiBhY2NlcHRpbmcgc3VjaCBvYmxpZ2F0aW9ucywgWW91IG1heSBhY3Qgb25seSBvbiBZb3VyIG93biBiZWhhbGYgYW5kIG9uIFlvdXIgc29sZSByZXNwb25zaWJpbGl0eSwgbm90IG9uIGJlaGFsZiBvZiBhbnkgb3RoZXIgQ29udHJpYnV0b3IsIGFuZCBvbmx5IGlmIFlvdSBhZ3JlZSB0byBpbmRlbW5pZnksIGRlZmVuZCwgYW5kIGhvbGQgZWFjaCBDb250cmlidXRvciBoYXJtbGVzcyBmb3IgYW55IGxpYWJpbGl0eSBpbmN1cnJlZCBieSwgb3IgY2xhaW1zIGFzc2VydGVkIGFnYWluc3QsIHN1Y2ggQ29udHJpYnV0b3IgYnkgcmVhc29uIG9mIHlvdXIgYWNjZXB0aW5nIGFueSBzdWNoIHdhcnJhbnR5IG9yIGFkZGl0aW9uYWwgbGlhYmlsaXR5LgoKRU5EIE9GIFRFUk1TIEFORCBDT05ESVRJT05TCgpBUFBFTkRJWDogSG93IHRvIGFwcGx5IHRoZSBBcGFjaGUgTGljZW5zZSB0byB5b3VyIHdvcmsuCgpUbyBhcHBseSB0aGUgQXBhY2hlIExpY2Vuc2UgdG8geW91ciB3b3JrLCBhdHRhY2ggdGhlIGZvbGxvd2luZyBib2lsZXJwbGF0ZSBub3RpY2UsIHdpdGggdGhlIGZpZWxkcyBlbmNsb3NlZCBieSBicmFja2V0cyAiW10iIHJlcGxhY2VkIHdpdGggeW91ciBvd24gaWRlbnRpZnlpbmcgaW5mb3JtYXRpb24uIChEb24ndCBpbmNsdWRlIHRoZSBicmFja2V0cyEpICBUaGUgdGV4dCBzaG91bGQgYmUgZW5jbG9zZWQgaW4gdGhlIGFwcHJvcHJpYXRlIGNvbW1lbnQgc3ludGF4IGZvciB0aGUgZmlsZSBmb3JtYXQuIFdlIGFsc28gcmVjb21tZW5kIHRoYXQgYSBmaWxlIG9yIGNsYXNzIG5hbWUgYW5kIGRlc2NyaXB0aW9uIG9mIHB1cnBvc2UgYmUgaW5jbHVkZWQgb24gdGhlIHNhbWUgInByaW50ZWQgcGFnZSIgYXMgdGhlIGNvcHlyaWdodCBub3RpY2UgZm9yIGVhc2llciBpZGVudGlmaWNhdGlvbiB3aXRoaW4gdGhpcmQtcGFydHkgYXJjaGl2ZXMuCgpDb3B5cmlnaHQgW3l5eXldIFtuYW1lIG9mIGNvcHlyaWdodCBvd25lcl0KCkxpY2Vuc2VkIHVuZGVyIHRoZSBBcGFjaGUgTGljZW5zZSwgVmVyc2lvbiAyLjAgKHRoZSAiTGljZW5zZSIpOwp5b3UgbWF5IG5vdCB1c2UgdGhpcyBmaWxlIGV4Y2VwdCBpbiBjb21wbGlhbmNlIHdpdGggdGhlIExpY2Vuc2UuCllvdSBtYXkgb2J0YWluIGEgY29weSBvZiB0aGUgTGljZW5zZSBhdAoKaHR0cDovL3d3dy5hcGFjaGUub3JnL2xpY2Vuc2VzL0xJQ0VOU0UtMi4wCgpVbmxlc3MgcmVxdWlyZWQgYnkgYXBwbGljYWJsZSBsYXcgb3IgYWdyZWVkIHRvIGluIHdyaXRpbmcsIHNvZnR3YXJlCmRpc3RyaWJ1dGVkIHVuZGVyIHRoZSBMaWNlbnNlIGlzIGRpc3RyaWJ1dGVkIG9uIGFuICJBUyBJUyIgQkFTSVMsCldJVEhPVVQgV0FSUkFOVElFUyBPUiBDT05ESVRJT05TIE9GIEFOWSBLSU5ELCBlaXRoZXIgZXhwcmVzcyBvciBpbXBsaWVkLgpTZWUgdGhlIExpY2Vuc2UgZm9yIHRoZSBzcGVjaWZpYyBsYW5ndWFnZSBnb3Zlcm5pbmcgcGVybWlzc2lvbnMgYW5kCmxpbWl0YXRpb25zIHVuZGVyIHRoZSBMaWNlbnNlLg==" + }, + "url": "https://www.apache.org/licenses/LICENSE-2.0" + } + } + ], + "version": "0.4.23", + "cpe": "cpe:2.3:a:mongodb:js-bson:0.4.23:*:*:*:*:*:*:*", + "purl": "pkg:npm/bson@0.4.23", + "bom-ref": "bson_0.4.23_dab6d920-0ee7-42a1-a6b9-4bedff5894b8", + "description": "A bson parser for node.js and the browser", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "99" + } + ] + }, + { + "name": "buffer-xor", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.0.3", + "purl": "pkg:npm/buffer-xor@1.0.3", + "bom-ref": "buffer-xor_1.0.3_0467cbc3-6af3-413f-82fe-07c3f16d0897", + "description": "A simple module for bitwise-xor on buffers", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "102" + } + ] + }, + { + "name": "builtin-modules", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.1.1", + "purl": "pkg:npm/builtin-modules@1.1.1", + "bom-ref": "builtin-modules_1.1.1_b53d6f0b-4e72-49e0-b169-6b5a708cac0e", + "description": "List of the Node.js builtin modules", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "103" + } + ] + }, + { + "name": "builtin-status-codes", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "3.0.0", + "purl": "pkg:npm/builtin-status-codes@3.0.0", + "bom-ref": "builtin-status-codes_3.0.0_ff7b9849-3616-4e51-a101-033cd2e42ed0", + "description": "The map of HTTP status codes from the builtin http module", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "104" + } + ] + }, + { + "name": "bytes", + "type": "library", + "version": "1.0.0", + "purl": "pkg:npm/bytes@1.0.0", + "bom-ref": "bytes_1.0.0_c0544a27-4858-49df-a2f9-5ae8e4c13c5f", + "description": "byte size string parser / serializer", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "106" + } + ] + }, + { + "name": "caching-transform", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.0.1", + "purl": "pkg:npm/caching-transform@1.0.1", + "bom-ref": "caching-transform_1.0.1_6dac9315-3f50-45eb-bb4c-b53d4cacb35e", + "description": "Wraps a transform and provides caching", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "109" + } + ] + }, + { + "name": "camelcase", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.2.1", + "purl": "pkg:npm/camelcase@1.2.1", + "bom-ref": "camelcase_1.2.1_24b2dd64-a21f-4ea0-b6e4-0378fa48b35a", + "description": "Convert a dash/dot/underscore/space separated string to camelCase: foo-bar → fooBar", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "110" + } + ] + }, + { + "name": "camelcase", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "4.1.0", + "purl": "pkg:npm/camelcase@4.1.0", + "bom-ref": "camelcase_4.1.0_8ebc1024-bd97-4abd-a29a-d50a21bee451", + "description": "Convert a dash/dot/underscore/space separated string to camelCase: foo-bar → fooBar", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "113" + } + ] + }, + { + "name": "center-align", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "0.1.3", + "purl": "pkg:npm/center-align@0.1.3", + "bom-ref": "center-align_0.1.3_0dff0cc2-3bc6-49ad-948b-514b7be0784a", + "description": "Center-align the text in a string.", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "117" + } + ] + }, + { + "name": "chalk", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.1.3", + "purl": "pkg:npm/chalk@1.1.3", + "bom-ref": "chalk_1.1.3_80e992d2-31d3-4841-aee7-f55ecf992725", + "description": "Terminal string styling done right. Much color.", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "119" + } + ] + }, + { + "name": "clean-yaml-object", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "0.1.0", + "purl": "pkg:npm/clean-yaml-object@0.1.0", + "bom-ref": "clean-yaml-object_0.1.0_bcb7489c-56d4-4961-89af-5f1f93f7ac47", + "description": "Clean up an object prior to serialization", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "124" + } + ] + }, + { + "name": "cliui", + "type": "library", + "licenses": [ + { + "license": { + "id": "ISC", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "SVNDIExpY2Vuc2U6CgpDb3B5cmlnaHQgKGMpIDIwMDQtMjAxMCBieSBJbnRlcm5ldCBTeXN0ZW1zIENvbnNvcnRpdW0sIEluYy4gKCJJU0MiKQpDb3B5cmlnaHQgKGMpIDE5OTUtMjAwMyBieSBJbnRlcm5ldCBTb2Z0d2FyZSBDb25zb3J0aXVtCgpQZXJtaXNzaW9uIHRvIHVzZSwgY29weSwgbW9kaWZ5LCBhbmQvb3IgZGlzdHJpYnV0ZSB0aGlzIHNvZnR3YXJlIGZvciBhbnkgcHVycG9zZSB3aXRoIG9yIHdpdGhvdXQgZmVlIGlzIGhlcmVieSBncmFudGVkLCBwcm92aWRlZCB0aGF0IHRoZSBhYm92ZSBjb3B5cmlnaHQgbm90aWNlIGFuZCB0aGlzIHBlcm1pc3Npb24gbm90aWNlIGFwcGVhciBpbiBhbGwgY29waWVzLgoKVEhFIFNPRlRXQVJFIElTIFBST1ZJREVEICJBUyBJUyIgQU5EIElTQyBESVNDTEFJTVMgQUxMIFdBUlJBTlRJRVMgV0lUSCBSRUdBUkQgVE8gVEhJUyBTT0ZUV0FSRSBJTkNMVURJTkcgQUxMIElNUExJRUQgV0FSUkFOVElFUyBPRiBNRVJDSEFOVEFCSUxJVFkgQU5EIEZJVE5FU1MuIElOIE5PIEVWRU5UIFNIQUxMIElTQyBCRSBMSUFCTEUgRk9SIEFOWSBTUEVDSUFMLCBESVJFQ1QsIElORElSRUNULCBPUiBDT05TRVFVRU5USUFMIERBTUFHRVMgT1IgQU5ZIERBTUFHRVMgV0hBVFNPRVZFUiBSRVNVTFRJTkcgRlJPTSBMT1NTIE9GIFVTRSwgREFUQSBPUiBQUk9GSVRTLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgTkVHTElHRU5DRSBPUiBPVEhFUiBUT1JUSU9VUyBBQ1RJT04sIEFSSVNJTkcgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgVVNFIE9SIFBFUkZPUk1BTkNFIE9GIFRISVMgU09GVFdBUkUu" + }, + "url": "https://www.isc.org/licenses/" + } + } + ], + "version": "2.1.0", + "purl": "pkg:npm/cliui@2.1.0", + "bom-ref": "cliui_2.1.0_ffa3db64-8c09-41ec-8a9d-a2256bb63a09", + "description": "easily create complex multi-column command-line-interfaces", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "130" + } + ] + }, + { + "name": "code-point-at", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.1.0", + "purl": "pkg:npm/code-point-at@1.1.0", + "bom-ref": "code-point-at_1.1.0_c419cbaa-6bfd-418f-9f1d-f02ce15edc87", + "description": "ES2015 `String#codePointAt()` ponyfill", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "134" + } + ] + }, + { + "name": "color-support", + "type": "library", + "licenses": [ + { + "license": { + "id": "ISC", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "SVNDIExpY2Vuc2U6CgpDb3B5cmlnaHQgKGMpIDIwMDQtMjAxMCBieSBJbnRlcm5ldCBTeXN0ZW1zIENvbnNvcnRpdW0sIEluYy4gKCJJU0MiKQpDb3B5cmlnaHQgKGMpIDE5OTUtMjAwMyBieSBJbnRlcm5ldCBTb2Z0d2FyZSBDb25zb3J0aXVtCgpQZXJtaXNzaW9uIHRvIHVzZSwgY29weSwgbW9kaWZ5LCBhbmQvb3IgZGlzdHJpYnV0ZSB0aGlzIHNvZnR3YXJlIGZvciBhbnkgcHVycG9zZSB3aXRoIG9yIHdpdGhvdXQgZmVlIGlzIGhlcmVieSBncmFudGVkLCBwcm92aWRlZCB0aGF0IHRoZSBhYm92ZSBjb3B5cmlnaHQgbm90aWNlIGFuZCB0aGlzIHBlcm1pc3Npb24gbm90aWNlIGFwcGVhciBpbiBhbGwgY29waWVzLgoKVEhFIFNPRlRXQVJFIElTIFBST1ZJREVEICJBUyBJUyIgQU5EIElTQyBESVNDTEFJTVMgQUxMIFdBUlJBTlRJRVMgV0lUSCBSRUdBUkQgVE8gVEhJUyBTT0ZUV0FSRSBJTkNMVURJTkcgQUxMIElNUExJRUQgV0FSUkFOVElFUyBPRiBNRVJDSEFOVEFCSUxJVFkgQU5EIEZJVE5FU1MuIElOIE5PIEVWRU5UIFNIQUxMIElTQyBCRSBMSUFCTEUgRk9SIEFOWSBTUEVDSUFMLCBESVJFQ1QsIElORElSRUNULCBPUiBDT05TRVFVRU5USUFMIERBTUFHRVMgT1IgQU5ZIERBTUFHRVMgV0hBVFNPRVZFUiBSRVNVTFRJTkcgRlJPTSBMT1NTIE9GIFVTRSwgREFUQSBPUiBQUk9GSVRTLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgTkVHTElHRU5DRSBPUiBPVEhFUiBUT1JUSU9VUyBBQ1RJT04sIEFSSVNJTkcgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgVVNFIE9SIFBFUkZPUk1BTkNFIE9GIFRISVMgU09GVFdBUkUu" + }, + "url": "https://www.isc.org/licenses/" + } + } + ], + "version": "1.1.3", + "purl": "pkg:npm/color-support@1.1.3", + "bom-ref": "color-support_1.1.3_c9c27abd-7c25-48ea-8111-a25acbaf76e3", + "description": "A module which will endeavor to guess your terminal's level of color support.", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "138" + } + ] + }, + { + "name": "combine-source-map", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "0.8.0", + "purl": "pkg:npm/combine-source-map@0.8.0", + "bom-ref": "combine-source-map_0.8.0_b3d138cc-8ea7-4df1-b78a-a9b8bc3cd1ae", + "description": "Add source maps of multiple files, offset them and then combine them into one source map", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "139" + } + ] + }, + { + "name": "commondir", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.0.1", + "purl": "pkg:npm/commondir@1.0.1", + "bom-ref": "commondir_1.0.1_a5e606fc-08f0-41d2-8b93-197123b26844", + "description": "compute the closest common parent for file paths", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "143" + } + ] + }, + { + "name": "concat-map", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "0.0.1", + "purl": "pkg:npm/concat-map@0.0.1", + "bom-ref": "concat-map_0.0.1_792275a4-d886-4a04-86a2-074eb35af4ae", + "description": "concatenative mapdashery", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "144" + } + ] + }, + { + "name": "concat-stream", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.5.2", + "purl": "pkg:npm/concat-stream@1.5.2", + "bom-ref": "concat-stream_1.5.2_6183bb43-76ba-4478-888f-f1fe32d0140f", + "description": "writable stream that concatenates strings or binary data and calls a callback with the result", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "145" + } + ] + }, + { + "name": "concat-stream", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.6.2", + "purl": "pkg:npm/concat-stream@1.6.2", + "bom-ref": "concat-stream_1.6.2_bd273961-013e-4979-b6f2-367d8971ebe9", + "description": "writable stream that concatenates strings or binary data and calls a callback with the result", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "146" + } + ] + }, + { + "name": "connect-busboy", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "0.0.2", + "purl": "pkg:npm/connect-busboy@0.0.2", + "bom-ref": "connect-busboy_0.0.2_fd55687a-594b-4ba9-a89e-5ba9d984b250", + "description": "Connect middleware for busboy", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "148" + } + ] + }, + { + "name": "consolidate", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "0.14.5", + "purl": "pkg:npm/consolidate@0.14.5", + "bom-ref": "consolidate_0.14.5_2f811b83-8c30-4f9c-98aa-b0d31458b825", + "description": "Template engine consolidation library", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "150" + } + ] + }, + { + "name": "constants-browserify", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.0.0", + "purl": "pkg:npm/constants-browserify@1.0.0", + "bom-ref": "constants-browserify_1.0.0_01f518f4-2835-4c96-8440-3aaf843890b3", + "description": "node's constants module for the browser", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "151" + } + ] + }, + { + "name": "content-disposition", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "0.5.0", + "purl": "pkg:npm/content-disposition@0.5.0", + "bom-ref": "content-disposition_0.5.0_e0be9c33-cb38-4ca3-b6ec-13c6626129ca", + "description": "Create and parse Content-Disposition header", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "152" + } + ] + }, + { + "name": "convert-source-map", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.1.3", + "purl": "pkg:npm/convert-source-map@1.1.3", + "bom-ref": "convert-source-map_1.1.3_0782fb75-a424-47b6-b28c-c9a1eb8564a7", + "description": "Converts a source-map from/to different formats and allows adding/changing properties.", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "154" + } + ] + }, + { + "name": "cookie", + "type": "library", + "version": "0.1.2", + "purl": "pkg:npm/cookie@0.1.2", + "bom-ref": "cookie_0.1.2_81a14c75-f864-4ce3-b44e-37fc8f4b5ac4", + "description": "cookie parsing and serialization", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "156" + } + ] + }, + { + "name": "cookie-signature", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.0.6", + "purl": "pkg:npm/cookie-signature@1.0.6", + "bom-ref": "cookie-signature_1.0.6_a0eabbd9-35c9-442e-b7c4-c0d2dc633b09", + "description": "Sign and unsign cookies", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "159" + } + ] + }, + { + "name": "core-util-is", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.0.2", + "purl": "pkg:npm/core-util-is@1.0.2", + "bom-ref": "core-util-is_1.0.2_47880255-498e-4e96-a73d-4563deed3418", + "description": "The `util.is*` functions introduced in Node v0.12.", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "161" + } + ] + }, + { + "name": "crc", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "3.2.1", + "purl": "pkg:npm/crc@3.2.1", + "bom-ref": "crc_3.2.1_70087718-4267-4754-b08b-ec2f9d85aca6", + "description": "Various CRC JavaScript implementations", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "163" + } + ] + }, + { + "name": "create-hash", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.2.0", + "purl": "pkg:npm/create-hash@1.2.0", + "bom-ref": "create-hash_1.2.0_6987c945-a810-4be9-afd3-29df682e1dfa", + "description": "create hashes for browserify", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "166" + } + ] + }, + { + "name": "create-hmac", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.1.7", + "purl": "pkg:npm/create-hmac@1.1.7", + "bom-ref": "create-hmac_1.1.7_410bccb4-578c-4a76-90e6-f5da3277416a", + "description": "node style hmacs in the browser", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "167" + } + ] + }, + { + "name": "cross-spawn", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "4.0.2", + "purl": "pkg:npm/cross-spawn@4.0.2", + "bom-ref": "cross-spawn_4.0.2_1c940b75-03bc-4262-a3f2-bdaf7cd6360b", + "description": "Cross platform child_process#spawn and child_process#spawnSync", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "168" + } + ] + }, + { + "name": "cross-spawn", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "5.1.0", + "purl": "pkg:npm/cross-spawn@5.1.0", + "bom-ref": "cross-spawn_5.1.0_471f50a6-3eb5-47b4-9cc8-1da8022c8f0c", + "description": "Cross platform child_process#spawn and child_process#spawnSync", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "169" + } + ] + }, + { + "name": "dash-ast", + "type": "library", + "licenses": [ + { + "license": { + "id": "Apache-2.0", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "QXBhY2hlIExpY2Vuc2UKVmVyc2lvbiAyLjAsIEphbnVhcnkgMjAwNApodHRwOi8vd3d3LmFwYWNoZS5vcmcvbGljZW5zZXMvCgpURVJNUyBBTkQgQ09ORElUSU9OUyBGT1IgVVNFLCBSRVBST0RVQ1RJT04sIEFORCBESVNUUklCVVRJT04KCjEuIERlZmluaXRpb25zLgoKIkxpY2Vuc2UiIHNoYWxsIG1lYW4gdGhlIHRlcm1zIGFuZCBjb25kaXRpb25zIGZvciB1c2UsIHJlcHJvZHVjdGlvbiwgYW5kIGRpc3RyaWJ1dGlvbiBhcyBkZWZpbmVkIGJ5IFNlY3Rpb25zIDEgdGhyb3VnaCA5IG9mIHRoaXMgZG9jdW1lbnQuCgoiTGljZW5zb3IiIHNoYWxsIG1lYW4gdGhlIGNvcHlyaWdodCBvd25lciBvciBlbnRpdHkgYXV0aG9yaXplZCBieSB0aGUgY29weXJpZ2h0IG93bmVyIHRoYXQgaXMgZ3JhbnRpbmcgdGhlIExpY2Vuc2UuCgoiTGVnYWwgRW50aXR5IiBzaGFsbCBtZWFuIHRoZSB1bmlvbiBvZiB0aGUgYWN0aW5nIGVudGl0eSBhbmQgYWxsIG90aGVyIGVudGl0aWVzIHRoYXQgY29udHJvbCwgYXJlIGNvbnRyb2xsZWQgYnksIG9yIGFyZSB1bmRlciBjb21tb24gY29udHJvbCB3aXRoIHRoYXQgZW50aXR5LiBGb3IgdGhlIHB1cnBvc2VzIG9mIHRoaXMgZGVmaW5pdGlvbiwgImNvbnRyb2wiIG1lYW5zIChpKSB0aGUgcG93ZXIsIGRpcmVjdCBvciBpbmRpcmVjdCwgdG8gY2F1c2UgdGhlIGRpcmVjdGlvbiBvciBtYW5hZ2VtZW50IG9mIHN1Y2ggZW50aXR5LCB3aGV0aGVyIGJ5IGNvbnRyYWN0IG9yIG90aGVyd2lzZSwgb3IgKGlpKSBvd25lcnNoaXAgb2YgZmlmdHkgcGVyY2VudCAoNTAlKSBvciBtb3JlIG9mIHRoZSBvdXRzdGFuZGluZyBzaGFyZXMsIG9yIChpaWkpIGJlbmVmaWNpYWwgb3duZXJzaGlwIG9mIHN1Y2ggZW50aXR5LgoKIllvdSIgKG9yICJZb3VyIikgc2hhbGwgbWVhbiBhbiBpbmRpdmlkdWFsIG9yIExlZ2FsIEVudGl0eSBleGVyY2lzaW5nIHBlcm1pc3Npb25zIGdyYW50ZWQgYnkgdGhpcyBMaWNlbnNlLgoKIlNvdXJjZSIgZm9ybSBzaGFsbCBtZWFuIHRoZSBwcmVmZXJyZWQgZm9ybSBmb3IgbWFraW5nIG1vZGlmaWNhdGlvbnMsIGluY2x1ZGluZyBidXQgbm90IGxpbWl0ZWQgdG8gc29mdHdhcmUgc291cmNlIGNvZGUsIGRvY3VtZW50YXRpb24gc291cmNlLCBhbmQgY29uZmlndXJhdGlvbiBmaWxlcy4KCiJPYmplY3QiIGZvcm0gc2hhbGwgbWVhbiBhbnkgZm9ybSByZXN1bHRpbmcgZnJvbSBtZWNoYW5pY2FsIHRyYW5zZm9ybWF0aW9uIG9yIHRyYW5zbGF0aW9uIG9mIGEgU291cmNlIGZvcm0sIGluY2x1ZGluZyBidXQgbm90IGxpbWl0ZWQgdG8gY29tcGlsZWQgb2JqZWN0IGNvZGUsIGdlbmVyYXRlZCBkb2N1bWVudGF0aW9uLCBhbmQgY29udmVyc2lvbnMgdG8gb3RoZXIgbWVkaWEgdHlwZXMuCgoiV29yayIgc2hhbGwgbWVhbiB0aGUgd29yayBvZiBhdXRob3JzaGlwLCB3aGV0aGVyIGluIFNvdXJjZSBvciBPYmplY3QgZm9ybSwgbWFkZSBhdmFpbGFibGUgdW5kZXIgdGhlIExpY2Vuc2UsIGFzIGluZGljYXRlZCBieSBhIGNvcHlyaWdodCBub3RpY2UgdGhhdCBpcyBpbmNsdWRlZCBpbiBvciBhdHRhY2hlZCB0byB0aGUgd29yayAoYW4gZXhhbXBsZSBpcyBwcm92aWRlZCBpbiB0aGUgQXBwZW5kaXggYmVsb3cpLgoKIkRlcml2YXRpdmUgV29ya3MiIHNoYWxsIG1lYW4gYW55IHdvcmssIHdoZXRoZXIgaW4gU291cmNlIG9yIE9iamVjdCBmb3JtLCB0aGF0IGlzIGJhc2VkIG9uIChvciBkZXJpdmVkIGZyb20pIHRoZSBXb3JrIGFuZCBmb3Igd2hpY2ggdGhlIGVkaXRvcmlhbCByZXZpc2lvbnMsIGFubm90YXRpb25zLCBlbGFib3JhdGlvbnMsIG9yIG90aGVyIG1vZGlmaWNhdGlvbnMgcmVwcmVzZW50LCBhcyBhIHdob2xlLCBhbiBvcmlnaW5hbCB3b3JrIG9mIGF1dGhvcnNoaXAuIEZvciB0aGUgcHVycG9zZXMgb2YgdGhpcyBMaWNlbnNlLCBEZXJpdmF0aXZlIFdvcmtzIHNoYWxsIG5vdCBpbmNsdWRlIHdvcmtzIHRoYXQgcmVtYWluIHNlcGFyYWJsZSBmcm9tLCBvciBtZXJlbHkgbGluayAob3IgYmluZCBieSBuYW1lKSB0byB0aGUgaW50ZXJmYWNlcyBvZiwgdGhlIFdvcmsgYW5kIERlcml2YXRpdmUgV29ya3MgdGhlcmVvZi4KCiJDb250cmlidXRpb24iIHNoYWxsIG1lYW4gYW55IHdvcmsgb2YgYXV0aG9yc2hpcCwgaW5jbHVkaW5nIHRoZSBvcmlnaW5hbCB2ZXJzaW9uIG9mIHRoZSBXb3JrIGFuZCBhbnkgbW9kaWZpY2F0aW9ucyBvciBhZGRpdGlvbnMgdG8gdGhhdCBXb3JrIG9yIERlcml2YXRpdmUgV29ya3MgdGhlcmVvZiwgdGhhdCBpcyBpbnRlbnRpb25hbGx5IHN1Ym1pdHRlZCB0byBMaWNlbnNvciBmb3IgaW5jbHVzaW9uIGluIHRoZSBXb3JrIGJ5IHRoZSBjb3B5cmlnaHQgb3duZXIgb3IgYnkgYW4gaW5kaXZpZHVhbCBvciBMZWdhbCBFbnRpdHkgYXV0aG9yaXplZCB0byBzdWJtaXQgb24gYmVoYWxmIG9mIHRoZSBjb3B5cmlnaHQgb3duZXIuIEZvciB0aGUgcHVycG9zZXMgb2YgdGhpcyBkZWZpbml0aW9uLCAic3VibWl0dGVkIiBtZWFucyBhbnkgZm9ybSBvZiBlbGVjdHJvbmljLCB2ZXJiYWwsIG9yIHdyaXR0ZW4gY29tbXVuaWNhdGlvbiBzZW50IHRvIHRoZSBMaWNlbnNvciBvciBpdHMgcmVwcmVzZW50YXRpdmVzLCBpbmNsdWRpbmcgYnV0IG5vdCBsaW1pdGVkIHRvIGNvbW11bmljYXRpb24gb24gZWxlY3Ryb25pYyBtYWlsaW5nIGxpc3RzLCBzb3VyY2UgY29kZSBjb250cm9sIHN5c3RlbXMsIGFuZCBpc3N1ZSB0cmFja2luZyBzeXN0ZW1zIHRoYXQgYXJlIG1hbmFnZWQgYnksIG9yIG9uIGJlaGFsZiBvZiwgdGhlIExpY2Vuc29yIGZvciB0aGUgcHVycG9zZSBvZiBkaXNjdXNzaW5nIGFuZCBpbXByb3ZpbmcgdGhlIFdvcmssIGJ1dCBleGNsdWRpbmcgY29tbXVuaWNhdGlvbiB0aGF0IGlzIGNvbnNwaWN1b3VzbHkgbWFya2VkIG9yIG90aGVyd2lzZSBkZXNpZ25hdGVkIGluIHdyaXRpbmcgYnkgdGhlIGNvcHlyaWdodCBvd25lciBhcyAiTm90IGEgQ29udHJpYnV0aW9uLiIKCiJDb250cmlidXRvciIgc2hhbGwgbWVhbiBMaWNlbnNvciBhbmQgYW55IGluZGl2aWR1YWwgb3IgTGVnYWwgRW50aXR5IG9uIGJlaGFsZiBvZiB3aG9tIGEgQ29udHJpYnV0aW9uIGhhcyBiZWVuIHJlY2VpdmVkIGJ5IExpY2Vuc29yIGFuZCBzdWJzZXF1ZW50bHkgaW5jb3Jwb3JhdGVkIHdpdGhpbiB0aGUgV29yay4KCjIuIEdyYW50IG9mIENvcHlyaWdodCBMaWNlbnNlLiBTdWJqZWN0IHRvIHRoZSB0ZXJtcyBhbmQgY29uZGl0aW9ucyBvZiB0aGlzIExpY2Vuc2UsIGVhY2ggQ29udHJpYnV0b3IgaGVyZWJ5IGdyYW50cyB0byBZb3UgYSBwZXJwZXR1YWwsIHdvcmxkd2lkZSwgbm9uLWV4Y2x1c2l2ZSwgbm8tY2hhcmdlLCByb3lhbHR5LWZyZWUsIGlycmV2b2NhYmxlIGNvcHlyaWdodCBsaWNlbnNlIHRvIHJlcHJvZHVjZSwgcHJlcGFyZSBEZXJpdmF0aXZlIFdvcmtzIG9mLCBwdWJsaWNseSBkaXNwbGF5LCBwdWJsaWNseSBwZXJmb3JtLCBzdWJsaWNlbnNlLCBhbmQgZGlzdHJpYnV0ZSB0aGUgV29yayBhbmQgc3VjaCBEZXJpdmF0aXZlIFdvcmtzIGluIFNvdXJjZSBvciBPYmplY3QgZm9ybS4KCjMuIEdyYW50IG9mIFBhdGVudCBMaWNlbnNlLiBTdWJqZWN0IHRvIHRoZSB0ZXJtcyBhbmQgY29uZGl0aW9ucyBvZiB0aGlzIExpY2Vuc2UsIGVhY2ggQ29udHJpYnV0b3IgaGVyZWJ5IGdyYW50cyB0byBZb3UgYSBwZXJwZXR1YWwsIHdvcmxkd2lkZSwgbm9uLWV4Y2x1c2l2ZSwgbm8tY2hhcmdlLCByb3lhbHR5LWZyZWUsIGlycmV2b2NhYmxlIChleGNlcHQgYXMgc3RhdGVkIGluIHRoaXMgc2VjdGlvbikgcGF0ZW50IGxpY2Vuc2UgdG8gbWFrZSwgaGF2ZSBtYWRlLCB1c2UsIG9mZmVyIHRvIHNlbGwsIHNlbGwsIGltcG9ydCwgYW5kIG90aGVyd2lzZSB0cmFuc2ZlciB0aGUgV29yaywgd2hlcmUgc3VjaCBsaWNlbnNlIGFwcGxpZXMgb25seSB0byB0aG9zZSBwYXRlbnQgY2xhaW1zIGxpY2Vuc2FibGUgYnkgc3VjaCBDb250cmlidXRvciB0aGF0IGFyZSBuZWNlc3NhcmlseSBpbmZyaW5nZWQgYnkgdGhlaXIgQ29udHJpYnV0aW9uKHMpIGFsb25lIG9yIGJ5IGNvbWJpbmF0aW9uIG9mIHRoZWlyIENvbnRyaWJ1dGlvbihzKSB3aXRoIHRoZSBXb3JrIHRvIHdoaWNoIHN1Y2ggQ29udHJpYnV0aW9uKHMpIHdhcyBzdWJtaXR0ZWQuIElmIFlvdSBpbnN0aXR1dGUgcGF0ZW50IGxpdGlnYXRpb24gYWdhaW5zdCBhbnkgZW50aXR5IChpbmNsdWRpbmcgYSBjcm9zcy1jbGFpbSBvciBjb3VudGVyY2xhaW0gaW4gYSBsYXdzdWl0KSBhbGxlZ2luZyB0aGF0IHRoZSBXb3JrIG9yIGEgQ29udHJpYnV0aW9uIGluY29ycG9yYXRlZCB3aXRoaW4gdGhlIFdvcmsgY29uc3RpdHV0ZXMgZGlyZWN0IG9yIGNvbnRyaWJ1dG9yeSBwYXRlbnQgaW5mcmluZ2VtZW50LCB0aGVuIGFueSBwYXRlbnQgbGljZW5zZXMgZ3JhbnRlZCB0byBZb3UgdW5kZXIgdGhpcyBMaWNlbnNlIGZvciB0aGF0IFdvcmsgc2hhbGwgdGVybWluYXRlIGFzIG9mIHRoZSBkYXRlIHN1Y2ggbGl0aWdhdGlvbiBpcyBmaWxlZC4KCjQuIFJlZGlzdHJpYnV0aW9uLiBZb3UgbWF5IHJlcHJvZHVjZSBhbmQgZGlzdHJpYnV0ZSBjb3BpZXMgb2YgdGhlIFdvcmsgb3IgRGVyaXZhdGl2ZSBXb3JrcyB0aGVyZW9mIGluIGFueSBtZWRpdW0sIHdpdGggb3Igd2l0aG91dCBtb2RpZmljYXRpb25zLCBhbmQgaW4gU291cmNlIG9yIE9iamVjdCBmb3JtLCBwcm92aWRlZCB0aGF0IFlvdSBtZWV0IHRoZSBmb2xsb3dpbmcgY29uZGl0aW9uczoKCiAgICAgKGEpIFlvdSBtdXN0IGdpdmUgYW55IG90aGVyIHJlY2lwaWVudHMgb2YgdGhlIFdvcmsgb3IgRGVyaXZhdGl2ZSBXb3JrcyBhIGNvcHkgb2YgdGhpcyBMaWNlbnNlOyBhbmQKCiAgICAgKGIpIFlvdSBtdXN0IGNhdXNlIGFueSBtb2RpZmllZCBmaWxlcyB0byBjYXJyeSBwcm9taW5lbnQgbm90aWNlcyBzdGF0aW5nIHRoYXQgWW91IGNoYW5nZWQgdGhlIGZpbGVzOyBhbmQKCiAgICAgKGMpIFlvdSBtdXN0IHJldGFpbiwgaW4gdGhlIFNvdXJjZSBmb3JtIG9mIGFueSBEZXJpdmF0aXZlIFdvcmtzIHRoYXQgWW91IGRpc3RyaWJ1dGUsIGFsbCBjb3B5cmlnaHQsIHBhdGVudCwgdHJhZGVtYXJrLCBhbmQgYXR0cmlidXRpb24gbm90aWNlcyBmcm9tIHRoZSBTb3VyY2UgZm9ybSBvZiB0aGUgV29yaywgZXhjbHVkaW5nIHRob3NlIG5vdGljZXMgdGhhdCBkbyBub3QgcGVydGFpbiB0byBhbnkgcGFydCBvZiB0aGUgRGVyaXZhdGl2ZSBXb3JrczsgYW5kCgogICAgIChkKSBJZiB0aGUgV29yayBpbmNsdWRlcyBhICJOT1RJQ0UiIHRleHQgZmlsZSBhcyBwYXJ0IG9mIGl0cyBkaXN0cmlidXRpb24sIHRoZW4gYW55IERlcml2YXRpdmUgV29ya3MgdGhhdCBZb3UgZGlzdHJpYnV0ZSBtdXN0IGluY2x1ZGUgYSByZWFkYWJsZSBjb3B5IG9mIHRoZSBhdHRyaWJ1dGlvbiBub3RpY2VzIGNvbnRhaW5lZCB3aXRoaW4gc3VjaCBOT1RJQ0UgZmlsZSwgZXhjbHVkaW5nIHRob3NlIG5vdGljZXMgdGhhdCBkbyBub3QgcGVydGFpbiB0byBhbnkgcGFydCBvZiB0aGUgRGVyaXZhdGl2ZSBXb3JrcywgaW4gYXQgbGVhc3Qgb25lIG9mIHRoZSBmb2xsb3dpbmcgcGxhY2VzOiB3aXRoaW4gYSBOT1RJQ0UgdGV4dCBmaWxlIGRpc3RyaWJ1dGVkIGFzIHBhcnQgb2YgdGhlIERlcml2YXRpdmUgV29ya3M7IHdpdGhpbiB0aGUgU291cmNlIGZvcm0gb3IgZG9jdW1lbnRhdGlvbiwgaWYgcHJvdmlkZWQgYWxvbmcgd2l0aCB0aGUgRGVyaXZhdGl2ZSBXb3Jrczsgb3IsIHdpdGhpbiBhIGRpc3BsYXkgZ2VuZXJhdGVkIGJ5IHRoZSBEZXJpdmF0aXZlIFdvcmtzLCBpZiBhbmQgd2hlcmV2ZXIgc3VjaCB0aGlyZC1wYXJ0eSBub3RpY2VzIG5vcm1hbGx5IGFwcGVhci4gVGhlIGNvbnRlbnRzIG9mIHRoZSBOT1RJQ0UgZmlsZSBhcmUgZm9yIGluZm9ybWF0aW9uYWwgcHVycG9zZXMgb25seSBhbmQgZG8gbm90IG1vZGlmeSB0aGUgTGljZW5zZS4gWW91IG1heSBhZGQgWW91ciBvd24gYXR0cmlidXRpb24gbm90aWNlcyB3aXRoaW4gRGVyaXZhdGl2ZSBXb3JrcyB0aGF0IFlvdSBkaXN0cmlidXRlLCBhbG9uZ3NpZGUgb3IgYXMgYW4gYWRkZW5kdW0gdG8gdGhlIE5PVElDRSB0ZXh0IGZyb20gdGhlIFdvcmssIHByb3ZpZGVkIHRoYXQgc3VjaCBhZGRpdGlvbmFsIGF0dHJpYnV0aW9uIG5vdGljZXMgY2Fubm90IGJlIGNvbnN0cnVlZCBhcyBtb2RpZnlpbmcgdGhlIExpY2Vuc2UuCgogICAgIFlvdSBtYXkgYWRkIFlvdXIgb3duIGNvcHlyaWdodCBzdGF0ZW1lbnQgdG8gWW91ciBtb2RpZmljYXRpb25zIGFuZCBtYXkgcHJvdmlkZSBhZGRpdGlvbmFsIG9yIGRpZmZlcmVudCBsaWNlbnNlIHRlcm1zIGFuZCBjb25kaXRpb25zIGZvciB1c2UsIHJlcHJvZHVjdGlvbiwgb3IgZGlzdHJpYnV0aW9uIG9mIFlvdXIgbW9kaWZpY2F0aW9ucywgb3IgZm9yIGFueSBzdWNoIERlcml2YXRpdmUgV29ya3MgYXMgYSB3aG9sZSwgcHJvdmlkZWQgWW91ciB1c2UsIHJlcHJvZHVjdGlvbiwgYW5kIGRpc3RyaWJ1dGlvbiBvZiB0aGUgV29yayBvdGhlcndpc2UgY29tcGxpZXMgd2l0aCB0aGUgY29uZGl0aW9ucyBzdGF0ZWQgaW4gdGhpcyBMaWNlbnNlLgoKNS4gU3VibWlzc2lvbiBvZiBDb250cmlidXRpb25zLiBVbmxlc3MgWW91IGV4cGxpY2l0bHkgc3RhdGUgb3RoZXJ3aXNlLCBhbnkgQ29udHJpYnV0aW9uIGludGVudGlvbmFsbHkgc3VibWl0dGVkIGZvciBpbmNsdXNpb24gaW4gdGhlIFdvcmsgYnkgWW91IHRvIHRoZSBMaWNlbnNvciBzaGFsbCBiZSB1bmRlciB0aGUgdGVybXMgYW5kIGNvbmRpdGlvbnMgb2YgdGhpcyBMaWNlbnNlLCB3aXRob3V0IGFueSBhZGRpdGlvbmFsIHRlcm1zIG9yIGNvbmRpdGlvbnMuIE5vdHdpdGhzdGFuZGluZyB0aGUgYWJvdmUsIG5vdGhpbmcgaGVyZWluIHNoYWxsIHN1cGVyc2VkZSBvciBtb2RpZnkgdGhlIHRlcm1zIG9mIGFueSBzZXBhcmF0ZSBsaWNlbnNlIGFncmVlbWVudCB5b3UgbWF5IGhhdmUgZXhlY3V0ZWQgd2l0aCBMaWNlbnNvciByZWdhcmRpbmcgc3VjaCBDb250cmlidXRpb25zLgoKNi4gVHJhZGVtYXJrcy4gVGhpcyBMaWNlbnNlIGRvZXMgbm90IGdyYW50IHBlcm1pc3Npb24gdG8gdXNlIHRoZSB0cmFkZSBuYW1lcywgdHJhZGVtYXJrcywgc2VydmljZSBtYXJrcywgb3IgcHJvZHVjdCBuYW1lcyBvZiB0aGUgTGljZW5zb3IsIGV4Y2VwdCBhcyByZXF1aXJlZCBmb3IgcmVhc29uYWJsZSBhbmQgY3VzdG9tYXJ5IHVzZSBpbiBkZXNjcmliaW5nIHRoZSBvcmlnaW4gb2YgdGhlIFdvcmsgYW5kIHJlcHJvZHVjaW5nIHRoZSBjb250ZW50IG9mIHRoZSBOT1RJQ0UgZmlsZS4KCjcuIERpc2NsYWltZXIgb2YgV2FycmFudHkuIFVubGVzcyByZXF1aXJlZCBieSBhcHBsaWNhYmxlIGxhdyBvciBhZ3JlZWQgdG8gaW4gd3JpdGluZywgTGljZW5zb3IgcHJvdmlkZXMgdGhlIFdvcmsgKGFuZCBlYWNoIENvbnRyaWJ1dG9yIHByb3ZpZGVzIGl0cyBDb250cmlidXRpb25zKSBvbiBhbiAiQVMgSVMiIEJBU0lTLCBXSVRIT1VUIFdBUlJBTlRJRVMgT1IgQ09ORElUSU9OUyBPRiBBTlkgS0lORCwgZWl0aGVyIGV4cHJlc3Mgb3IgaW1wbGllZCwgaW5jbHVkaW5nLCB3aXRob3V0IGxpbWl0YXRpb24sIGFueSB3YXJyYW50aWVzIG9yIGNvbmRpdGlvbnMgb2YgVElUTEUsIE5PTi1JTkZSSU5HRU1FTlQsIE1FUkNIQU5UQUJJTElUWSwgb3IgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UuIFlvdSBhcmUgc29sZWx5IHJlc3BvbnNpYmxlIGZvciBkZXRlcm1pbmluZyB0aGUgYXBwcm9wcmlhdGVuZXNzIG9mIHVzaW5nIG9yIHJlZGlzdHJpYnV0aW5nIHRoZSBXb3JrIGFuZCBhc3N1bWUgYW55IHJpc2tzIGFzc29jaWF0ZWQgd2l0aCBZb3VyIGV4ZXJjaXNlIG9mIHBlcm1pc3Npb25zIHVuZGVyIHRoaXMgTGljZW5zZS4KCjguIExpbWl0YXRpb24gb2YgTGlhYmlsaXR5LiBJbiBubyBldmVudCBhbmQgdW5kZXIgbm8gbGVnYWwgdGhlb3J5LCB3aGV0aGVyIGluIHRvcnQgKGluY2x1ZGluZyBuZWdsaWdlbmNlKSwgY29udHJhY3QsIG9yIG90aGVyd2lzZSwgdW5sZXNzIHJlcXVpcmVkIGJ5IGFwcGxpY2FibGUgbGF3IChzdWNoIGFzIGRlbGliZXJhdGUgYW5kIGdyb3NzbHkgbmVnbGlnZW50IGFjdHMpIG9yIGFncmVlZCB0byBpbiB3cml0aW5nLCBzaGFsbCBhbnkgQ29udHJpYnV0b3IgYmUgbGlhYmxlIHRvIFlvdSBmb3IgZGFtYWdlcywgaW5jbHVkaW5nIGFueSBkaXJlY3QsIGluZGlyZWN0LCBzcGVjaWFsLCBpbmNpZGVudGFsLCBvciBjb25zZXF1ZW50aWFsIGRhbWFnZXMgb2YgYW55IGNoYXJhY3RlciBhcmlzaW5nIGFzIGEgcmVzdWx0IG9mIHRoaXMgTGljZW5zZSBvciBvdXQgb2YgdGhlIHVzZSBvciBpbmFiaWxpdHkgdG8gdXNlIHRoZSBXb3JrIChpbmNsdWRpbmcgYnV0IG5vdCBsaW1pdGVkIHRvIGRhbWFnZXMgZm9yIGxvc3Mgb2YgZ29vZHdpbGwsIHdvcmsgc3RvcHBhZ2UsIGNvbXB1dGVyIGZhaWx1cmUgb3IgbWFsZnVuY3Rpb24sIG9yIGFueSBhbmQgYWxsIG90aGVyIGNvbW1lcmNpYWwgZGFtYWdlcyBvciBsb3NzZXMpLCBldmVuIGlmIHN1Y2ggQ29udHJpYnV0b3IgaGFzIGJlZW4gYWR2aXNlZCBvZiB0aGUgcG9zc2liaWxpdHkgb2Ygc3VjaCBkYW1hZ2VzLgoKOS4gQWNjZXB0aW5nIFdhcnJhbnR5IG9yIEFkZGl0aW9uYWwgTGlhYmlsaXR5LiBXaGlsZSByZWRpc3RyaWJ1dGluZyB0aGUgV29yayBvciBEZXJpdmF0aXZlIFdvcmtzIHRoZXJlb2YsIFlvdSBtYXkgY2hvb3NlIHRvIG9mZmVyLCBhbmQgY2hhcmdlIGEgZmVlIGZvciwgYWNjZXB0YW5jZSBvZiBzdXBwb3J0LCB3YXJyYW50eSwgaW5kZW1uaXR5LCBvciBvdGhlciBsaWFiaWxpdHkgb2JsaWdhdGlvbnMgYW5kL29yIHJpZ2h0cyBjb25zaXN0ZW50IHdpdGggdGhpcyBMaWNlbnNlLiBIb3dldmVyLCBpbiBhY2NlcHRpbmcgc3VjaCBvYmxpZ2F0aW9ucywgWW91IG1heSBhY3Qgb25seSBvbiBZb3VyIG93biBiZWhhbGYgYW5kIG9uIFlvdXIgc29sZSByZXNwb25zaWJpbGl0eSwgbm90IG9uIGJlaGFsZiBvZiBhbnkgb3RoZXIgQ29udHJpYnV0b3IsIGFuZCBvbmx5IGlmIFlvdSBhZ3JlZSB0byBpbmRlbW5pZnksIGRlZmVuZCwgYW5kIGhvbGQgZWFjaCBDb250cmlidXRvciBoYXJtbGVzcyBmb3IgYW55IGxpYWJpbGl0eSBpbmN1cnJlZCBieSwgb3IgY2xhaW1zIGFzc2VydGVkIGFnYWluc3QsIHN1Y2ggQ29udHJpYnV0b3IgYnkgcmVhc29uIG9mIHlvdXIgYWNjZXB0aW5nIGFueSBzdWNoIHdhcnJhbnR5IG9yIGFkZGl0aW9uYWwgbGlhYmlsaXR5LgoKRU5EIE9GIFRFUk1TIEFORCBDT05ESVRJT05TCgpBUFBFTkRJWDogSG93IHRvIGFwcGx5IHRoZSBBcGFjaGUgTGljZW5zZSB0byB5b3VyIHdvcmsuCgpUbyBhcHBseSB0aGUgQXBhY2hlIExpY2Vuc2UgdG8geW91ciB3b3JrLCBhdHRhY2ggdGhlIGZvbGxvd2luZyBib2lsZXJwbGF0ZSBub3RpY2UsIHdpdGggdGhlIGZpZWxkcyBlbmNsb3NlZCBieSBicmFja2V0cyAiW10iIHJlcGxhY2VkIHdpdGggeW91ciBvd24gaWRlbnRpZnlpbmcgaW5mb3JtYXRpb24uIChEb24ndCBpbmNsdWRlIHRoZSBicmFja2V0cyEpICBUaGUgdGV4dCBzaG91bGQgYmUgZW5jbG9zZWQgaW4gdGhlIGFwcHJvcHJpYXRlIGNvbW1lbnQgc3ludGF4IGZvciB0aGUgZmlsZSBmb3JtYXQuIFdlIGFsc28gcmVjb21tZW5kIHRoYXQgYSBmaWxlIG9yIGNsYXNzIG5hbWUgYW5kIGRlc2NyaXB0aW9uIG9mIHB1cnBvc2UgYmUgaW5jbHVkZWQgb24gdGhlIHNhbWUgInByaW50ZWQgcGFnZSIgYXMgdGhlIGNvcHlyaWdodCBub3RpY2UgZm9yIGVhc2llciBpZGVudGlmaWNhdGlvbiB3aXRoaW4gdGhpcmQtcGFydHkgYXJjaGl2ZXMuCgpDb3B5cmlnaHQgW3l5eXldIFtuYW1lIG9mIGNvcHlyaWdodCBvd25lcl0KCkxpY2Vuc2VkIHVuZGVyIHRoZSBBcGFjaGUgTGljZW5zZSwgVmVyc2lvbiAyLjAgKHRoZSAiTGljZW5zZSIpOwp5b3UgbWF5IG5vdCB1c2UgdGhpcyBmaWxlIGV4Y2VwdCBpbiBjb21wbGlhbmNlIHdpdGggdGhlIExpY2Vuc2UuCllvdSBtYXkgb2J0YWluIGEgY29weSBvZiB0aGUgTGljZW5zZSBhdAoKaHR0cDovL3d3dy5hcGFjaGUub3JnL2xpY2Vuc2VzL0xJQ0VOU0UtMi4wCgpVbmxlc3MgcmVxdWlyZWQgYnkgYXBwbGljYWJsZSBsYXcgb3IgYWdyZWVkIHRvIGluIHdyaXRpbmcsIHNvZnR3YXJlCmRpc3RyaWJ1dGVkIHVuZGVyIHRoZSBMaWNlbnNlIGlzIGRpc3RyaWJ1dGVkIG9uIGFuICJBUyBJUyIgQkFTSVMsCldJVEhPVVQgV0FSUkFOVElFUyBPUiBDT05ESVRJT05TIE9GIEFOWSBLSU5ELCBlaXRoZXIgZXhwcmVzcyBvciBpbXBsaWVkLgpTZWUgdGhlIExpY2Vuc2UgZm9yIHRoZSBzcGVjaWZpYyBsYW5ndWFnZSBnb3Zlcm5pbmcgcGVybWlzc2lvbnMgYW5kCmxpbWl0YXRpb25zIHVuZGVyIHRoZSBMaWNlbnNlLg==" + }, + "url": "https://www.apache.org/licenses/LICENSE-2.0" + } + } + ], + "version": "1.0.0", + "purl": "pkg:npm/dash-ast@1.0.0", + "bom-ref": "dash-ast_1.0.0_ccf91253-aa8b-46c8-806c-626fe722d9c0", + "description": "walk an AST, quickly", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "177" + } + ] + }, + { + "name": "dashdash", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.14.1", + "purl": "pkg:npm/dashdash@1.14.1", + "bom-ref": "dashdash_1.14.1_786cc934-35b3-4a7b-8a96-7e90f34a5d4e", + "description": "A light, featureful and explicit option parsing library.", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "178" + } + ] + }, + { + "name": "debug", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "2.2.0", + "cpe": "cpe:2.3:a:debug_project:debug:2.2.0:*:*:*:*:node.js:*:*", + "purl": "pkg:npm/debug@2.2.0", + "bom-ref": "debug_2.2.0_23744295-ff4c-4fc6-baf7-250d6257f36a", + "description": "small debugging utility", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "181" + } + ] + }, + { + "name": "debug", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "2.6.9", + "purl": "pkg:npm/debug@2.6.9", + "bom-ref": "debug_2.6.9_94de3aa9-86bc-4cc8-80a2-3ed8bfcfce5b", + "description": "small debugging utility", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "182" + } + ] + }, + { + "name": "debug", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "3.1.0", + "purl": "pkg:npm/debug@3.1.0", + "bom-ref": "debug_3.1.0_bb3e9186-7533-4eb1-bf4b-de79cb926f9f", + "description": "small debugging utility", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "183" + } + ] + }, + { + "name": "decamelize", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.2.0", + "purl": "pkg:npm/decamelize@1.2.0", + "bom-ref": "decamelize_1.2.0_4a3ad1bc-bb7e-4049-b685-deb13fe594ae", + "description": "Convert a camelized string into a lowercased one with a custom separator: unicornRainbow → unicorn_rainbow", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "186" + } + ] + }, + { + "name": "default-require-extensions", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.0.0", + "purl": "pkg:npm/default-require-extensions@1.0.0", + "bom-ref": "default-require-extensions_1.0.0_a6b6465c-fc03-4286-b7b6-401754b234d5", + "description": "Node's default require extensions as a separate module", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "191" + } + ] + }, + { + "name": "delayed-stream", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.0.0", + "purl": "pkg:npm/delayed-stream@1.0.0", + "bom-ref": "delayed-stream_1.0.0_b3e31300-7c2e-4f38-ae6e-5bdee6831e31", + "description": "Buffers events from a stream until you are ready to handle them.", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "196" + } + ] + }, + { + "name": "depd", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.0.1", + "purl": "pkg:npm/depd@1.0.1", + "bom-ref": "depd_1.0.1_8fea013a-d6cb-466a-9387-fa060b343eca", + "description": "Deprecate all the things", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "197" + } + ] + }, + { + "name": "depd", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "2.0.0", + "purl": "pkg:npm/depd@2.0.0", + "bom-ref": "depd_2.0.0_39299038-2177-4302-9d68-1c37a18fc465", + "description": "Deprecate all the things", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "199" + } + ] + }, + { + "name": "destroy", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.0.3", + "purl": "pkg:npm/destroy@1.0.3", + "bom-ref": "destroy_1.0.3_f8fe9df1-ea10-4161-9204-21c297a97f40", + "description": "destroy a stream if possible", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "202" + } + ] + }, + { + "name": "detective", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "4.7.1", + "purl": "pkg:npm/detective@4.7.1", + "bom-ref": "detective_4.7.1_7f85cf14-e8fb-4db1-bcf7-1d5dec8413ac", + "description": "find all require() calls by walking the AST", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "203" + } + ] + }, + { + "name": "diff", + "type": "library", + "licenses": [ + { + "license": { + "id": "BSD-3-Clause", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "Q29weXJpZ2h0IChjKSA8eWVhcj4gPG93bmVyPi4gCgpSZWRpc3RyaWJ1dGlvbiBhbmQgdXNlIGluIHNvdXJjZSBhbmQgYmluYXJ5IGZvcm1zLCB3aXRoIG9yIHdpdGhvdXQgbW9kaWZpY2F0aW9uLCBhcmUgcGVybWl0dGVkIHByb3ZpZGVkIHRoYXQgdGhlIGZvbGxvd2luZyBjb25kaXRpb25zIGFyZSBtZXQ6CgoxLiBSZWRpc3RyaWJ1dGlvbnMgb2Ygc291cmNlIGNvZGUgbXVzdCByZXRhaW4gdGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UsIHRoaXMgbGlzdCBvZiBjb25kaXRpb25zIGFuZCB0aGUgZm9sbG93aW5nIGRpc2NsYWltZXIuCgoyLiBSZWRpc3RyaWJ1dGlvbnMgaW4gYmluYXJ5IGZvcm0gbXVzdCByZXByb2R1Y2UgdGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UsIHRoaXMgbGlzdCBvZiBjb25kaXRpb25zIGFuZCB0aGUgZm9sbG93aW5nIGRpc2NsYWltZXIgaW4gdGhlIGRvY3VtZW50YXRpb24gYW5kL29yIG90aGVyIG1hdGVyaWFscyBwcm92aWRlZCB3aXRoIHRoZSBkaXN0cmlidXRpb24uCgozLiBOZWl0aGVyIHRoZSBuYW1lIG9mIHRoZSBjb3B5cmlnaHQgaG9sZGVyIG5vciB0aGUgbmFtZXMgb2YgaXRzIGNvbnRyaWJ1dG9ycyBtYXkgYmUgdXNlZCB0byBlbmRvcnNlIG9yIHByb21vdGUgcHJvZHVjdHMgZGVyaXZlZCBmcm9tIHRoaXMgc29mdHdhcmUgd2l0aG91dCBzcGVjaWZpYyBwcmlvciB3cml0dGVuIHBlcm1pc3Npb24uCgpUSElTIFNPRlRXQVJFIElTIFBST1ZJREVEIEJZIFRIRSBDT1BZUklHSFQgSE9MREVSUyBBTkQgQ09OVFJJQlVUT1JTICJBUyBJUyIgQU5EIEFOWSBFWFBSRVNTIE9SIElNUExJRUQgV0FSUkFOVElFUywgSU5DTFVESU5HLCBCVVQgTk9UIExJTUlURUQgVE8sIFRIRSBJTVBMSUVEIFdBUlJBTlRJRVMgT0YgTUVSQ0hBTlRBQklMSVRZIEFORCBGSVRORVNTIEZPUiBBIFBBUlRJQ1VMQVIgUFVSUE9TRSBBUkUgRElTQ0xBSU1FRC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIENPUFlSSUdIVCBIT0xERVIgT1IgQ09OVFJJQlVUT1JTIEJFIExJQUJMRSBGT1IgQU5ZIERJUkVDVCwgSU5ESVJFQ1QsIElOQ0lERU5UQUwsIFNQRUNJQUwsIEVYRU1QTEFSWSwgT1IgQ09OU0VRVUVOVElBTCBEQU1BR0VTIChJTkNMVURJTkcsIEJVVCBOT1QgTElNSVRFRCBUTywgUFJPQ1VSRU1FTlQgT0YgU1VCU1RJVFVURSBHT09EUyBPUiBTRVJWSUNFUzsgTE9TUyBPRiBVU0UsIERBVEEsIE9SIFBST0ZJVFM7IE9SIEJVU0lORVNTIElOVEVSUlVQVElPTikgSE9XRVZFUiBDQVVTRUQgQU5EIE9OIEFOWSBUSEVPUlkgT0YgTElBQklMSVRZLCBXSEVUSEVSIElOIENPTlRSQUNULCBTVFJJQ1QgTElBQklMSVRZLCBPUiBUT1JUIChJTkNMVURJTkcgTkVHTElHRU5DRSBPUiBPVEhFUldJU0UpIEFSSVNJTkcgSU4gQU5ZIFdBWSBPVVQgT0YgVEhFIFVTRSBPRiBUSElTIFNPRlRXQVJFLCBFVkVOIElGIEFEVklTRUQgT0YgVEhFIFBPU1NJQklMSVRZIE9GIFNVQ0ggREFNQUdFLg==" + }, + "url": "https://opensource.org/licenses/BSD-3-Clause" + } + } + ], + "version": "1.4.0", + "purl": "pkg:npm/diff@1.4.0", + "bom-ref": "diff_1.4.0_f66599a8-cbbc-4262-9d54-421f719498fe", + "description": "A javascript text diff implementation.", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "205" + } + ] + }, + { + "name": "diffie-hellman", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "5.0.3", + "purl": "pkg:npm/diffie-hellman@5.0.3", + "bom-ref": "diffie-hellman_5.0.3_fb786ba7-90d7-4f39-8f7f-b98db8f2cd12", + "description": "pure js diffie-hellman", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "207" + } + ] + }, + { + "name": "domain-browser", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.1.7", + "purl": "pkg:npm/domain-browser@1.1.7", + "bom-ref": "domain-browser_1.1.7_2a01b81e-9a71-48c0-81a4-2ee256ad2f75", + "description": "Node's domain module for the web browser. This is merely an evented try...catch with the same API as node, nothing more.", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "209" + } + ] + }, + { + "name": "duplexer2", + "type": "library", + "licenses": [ + { + "license": { + "id": "BSD-3-Clause", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "Q29weXJpZ2h0IChjKSA8eWVhcj4gPG93bmVyPi4gCgpSZWRpc3RyaWJ1dGlvbiBhbmQgdXNlIGluIHNvdXJjZSBhbmQgYmluYXJ5IGZvcm1zLCB3aXRoIG9yIHdpdGhvdXQgbW9kaWZpY2F0aW9uLCBhcmUgcGVybWl0dGVkIHByb3ZpZGVkIHRoYXQgdGhlIGZvbGxvd2luZyBjb25kaXRpb25zIGFyZSBtZXQ6CgoxLiBSZWRpc3RyaWJ1dGlvbnMgb2Ygc291cmNlIGNvZGUgbXVzdCByZXRhaW4gdGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UsIHRoaXMgbGlzdCBvZiBjb25kaXRpb25zIGFuZCB0aGUgZm9sbG93aW5nIGRpc2NsYWltZXIuCgoyLiBSZWRpc3RyaWJ1dGlvbnMgaW4gYmluYXJ5IGZvcm0gbXVzdCByZXByb2R1Y2UgdGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UsIHRoaXMgbGlzdCBvZiBjb25kaXRpb25zIGFuZCB0aGUgZm9sbG93aW5nIGRpc2NsYWltZXIgaW4gdGhlIGRvY3VtZW50YXRpb24gYW5kL29yIG90aGVyIG1hdGVyaWFscyBwcm92aWRlZCB3aXRoIHRoZSBkaXN0cmlidXRpb24uCgozLiBOZWl0aGVyIHRoZSBuYW1lIG9mIHRoZSBjb3B5cmlnaHQgaG9sZGVyIG5vciB0aGUgbmFtZXMgb2YgaXRzIGNvbnRyaWJ1dG9ycyBtYXkgYmUgdXNlZCB0byBlbmRvcnNlIG9yIHByb21vdGUgcHJvZHVjdHMgZGVyaXZlZCBmcm9tIHRoaXMgc29mdHdhcmUgd2l0aG91dCBzcGVjaWZpYyBwcmlvciB3cml0dGVuIHBlcm1pc3Npb24uCgpUSElTIFNPRlRXQVJFIElTIFBST1ZJREVEIEJZIFRIRSBDT1BZUklHSFQgSE9MREVSUyBBTkQgQ09OVFJJQlVUT1JTICJBUyBJUyIgQU5EIEFOWSBFWFBSRVNTIE9SIElNUExJRUQgV0FSUkFOVElFUywgSU5DTFVESU5HLCBCVVQgTk9UIExJTUlURUQgVE8sIFRIRSBJTVBMSUVEIFdBUlJBTlRJRVMgT0YgTUVSQ0hBTlRBQklMSVRZIEFORCBGSVRORVNTIEZPUiBBIFBBUlRJQ1VMQVIgUFVSUE9TRSBBUkUgRElTQ0xBSU1FRC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIENPUFlSSUdIVCBIT0xERVIgT1IgQ09OVFJJQlVUT1JTIEJFIExJQUJMRSBGT1IgQU5ZIERJUkVDVCwgSU5ESVJFQ1QsIElOQ0lERU5UQUwsIFNQRUNJQUwsIEVYRU1QTEFSWSwgT1IgQ09OU0VRVUVOVElBTCBEQU1BR0VTIChJTkNMVURJTkcsIEJVVCBOT1QgTElNSVRFRCBUTywgUFJPQ1VSRU1FTlQgT0YgU1VCU1RJVFVURSBHT09EUyBPUiBTRVJWSUNFUzsgTE9TUyBPRiBVU0UsIERBVEEsIE9SIFBST0ZJVFM7IE9SIEJVU0lORVNTIElOVEVSUlVQVElPTikgSE9XRVZFUiBDQVVTRUQgQU5EIE9OIEFOWSBUSEVPUlkgT0YgTElBQklMSVRZLCBXSEVUSEVSIElOIENPTlRSQUNULCBTVFJJQ1QgTElBQklMSVRZLCBPUiBUT1JUIChJTkNMVURJTkcgTkVHTElHRU5DRSBPUiBPVEhFUldJU0UpIEFSSVNJTkcgSU4gQU5ZIFdBWSBPVVQgT0YgVEhFIFVTRSBPRiBUSElTIFNPRlRXQVJFLCBFVkVOIElGIEFEVklTRUQgT0YgVEhFIFBPU1NJQklMSVRZIE9GIFNVQ0ggREFNQUdFLg==" + }, + "url": "https://opensource.org/licenses/BSD-3-Clause" + } + } + ], + "version": "0.1.4", + "purl": "pkg:npm/duplexer2@0.1.4", + "bom-ref": "duplexer2_0.1.4_b87401e8-8633-4336-b469-cace7cd46b98", + "description": "Like duplexer but using streams3", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "213" + } + ] + }, + { + "name": "dustjs-helpers", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.5.0", + "purl": "pkg:npm/dustjs-helpers@1.5.0", + "bom-ref": "dustjs-helpers_1.5.0_389b365a-8afe-44b2-9101-3c05a132e04e", + "description": "Helpers for dustjs-linkedin package", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "215" + } + ] + }, + { + "name": "ecc-jsbn", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "0.1.2", + "purl": "pkg:npm/ecc-jsbn@0.1.2", + "bom-ref": "ecc-jsbn_0.1.2_e14bfd7d-7230-410d-b36b-fa0d07c9af0b", + "description": "ECC JS code based on JSBN", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "217" + } + ] + }, + { + "name": "ee-first", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.0.5", + "purl": "pkg:npm/ee-first@1.0.5", + "bom-ref": "ee-first_1.0.5_eecdf511-25b1-4763-8354-5daccdf9c1b0", + "description": "return the first event in a set of ee/event pairs", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "218" + } + ] + }, + { + "name": "ee-first", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.1.0", + "purl": "pkg:npm/ee-first@1.1.0", + "bom-ref": "ee-first_1.1.0_0981dc02-6392-418d-ba88-c0896fc232ea", + "description": "return the first event in a set of ee/event pairs", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "219" + } + ] + }, + { + "name": "ee-first", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.1.1", + "purl": "pkg:npm/ee-first@1.1.1", + "bom-ref": "ee-first_1.1.1_e2758646-0a67-4fc7-92d4-1c39bfaa0fa6", + "description": "return the first event in a set of ee/event pairs", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "220" + } + ] + }, + { + "name": "ejs", + "type": "library", + "version": "0.8.8", + "purl": "pkg:npm/ejs@0.8.8", + "bom-ref": "ejs_0.8.8_136181c1-1dcb-40ce-904a-1c76c0c22858", + "description": "Embedded JavaScript templates", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "221" + } + ] + }, + { + "name": "ejs", + "type": "library", + "version": "1.0.0", + "purl": "pkg:npm/ejs@1.0.0", + "bom-ref": "ejs_1.0.0_6be711e7-df4b-456e-9e11-b55b239644ff", + "description": "Embedded JavaScript templates", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "222" + } + ] + }, + { + "name": "ejs-locals", + "type": "library", + "version": "1.0.2", + "purl": "pkg:npm/ejs-locals@1.0.2", + "bom-ref": "ejs-locals_1.0.2_285f0fbe-7763-4603-81bb-c7bc234360f7", + "description": "Express 3.x locals for layout, partial and blocks.", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "223" + } + ] + }, + { + "name": "errorhandler", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.2.0", + "purl": "pkg:npm/errorhandler@1.2.0", + "bom-ref": "errorhandler_1.2.0_ec86a4b5-7e29-429a-8c17-014b8bb68da7", + "description": "Development-only error handler middleware", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "229" + } + ] + }, + { + "name": "es6-promise", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "2.1.1", + "purl": "pkg:npm/es6-promise@2.1.1", + "bom-ref": "es6-promise_2.1.1_b4dbdcac-5800-4f07-a3cf-adc9186cdd8a", + "description": "A lightweight library that provides tools for organizing asynchronous code", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "230" + } + ] + }, + { + "name": "escape-html", + "type": "library", + "version": "1.0.1", + "purl": "pkg:npm/escape-html@1.0.1", + "bom-ref": "escape-html_1.0.1_0c95f8c2-7791-4b0d-b200-9cac01726458", + "description": "Escape HTML entities", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "233" + } + ] + }, + { + "name": "escape-string-regexp", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.0.5", + "purl": "pkg:npm/escape-string-regexp@1.0.5", + "bom-ref": "escape-string-regexp_1.0.5_2f0f6f48-f32a-42e7-a9b3-5b746b63963b", + "description": "Escape RegExp special characters", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "234" + } + ] + }, + { + "name": "esprima", + "type": "library", + "licenses": [ + { + "license": { + "id": "BSD-2-Clause", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "Q29weXJpZ2h0IChjKSA8eWVhcj4gPG93bmVyPiAKClJlZGlzdHJpYnV0aW9uIGFuZCB1c2UgaW4gc291cmNlIGFuZCBiaW5hcnkgZm9ybXMsIHdpdGggb3Igd2l0aG91dCBtb2RpZmljYXRpb24sIGFyZSBwZXJtaXR0ZWQgcHJvdmlkZWQgdGhhdCB0aGUgZm9sbG93aW5nIGNvbmRpdGlvbnMgYXJlIG1ldDoKCjEuIFJlZGlzdHJpYnV0aW9ucyBvZiBzb3VyY2UgY29kZSBtdXN0IHJldGFpbiB0aGUgYWJvdmUgY29weXJpZ2h0IG5vdGljZSwgdGhpcyBsaXN0IG9mIGNvbmRpdGlvbnMgYW5kIHRoZSBmb2xsb3dpbmcgZGlzY2xhaW1lci4KCjIuIFJlZGlzdHJpYnV0aW9ucyBpbiBiaW5hcnkgZm9ybSBtdXN0IHJlcHJvZHVjZSB0aGUgYWJvdmUgY29weXJpZ2h0IG5vdGljZSwgdGhpcyBsaXN0IG9mIGNvbmRpdGlvbnMgYW5kIHRoZSBmb2xsb3dpbmcgZGlzY2xhaW1lciBpbiB0aGUgZG9jdW1lbnRhdGlvbiBhbmQvb3Igb3RoZXIgbWF0ZXJpYWxzIHByb3ZpZGVkIHdpdGggdGhlIGRpc3RyaWJ1dGlvbi4KClRISVMgU09GVFdBUkUgSVMgUFJPVklERUQgQlkgVEhFIENPUFlSSUdIVCBIT0xERVJTIEFORCBDT05UUklCVVRPUlMgIkFTIElTIiBBTkQgQU5ZIEVYUFJFU1MgT1IgSU1QTElFRCBXQVJSQU5USUVTLCBJTkNMVURJTkcsIEJVVCBOT1QgTElNSVRFRCBUTywgVEhFIElNUExJRUQgV0FSUkFOVElFUyBPRiBNRVJDSEFOVEFCSUxJVFkgQU5EIEZJVE5FU1MgRk9SIEEgUEFSVElDVUxBUiBQVVJQT1NFIEFSRSBESVNDTEFJTUVELiBJTiBOTyBFVkVOVCBTSEFMTCBUSEUgQ09QWVJJR0hUIEhPTERFUiBPUiBDT05UUklCVVRPUlMgQkUgTElBQkxFIEZPUiBBTlkgRElSRUNULCBJTkRJUkVDVCwgSU5DSURFTlRBTCwgU1BFQ0lBTCwgRVhFTVBMQVJZLCBPUiBDT05TRVFVRU5USUFMIERBTUFHRVMgKElOQ0xVRElORywgQlVUIE5PVCBMSU1JVEVEIFRPLCBQUk9DVVJFTUVOVCBPRiBTVUJTVElUVVRFIEdPT0RTIE9SIFNFUlZJQ0VTOyBMT1NTIE9GIFVTRSwgREFUQSwgT1IgUFJPRklUUzsgT1IgQlVTSU5FU1MgSU5URVJSVVBUSU9OKSBIT1dFVkVSIENBVVNFRCBBTkQgT04gQU5ZIFRIRU9SWSBPRiBMSUFCSUxJVFksIFdIRVRIRVIgSU4gQ09OVFJBQ1QsIFNUUklDVCBMSUFCSUxJVFksIE9SIFRPUlQgKElOQ0xVRElORyBORUdMSUdFTkNFIE9SIE9USEVSV0lTRSkgQVJJU0lORyBJTiBBTlkgV0FZIE9VVCBPRiBUSEUgVVNFIE9GIFRISVMgU09GVFdBUkUsIEVWRU4gSUYgQURWSVNFRCBPRiBUSEUgUE9TU0lCSUxJVFkgT0YgU1VDSCBEQU1BR0Uu" + }, + "url": "https://opensource.org/licenses/BSD-2-Clause" + } + } + ], + "version": "4.0.1", + "purl": "pkg:npm/esprima@4.0.1", + "bom-ref": "esprima_4.0.1_fd220f85-c6fc-4c00-a99d-1ac827c5afba", + "description": "ECMAScript parsing infrastructure for multipurpose analysis", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "240" + } + ] + }, + { + "name": "esutils", + "type": "library", + "licenses": [ + { + "license": { + "id": "BSD-3-Clause", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "Q29weXJpZ2h0IChjKSA8eWVhcj4gPG93bmVyPi4gCgpSZWRpc3RyaWJ1dGlvbiBhbmQgdXNlIGluIHNvdXJjZSBhbmQgYmluYXJ5IGZvcm1zLCB3aXRoIG9yIHdpdGhvdXQgbW9kaWZpY2F0aW9uLCBhcmUgcGVybWl0dGVkIHByb3ZpZGVkIHRoYXQgdGhlIGZvbGxvd2luZyBjb25kaXRpb25zIGFyZSBtZXQ6CgoxLiBSZWRpc3RyaWJ1dGlvbnMgb2Ygc291cmNlIGNvZGUgbXVzdCByZXRhaW4gdGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UsIHRoaXMgbGlzdCBvZiBjb25kaXRpb25zIGFuZCB0aGUgZm9sbG93aW5nIGRpc2NsYWltZXIuCgoyLiBSZWRpc3RyaWJ1dGlvbnMgaW4gYmluYXJ5IGZvcm0gbXVzdCByZXByb2R1Y2UgdGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UsIHRoaXMgbGlzdCBvZiBjb25kaXRpb25zIGFuZCB0aGUgZm9sbG93aW5nIGRpc2NsYWltZXIgaW4gdGhlIGRvY3VtZW50YXRpb24gYW5kL29yIG90aGVyIG1hdGVyaWFscyBwcm92aWRlZCB3aXRoIHRoZSBkaXN0cmlidXRpb24uCgozLiBOZWl0aGVyIHRoZSBuYW1lIG9mIHRoZSBjb3B5cmlnaHQgaG9sZGVyIG5vciB0aGUgbmFtZXMgb2YgaXRzIGNvbnRyaWJ1dG9ycyBtYXkgYmUgdXNlZCB0byBlbmRvcnNlIG9yIHByb21vdGUgcHJvZHVjdHMgZGVyaXZlZCBmcm9tIHRoaXMgc29mdHdhcmUgd2l0aG91dCBzcGVjaWZpYyBwcmlvciB3cml0dGVuIHBlcm1pc3Npb24uCgpUSElTIFNPRlRXQVJFIElTIFBST1ZJREVEIEJZIFRIRSBDT1BZUklHSFQgSE9MREVSUyBBTkQgQ09OVFJJQlVUT1JTICJBUyBJUyIgQU5EIEFOWSBFWFBSRVNTIE9SIElNUExJRUQgV0FSUkFOVElFUywgSU5DTFVESU5HLCBCVVQgTk9UIExJTUlURUQgVE8sIFRIRSBJTVBMSUVEIFdBUlJBTlRJRVMgT0YgTUVSQ0hBTlRBQklMSVRZIEFORCBGSVRORVNTIEZPUiBBIFBBUlRJQ1VMQVIgUFVSUE9TRSBBUkUgRElTQ0xBSU1FRC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIENPUFlSSUdIVCBIT0xERVIgT1IgQ09OVFJJQlVUT1JTIEJFIExJQUJMRSBGT1IgQU5ZIERJUkVDVCwgSU5ESVJFQ1QsIElOQ0lERU5UQUwsIFNQRUNJQUwsIEVYRU1QTEFSWSwgT1IgQ09OU0VRVUVOVElBTCBEQU1BR0VTIChJTkNMVURJTkcsIEJVVCBOT1QgTElNSVRFRCBUTywgUFJPQ1VSRU1FTlQgT0YgU1VCU1RJVFVURSBHT09EUyBPUiBTRVJWSUNFUzsgTE9TUyBPRiBVU0UsIERBVEEsIE9SIFBST0ZJVFM7IE9SIEJVU0lORVNTIElOVEVSUlVQVElPTikgSE9XRVZFUiBDQVVTRUQgQU5EIE9OIEFOWSBUSEVPUlkgT0YgTElBQklMSVRZLCBXSEVUSEVSIElOIENPTlRSQUNULCBTVFJJQ1QgTElBQklMSVRZLCBPUiBUT1JUIChJTkNMVURJTkcgTkVHTElHRU5DRSBPUiBPVEhFUldJU0UpIEFSSVNJTkcgSU4gQU5ZIFdBWSBPVVQgT0YgVEhFIFVTRSBPRiBUSElTIFNPRlRXQVJFLCBFVkVOIElGIEFEVklTRUQgT0YgVEhFIFBPU1NJQklMSVRZIE9GIFNVQ0ggREFNQUdFLg==" + }, + "url": "https://opensource.org/licenses/BSD-3-Clause" + } + } + ], + "version": "2.0.2", + "purl": "pkg:npm/esutils@2.0.2", + "bom-ref": "esutils_2.0.2_537f6535-03d7-45c1-af5d-6a5f967b6add", + "description": "utility box for ECMAScript language tools", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "243" + } + ] + }, + { + "name": "etag", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.6.0", + "purl": "pkg:npm/etag@1.6.0", + "bom-ref": "etag_1.6.0_0a3e823c-631d-475e-86fb-acfb4570d0f8", + "description": "Create simple ETags", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "245" + } + ] + }, + { + "name": "events", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.1.1", + "purl": "pkg:npm/events@1.1.1", + "bom-ref": "events_1.1.1_b96b9b0e-0715-41c3-a4ec-ef86815b035c", + "description": "Node's event emitter for all engines.", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "247" + } + ] + }, + { + "name": "events-to-array", + "type": "library", + "licenses": [ + { + "license": { + "id": "ISC", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "SVNDIExpY2Vuc2U6CgpDb3B5cmlnaHQgKGMpIDIwMDQtMjAxMCBieSBJbnRlcm5ldCBTeXN0ZW1zIENvbnNvcnRpdW0sIEluYy4gKCJJU0MiKQpDb3B5cmlnaHQgKGMpIDE5OTUtMjAwMyBieSBJbnRlcm5ldCBTb2Z0d2FyZSBDb25zb3J0aXVtCgpQZXJtaXNzaW9uIHRvIHVzZSwgY29weSwgbW9kaWZ5LCBhbmQvb3IgZGlzdHJpYnV0ZSB0aGlzIHNvZnR3YXJlIGZvciBhbnkgcHVycG9zZSB3aXRoIG9yIHdpdGhvdXQgZmVlIGlzIGhlcmVieSBncmFudGVkLCBwcm92aWRlZCB0aGF0IHRoZSBhYm92ZSBjb3B5cmlnaHQgbm90aWNlIGFuZCB0aGlzIHBlcm1pc3Npb24gbm90aWNlIGFwcGVhciBpbiBhbGwgY29waWVzLgoKVEhFIFNPRlRXQVJFIElTIFBST1ZJREVEICJBUyBJUyIgQU5EIElTQyBESVNDTEFJTVMgQUxMIFdBUlJBTlRJRVMgV0lUSCBSRUdBUkQgVE8gVEhJUyBTT0ZUV0FSRSBJTkNMVURJTkcgQUxMIElNUExJRUQgV0FSUkFOVElFUyBPRiBNRVJDSEFOVEFCSUxJVFkgQU5EIEZJVE5FU1MuIElOIE5PIEVWRU5UIFNIQUxMIElTQyBCRSBMSUFCTEUgRk9SIEFOWSBTUEVDSUFMLCBESVJFQ1QsIElORElSRUNULCBPUiBDT05TRVFVRU5USUFMIERBTUFHRVMgT1IgQU5ZIERBTUFHRVMgV0hBVFNPRVZFUiBSRVNVTFRJTkcgRlJPTSBMT1NTIE9GIFVTRSwgREFUQSBPUiBQUk9GSVRTLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgTkVHTElHRU5DRSBPUiBPVEhFUiBUT1JUSU9VUyBBQ1RJT04sIEFSSVNJTkcgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgVVNFIE9SIFBFUkZPUk1BTkNFIE9GIFRISVMgU09GVFdBUkUu" + }, + "url": "https://www.isc.org/licenses/" + } + } + ], + "version": "1.1.2", + "purl": "pkg:npm/events-to-array@1.1.2", + "bom-ref": "events-to-array_1.1.2_d7c8872d-53ff-454f-ad2b-0ec3957bea05", + "description": "Put a bunch of emitted events in an array, for testing.", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "248" + } + ] + }, + { + "name": "evp_bytestokey", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.0.3", + "purl": "pkg:npm/evp_bytestokey@1.0.3", + "bom-ref": "evp_bytestokey_1.0.3_92491972-065c-4c6b-87e3-07f3a2d7d9c7", + "description": "The insecure key derivation algorithm from OpenSSL", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "249" + } + ] + }, + { + "name": "execa", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "0.7.0", + "purl": "pkg:npm/execa@0.7.0", + "bom-ref": "execa_0.7.0_d87eaa03-5131-4282-a29d-8453262b20e2", + "description": "A better `child_process`", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "250" + } + ] + }, + { + "name": "express", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "4.12.4", + "cpe": "cpe:2.3:a:openjsf:express:4.12.4:*:*:*:*:node.js:*:*", + "purl": "pkg:npm/express@4.12.4", + "bom-ref": "express_4.12.4_ba283401-bbd3-41f0-94fe-e15449290a52", + "description": "Fast, unopinionated, minimalist web framework", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "255" + } + ] + }, + { + "name": "express-fileupload", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "0.0.5", + "purl": "pkg:npm/express-fileupload@0.0.5", + "bom-ref": "express-fileupload_0.0.5_7144474d-bc9a-4fde-ab12-b6e684544503", + "description": "Simple express file upload middleware that wraps around connect-busboy", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "256" + } + ] + }, + { + "name": "extend", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "3.0.2", + "purl": "pkg:npm/extend@3.0.2", + "bom-ref": "extend_3.0.2_2c05eee1-97be-470f-8318-22fe0420434b", + "description": "Port of jQuery.extend for node.js and the browser", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "257" + } + ] + }, + { + "name": "extsprintf", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.3.0", + "purl": "pkg:npm/extsprintf@1.3.0", + "bom-ref": "extsprintf_1.3.0_311cfb6d-dc6c-43a2-83b6-e77363951707", + "description": "extended POSIX-style sprintf", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "260" + } + ] + }, + { + "name": "fd", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "0.0.3", + "purl": "pkg:npm/fd@0.0.3", + "bom-ref": "fd_0.0.3_e362d035-d04a-4063-acbc-860ea28e75ac", + "description": "File descriptor manager", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "263" + } + ] + }, + { + "name": "file-type", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "8.1.0", + "cpe": "cpe:2.3:a:file-type_project:file-type:8.1.0:*:*:*:*:node.js:*:*", + "purl": "pkg:npm/file-type@8.1.0", + "bom-ref": "file-type_8.1.0_4ff35a4e-3aa7-425f-bb8e-302e195b51af", + "description": "Detect the file type of a Buffer/Uint8Array", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "265" + } + ] + }, + { + "name": "finalhandler", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "0.3.6", + "purl": "pkg:npm/finalhandler@0.3.6", + "bom-ref": "finalhandler_0.3.6_357258e1-37cf-4b0b-b186-ba1dc43974c2", + "description": "Node.js final http responder", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "270" + } + ] + }, + { + "name": "find-cache-dir", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "0.1.1", + "purl": "pkg:npm/find-cache-dir@0.1.1", + "bom-ref": "find-cache-dir_0.1.1_7ce1ff36-6bc7-453d-b644-ec1b668176b0", + "description": "My well-made module", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "271" + } + ] + }, + { + "name": "find-up", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.1.2", + "purl": "pkg:npm/find-up@1.1.2", + "bom-ref": "find-up_1.1.2_d5cfd826-0a2b-4356-9c8b-8ef052c8763f", + "description": "Find a file by walking up parent directories", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "272" + } + ] + }, + { + "name": "foreground-child", + "type": "library", + "licenses": [ + { + "license": { + "id": "ISC", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "SVNDIExpY2Vuc2U6CgpDb3B5cmlnaHQgKGMpIDIwMDQtMjAxMCBieSBJbnRlcm5ldCBTeXN0ZW1zIENvbnNvcnRpdW0sIEluYy4gKCJJU0MiKQpDb3B5cmlnaHQgKGMpIDE5OTUtMjAwMyBieSBJbnRlcm5ldCBTb2Z0d2FyZSBDb25zb3J0aXVtCgpQZXJtaXNzaW9uIHRvIHVzZSwgY29weSwgbW9kaWZ5LCBhbmQvb3IgZGlzdHJpYnV0ZSB0aGlzIHNvZnR3YXJlIGZvciBhbnkgcHVycG9zZSB3aXRoIG9yIHdpdGhvdXQgZmVlIGlzIGhlcmVieSBncmFudGVkLCBwcm92aWRlZCB0aGF0IHRoZSBhYm92ZSBjb3B5cmlnaHQgbm90aWNlIGFuZCB0aGlzIHBlcm1pc3Npb24gbm90aWNlIGFwcGVhciBpbiBhbGwgY29waWVzLgoKVEhFIFNPRlRXQVJFIElTIFBST1ZJREVEICJBUyBJUyIgQU5EIElTQyBESVNDTEFJTVMgQUxMIFdBUlJBTlRJRVMgV0lUSCBSRUdBUkQgVE8gVEhJUyBTT0ZUV0FSRSBJTkNMVURJTkcgQUxMIElNUExJRUQgV0FSUkFOVElFUyBPRiBNRVJDSEFOVEFCSUxJVFkgQU5EIEZJVE5FU1MuIElOIE5PIEVWRU5UIFNIQUxMIElTQyBCRSBMSUFCTEUgRk9SIEFOWSBTUEVDSUFMLCBESVJFQ1QsIElORElSRUNULCBPUiBDT05TRVFVRU5USUFMIERBTUFHRVMgT1IgQU5ZIERBTUFHRVMgV0hBVFNPRVZFUiBSRVNVTFRJTkcgRlJPTSBMT1NTIE9GIFVTRSwgREFUQSBPUiBQUk9GSVRTLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgTkVHTElHRU5DRSBPUiBPVEhFUiBUT1JUSU9VUyBBQ1RJT04sIEFSSVNJTkcgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgVVNFIE9SIFBFUkZPUk1BTkNFIE9GIFRISVMgU09GVFdBUkUu" + }, + "url": "https://www.isc.org/licenses/" + } + } + ], + "version": "1.5.6", + "purl": "pkg:npm/foreground-child@1.5.6", + "bom-ref": "foreground-child_1.5.6_3bb69af5-31aa-4bd4-aeeb-70c6b6261d6d", + "description": "Run a child as if it's the foreground process. Give it stdio. Exit when it exits.", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "276" + } + ] + }, + { + "name": "forever-agent", + "type": "library", + "licenses": [ + { + "license": { + "id": "Apache-2.0", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "QXBhY2hlIExpY2Vuc2UKVmVyc2lvbiAyLjAsIEphbnVhcnkgMjAwNApodHRwOi8vd3d3LmFwYWNoZS5vcmcvbGljZW5zZXMvCgpURVJNUyBBTkQgQ09ORElUSU9OUyBGT1IgVVNFLCBSRVBST0RVQ1RJT04sIEFORCBESVNUUklCVVRJT04KCjEuIERlZmluaXRpb25zLgoKIkxpY2Vuc2UiIHNoYWxsIG1lYW4gdGhlIHRlcm1zIGFuZCBjb25kaXRpb25zIGZvciB1c2UsIHJlcHJvZHVjdGlvbiwgYW5kIGRpc3RyaWJ1dGlvbiBhcyBkZWZpbmVkIGJ5IFNlY3Rpb25zIDEgdGhyb3VnaCA5IG9mIHRoaXMgZG9jdW1lbnQuCgoiTGljZW5zb3IiIHNoYWxsIG1lYW4gdGhlIGNvcHlyaWdodCBvd25lciBvciBlbnRpdHkgYXV0aG9yaXplZCBieSB0aGUgY29weXJpZ2h0IG93bmVyIHRoYXQgaXMgZ3JhbnRpbmcgdGhlIExpY2Vuc2UuCgoiTGVnYWwgRW50aXR5IiBzaGFsbCBtZWFuIHRoZSB1bmlvbiBvZiB0aGUgYWN0aW5nIGVudGl0eSBhbmQgYWxsIG90aGVyIGVudGl0aWVzIHRoYXQgY29udHJvbCwgYXJlIGNvbnRyb2xsZWQgYnksIG9yIGFyZSB1bmRlciBjb21tb24gY29udHJvbCB3aXRoIHRoYXQgZW50aXR5LiBGb3IgdGhlIHB1cnBvc2VzIG9mIHRoaXMgZGVmaW5pdGlvbiwgImNvbnRyb2wiIG1lYW5zIChpKSB0aGUgcG93ZXIsIGRpcmVjdCBvciBpbmRpcmVjdCwgdG8gY2F1c2UgdGhlIGRpcmVjdGlvbiBvciBtYW5hZ2VtZW50IG9mIHN1Y2ggZW50aXR5LCB3aGV0aGVyIGJ5IGNvbnRyYWN0IG9yIG90aGVyd2lzZSwgb3IgKGlpKSBvd25lcnNoaXAgb2YgZmlmdHkgcGVyY2VudCAoNTAlKSBvciBtb3JlIG9mIHRoZSBvdXRzdGFuZGluZyBzaGFyZXMsIG9yIChpaWkpIGJlbmVmaWNpYWwgb3duZXJzaGlwIG9mIHN1Y2ggZW50aXR5LgoKIllvdSIgKG9yICJZb3VyIikgc2hhbGwgbWVhbiBhbiBpbmRpdmlkdWFsIG9yIExlZ2FsIEVudGl0eSBleGVyY2lzaW5nIHBlcm1pc3Npb25zIGdyYW50ZWQgYnkgdGhpcyBMaWNlbnNlLgoKIlNvdXJjZSIgZm9ybSBzaGFsbCBtZWFuIHRoZSBwcmVmZXJyZWQgZm9ybSBmb3IgbWFraW5nIG1vZGlmaWNhdGlvbnMsIGluY2x1ZGluZyBidXQgbm90IGxpbWl0ZWQgdG8gc29mdHdhcmUgc291cmNlIGNvZGUsIGRvY3VtZW50YXRpb24gc291cmNlLCBhbmQgY29uZmlndXJhdGlvbiBmaWxlcy4KCiJPYmplY3QiIGZvcm0gc2hhbGwgbWVhbiBhbnkgZm9ybSByZXN1bHRpbmcgZnJvbSBtZWNoYW5pY2FsIHRyYW5zZm9ybWF0aW9uIG9yIHRyYW5zbGF0aW9uIG9mIGEgU291cmNlIGZvcm0sIGluY2x1ZGluZyBidXQgbm90IGxpbWl0ZWQgdG8gY29tcGlsZWQgb2JqZWN0IGNvZGUsIGdlbmVyYXRlZCBkb2N1bWVudGF0aW9uLCBhbmQgY29udmVyc2lvbnMgdG8gb3RoZXIgbWVkaWEgdHlwZXMuCgoiV29yayIgc2hhbGwgbWVhbiB0aGUgd29yayBvZiBhdXRob3JzaGlwLCB3aGV0aGVyIGluIFNvdXJjZSBvciBPYmplY3QgZm9ybSwgbWFkZSBhdmFpbGFibGUgdW5kZXIgdGhlIExpY2Vuc2UsIGFzIGluZGljYXRlZCBieSBhIGNvcHlyaWdodCBub3RpY2UgdGhhdCBpcyBpbmNsdWRlZCBpbiBvciBhdHRhY2hlZCB0byB0aGUgd29yayAoYW4gZXhhbXBsZSBpcyBwcm92aWRlZCBpbiB0aGUgQXBwZW5kaXggYmVsb3cpLgoKIkRlcml2YXRpdmUgV29ya3MiIHNoYWxsIG1lYW4gYW55IHdvcmssIHdoZXRoZXIgaW4gU291cmNlIG9yIE9iamVjdCBmb3JtLCB0aGF0IGlzIGJhc2VkIG9uIChvciBkZXJpdmVkIGZyb20pIHRoZSBXb3JrIGFuZCBmb3Igd2hpY2ggdGhlIGVkaXRvcmlhbCByZXZpc2lvbnMsIGFubm90YXRpb25zLCBlbGFib3JhdGlvbnMsIG9yIG90aGVyIG1vZGlmaWNhdGlvbnMgcmVwcmVzZW50LCBhcyBhIHdob2xlLCBhbiBvcmlnaW5hbCB3b3JrIG9mIGF1dGhvcnNoaXAuIEZvciB0aGUgcHVycG9zZXMgb2YgdGhpcyBMaWNlbnNlLCBEZXJpdmF0aXZlIFdvcmtzIHNoYWxsIG5vdCBpbmNsdWRlIHdvcmtzIHRoYXQgcmVtYWluIHNlcGFyYWJsZSBmcm9tLCBvciBtZXJlbHkgbGluayAob3IgYmluZCBieSBuYW1lKSB0byB0aGUgaW50ZXJmYWNlcyBvZiwgdGhlIFdvcmsgYW5kIERlcml2YXRpdmUgV29ya3MgdGhlcmVvZi4KCiJDb250cmlidXRpb24iIHNoYWxsIG1lYW4gYW55IHdvcmsgb2YgYXV0aG9yc2hpcCwgaW5jbHVkaW5nIHRoZSBvcmlnaW5hbCB2ZXJzaW9uIG9mIHRoZSBXb3JrIGFuZCBhbnkgbW9kaWZpY2F0aW9ucyBvciBhZGRpdGlvbnMgdG8gdGhhdCBXb3JrIG9yIERlcml2YXRpdmUgV29ya3MgdGhlcmVvZiwgdGhhdCBpcyBpbnRlbnRpb25hbGx5IHN1Ym1pdHRlZCB0byBMaWNlbnNvciBmb3IgaW5jbHVzaW9uIGluIHRoZSBXb3JrIGJ5IHRoZSBjb3B5cmlnaHQgb3duZXIgb3IgYnkgYW4gaW5kaXZpZHVhbCBvciBMZWdhbCBFbnRpdHkgYXV0aG9yaXplZCB0byBzdWJtaXQgb24gYmVoYWxmIG9mIHRoZSBjb3B5cmlnaHQgb3duZXIuIEZvciB0aGUgcHVycG9zZXMgb2YgdGhpcyBkZWZpbml0aW9uLCAic3VibWl0dGVkIiBtZWFucyBhbnkgZm9ybSBvZiBlbGVjdHJvbmljLCB2ZXJiYWwsIG9yIHdyaXR0ZW4gY29tbXVuaWNhdGlvbiBzZW50IHRvIHRoZSBMaWNlbnNvciBvciBpdHMgcmVwcmVzZW50YXRpdmVzLCBpbmNsdWRpbmcgYnV0IG5vdCBsaW1pdGVkIHRvIGNvbW11bmljYXRpb24gb24gZWxlY3Ryb25pYyBtYWlsaW5nIGxpc3RzLCBzb3VyY2UgY29kZSBjb250cm9sIHN5c3RlbXMsIGFuZCBpc3N1ZSB0cmFja2luZyBzeXN0ZW1zIHRoYXQgYXJlIG1hbmFnZWQgYnksIG9yIG9uIGJlaGFsZiBvZiwgdGhlIExpY2Vuc29yIGZvciB0aGUgcHVycG9zZSBvZiBkaXNjdXNzaW5nIGFuZCBpbXByb3ZpbmcgdGhlIFdvcmssIGJ1dCBleGNsdWRpbmcgY29tbXVuaWNhdGlvbiB0aGF0IGlzIGNvbnNwaWN1b3VzbHkgbWFya2VkIG9yIG90aGVyd2lzZSBkZXNpZ25hdGVkIGluIHdyaXRpbmcgYnkgdGhlIGNvcHlyaWdodCBvd25lciBhcyAiTm90IGEgQ29udHJpYnV0aW9uLiIKCiJDb250cmlidXRvciIgc2hhbGwgbWVhbiBMaWNlbnNvciBhbmQgYW55IGluZGl2aWR1YWwgb3IgTGVnYWwgRW50aXR5IG9uIGJlaGFsZiBvZiB3aG9tIGEgQ29udHJpYnV0aW9uIGhhcyBiZWVuIHJlY2VpdmVkIGJ5IExpY2Vuc29yIGFuZCBzdWJzZXF1ZW50bHkgaW5jb3Jwb3JhdGVkIHdpdGhpbiB0aGUgV29yay4KCjIuIEdyYW50IG9mIENvcHlyaWdodCBMaWNlbnNlLiBTdWJqZWN0IHRvIHRoZSB0ZXJtcyBhbmQgY29uZGl0aW9ucyBvZiB0aGlzIExpY2Vuc2UsIGVhY2ggQ29udHJpYnV0b3IgaGVyZWJ5IGdyYW50cyB0byBZb3UgYSBwZXJwZXR1YWwsIHdvcmxkd2lkZSwgbm9uLWV4Y2x1c2l2ZSwgbm8tY2hhcmdlLCByb3lhbHR5LWZyZWUsIGlycmV2b2NhYmxlIGNvcHlyaWdodCBsaWNlbnNlIHRvIHJlcHJvZHVjZSwgcHJlcGFyZSBEZXJpdmF0aXZlIFdvcmtzIG9mLCBwdWJsaWNseSBkaXNwbGF5LCBwdWJsaWNseSBwZXJmb3JtLCBzdWJsaWNlbnNlLCBhbmQgZGlzdHJpYnV0ZSB0aGUgV29yayBhbmQgc3VjaCBEZXJpdmF0aXZlIFdvcmtzIGluIFNvdXJjZSBvciBPYmplY3QgZm9ybS4KCjMuIEdyYW50IG9mIFBhdGVudCBMaWNlbnNlLiBTdWJqZWN0IHRvIHRoZSB0ZXJtcyBhbmQgY29uZGl0aW9ucyBvZiB0aGlzIExpY2Vuc2UsIGVhY2ggQ29udHJpYnV0b3IgaGVyZWJ5IGdyYW50cyB0byBZb3UgYSBwZXJwZXR1YWwsIHdvcmxkd2lkZSwgbm9uLWV4Y2x1c2l2ZSwgbm8tY2hhcmdlLCByb3lhbHR5LWZyZWUsIGlycmV2b2NhYmxlIChleGNlcHQgYXMgc3RhdGVkIGluIHRoaXMgc2VjdGlvbikgcGF0ZW50IGxpY2Vuc2UgdG8gbWFrZSwgaGF2ZSBtYWRlLCB1c2UsIG9mZmVyIHRvIHNlbGwsIHNlbGwsIGltcG9ydCwgYW5kIG90aGVyd2lzZSB0cmFuc2ZlciB0aGUgV29yaywgd2hlcmUgc3VjaCBsaWNlbnNlIGFwcGxpZXMgb25seSB0byB0aG9zZSBwYXRlbnQgY2xhaW1zIGxpY2Vuc2FibGUgYnkgc3VjaCBDb250cmlidXRvciB0aGF0IGFyZSBuZWNlc3NhcmlseSBpbmZyaW5nZWQgYnkgdGhlaXIgQ29udHJpYnV0aW9uKHMpIGFsb25lIG9yIGJ5IGNvbWJpbmF0aW9uIG9mIHRoZWlyIENvbnRyaWJ1dGlvbihzKSB3aXRoIHRoZSBXb3JrIHRvIHdoaWNoIHN1Y2ggQ29udHJpYnV0aW9uKHMpIHdhcyBzdWJtaXR0ZWQuIElmIFlvdSBpbnN0aXR1dGUgcGF0ZW50IGxpdGlnYXRpb24gYWdhaW5zdCBhbnkgZW50aXR5IChpbmNsdWRpbmcgYSBjcm9zcy1jbGFpbSBvciBjb3VudGVyY2xhaW0gaW4gYSBsYXdzdWl0KSBhbGxlZ2luZyB0aGF0IHRoZSBXb3JrIG9yIGEgQ29udHJpYnV0aW9uIGluY29ycG9yYXRlZCB3aXRoaW4gdGhlIFdvcmsgY29uc3RpdHV0ZXMgZGlyZWN0IG9yIGNvbnRyaWJ1dG9yeSBwYXRlbnQgaW5mcmluZ2VtZW50LCB0aGVuIGFueSBwYXRlbnQgbGljZW5zZXMgZ3JhbnRlZCB0byBZb3UgdW5kZXIgdGhpcyBMaWNlbnNlIGZvciB0aGF0IFdvcmsgc2hhbGwgdGVybWluYXRlIGFzIG9mIHRoZSBkYXRlIHN1Y2ggbGl0aWdhdGlvbiBpcyBmaWxlZC4KCjQuIFJlZGlzdHJpYnV0aW9uLiBZb3UgbWF5IHJlcHJvZHVjZSBhbmQgZGlzdHJpYnV0ZSBjb3BpZXMgb2YgdGhlIFdvcmsgb3IgRGVyaXZhdGl2ZSBXb3JrcyB0aGVyZW9mIGluIGFueSBtZWRpdW0sIHdpdGggb3Igd2l0aG91dCBtb2RpZmljYXRpb25zLCBhbmQgaW4gU291cmNlIG9yIE9iamVjdCBmb3JtLCBwcm92aWRlZCB0aGF0IFlvdSBtZWV0IHRoZSBmb2xsb3dpbmcgY29uZGl0aW9uczoKCiAgICAgKGEpIFlvdSBtdXN0IGdpdmUgYW55IG90aGVyIHJlY2lwaWVudHMgb2YgdGhlIFdvcmsgb3IgRGVyaXZhdGl2ZSBXb3JrcyBhIGNvcHkgb2YgdGhpcyBMaWNlbnNlOyBhbmQKCiAgICAgKGIpIFlvdSBtdXN0IGNhdXNlIGFueSBtb2RpZmllZCBmaWxlcyB0byBjYXJyeSBwcm9taW5lbnQgbm90aWNlcyBzdGF0aW5nIHRoYXQgWW91IGNoYW5nZWQgdGhlIGZpbGVzOyBhbmQKCiAgICAgKGMpIFlvdSBtdXN0IHJldGFpbiwgaW4gdGhlIFNvdXJjZSBmb3JtIG9mIGFueSBEZXJpdmF0aXZlIFdvcmtzIHRoYXQgWW91IGRpc3RyaWJ1dGUsIGFsbCBjb3B5cmlnaHQsIHBhdGVudCwgdHJhZGVtYXJrLCBhbmQgYXR0cmlidXRpb24gbm90aWNlcyBmcm9tIHRoZSBTb3VyY2UgZm9ybSBvZiB0aGUgV29yaywgZXhjbHVkaW5nIHRob3NlIG5vdGljZXMgdGhhdCBkbyBub3QgcGVydGFpbiB0byBhbnkgcGFydCBvZiB0aGUgRGVyaXZhdGl2ZSBXb3JrczsgYW5kCgogICAgIChkKSBJZiB0aGUgV29yayBpbmNsdWRlcyBhICJOT1RJQ0UiIHRleHQgZmlsZSBhcyBwYXJ0IG9mIGl0cyBkaXN0cmlidXRpb24sIHRoZW4gYW55IERlcml2YXRpdmUgV29ya3MgdGhhdCBZb3UgZGlzdHJpYnV0ZSBtdXN0IGluY2x1ZGUgYSByZWFkYWJsZSBjb3B5IG9mIHRoZSBhdHRyaWJ1dGlvbiBub3RpY2VzIGNvbnRhaW5lZCB3aXRoaW4gc3VjaCBOT1RJQ0UgZmlsZSwgZXhjbHVkaW5nIHRob3NlIG5vdGljZXMgdGhhdCBkbyBub3QgcGVydGFpbiB0byBhbnkgcGFydCBvZiB0aGUgRGVyaXZhdGl2ZSBXb3JrcywgaW4gYXQgbGVhc3Qgb25lIG9mIHRoZSBmb2xsb3dpbmcgcGxhY2VzOiB3aXRoaW4gYSBOT1RJQ0UgdGV4dCBmaWxlIGRpc3RyaWJ1dGVkIGFzIHBhcnQgb2YgdGhlIERlcml2YXRpdmUgV29ya3M7IHdpdGhpbiB0aGUgU291cmNlIGZvcm0gb3IgZG9jdW1lbnRhdGlvbiwgaWYgcHJvdmlkZWQgYWxvbmcgd2l0aCB0aGUgRGVyaXZhdGl2ZSBXb3Jrczsgb3IsIHdpdGhpbiBhIGRpc3BsYXkgZ2VuZXJhdGVkIGJ5IHRoZSBEZXJpdmF0aXZlIFdvcmtzLCBpZiBhbmQgd2hlcmV2ZXIgc3VjaCB0aGlyZC1wYXJ0eSBub3RpY2VzIG5vcm1hbGx5IGFwcGVhci4gVGhlIGNvbnRlbnRzIG9mIHRoZSBOT1RJQ0UgZmlsZSBhcmUgZm9yIGluZm9ybWF0aW9uYWwgcHVycG9zZXMgb25seSBhbmQgZG8gbm90IG1vZGlmeSB0aGUgTGljZW5zZS4gWW91IG1heSBhZGQgWW91ciBvd24gYXR0cmlidXRpb24gbm90aWNlcyB3aXRoaW4gRGVyaXZhdGl2ZSBXb3JrcyB0aGF0IFlvdSBkaXN0cmlidXRlLCBhbG9uZ3NpZGUgb3IgYXMgYW4gYWRkZW5kdW0gdG8gdGhlIE5PVElDRSB0ZXh0IGZyb20gdGhlIFdvcmssIHByb3ZpZGVkIHRoYXQgc3VjaCBhZGRpdGlvbmFsIGF0dHJpYnV0aW9uIG5vdGljZXMgY2Fubm90IGJlIGNvbnN0cnVlZCBhcyBtb2RpZnlpbmcgdGhlIExpY2Vuc2UuCgogICAgIFlvdSBtYXkgYWRkIFlvdXIgb3duIGNvcHlyaWdodCBzdGF0ZW1lbnQgdG8gWW91ciBtb2RpZmljYXRpb25zIGFuZCBtYXkgcHJvdmlkZSBhZGRpdGlvbmFsIG9yIGRpZmZlcmVudCBsaWNlbnNlIHRlcm1zIGFuZCBjb25kaXRpb25zIGZvciB1c2UsIHJlcHJvZHVjdGlvbiwgb3IgZGlzdHJpYnV0aW9uIG9mIFlvdXIgbW9kaWZpY2F0aW9ucywgb3IgZm9yIGFueSBzdWNoIERlcml2YXRpdmUgV29ya3MgYXMgYSB3aG9sZSwgcHJvdmlkZWQgWW91ciB1c2UsIHJlcHJvZHVjdGlvbiwgYW5kIGRpc3RyaWJ1dGlvbiBvZiB0aGUgV29yayBvdGhlcndpc2UgY29tcGxpZXMgd2l0aCB0aGUgY29uZGl0aW9ucyBzdGF0ZWQgaW4gdGhpcyBMaWNlbnNlLgoKNS4gU3VibWlzc2lvbiBvZiBDb250cmlidXRpb25zLiBVbmxlc3MgWW91IGV4cGxpY2l0bHkgc3RhdGUgb3RoZXJ3aXNlLCBhbnkgQ29udHJpYnV0aW9uIGludGVudGlvbmFsbHkgc3VibWl0dGVkIGZvciBpbmNsdXNpb24gaW4gdGhlIFdvcmsgYnkgWW91IHRvIHRoZSBMaWNlbnNvciBzaGFsbCBiZSB1bmRlciB0aGUgdGVybXMgYW5kIGNvbmRpdGlvbnMgb2YgdGhpcyBMaWNlbnNlLCB3aXRob3V0IGFueSBhZGRpdGlvbmFsIHRlcm1zIG9yIGNvbmRpdGlvbnMuIE5vdHdpdGhzdGFuZGluZyB0aGUgYWJvdmUsIG5vdGhpbmcgaGVyZWluIHNoYWxsIHN1cGVyc2VkZSBvciBtb2RpZnkgdGhlIHRlcm1zIG9mIGFueSBzZXBhcmF0ZSBsaWNlbnNlIGFncmVlbWVudCB5b3UgbWF5IGhhdmUgZXhlY3V0ZWQgd2l0aCBMaWNlbnNvciByZWdhcmRpbmcgc3VjaCBDb250cmlidXRpb25zLgoKNi4gVHJhZGVtYXJrcy4gVGhpcyBMaWNlbnNlIGRvZXMgbm90IGdyYW50IHBlcm1pc3Npb24gdG8gdXNlIHRoZSB0cmFkZSBuYW1lcywgdHJhZGVtYXJrcywgc2VydmljZSBtYXJrcywgb3IgcHJvZHVjdCBuYW1lcyBvZiB0aGUgTGljZW5zb3IsIGV4Y2VwdCBhcyByZXF1aXJlZCBmb3IgcmVhc29uYWJsZSBhbmQgY3VzdG9tYXJ5IHVzZSBpbiBkZXNjcmliaW5nIHRoZSBvcmlnaW4gb2YgdGhlIFdvcmsgYW5kIHJlcHJvZHVjaW5nIHRoZSBjb250ZW50IG9mIHRoZSBOT1RJQ0UgZmlsZS4KCjcuIERpc2NsYWltZXIgb2YgV2FycmFudHkuIFVubGVzcyByZXF1aXJlZCBieSBhcHBsaWNhYmxlIGxhdyBvciBhZ3JlZWQgdG8gaW4gd3JpdGluZywgTGljZW5zb3IgcHJvdmlkZXMgdGhlIFdvcmsgKGFuZCBlYWNoIENvbnRyaWJ1dG9yIHByb3ZpZGVzIGl0cyBDb250cmlidXRpb25zKSBvbiBhbiAiQVMgSVMiIEJBU0lTLCBXSVRIT1VUIFdBUlJBTlRJRVMgT1IgQ09ORElUSU9OUyBPRiBBTlkgS0lORCwgZWl0aGVyIGV4cHJlc3Mgb3IgaW1wbGllZCwgaW5jbHVkaW5nLCB3aXRob3V0IGxpbWl0YXRpb24sIGFueSB3YXJyYW50aWVzIG9yIGNvbmRpdGlvbnMgb2YgVElUTEUsIE5PTi1JTkZSSU5HRU1FTlQsIE1FUkNIQU5UQUJJTElUWSwgb3IgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UuIFlvdSBhcmUgc29sZWx5IHJlc3BvbnNpYmxlIGZvciBkZXRlcm1pbmluZyB0aGUgYXBwcm9wcmlhdGVuZXNzIG9mIHVzaW5nIG9yIHJlZGlzdHJpYnV0aW5nIHRoZSBXb3JrIGFuZCBhc3N1bWUgYW55IHJpc2tzIGFzc29jaWF0ZWQgd2l0aCBZb3VyIGV4ZXJjaXNlIG9mIHBlcm1pc3Npb25zIHVuZGVyIHRoaXMgTGljZW5zZS4KCjguIExpbWl0YXRpb24gb2YgTGlhYmlsaXR5LiBJbiBubyBldmVudCBhbmQgdW5kZXIgbm8gbGVnYWwgdGhlb3J5LCB3aGV0aGVyIGluIHRvcnQgKGluY2x1ZGluZyBuZWdsaWdlbmNlKSwgY29udHJhY3QsIG9yIG90aGVyd2lzZSwgdW5sZXNzIHJlcXVpcmVkIGJ5IGFwcGxpY2FibGUgbGF3IChzdWNoIGFzIGRlbGliZXJhdGUgYW5kIGdyb3NzbHkgbmVnbGlnZW50IGFjdHMpIG9yIGFncmVlZCB0byBpbiB3cml0aW5nLCBzaGFsbCBhbnkgQ29udHJpYnV0b3IgYmUgbGlhYmxlIHRvIFlvdSBmb3IgZGFtYWdlcywgaW5jbHVkaW5nIGFueSBkaXJlY3QsIGluZGlyZWN0LCBzcGVjaWFsLCBpbmNpZGVudGFsLCBvciBjb25zZXF1ZW50aWFsIGRhbWFnZXMgb2YgYW55IGNoYXJhY3RlciBhcmlzaW5nIGFzIGEgcmVzdWx0IG9mIHRoaXMgTGljZW5zZSBvciBvdXQgb2YgdGhlIHVzZSBvciBpbmFiaWxpdHkgdG8gdXNlIHRoZSBXb3JrIChpbmNsdWRpbmcgYnV0IG5vdCBsaW1pdGVkIHRvIGRhbWFnZXMgZm9yIGxvc3Mgb2YgZ29vZHdpbGwsIHdvcmsgc3RvcHBhZ2UsIGNvbXB1dGVyIGZhaWx1cmUgb3IgbWFsZnVuY3Rpb24sIG9yIGFueSBhbmQgYWxsIG90aGVyIGNvbW1lcmNpYWwgZGFtYWdlcyBvciBsb3NzZXMpLCBldmVuIGlmIHN1Y2ggQ29udHJpYnV0b3IgaGFzIGJlZW4gYWR2aXNlZCBvZiB0aGUgcG9zc2liaWxpdHkgb2Ygc3VjaCBkYW1hZ2VzLgoKOS4gQWNjZXB0aW5nIFdhcnJhbnR5IG9yIEFkZGl0aW9uYWwgTGlhYmlsaXR5LiBXaGlsZSByZWRpc3RyaWJ1dGluZyB0aGUgV29yayBvciBEZXJpdmF0aXZlIFdvcmtzIHRoZXJlb2YsIFlvdSBtYXkgY2hvb3NlIHRvIG9mZmVyLCBhbmQgY2hhcmdlIGEgZmVlIGZvciwgYWNjZXB0YW5jZSBvZiBzdXBwb3J0LCB3YXJyYW50eSwgaW5kZW1uaXR5LCBvciBvdGhlciBsaWFiaWxpdHkgb2JsaWdhdGlvbnMgYW5kL29yIHJpZ2h0cyBjb25zaXN0ZW50IHdpdGggdGhpcyBMaWNlbnNlLiBIb3dldmVyLCBpbiBhY2NlcHRpbmcgc3VjaCBvYmxpZ2F0aW9ucywgWW91IG1heSBhY3Qgb25seSBvbiBZb3VyIG93biBiZWhhbGYgYW5kIG9uIFlvdXIgc29sZSByZXNwb25zaWJpbGl0eSwgbm90IG9uIGJlaGFsZiBvZiBhbnkgb3RoZXIgQ29udHJpYnV0b3IsIGFuZCBvbmx5IGlmIFlvdSBhZ3JlZSB0byBpbmRlbW5pZnksIGRlZmVuZCwgYW5kIGhvbGQgZWFjaCBDb250cmlidXRvciBoYXJtbGVzcyBmb3IgYW55IGxpYWJpbGl0eSBpbmN1cnJlZCBieSwgb3IgY2xhaW1zIGFzc2VydGVkIGFnYWluc3QsIHN1Y2ggQ29udHJpYnV0b3IgYnkgcmVhc29uIG9mIHlvdXIgYWNjZXB0aW5nIGFueSBzdWNoIHdhcnJhbnR5IG9yIGFkZGl0aW9uYWwgbGlhYmlsaXR5LgoKRU5EIE9GIFRFUk1TIEFORCBDT05ESVRJT05TCgpBUFBFTkRJWDogSG93IHRvIGFwcGx5IHRoZSBBcGFjaGUgTGljZW5zZSB0byB5b3VyIHdvcmsuCgpUbyBhcHBseSB0aGUgQXBhY2hlIExpY2Vuc2UgdG8geW91ciB3b3JrLCBhdHRhY2ggdGhlIGZvbGxvd2luZyBib2lsZXJwbGF0ZSBub3RpY2UsIHdpdGggdGhlIGZpZWxkcyBlbmNsb3NlZCBieSBicmFja2V0cyAiW10iIHJlcGxhY2VkIHdpdGggeW91ciBvd24gaWRlbnRpZnlpbmcgaW5mb3JtYXRpb24uIChEb24ndCBpbmNsdWRlIHRoZSBicmFja2V0cyEpICBUaGUgdGV4dCBzaG91bGQgYmUgZW5jbG9zZWQgaW4gdGhlIGFwcHJvcHJpYXRlIGNvbW1lbnQgc3ludGF4IGZvciB0aGUgZmlsZSBmb3JtYXQuIFdlIGFsc28gcmVjb21tZW5kIHRoYXQgYSBmaWxlIG9yIGNsYXNzIG5hbWUgYW5kIGRlc2NyaXB0aW9uIG9mIHB1cnBvc2UgYmUgaW5jbHVkZWQgb24gdGhlIHNhbWUgInByaW50ZWQgcGFnZSIgYXMgdGhlIGNvcHlyaWdodCBub3RpY2UgZm9yIGVhc2llciBpZGVudGlmaWNhdGlvbiB3aXRoaW4gdGhpcmQtcGFydHkgYXJjaGl2ZXMuCgpDb3B5cmlnaHQgW3l5eXldIFtuYW1lIG9mIGNvcHlyaWdodCBvd25lcl0KCkxpY2Vuc2VkIHVuZGVyIHRoZSBBcGFjaGUgTGljZW5zZSwgVmVyc2lvbiAyLjAgKHRoZSAiTGljZW5zZSIpOwp5b3UgbWF5IG5vdCB1c2UgdGhpcyBmaWxlIGV4Y2VwdCBpbiBjb21wbGlhbmNlIHdpdGggdGhlIExpY2Vuc2UuCllvdSBtYXkgb2J0YWluIGEgY29weSBvZiB0aGUgTGljZW5zZSBhdAoKaHR0cDovL3d3dy5hcGFjaGUub3JnL2xpY2Vuc2VzL0xJQ0VOU0UtMi4wCgpVbmxlc3MgcmVxdWlyZWQgYnkgYXBwbGljYWJsZSBsYXcgb3IgYWdyZWVkIHRvIGluIHdyaXRpbmcsIHNvZnR3YXJlCmRpc3RyaWJ1dGVkIHVuZGVyIHRoZSBMaWNlbnNlIGlzIGRpc3RyaWJ1dGVkIG9uIGFuICJBUyBJUyIgQkFTSVMsCldJVEhPVVQgV0FSUkFOVElFUyBPUiBDT05ESVRJT05TIE9GIEFOWSBLSU5ELCBlaXRoZXIgZXhwcmVzcyBvciBpbXBsaWVkLgpTZWUgdGhlIExpY2Vuc2UgZm9yIHRoZSBzcGVjaWZpYyBsYW5ndWFnZSBnb3Zlcm5pbmcgcGVybWlzc2lvbnMgYW5kCmxpbWl0YXRpb25zIHVuZGVyIHRoZSBMaWNlbnNlLg==" + }, + "url": "https://www.apache.org/licenses/LICENSE-2.0" + } + } + ], + "version": "0.6.1", + "purl": "pkg:npm/forever-agent@0.6.1", + "bom-ref": "forever-agent_0.6.1_a6396bb0-b1f8-4fee-9933-893a1c51b580", + "description": "HTTP Agent that keeps socket connections alive between keep-alive requests. Formerly part of mikeal/request, now a standalone module.", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "278" + } + ] + }, + { + "name": "forwarded", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "0.1.2", + "purl": "pkg:npm/forwarded@0.1.2", + "bom-ref": "forwarded_0.1.2_f82075b6-046d-4583-b8d9-5ac38c5aaab1", + "description": "Parse HTTP X-Forwarded-For header", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "281" + } + ] + }, + { + "name": "fresh", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "0.2.4", + "cpe": "cpe:2.3:a:fresh_project:fresh:0.2.4:*:*:*:*:node.js:*:*", + "purl": "pkg:npm/fresh@0.2.4", + "bom-ref": "fresh_0.2.4_7907c40c-19f7-4eff-9230-de35343d0022", + "description": "HTTP response freshness testing", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "282" + } + ] + }, + { + "name": "fs-extra", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "0.22.1", + "purl": "pkg:npm/fs-extra@0.22.1", + "bom-ref": "fs-extra_0.22.1_ae4beaea-bce6-4309-bcc0-5ae1c7d87f7e", + "description": "fs-extra contains methods that aren't included in the vanilla Node.js fs package. Such as mkdir -p, cp -r, and rm -rf.", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "284" + } + ] + }, + { + "name": "fs.realpath", + "type": "library", + "licenses": [ + { + "license": { + "id": "ISC", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "SVNDIExpY2Vuc2U6CgpDb3B5cmlnaHQgKGMpIDIwMDQtMjAxMCBieSBJbnRlcm5ldCBTeXN0ZW1zIENvbnNvcnRpdW0sIEluYy4gKCJJU0MiKQpDb3B5cmlnaHQgKGMpIDE5OTUtMjAwMyBieSBJbnRlcm5ldCBTb2Z0d2FyZSBDb25zb3J0aXVtCgpQZXJtaXNzaW9uIHRvIHVzZSwgY29weSwgbW9kaWZ5LCBhbmQvb3IgZGlzdHJpYnV0ZSB0aGlzIHNvZnR3YXJlIGZvciBhbnkgcHVycG9zZSB3aXRoIG9yIHdpdGhvdXQgZmVlIGlzIGhlcmVieSBncmFudGVkLCBwcm92aWRlZCB0aGF0IHRoZSBhYm92ZSBjb3B5cmlnaHQgbm90aWNlIGFuZCB0aGlzIHBlcm1pc3Npb24gbm90aWNlIGFwcGVhciBpbiBhbGwgY29waWVzLgoKVEhFIFNPRlRXQVJFIElTIFBST1ZJREVEICJBUyBJUyIgQU5EIElTQyBESVNDTEFJTVMgQUxMIFdBUlJBTlRJRVMgV0lUSCBSRUdBUkQgVE8gVEhJUyBTT0ZUV0FSRSBJTkNMVURJTkcgQUxMIElNUExJRUQgV0FSUkFOVElFUyBPRiBNRVJDSEFOVEFCSUxJVFkgQU5EIEZJVE5FU1MuIElOIE5PIEVWRU5UIFNIQUxMIElTQyBCRSBMSUFCTEUgRk9SIEFOWSBTUEVDSUFMLCBESVJFQ1QsIElORElSRUNULCBPUiBDT05TRVFVRU5USUFMIERBTUFHRVMgT1IgQU5ZIERBTUFHRVMgV0hBVFNPRVZFUiBSRVNVTFRJTkcgRlJPTSBMT1NTIE9GIFVTRSwgREFUQSBPUiBQUk9GSVRTLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgTkVHTElHRU5DRSBPUiBPVEhFUiBUT1JUSU9VUyBBQ1RJT04sIEFSSVNJTkcgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgVVNFIE9SIFBFUkZPUk1BTkNFIE9GIFRISVMgU09GVFdBUkUu" + }, + "url": "https://www.isc.org/licenses/" + } + } + ], + "version": "1.0.0", + "purl": "pkg:npm/fs.realpath@1.0.0", + "bom-ref": "fs.realpath_1.0.0_6096ef6b-3692-477f-854d-1a74baf3e2f7", + "description": "Use node's fs.realpath, but fall back to the JS implementation if the native one fails", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "285" + } + ] + }, + { + "name": "get-assigned-identifiers", + "type": "library", + "licenses": [ + { + "license": { + "id": "Apache-2.0", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "QXBhY2hlIExpY2Vuc2UKVmVyc2lvbiAyLjAsIEphbnVhcnkgMjAwNApodHRwOi8vd3d3LmFwYWNoZS5vcmcvbGljZW5zZXMvCgpURVJNUyBBTkQgQ09ORElUSU9OUyBGT1IgVVNFLCBSRVBST0RVQ1RJT04sIEFORCBESVNUUklCVVRJT04KCjEuIERlZmluaXRpb25zLgoKIkxpY2Vuc2UiIHNoYWxsIG1lYW4gdGhlIHRlcm1zIGFuZCBjb25kaXRpb25zIGZvciB1c2UsIHJlcHJvZHVjdGlvbiwgYW5kIGRpc3RyaWJ1dGlvbiBhcyBkZWZpbmVkIGJ5IFNlY3Rpb25zIDEgdGhyb3VnaCA5IG9mIHRoaXMgZG9jdW1lbnQuCgoiTGljZW5zb3IiIHNoYWxsIG1lYW4gdGhlIGNvcHlyaWdodCBvd25lciBvciBlbnRpdHkgYXV0aG9yaXplZCBieSB0aGUgY29weXJpZ2h0IG93bmVyIHRoYXQgaXMgZ3JhbnRpbmcgdGhlIExpY2Vuc2UuCgoiTGVnYWwgRW50aXR5IiBzaGFsbCBtZWFuIHRoZSB1bmlvbiBvZiB0aGUgYWN0aW5nIGVudGl0eSBhbmQgYWxsIG90aGVyIGVudGl0aWVzIHRoYXQgY29udHJvbCwgYXJlIGNvbnRyb2xsZWQgYnksIG9yIGFyZSB1bmRlciBjb21tb24gY29udHJvbCB3aXRoIHRoYXQgZW50aXR5LiBGb3IgdGhlIHB1cnBvc2VzIG9mIHRoaXMgZGVmaW5pdGlvbiwgImNvbnRyb2wiIG1lYW5zIChpKSB0aGUgcG93ZXIsIGRpcmVjdCBvciBpbmRpcmVjdCwgdG8gY2F1c2UgdGhlIGRpcmVjdGlvbiBvciBtYW5hZ2VtZW50IG9mIHN1Y2ggZW50aXR5LCB3aGV0aGVyIGJ5IGNvbnRyYWN0IG9yIG90aGVyd2lzZSwgb3IgKGlpKSBvd25lcnNoaXAgb2YgZmlmdHkgcGVyY2VudCAoNTAlKSBvciBtb3JlIG9mIHRoZSBvdXRzdGFuZGluZyBzaGFyZXMsIG9yIChpaWkpIGJlbmVmaWNpYWwgb3duZXJzaGlwIG9mIHN1Y2ggZW50aXR5LgoKIllvdSIgKG9yICJZb3VyIikgc2hhbGwgbWVhbiBhbiBpbmRpdmlkdWFsIG9yIExlZ2FsIEVudGl0eSBleGVyY2lzaW5nIHBlcm1pc3Npb25zIGdyYW50ZWQgYnkgdGhpcyBMaWNlbnNlLgoKIlNvdXJjZSIgZm9ybSBzaGFsbCBtZWFuIHRoZSBwcmVmZXJyZWQgZm9ybSBmb3IgbWFraW5nIG1vZGlmaWNhdGlvbnMsIGluY2x1ZGluZyBidXQgbm90IGxpbWl0ZWQgdG8gc29mdHdhcmUgc291cmNlIGNvZGUsIGRvY3VtZW50YXRpb24gc291cmNlLCBhbmQgY29uZmlndXJhdGlvbiBmaWxlcy4KCiJPYmplY3QiIGZvcm0gc2hhbGwgbWVhbiBhbnkgZm9ybSByZXN1bHRpbmcgZnJvbSBtZWNoYW5pY2FsIHRyYW5zZm9ybWF0aW9uIG9yIHRyYW5zbGF0aW9uIG9mIGEgU291cmNlIGZvcm0sIGluY2x1ZGluZyBidXQgbm90IGxpbWl0ZWQgdG8gY29tcGlsZWQgb2JqZWN0IGNvZGUsIGdlbmVyYXRlZCBkb2N1bWVudGF0aW9uLCBhbmQgY29udmVyc2lvbnMgdG8gb3RoZXIgbWVkaWEgdHlwZXMuCgoiV29yayIgc2hhbGwgbWVhbiB0aGUgd29yayBvZiBhdXRob3JzaGlwLCB3aGV0aGVyIGluIFNvdXJjZSBvciBPYmplY3QgZm9ybSwgbWFkZSBhdmFpbGFibGUgdW5kZXIgdGhlIExpY2Vuc2UsIGFzIGluZGljYXRlZCBieSBhIGNvcHlyaWdodCBub3RpY2UgdGhhdCBpcyBpbmNsdWRlZCBpbiBvciBhdHRhY2hlZCB0byB0aGUgd29yayAoYW4gZXhhbXBsZSBpcyBwcm92aWRlZCBpbiB0aGUgQXBwZW5kaXggYmVsb3cpLgoKIkRlcml2YXRpdmUgV29ya3MiIHNoYWxsIG1lYW4gYW55IHdvcmssIHdoZXRoZXIgaW4gU291cmNlIG9yIE9iamVjdCBmb3JtLCB0aGF0IGlzIGJhc2VkIG9uIChvciBkZXJpdmVkIGZyb20pIHRoZSBXb3JrIGFuZCBmb3Igd2hpY2ggdGhlIGVkaXRvcmlhbCByZXZpc2lvbnMsIGFubm90YXRpb25zLCBlbGFib3JhdGlvbnMsIG9yIG90aGVyIG1vZGlmaWNhdGlvbnMgcmVwcmVzZW50LCBhcyBhIHdob2xlLCBhbiBvcmlnaW5hbCB3b3JrIG9mIGF1dGhvcnNoaXAuIEZvciB0aGUgcHVycG9zZXMgb2YgdGhpcyBMaWNlbnNlLCBEZXJpdmF0aXZlIFdvcmtzIHNoYWxsIG5vdCBpbmNsdWRlIHdvcmtzIHRoYXQgcmVtYWluIHNlcGFyYWJsZSBmcm9tLCBvciBtZXJlbHkgbGluayAob3IgYmluZCBieSBuYW1lKSB0byB0aGUgaW50ZXJmYWNlcyBvZiwgdGhlIFdvcmsgYW5kIERlcml2YXRpdmUgV29ya3MgdGhlcmVvZi4KCiJDb250cmlidXRpb24iIHNoYWxsIG1lYW4gYW55IHdvcmsgb2YgYXV0aG9yc2hpcCwgaW5jbHVkaW5nIHRoZSBvcmlnaW5hbCB2ZXJzaW9uIG9mIHRoZSBXb3JrIGFuZCBhbnkgbW9kaWZpY2F0aW9ucyBvciBhZGRpdGlvbnMgdG8gdGhhdCBXb3JrIG9yIERlcml2YXRpdmUgV29ya3MgdGhlcmVvZiwgdGhhdCBpcyBpbnRlbnRpb25hbGx5IHN1Ym1pdHRlZCB0byBMaWNlbnNvciBmb3IgaW5jbHVzaW9uIGluIHRoZSBXb3JrIGJ5IHRoZSBjb3B5cmlnaHQgb3duZXIgb3IgYnkgYW4gaW5kaXZpZHVhbCBvciBMZWdhbCBFbnRpdHkgYXV0aG9yaXplZCB0byBzdWJtaXQgb24gYmVoYWxmIG9mIHRoZSBjb3B5cmlnaHQgb3duZXIuIEZvciB0aGUgcHVycG9zZXMgb2YgdGhpcyBkZWZpbml0aW9uLCAic3VibWl0dGVkIiBtZWFucyBhbnkgZm9ybSBvZiBlbGVjdHJvbmljLCB2ZXJiYWwsIG9yIHdyaXR0ZW4gY29tbXVuaWNhdGlvbiBzZW50IHRvIHRoZSBMaWNlbnNvciBvciBpdHMgcmVwcmVzZW50YXRpdmVzLCBpbmNsdWRpbmcgYnV0IG5vdCBsaW1pdGVkIHRvIGNvbW11bmljYXRpb24gb24gZWxlY3Ryb25pYyBtYWlsaW5nIGxpc3RzLCBzb3VyY2UgY29kZSBjb250cm9sIHN5c3RlbXMsIGFuZCBpc3N1ZSB0cmFja2luZyBzeXN0ZW1zIHRoYXQgYXJlIG1hbmFnZWQgYnksIG9yIG9uIGJlaGFsZiBvZiwgdGhlIExpY2Vuc29yIGZvciB0aGUgcHVycG9zZSBvZiBkaXNjdXNzaW5nIGFuZCBpbXByb3ZpbmcgdGhlIFdvcmssIGJ1dCBleGNsdWRpbmcgY29tbXVuaWNhdGlvbiB0aGF0IGlzIGNvbnNwaWN1b3VzbHkgbWFya2VkIG9yIG90aGVyd2lzZSBkZXNpZ25hdGVkIGluIHdyaXRpbmcgYnkgdGhlIGNvcHlyaWdodCBvd25lciBhcyAiTm90IGEgQ29udHJpYnV0aW9uLiIKCiJDb250cmlidXRvciIgc2hhbGwgbWVhbiBMaWNlbnNvciBhbmQgYW55IGluZGl2aWR1YWwgb3IgTGVnYWwgRW50aXR5IG9uIGJlaGFsZiBvZiB3aG9tIGEgQ29udHJpYnV0aW9uIGhhcyBiZWVuIHJlY2VpdmVkIGJ5IExpY2Vuc29yIGFuZCBzdWJzZXF1ZW50bHkgaW5jb3Jwb3JhdGVkIHdpdGhpbiB0aGUgV29yay4KCjIuIEdyYW50IG9mIENvcHlyaWdodCBMaWNlbnNlLiBTdWJqZWN0IHRvIHRoZSB0ZXJtcyBhbmQgY29uZGl0aW9ucyBvZiB0aGlzIExpY2Vuc2UsIGVhY2ggQ29udHJpYnV0b3IgaGVyZWJ5IGdyYW50cyB0byBZb3UgYSBwZXJwZXR1YWwsIHdvcmxkd2lkZSwgbm9uLWV4Y2x1c2l2ZSwgbm8tY2hhcmdlLCByb3lhbHR5LWZyZWUsIGlycmV2b2NhYmxlIGNvcHlyaWdodCBsaWNlbnNlIHRvIHJlcHJvZHVjZSwgcHJlcGFyZSBEZXJpdmF0aXZlIFdvcmtzIG9mLCBwdWJsaWNseSBkaXNwbGF5LCBwdWJsaWNseSBwZXJmb3JtLCBzdWJsaWNlbnNlLCBhbmQgZGlzdHJpYnV0ZSB0aGUgV29yayBhbmQgc3VjaCBEZXJpdmF0aXZlIFdvcmtzIGluIFNvdXJjZSBvciBPYmplY3QgZm9ybS4KCjMuIEdyYW50IG9mIFBhdGVudCBMaWNlbnNlLiBTdWJqZWN0IHRvIHRoZSB0ZXJtcyBhbmQgY29uZGl0aW9ucyBvZiB0aGlzIExpY2Vuc2UsIGVhY2ggQ29udHJpYnV0b3IgaGVyZWJ5IGdyYW50cyB0byBZb3UgYSBwZXJwZXR1YWwsIHdvcmxkd2lkZSwgbm9uLWV4Y2x1c2l2ZSwgbm8tY2hhcmdlLCByb3lhbHR5LWZyZWUsIGlycmV2b2NhYmxlIChleGNlcHQgYXMgc3RhdGVkIGluIHRoaXMgc2VjdGlvbikgcGF0ZW50IGxpY2Vuc2UgdG8gbWFrZSwgaGF2ZSBtYWRlLCB1c2UsIG9mZmVyIHRvIHNlbGwsIHNlbGwsIGltcG9ydCwgYW5kIG90aGVyd2lzZSB0cmFuc2ZlciB0aGUgV29yaywgd2hlcmUgc3VjaCBsaWNlbnNlIGFwcGxpZXMgb25seSB0byB0aG9zZSBwYXRlbnQgY2xhaW1zIGxpY2Vuc2FibGUgYnkgc3VjaCBDb250cmlidXRvciB0aGF0IGFyZSBuZWNlc3NhcmlseSBpbmZyaW5nZWQgYnkgdGhlaXIgQ29udHJpYnV0aW9uKHMpIGFsb25lIG9yIGJ5IGNvbWJpbmF0aW9uIG9mIHRoZWlyIENvbnRyaWJ1dGlvbihzKSB3aXRoIHRoZSBXb3JrIHRvIHdoaWNoIHN1Y2ggQ29udHJpYnV0aW9uKHMpIHdhcyBzdWJtaXR0ZWQuIElmIFlvdSBpbnN0aXR1dGUgcGF0ZW50IGxpdGlnYXRpb24gYWdhaW5zdCBhbnkgZW50aXR5IChpbmNsdWRpbmcgYSBjcm9zcy1jbGFpbSBvciBjb3VudGVyY2xhaW0gaW4gYSBsYXdzdWl0KSBhbGxlZ2luZyB0aGF0IHRoZSBXb3JrIG9yIGEgQ29udHJpYnV0aW9uIGluY29ycG9yYXRlZCB3aXRoaW4gdGhlIFdvcmsgY29uc3RpdHV0ZXMgZGlyZWN0IG9yIGNvbnRyaWJ1dG9yeSBwYXRlbnQgaW5mcmluZ2VtZW50LCB0aGVuIGFueSBwYXRlbnQgbGljZW5zZXMgZ3JhbnRlZCB0byBZb3UgdW5kZXIgdGhpcyBMaWNlbnNlIGZvciB0aGF0IFdvcmsgc2hhbGwgdGVybWluYXRlIGFzIG9mIHRoZSBkYXRlIHN1Y2ggbGl0aWdhdGlvbiBpcyBmaWxlZC4KCjQuIFJlZGlzdHJpYnV0aW9uLiBZb3UgbWF5IHJlcHJvZHVjZSBhbmQgZGlzdHJpYnV0ZSBjb3BpZXMgb2YgdGhlIFdvcmsgb3IgRGVyaXZhdGl2ZSBXb3JrcyB0aGVyZW9mIGluIGFueSBtZWRpdW0sIHdpdGggb3Igd2l0aG91dCBtb2RpZmljYXRpb25zLCBhbmQgaW4gU291cmNlIG9yIE9iamVjdCBmb3JtLCBwcm92aWRlZCB0aGF0IFlvdSBtZWV0IHRoZSBmb2xsb3dpbmcgY29uZGl0aW9uczoKCiAgICAgKGEpIFlvdSBtdXN0IGdpdmUgYW55IG90aGVyIHJlY2lwaWVudHMgb2YgdGhlIFdvcmsgb3IgRGVyaXZhdGl2ZSBXb3JrcyBhIGNvcHkgb2YgdGhpcyBMaWNlbnNlOyBhbmQKCiAgICAgKGIpIFlvdSBtdXN0IGNhdXNlIGFueSBtb2RpZmllZCBmaWxlcyB0byBjYXJyeSBwcm9taW5lbnQgbm90aWNlcyBzdGF0aW5nIHRoYXQgWW91IGNoYW5nZWQgdGhlIGZpbGVzOyBhbmQKCiAgICAgKGMpIFlvdSBtdXN0IHJldGFpbiwgaW4gdGhlIFNvdXJjZSBmb3JtIG9mIGFueSBEZXJpdmF0aXZlIFdvcmtzIHRoYXQgWW91IGRpc3RyaWJ1dGUsIGFsbCBjb3B5cmlnaHQsIHBhdGVudCwgdHJhZGVtYXJrLCBhbmQgYXR0cmlidXRpb24gbm90aWNlcyBmcm9tIHRoZSBTb3VyY2UgZm9ybSBvZiB0aGUgV29yaywgZXhjbHVkaW5nIHRob3NlIG5vdGljZXMgdGhhdCBkbyBub3QgcGVydGFpbiB0byBhbnkgcGFydCBvZiB0aGUgRGVyaXZhdGl2ZSBXb3JrczsgYW5kCgogICAgIChkKSBJZiB0aGUgV29yayBpbmNsdWRlcyBhICJOT1RJQ0UiIHRleHQgZmlsZSBhcyBwYXJ0IG9mIGl0cyBkaXN0cmlidXRpb24sIHRoZW4gYW55IERlcml2YXRpdmUgV29ya3MgdGhhdCBZb3UgZGlzdHJpYnV0ZSBtdXN0IGluY2x1ZGUgYSByZWFkYWJsZSBjb3B5IG9mIHRoZSBhdHRyaWJ1dGlvbiBub3RpY2VzIGNvbnRhaW5lZCB3aXRoaW4gc3VjaCBOT1RJQ0UgZmlsZSwgZXhjbHVkaW5nIHRob3NlIG5vdGljZXMgdGhhdCBkbyBub3QgcGVydGFpbiB0byBhbnkgcGFydCBvZiB0aGUgRGVyaXZhdGl2ZSBXb3JrcywgaW4gYXQgbGVhc3Qgb25lIG9mIHRoZSBmb2xsb3dpbmcgcGxhY2VzOiB3aXRoaW4gYSBOT1RJQ0UgdGV4dCBmaWxlIGRpc3RyaWJ1dGVkIGFzIHBhcnQgb2YgdGhlIERlcml2YXRpdmUgV29ya3M7IHdpdGhpbiB0aGUgU291cmNlIGZvcm0gb3IgZG9jdW1lbnRhdGlvbiwgaWYgcHJvdmlkZWQgYWxvbmcgd2l0aCB0aGUgRGVyaXZhdGl2ZSBXb3Jrczsgb3IsIHdpdGhpbiBhIGRpc3BsYXkgZ2VuZXJhdGVkIGJ5IHRoZSBEZXJpdmF0aXZlIFdvcmtzLCBpZiBhbmQgd2hlcmV2ZXIgc3VjaCB0aGlyZC1wYXJ0eSBub3RpY2VzIG5vcm1hbGx5IGFwcGVhci4gVGhlIGNvbnRlbnRzIG9mIHRoZSBOT1RJQ0UgZmlsZSBhcmUgZm9yIGluZm9ybWF0aW9uYWwgcHVycG9zZXMgb25seSBhbmQgZG8gbm90IG1vZGlmeSB0aGUgTGljZW5zZS4gWW91IG1heSBhZGQgWW91ciBvd24gYXR0cmlidXRpb24gbm90aWNlcyB3aXRoaW4gRGVyaXZhdGl2ZSBXb3JrcyB0aGF0IFlvdSBkaXN0cmlidXRlLCBhbG9uZ3NpZGUgb3IgYXMgYW4gYWRkZW5kdW0gdG8gdGhlIE5PVElDRSB0ZXh0IGZyb20gdGhlIFdvcmssIHByb3ZpZGVkIHRoYXQgc3VjaCBhZGRpdGlvbmFsIGF0dHJpYnV0aW9uIG5vdGljZXMgY2Fubm90IGJlIGNvbnN0cnVlZCBhcyBtb2RpZnlpbmcgdGhlIExpY2Vuc2UuCgogICAgIFlvdSBtYXkgYWRkIFlvdXIgb3duIGNvcHlyaWdodCBzdGF0ZW1lbnQgdG8gWW91ciBtb2RpZmljYXRpb25zIGFuZCBtYXkgcHJvdmlkZSBhZGRpdGlvbmFsIG9yIGRpZmZlcmVudCBsaWNlbnNlIHRlcm1zIGFuZCBjb25kaXRpb25zIGZvciB1c2UsIHJlcHJvZHVjdGlvbiwgb3IgZGlzdHJpYnV0aW9uIG9mIFlvdXIgbW9kaWZpY2F0aW9ucywgb3IgZm9yIGFueSBzdWNoIERlcml2YXRpdmUgV29ya3MgYXMgYSB3aG9sZSwgcHJvdmlkZWQgWW91ciB1c2UsIHJlcHJvZHVjdGlvbiwgYW5kIGRpc3RyaWJ1dGlvbiBvZiB0aGUgV29yayBvdGhlcndpc2UgY29tcGxpZXMgd2l0aCB0aGUgY29uZGl0aW9ucyBzdGF0ZWQgaW4gdGhpcyBMaWNlbnNlLgoKNS4gU3VibWlzc2lvbiBvZiBDb250cmlidXRpb25zLiBVbmxlc3MgWW91IGV4cGxpY2l0bHkgc3RhdGUgb3RoZXJ3aXNlLCBhbnkgQ29udHJpYnV0aW9uIGludGVudGlvbmFsbHkgc3VibWl0dGVkIGZvciBpbmNsdXNpb24gaW4gdGhlIFdvcmsgYnkgWW91IHRvIHRoZSBMaWNlbnNvciBzaGFsbCBiZSB1bmRlciB0aGUgdGVybXMgYW5kIGNvbmRpdGlvbnMgb2YgdGhpcyBMaWNlbnNlLCB3aXRob3V0IGFueSBhZGRpdGlvbmFsIHRlcm1zIG9yIGNvbmRpdGlvbnMuIE5vdHdpdGhzdGFuZGluZyB0aGUgYWJvdmUsIG5vdGhpbmcgaGVyZWluIHNoYWxsIHN1cGVyc2VkZSBvciBtb2RpZnkgdGhlIHRlcm1zIG9mIGFueSBzZXBhcmF0ZSBsaWNlbnNlIGFncmVlbWVudCB5b3UgbWF5IGhhdmUgZXhlY3V0ZWQgd2l0aCBMaWNlbnNvciByZWdhcmRpbmcgc3VjaCBDb250cmlidXRpb25zLgoKNi4gVHJhZGVtYXJrcy4gVGhpcyBMaWNlbnNlIGRvZXMgbm90IGdyYW50IHBlcm1pc3Npb24gdG8gdXNlIHRoZSB0cmFkZSBuYW1lcywgdHJhZGVtYXJrcywgc2VydmljZSBtYXJrcywgb3IgcHJvZHVjdCBuYW1lcyBvZiB0aGUgTGljZW5zb3IsIGV4Y2VwdCBhcyByZXF1aXJlZCBmb3IgcmVhc29uYWJsZSBhbmQgY3VzdG9tYXJ5IHVzZSBpbiBkZXNjcmliaW5nIHRoZSBvcmlnaW4gb2YgdGhlIFdvcmsgYW5kIHJlcHJvZHVjaW5nIHRoZSBjb250ZW50IG9mIHRoZSBOT1RJQ0UgZmlsZS4KCjcuIERpc2NsYWltZXIgb2YgV2FycmFudHkuIFVubGVzcyByZXF1aXJlZCBieSBhcHBsaWNhYmxlIGxhdyBvciBhZ3JlZWQgdG8gaW4gd3JpdGluZywgTGljZW5zb3IgcHJvdmlkZXMgdGhlIFdvcmsgKGFuZCBlYWNoIENvbnRyaWJ1dG9yIHByb3ZpZGVzIGl0cyBDb250cmlidXRpb25zKSBvbiBhbiAiQVMgSVMiIEJBU0lTLCBXSVRIT1VUIFdBUlJBTlRJRVMgT1IgQ09ORElUSU9OUyBPRiBBTlkgS0lORCwgZWl0aGVyIGV4cHJlc3Mgb3IgaW1wbGllZCwgaW5jbHVkaW5nLCB3aXRob3V0IGxpbWl0YXRpb24sIGFueSB3YXJyYW50aWVzIG9yIGNvbmRpdGlvbnMgb2YgVElUTEUsIE5PTi1JTkZSSU5HRU1FTlQsIE1FUkNIQU5UQUJJTElUWSwgb3IgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UuIFlvdSBhcmUgc29sZWx5IHJlc3BvbnNpYmxlIGZvciBkZXRlcm1pbmluZyB0aGUgYXBwcm9wcmlhdGVuZXNzIG9mIHVzaW5nIG9yIHJlZGlzdHJpYnV0aW5nIHRoZSBXb3JrIGFuZCBhc3N1bWUgYW55IHJpc2tzIGFzc29jaWF0ZWQgd2l0aCBZb3VyIGV4ZXJjaXNlIG9mIHBlcm1pc3Npb25zIHVuZGVyIHRoaXMgTGljZW5zZS4KCjguIExpbWl0YXRpb24gb2YgTGlhYmlsaXR5LiBJbiBubyBldmVudCBhbmQgdW5kZXIgbm8gbGVnYWwgdGhlb3J5LCB3aGV0aGVyIGluIHRvcnQgKGluY2x1ZGluZyBuZWdsaWdlbmNlKSwgY29udHJhY3QsIG9yIG90aGVyd2lzZSwgdW5sZXNzIHJlcXVpcmVkIGJ5IGFwcGxpY2FibGUgbGF3IChzdWNoIGFzIGRlbGliZXJhdGUgYW5kIGdyb3NzbHkgbmVnbGlnZW50IGFjdHMpIG9yIGFncmVlZCB0byBpbiB3cml0aW5nLCBzaGFsbCBhbnkgQ29udHJpYnV0b3IgYmUgbGlhYmxlIHRvIFlvdSBmb3IgZGFtYWdlcywgaW5jbHVkaW5nIGFueSBkaXJlY3QsIGluZGlyZWN0LCBzcGVjaWFsLCBpbmNpZGVudGFsLCBvciBjb25zZXF1ZW50aWFsIGRhbWFnZXMgb2YgYW55IGNoYXJhY3RlciBhcmlzaW5nIGFzIGEgcmVzdWx0IG9mIHRoaXMgTGljZW5zZSBvciBvdXQgb2YgdGhlIHVzZSBvciBpbmFiaWxpdHkgdG8gdXNlIHRoZSBXb3JrIChpbmNsdWRpbmcgYnV0IG5vdCBsaW1pdGVkIHRvIGRhbWFnZXMgZm9yIGxvc3Mgb2YgZ29vZHdpbGwsIHdvcmsgc3RvcHBhZ2UsIGNvbXB1dGVyIGZhaWx1cmUgb3IgbWFsZnVuY3Rpb24sIG9yIGFueSBhbmQgYWxsIG90aGVyIGNvbW1lcmNpYWwgZGFtYWdlcyBvciBsb3NzZXMpLCBldmVuIGlmIHN1Y2ggQ29udHJpYnV0b3IgaGFzIGJlZW4gYWR2aXNlZCBvZiB0aGUgcG9zc2liaWxpdHkgb2Ygc3VjaCBkYW1hZ2VzLgoKOS4gQWNjZXB0aW5nIFdhcnJhbnR5IG9yIEFkZGl0aW9uYWwgTGlhYmlsaXR5LiBXaGlsZSByZWRpc3RyaWJ1dGluZyB0aGUgV29yayBvciBEZXJpdmF0aXZlIFdvcmtzIHRoZXJlb2YsIFlvdSBtYXkgY2hvb3NlIHRvIG9mZmVyLCBhbmQgY2hhcmdlIGEgZmVlIGZvciwgYWNjZXB0YW5jZSBvZiBzdXBwb3J0LCB3YXJyYW50eSwgaW5kZW1uaXR5LCBvciBvdGhlciBsaWFiaWxpdHkgb2JsaWdhdGlvbnMgYW5kL29yIHJpZ2h0cyBjb25zaXN0ZW50IHdpdGggdGhpcyBMaWNlbnNlLiBIb3dldmVyLCBpbiBhY2NlcHRpbmcgc3VjaCBvYmxpZ2F0aW9ucywgWW91IG1heSBhY3Qgb25seSBvbiBZb3VyIG93biBiZWhhbGYgYW5kIG9uIFlvdXIgc29sZSByZXNwb25zaWJpbGl0eSwgbm90IG9uIGJlaGFsZiBvZiBhbnkgb3RoZXIgQ29udHJpYnV0b3IsIGFuZCBvbmx5IGlmIFlvdSBhZ3JlZSB0byBpbmRlbW5pZnksIGRlZmVuZCwgYW5kIGhvbGQgZWFjaCBDb250cmlidXRvciBoYXJtbGVzcyBmb3IgYW55IGxpYWJpbGl0eSBpbmN1cnJlZCBieSwgb3IgY2xhaW1zIGFzc2VydGVkIGFnYWluc3QsIHN1Y2ggQ29udHJpYnV0b3IgYnkgcmVhc29uIG9mIHlvdXIgYWNjZXB0aW5nIGFueSBzdWNoIHdhcnJhbnR5IG9yIGFkZGl0aW9uYWwgbGlhYmlsaXR5LgoKRU5EIE9GIFRFUk1TIEFORCBDT05ESVRJT05TCgpBUFBFTkRJWDogSG93IHRvIGFwcGx5IHRoZSBBcGFjaGUgTGljZW5zZSB0byB5b3VyIHdvcmsuCgpUbyBhcHBseSB0aGUgQXBhY2hlIExpY2Vuc2UgdG8geW91ciB3b3JrLCBhdHRhY2ggdGhlIGZvbGxvd2luZyBib2lsZXJwbGF0ZSBub3RpY2UsIHdpdGggdGhlIGZpZWxkcyBlbmNsb3NlZCBieSBicmFja2V0cyAiW10iIHJlcGxhY2VkIHdpdGggeW91ciBvd24gaWRlbnRpZnlpbmcgaW5mb3JtYXRpb24uIChEb24ndCBpbmNsdWRlIHRoZSBicmFja2V0cyEpICBUaGUgdGV4dCBzaG91bGQgYmUgZW5jbG9zZWQgaW4gdGhlIGFwcHJvcHJpYXRlIGNvbW1lbnQgc3ludGF4IGZvciB0aGUgZmlsZSBmb3JtYXQuIFdlIGFsc28gcmVjb21tZW5kIHRoYXQgYSBmaWxlIG9yIGNsYXNzIG5hbWUgYW5kIGRlc2NyaXB0aW9uIG9mIHB1cnBvc2UgYmUgaW5jbHVkZWQgb24gdGhlIHNhbWUgInByaW50ZWQgcGFnZSIgYXMgdGhlIGNvcHlyaWdodCBub3RpY2UgZm9yIGVhc2llciBpZGVudGlmaWNhdGlvbiB3aXRoaW4gdGhpcmQtcGFydHkgYXJjaGl2ZXMuCgpDb3B5cmlnaHQgW3l5eXldIFtuYW1lIG9mIGNvcHlyaWdodCBvd25lcl0KCkxpY2Vuc2VkIHVuZGVyIHRoZSBBcGFjaGUgTGljZW5zZSwgVmVyc2lvbiAyLjAgKHRoZSAiTGljZW5zZSIpOwp5b3UgbWF5IG5vdCB1c2UgdGhpcyBmaWxlIGV4Y2VwdCBpbiBjb21wbGlhbmNlIHdpdGggdGhlIExpY2Vuc2UuCllvdSBtYXkgb2J0YWluIGEgY29weSBvZiB0aGUgTGljZW5zZSBhdAoKaHR0cDovL3d3dy5hcGFjaGUub3JnL2xpY2Vuc2VzL0xJQ0VOU0UtMi4wCgpVbmxlc3MgcmVxdWlyZWQgYnkgYXBwbGljYWJsZSBsYXcgb3IgYWdyZWVkIHRvIGluIHdyaXRpbmcsIHNvZnR3YXJlCmRpc3RyaWJ1dGVkIHVuZGVyIHRoZSBMaWNlbnNlIGlzIGRpc3RyaWJ1dGVkIG9uIGFuICJBUyBJUyIgQkFTSVMsCldJVEhPVVQgV0FSUkFOVElFUyBPUiBDT05ESVRJT05TIE9GIEFOWSBLSU5ELCBlaXRoZXIgZXhwcmVzcyBvciBpbXBsaWVkLgpTZWUgdGhlIExpY2Vuc2UgZm9yIHRoZSBzcGVjaWZpYyBsYW5ndWFnZSBnb3Zlcm5pbmcgcGVybWlzc2lvbnMgYW5kCmxpbWl0YXRpb25zIHVuZGVyIHRoZSBMaWNlbnNlLg==" + }, + "url": "https://www.apache.org/licenses/LICENSE-2.0" + } + } + ], + "version": "1.2.0", + "purl": "pkg:npm/get-assigned-identifiers@1.2.0", + "bom-ref": "get-assigned-identifiers_1.2.0_bf234d42-457a-4c17-829a-faaceb014800", + "description": "get a list of identifiers that are initialised by a JavaScript AST node.", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "290" + } + ] + }, + { + "name": "get-stream", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "3.0.0", + "purl": "pkg:npm/get-stream@3.0.0", + "bom-ref": "get-stream_3.0.0_0031156c-ac72-46d0-8fb4-0eb29bcf1d64", + "description": "Get a stream as a string, buffer, or array", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "291" + } + ] + }, + { + "name": "getpass", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "0.1.7", + "purl": "pkg:npm/getpass@0.1.7", + "bom-ref": "getpass_0.1.7_11e4bda0-34cc-44e1-a293-cf9e3c5fe17f", + "description": "getpass for node.js", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "294" + } + ] + }, + { + "name": "graceful-fs", + "type": "library", + "licenses": [ + { + "license": { + "id": "BSD-3-Clause", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "Q29weXJpZ2h0IChjKSA8eWVhcj4gPG93bmVyPi4gCgpSZWRpc3RyaWJ1dGlvbiBhbmQgdXNlIGluIHNvdXJjZSBhbmQgYmluYXJ5IGZvcm1zLCB3aXRoIG9yIHdpdGhvdXQgbW9kaWZpY2F0aW9uLCBhcmUgcGVybWl0dGVkIHByb3ZpZGVkIHRoYXQgdGhlIGZvbGxvd2luZyBjb25kaXRpb25zIGFyZSBtZXQ6CgoxLiBSZWRpc3RyaWJ1dGlvbnMgb2Ygc291cmNlIGNvZGUgbXVzdCByZXRhaW4gdGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UsIHRoaXMgbGlzdCBvZiBjb25kaXRpb25zIGFuZCB0aGUgZm9sbG93aW5nIGRpc2NsYWltZXIuCgoyLiBSZWRpc3RyaWJ1dGlvbnMgaW4gYmluYXJ5IGZvcm0gbXVzdCByZXByb2R1Y2UgdGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UsIHRoaXMgbGlzdCBvZiBjb25kaXRpb25zIGFuZCB0aGUgZm9sbG93aW5nIGRpc2NsYWltZXIgaW4gdGhlIGRvY3VtZW50YXRpb24gYW5kL29yIG90aGVyIG1hdGVyaWFscyBwcm92aWRlZCB3aXRoIHRoZSBkaXN0cmlidXRpb24uCgozLiBOZWl0aGVyIHRoZSBuYW1lIG9mIHRoZSBjb3B5cmlnaHQgaG9sZGVyIG5vciB0aGUgbmFtZXMgb2YgaXRzIGNvbnRyaWJ1dG9ycyBtYXkgYmUgdXNlZCB0byBlbmRvcnNlIG9yIHByb21vdGUgcHJvZHVjdHMgZGVyaXZlZCBmcm9tIHRoaXMgc29mdHdhcmUgd2l0aG91dCBzcGVjaWZpYyBwcmlvciB3cml0dGVuIHBlcm1pc3Npb24uCgpUSElTIFNPRlRXQVJFIElTIFBST1ZJREVEIEJZIFRIRSBDT1BZUklHSFQgSE9MREVSUyBBTkQgQ09OVFJJQlVUT1JTICJBUyBJUyIgQU5EIEFOWSBFWFBSRVNTIE9SIElNUExJRUQgV0FSUkFOVElFUywgSU5DTFVESU5HLCBCVVQgTk9UIExJTUlURUQgVE8sIFRIRSBJTVBMSUVEIFdBUlJBTlRJRVMgT0YgTUVSQ0hBTlRBQklMSVRZIEFORCBGSVRORVNTIEZPUiBBIFBBUlRJQ1VMQVIgUFVSUE9TRSBBUkUgRElTQ0xBSU1FRC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIENPUFlSSUdIVCBIT0xERVIgT1IgQ09OVFJJQlVUT1JTIEJFIExJQUJMRSBGT1IgQU5ZIERJUkVDVCwgSU5ESVJFQ1QsIElOQ0lERU5UQUwsIFNQRUNJQUwsIEVYRU1QTEFSWSwgT1IgQ09OU0VRVUVOVElBTCBEQU1BR0VTIChJTkNMVURJTkcsIEJVVCBOT1QgTElNSVRFRCBUTywgUFJPQ1VSRU1FTlQgT0YgU1VCU1RJVFVURSBHT09EUyBPUiBTRVJWSUNFUzsgTE9TUyBPRiBVU0UsIERBVEEsIE9SIFBST0ZJVFM7IE9SIEJVU0lORVNTIElOVEVSUlVQVElPTikgSE9XRVZFUiBDQVVTRUQgQU5EIE9OIEFOWSBUSEVPUlkgT0YgTElBQklMSVRZLCBXSEVUSEVSIElOIENPTlRSQUNULCBTVFJJQ1QgTElBQklMSVRZLCBPUiBUT1JUIChJTkNMVURJTkcgTkVHTElHRU5DRSBPUiBPVEhFUldJU0UpIEFSSVNJTkcgSU4gQU5ZIFdBWSBPVVQgT0YgVEhFIFVTRSBPRiBUSElTIFNPRlRXQVJFLCBFVkVOIElGIEFEVklTRUQgT0YgVEhFIFBPU1NJQklMSVRZIE9GIFNVQ0ggREFNQUdFLg==" + }, + "url": "https://opensource.org/licenses/BSD-3-Clause" + } + } + ], + "version": "1.2.3", + "purl": "pkg:npm/graceful-fs@1.2.3", + "bom-ref": "graceful-fs_1.2.3_8f3ca25f-41a1-4e2f-b557-83cf223b45c6", + "description": "A drop-in replacement for fs, making various improvements.", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "305" + } + ] + }, + { + "name": "has-ansi", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "2.0.0", + "purl": "pkg:npm/has-ansi@2.0.0", + "bom-ref": "has-ansi_2.0.0_ffd7f181-1cde-470a-aafd-7883276eeecc", + "description": "Check if a string has ANSI escape codes", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "312" + } + ] + }, + { + "name": "has-flag", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.0.0", + "purl": "pkg:npm/has-flag@1.0.0", + "bom-ref": "has-flag_1.0.0_146d6171-3b24-405c-a56a-49b4f83219b0", + "description": "Check if argv has a specific flag", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "313" + } + ] + }, + { + "name": "has-flag", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "3.0.0", + "purl": "pkg:npm/has-flag@3.0.0", + "bom-ref": "has-flag_3.0.0_f73fa0ac-0a26-4b7d-9e08-2415036a6773", + "description": "Check if argv has a specific flag", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "314" + } + ] + }, + { + "name": "hash.js", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.1.7", + "purl": "pkg:npm/hash.js@1.1.7", + "bom-ref": "hash.js_1.1.7_db3bebef-a349-4e35-8c90-2e022977699d", + "description": "Various hash functions that could be run by both browser and node", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "316" + } + ] + }, + { + "name": "hmac-drbg", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.0.1", + "purl": "pkg:npm/hmac-drbg@1.0.1", + "bom-ref": "hmac-drbg_1.0.1_7b99a17d-bda7-4563-8b4a-f74fec7f8eac", + "description": "Deterministic random bit generator (hmac)", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "319" + } + ] + }, + { + "name": "hooks-fixed", + "type": "library", + "version": "1.1.0", + "purl": "pkg:npm/hooks-fixed@1.1.0", + "bom-ref": "hooks-fixed_1.1.0_96ddc872-fd1c-436b-a7e9-bd87310ff931", + "description": "Adds pre and post hook functionality to your JavaScript methods.", + "copyright": "", + "properties": [ + { + "name": "component_id", + "value": "322" + } + ] + }, + { + "name": "htmlescape", + "type": "library", + "licenses": [ + { + "license": { + "id": "MIT", + "text": { + "contentType": "text/plain", + "encoding": "base64", + "content": "TUlUIExpY2Vuc2UKCkNvcHlyaWdodCAoYykgPHllYXI+IDxjb3B5cmlnaHQgaG9sZGVycz4KClBlcm1pc3Npb24gaXMgaGVyZWJ5IGdyYW50ZWQsIGZyZWUgb2YgY2hhcmdlLCB0byBhbnkgcGVyc29uIG9idGFpbmluZyBhIGNvcHkgb2YgdGhpcyBzb2Z0d2FyZSBhbmQgYXNzb2NpYXRlZCBkb2N1bWVudGF0aW9uIGZpbGVzICh0aGUgIlNvZnR3YXJlIiksIHRvIGRlYWwgaW4gdGhlIFNvZnR3YXJlIHdpdGhvdXQgcmVzdHJpY3Rpb24sIGluY2x1ZGluZyB3aXRob3V0IGxpbWl0YXRpb24gdGhlIHJpZ2h0cyB0byB1c2UsIGNvcHksIG1vZGlmeSwgbWVyZ2UsIHB1Ymxpc2gsIGRpc3RyaWJ1dGUsIHN1YmxpY2Vuc2UsIGFuZC9vciBzZWxsIGNvcGllcyBvZiB0aGUgU29mdHdhcmUsIGFuZCB0byBwZXJtaXQgcGVyc29ucyB0byB3aG9tIHRoZSBTb2Z0d2FyZSBpcyBmdXJuaXNoZWQgdG8gZG8gc28sIHN1YmplY3QgdG8gdGhlIGZvbGxvd2luZyBjb25kaXRpb25zOgoKVGhlIGFib3ZlIGNvcHlyaWdodCBub3RpY2UgYW5kIHRoaXMgcGVybWlzc2lvbiBub3RpY2Ugc2hhbGwgYmUgaW5jbHVkZWQgaW4gYWxsIGNvcGllcyBvciBzdWJzdGFudGlhbCBwb3J0aW9ucyBvZiB0aGUgU29mdHdhcmUuCgpUSEUgU09GVFdBUkUgSVMgUFJPVklERUQgIkFTIElTIiwgV0lUSE9VVCBXQVJSQU5UWSBPRiBBTlkgS0lORCwgRVhQUkVTUyBPUiBJTVBMSUVELCBJTkNMVURJTkcgQlVUIE5PVCBMSU1JVEVEIFRPIFRIRSBXQVJSQU5USUVTIE9GIE1FUkNIQU5UQUJJTElUWSwgRklUTkVTUyBGT1IgQSBQQVJUSUNVTEFSIFBVUlBPU0UgQU5EIE5PTklORlJJTkdFTUVOVC4gSU4gTk8gRVZFTlQgU0hBTEwgVEhFIEFVVEhPUlMgT1IgQ09QWVJJR0hUIEhPTERFUlMgQkUgTElBQkxFIEZPUiBBTlkgQ0xBSU0sIERBTUFHRVMgT1IgT1RIRVIgTElBQklMSVRZLCBXSEVUSEVSIElOIEFOIEFDVElPTiBPRiBDT05UUkFDVCwgVE9SVCBPUiBPVEhFUldJU0UsIEFSSVNJTkcgRlJPTSwgT1VUIE9GIE9SIElOIENPTk5FQ1RJT04gV0lUSCBUSEUgU09GVFdBUkUgT1IgVEhFIFVTRSBPUiBPVEhFUiBERUFMSU5HUyBJTiBUSEUgU09GVFdBUkUu" + }, + "url": "https://opensource.org/licenses/MIT" + } + } + ], + "version": "1.1.1", + "purl": "pkg:npm/htmlescape@1.1.1", + "bom-ref": "htmlescape_1.1.1_0783ece3-96b0-43e2-ae11-9984a03d92a4", + "description": "Properly escape JSON for usage as an object literal inside of a `