Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/57394?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/57394?format=api", "purl": "pkg:maven/org.apache.spark/spark-core@2.3.2", "type": "maven", "namespace": "org.apache.spark", "name": "spark-core", "version": "2.3.2", "qualifiers": {}, "subpath": "", "is_vulnerable": false, "next_non_vulnerable_version": "3.4.0", "latest_non_vulnerable_version": "3.4.0", "affected_by_vulnerabilities": [], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/35317?format=api", "vulnerability_id": "VCID-mmf5-ctmn-b3ep", "summary": "When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1.", "references": [ { "reference_url": "https://github.com/advisories/GHSA-fvxv-9xxr-h7wj", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-fvxv-9xxr-h7wj" }, { "reference_url": "https://github.com/apache/spark", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/apache/spark" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2019-169.yaml", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2019-169.yaml" }, { "reference_url": "https://lists.apache.org/thread.html/6d015e56b3a3da968f86e0b6acc69f17ecc16b499389e12d8255bf6e@%3Ccommits.spark.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.apache.org/thread.html/6d015e56b3a3da968f86e0b6acc69f17ecc16b499389e12d8255bf6e@%3Ccommits.spark.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/a86ee93d07b6f61b82b61a28049aed311f5cc9420d26cc95f1a9de7b@%3Cuser.spark.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.apache.org/thread.html/a86ee93d07b6f61b82b61a28049aed311f5cc9420d26cc95f1a9de7b@%3Cuser.spark.apache.org%3E" }, { "reference_url": "https://web.archive.org/web/20200227091119/http://www.securityfocus.com/bid/106786", "reference_id": "", "reference_type": "", "scores": [], "url": "https://web.archive.org/web/20200227091119/http://www.securityfocus.com/bid/106786" }, { "reference_url": "https://web.archive.org/web/20200925111106/https://issues.apache.org/jira/browse/SPARK-26802", "reference_id": "", "reference_type": "", "scores": [], "url": "https://web.archive.org/web/20200925111106/https://issues.apache.org/jira/browse/SPARK-26802" }, { "reference_url": "http://www.securityfocus.com/bid/106786", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.securityfocus.com/bid/106786" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11760", "reference_id": "CVE-2018-11760", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11760" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/57394?format=api", "purl": "pkg:maven/org.apache.spark/spark-core@2.3.2", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.spark/spark-core@2.3.2" } ], "aliases": [ "CVE-2018-11760", "GHSA-fvxv-9xxr-h7wj", "PYSEC-2019-169" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-mmf5-ctmn-b3ep" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/35395?format=api", "vulnerability_id": "VCID-ntyz-qt6e-vqf3", "summary": "Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.", "references": [ { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2019-114.yaml", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2019-114.yaml" }, { "reference_url": "https://lists.apache.org/thread.html/c2a39c207421797f82823a8aff488dcd332d9544038307bf69a2ba9e@%3Cuser.spark.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.apache.org/thread.html/c2a39c207421797f82823a8aff488dcd332d9544038307bf69a2ba9e@%3Cuser.spark.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/ra216b7b0dd82a2c12c2df9d6095e689eb3f3d28164e6b6587da69fae@%3Ccommits.spark.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.apache.org/thread.html/ra216b7b0dd82a2c12c2df9d6095e689eb3f3d28164e6b6587da69fae@%3Ccommits.spark.apache.org%3E" }, { "reference_url": "https://lists.apache.org/thread.html/rabe1d47e2bf8b8f6d9f3068c8d2679731d57fa73b3a7ed1fa82406d2@%3Cissues.spark.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.apache.org/thread.html/rabe1d47e2bf8b8f6d9f3068c8d2679731d57fa73b3a7ed1fa82406d2@%3Cissues.spark.apache.org%3E" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10099", "reference_id": "CVE-2019-10099", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10099" }, { "reference_url": "https://github.com/advisories/GHSA-fp5j-3fpf-mhj5", "reference_id": "GHSA-fp5j-3fpf-mhj5", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-fp5j-3fpf-mhj5" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/57394?format=api", "purl": "pkg:maven/org.apache.spark/spark-core@2.3.2", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.spark/spark-core@2.3.2" } ], "aliases": [ "CVE-2019-10099", "GHSA-fp5j-3fpf-mhj5", "PYSEC-2019-114" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ntyz-qt6e-vqf3" } ], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.spark/spark-core@2.3.2" }