Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:apk/alpine/curl@7.55.0-r0?arch=riscv64&distroversion=v3.22&reponame=main
Typeapk
Namespacealpine
Namecurl
Version7.55.0-r0
Qualifiers
arch riscv64
distroversion v3.22
reponame main
Subpath
Is_vulnerablefalse
Next_non_vulnerable_version7.56.1-r0
Latest_non_vulnerable_version8.14.1-r2
Affected_by_vulnerabilities
Fixing_vulnerabilities
0
url VCID-5svr-3vv9-mqea
vulnerability_id VCID-5svr-3vv9-mqea
summary When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The endto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. Limit curl's redirect protocols with --proto-redir and libcurl's with CURLOPT_REDIR_PROTOCOLS.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-1000100.json
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-1000100.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2017-1000100
reference_id
reference_type
scores
0
value 0.00618
scoring_system epss
scoring_elements 0.70384
published_at 2026-06-05T12:55:00Z
1
value 0.00618
scoring_system epss
scoring_elements 0.70342
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2017-1000100
2
reference_url https://curl.se/docs/CVE-2017-1000100.html
reference_id
reference_type
scores
0
value High
scoring_system cvssv3.1
scoring_elements
url https://curl.se/docs/CVE-2017-1000100.html
3
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000100
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000100
4
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000101
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000101
5
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000254
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000254
6
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 1.5
scoring_system cvssv2
scoring_elements AV:L/AC:M/Au:S/C:P/I:N/A:N
1
value 3.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
7
reference_url http://www.securityfocus.com/bid/100286
reference_id 100286
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-16T13:34:47Z/
url http://www.securityfocus.com/bid/100286
8
reference_url http://www.securitytracker.com/id/1039118
reference_id 1039118
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-16T13:34:47Z/
url http://www.securitytracker.com/id/1039118
9
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1478310
reference_id 1478310
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1478310
10
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871555
reference_id 871555
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871555
11
reference_url https://curl.haxx.se/docs/adv_20170809B.html
reference_id adv_20170809B.html
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-16T13:34:47Z/
url https://curl.haxx.se/docs/adv_20170809B.html
12
reference_url https://security.archlinux.org/ASA-201708-16
reference_id ASA-201708-16
reference_type
scores
url https://security.archlinux.org/ASA-201708-16
13
reference_url https://security.archlinux.org/ASA-201710-3
reference_id ASA-201710-3
reference_type
scores
url https://security.archlinux.org/ASA-201710-3
14
reference_url https://security.archlinux.org/ASA-201710-4
reference_id ASA-201710-4
reference_type
scores
url https://security.archlinux.org/ASA-201710-4
15
reference_url https://security.archlinux.org/ASA-201710-5
reference_id ASA-201710-5
reference_type
scores
url https://security.archlinux.org/ASA-201710-5
16
reference_url https://security.archlinux.org/ASA-201710-6
reference_id ASA-201710-6
reference_type
scores
url https://security.archlinux.org/ASA-201710-6
17
reference_url https://security.archlinux.org/ASA-201710-7
reference_id ASA-201710-7
reference_type
scores
url https://security.archlinux.org/ASA-201710-7
18
reference_url https://security.archlinux.org/AVG-370
reference_id AVG-370
reference_type
scores
0
value Medium
scoring_system archlinux
scoring_elements
url https://security.archlinux.org/AVG-370
19
reference_url https://security.archlinux.org/AVG-371
reference_id AVG-371
reference_type
scores
0
value Medium
scoring_system archlinux
scoring_elements
url https://security.archlinux.org/AVG-371
20
reference_url https://security.archlinux.org/AVG-386
reference_id AVG-386
reference_type
scores
0
value Medium
scoring_system archlinux
scoring_elements
url https://security.archlinux.org/AVG-386
21
reference_url https://security.archlinux.org/AVG-387
reference_id AVG-387
reference_type
scores
0
value Medium
scoring_system archlinux
scoring_elements
url https://security.archlinux.org/AVG-387
22
reference_url https://security.archlinux.org/AVG-388
reference_id AVG-388
reference_type
scores
0
value Medium
scoring_system archlinux
scoring_elements
url https://security.archlinux.org/AVG-388
23
reference_url https://security.archlinux.org/AVG-389
reference_id AVG-389
reference_type
scores
0
value Medium
scoring_system archlinux
scoring_elements
url https://security.archlinux.org/AVG-389
24
reference_url http://www.debian.org/security/2017/dsa-3992
reference_id dsa-3992
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-16T13:34:47Z/
url http://www.debian.org/security/2017/dsa-3992
25
reference_url https://security.gentoo.org/glsa/201709-14
reference_id GLSA-201709-14
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-16T13:34:47Z/
url https://security.gentoo.org/glsa/201709-14
26
reference_url https://support.apple.com/HT208221
reference_id HT208221
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-16T13:34:47Z/
url https://support.apple.com/HT208221
27
reference_url https://usn.ubuntu.com/3441-1/
reference_id USN-3441-1
reference_type
scores
url https://usn.ubuntu.com/3441-1/
28
reference_url https://usn.ubuntu.com/3441-2/
reference_id USN-3441-2
reference_type
scores
url https://usn.ubuntu.com/3441-2/
fixed_packages
0
url pkg:apk/alpine/curl@7.55.0-r0?arch=riscv64&distroversion=v3.22&reponame=main
purl pkg:apk/alpine/curl@7.55.0-r0?arch=riscv64&distroversion=v3.22&reponame=main
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/curl@7.55.0-r0%3Farch=riscv64&distroversion=v3.22&reponame=main
aliases CVE-2017-1000100
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-5svr-3vv9-mqea
1
url VCID-mh96-gkf1-9uek
vulnerability_id VCID-mh96-gkf1-9uek
summary curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be `http://ur%20[0-60000000000000000000`.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-1000101.json
reference_id
reference_type
scores
0
value 4.2
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-1000101.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2017-1000101
reference_id
reference_type
scores
0
value 0.00655
scoring_system epss
scoring_elements 0.7133
published_at 2026-06-04T12:55:00Z
1
value 0.00655
scoring_system epss
scoring_elements 0.71375
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2017-1000101
2
reference_url https://curl.se/docs/CVE-2017-1000101.html
reference_id
reference_type
scores
0
value Medium
scoring_system cvssv3.1
scoring_elements
url https://curl.se/docs/CVE-2017-1000101.html
3
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000100
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000100
4
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000101
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000101
5
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000254
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000254
6
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 6.4
scoring_system cvssv2
scoring_elements AV:N/AC:L/Au:N/C:P/I:N/A:P
1
value 6.5
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
7
reference_url http://www.securityfocus.com/bid/100249
reference_id 100249
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-16T13:45:32Z/
url http://www.securityfocus.com/bid/100249
8
reference_url http://www.securitytracker.com/id/1039117
reference_id 1039117
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-16T13:45:32Z/
url http://www.securitytracker.com/id/1039117
9
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1478309
reference_id 1478309
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1478309
10
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871554
reference_id 871554
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871554
11
reference_url https://curl.haxx.se/docs/adv_20170809A.html
reference_id adv_20170809A.html
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-16T13:45:32Z/
url https://curl.haxx.se/docs/adv_20170809A.html
12
reference_url https://security.archlinux.org/ASA-201708-16
reference_id ASA-201708-16
reference_type
scores
url https://security.archlinux.org/ASA-201708-16
13
reference_url https://security.archlinux.org/AVG-370
reference_id AVG-370
reference_type
scores
0
value Medium
scoring_system archlinux
scoring_elements
url https://security.archlinux.org/AVG-370
14
reference_url http://www.debian.org/security/2017/dsa-3992
reference_id dsa-3992
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-16T13:45:32Z/
url http://www.debian.org/security/2017/dsa-3992
15
reference_url https://security.gentoo.org/glsa/201709-14
reference_id GLSA-201709-14
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-16T13:45:32Z/
url https://security.gentoo.org/glsa/201709-14
16
reference_url https://support.apple.com/HT208221
reference_id HT208221
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-16T13:45:32Z/
url https://support.apple.com/HT208221
17
reference_url https://usn.ubuntu.com/3441-1/
reference_id USN-3441-1
reference_type
scores
url https://usn.ubuntu.com/3441-1/
fixed_packages
0
url pkg:apk/alpine/curl@7.55.0-r0?arch=riscv64&distroversion=v3.22&reponame=main
purl pkg:apk/alpine/curl@7.55.0-r0?arch=riscv64&distroversion=v3.22&reponame=main
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/curl@7.55.0-r0%3Farch=riscv64&distroversion=v3.22&reponame=main
aliases CVE-2017-1000101
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-mh96-gkf1-9uek
2
url VCID-u3au-c4x8-m7hc
vulnerability_id VCID-u3au-c4x8-m7hc
summary When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HTTP-like headers. The code doing this would send the wrong buffer to the user (stdout or the application's provide callback), which could lead to other private data from the heap to get inadvertently displayed. The wrong buffer was an uninitialized memory area allocated on the heap and if it turned out to not contain any zero byte, it would continue and display the data following that buffer in memory.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-1000099.json
reference_id
reference_type
scores
0
value 4.7
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-1000099.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2017-1000099
reference_id
reference_type
scores
0
value 0.00623
scoring_system epss
scoring_elements 0.70512
published_at 2026-06-04T12:55:00Z
1
value 0.00623
scoring_system epss
scoring_elements 0.70554
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2017-1000099
2
reference_url https://curl.se/docs/CVE-2017-1000099.html
reference_id
reference_type
scores
0
value Medium
scoring_system cvssv3.1
scoring_elements
url https://curl.se/docs/CVE-2017-1000099.html
3
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1478316
reference_id 1478316
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1478316
4
reference_url https://security.archlinux.org/ASA-201708-16
reference_id ASA-201708-16
reference_type
scores
url https://security.archlinux.org/ASA-201708-16
5
reference_url https://security.archlinux.org/ASA-201710-3
reference_id ASA-201710-3
reference_type
scores
url https://security.archlinux.org/ASA-201710-3
6
reference_url https://security.archlinux.org/ASA-201710-4
reference_id ASA-201710-4
reference_type
scores
url https://security.archlinux.org/ASA-201710-4
7
reference_url https://security.archlinux.org/ASA-201710-5
reference_id ASA-201710-5
reference_type
scores
url https://security.archlinux.org/ASA-201710-5
8
reference_url https://security.archlinux.org/ASA-201710-6
reference_id ASA-201710-6
reference_type
scores
url https://security.archlinux.org/ASA-201710-6
9
reference_url https://security.archlinux.org/ASA-201710-7
reference_id ASA-201710-7
reference_type
scores
url https://security.archlinux.org/ASA-201710-7
10
reference_url https://security.archlinux.org/AVG-370
reference_id AVG-370
reference_type
scores
0
value Medium
scoring_system archlinux
scoring_elements
url https://security.archlinux.org/AVG-370
11
reference_url https://security.archlinux.org/AVG-371
reference_id AVG-371
reference_type
scores
0
value Medium
scoring_system archlinux
scoring_elements
url https://security.archlinux.org/AVG-371
12
reference_url https://security.archlinux.org/AVG-386
reference_id AVG-386
reference_type
scores
0
value Medium
scoring_system archlinux
scoring_elements
url https://security.archlinux.org/AVG-386
13
reference_url https://security.archlinux.org/AVG-387
reference_id AVG-387
reference_type
scores
0
value Medium
scoring_system archlinux
scoring_elements
url https://security.archlinux.org/AVG-387
14
reference_url https://security.archlinux.org/AVG-388
reference_id AVG-388
reference_type
scores
0
value Medium
scoring_system archlinux
scoring_elements
url https://security.archlinux.org/AVG-388
15
reference_url https://security.archlinux.org/AVG-389
reference_id AVG-389
reference_type
scores
0
value Medium
scoring_system archlinux
scoring_elements
url https://security.archlinux.org/AVG-389
16
reference_url https://security.gentoo.org/glsa/201709-14
reference_id GLSA-201709-14
reference_type
scores
url https://security.gentoo.org/glsa/201709-14
fixed_packages
0
url pkg:apk/alpine/curl@7.55.0-r0?arch=riscv64&distroversion=v3.22&reponame=main
purl pkg:apk/alpine/curl@7.55.0-r0?arch=riscv64&distroversion=v3.22&reponame=main
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:apk/alpine/curl@7.55.0-r0%3Farch=riscv64&distroversion=v3.22&reponame=main
aliases CVE-2017-1000099
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-u3au-c4x8-m7hc
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:apk/alpine/curl@7.55.0-r0%3Farch=riscv64&distroversion=v3.22&reponame=main