Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/63689?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/63689?format=api", "purl": "pkg:gem/commonmarker@0.23.7", "type": "gem", "namespace": "", "name": "commonmarker", "version": "0.23.7", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "0.23.10", "latest_non_vulnerable_version": "1.0.0.pre", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/45800?format=api", "vulnerability_id": "VCID-9q5d-95ws-2uhh", "summary": "Several quadratic complexity bugs may lead to denial of service in Commonmarker\n## Impact\n\nSeveral quadratic complexity bugs in commonmarker's underlying [`cmark-gfm`](https://github.com/github/cmark-gfm) library may lead to unbounded resource exhaustion and subsequent denial of service.\n\nThe following vulnerabilities were addressed:\n\n* [CVE-2023-37463](https://github.com/github/cmark-gfm/security/advisories/GHSA-w4qg-3vf7-m9x5)\n\nFor more information, consult the release notes for version [`0.29.0.gfm.12`](https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.12).\n\n## Mitigation\n\nUsers are advised to upgrade to commonmarker version [`0.23.10`](https://rubygems.org/gems/commonmarker/versions/0.23.10).", "references": [ { "reference_url": "https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.12", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.12" }, { "reference_url": "https://github.com/gjtorikian/commonmarker", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/gjtorikian/commonmarker" }, { "reference_url": "https://github.com/gjtorikian/commonmarker/commit/db8cd377b54541f7fd484d168b7682a282a680f7", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/gjtorikian/commonmarker/commit/db8cd377b54541f7fd484d168b7682a282a680f7" }, { "reference_url": "https://rubygems.org/gems/commonmarker/versions/0.23.10", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://rubygems.org/gems/commonmarker/versions/0.23.10" }, { "reference_url": "https://github.com/advisories/GHSA-7vh7-fw88-wj87", "reference_id": "GHSA-7vh7-fw88-wj87", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-7vh7-fw88-wj87" }, { "reference_url": "https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-7vh7-fw88-wj87", "reference_id": "GHSA-7vh7-fw88-wj87", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-7vh7-fw88-wj87" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/66478?format=api", "purl": "pkg:gem/commonmarker@0.23.10", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/commonmarker@0.23.10" } ], "aliases": [ "GHSA-7vh7-fw88-wj87", "GMS-2023-1914" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9q5d-95ws-2uhh" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/44895?format=api", "vulnerability_id": "VCID-mypd-qfsc-53g3", "summary": "Commonmarker vulnerable to to several quadratic complexity bugs that may lead to denial of service\nSeveral quadratic complexity bugs in commonmarker's underlying cmark-gfm library may lead to unbounded resource exhaustion and subsequent denial of service.", "references": [ { "reference_url": "https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.10", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.10" }, { "reference_url": "https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.11", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.11" }, { "reference_url": "https://github.com/gjtorikian/commonmarker", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/gjtorikian/commonmarker" }, { "reference_url": "https://github.com/gjtorikian/commonmarker/pull/236", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/gjtorikian/commonmarker/pull/236" }, { "reference_url": "https://github.com/gjtorikian/commonmarker/releases/tag/v0.23.9", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/gjtorikian/commonmarker/releases/tag/v0.23.9" }, { "reference_url": "https://github.com/advisories/GHSA-48wp-p9qv-4j64", "reference_id": "GHSA-48wp-p9qv-4j64", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-48wp-p9qv-4j64" }, { "reference_url": "https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-48wp-p9qv-4j64", "reference_id": "GHSA-48wp-p9qv-4j64", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-48wp-p9qv-4j64" }, { "reference_url": "https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh", "reference_id": "GHSA-66g8-4hjf-77xh", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh" }, { "reference_url": "https://github.com/github/cmark-gfm/security/advisories/GHSA-r8vr-c48j-fcc5", "reference_id": "GHSA-r8vr-c48j-fcc5", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/github/cmark-gfm/security/advisories/GHSA-r8vr-c48j-fcc5" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/64573?format=api", "purl": "pkg:gem/commonmarker@0.23.9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-9q5d-95ws-2uhh" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/commonmarker@0.23.9" }, { "url": "http://public2.vulnerablecode.io/api/packages/166769?format=api", "purl": "pkg:gem/commonmarker@1.0.0.pre", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/commonmarker@1.0.0.pre" } ], "aliases": [ "GHSA-48wp-p9qv-4j64", "GMS-2023-1110" ], "risk_score": 3.4, "exploitability": "0.5", "weighted_severity": "6.8", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-mypd-qfsc-53g3" } ], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/44265?format=api", "vulnerability_id": "VCID-ryey-1gks-fydw", "summary": "Several quadratic complexity bugs may lead to denial of service in Commonmarker\n## Impact\n\nSeveral quadratic complexity bugs in commonmarker's underlying [`cmark-gfm`](https://github.com/github/cmark-gfm) library may lead to unbounded resource exhaustion and subsequent denial of service.\n\nThe following vulnerabilities were addressed:\n\n* [CVE-2023-22483](https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c)\n* [CVE-2023-22484](https://github.com/github/cmark-gfm/security/advisories/GHSA-24f7-9frr-5h2r)\n* [CVE-2023-22485](https://github.com/github/cmark-gfm/security/advisories/GHSA-c944-cv5f-hpvr)\n* [CVE-2023-22486](https://github.com/github/cmark-gfm/security/advisories/GHSA-r572-jvj2-3m8p)\n\nFor more information, consult the release notes for version [`0.23.0.gfm.7`](https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.7).\n\n## Mitigation\n\nUsers are advised to upgrade to commonmarker version [`0.23.7`](https://rubygems.org/gems/commonmarker/versions/0.23.7).", "references": [ { "reference_url": "https://github.com/gjtorikian/commonmarker", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/gjtorikian/commonmarker" }, { "reference_url": "https://github.com/advisories/GHSA-636f-xm5j-pj9m", "reference_id": "GHSA-636f-xm5j-pj9m", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-636f-xm5j-pj9m" }, { "reference_url": "https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-636f-xm5j-pj9m", "reference_id": "GHSA-636f-xm5j-pj9m", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-636f-xm5j-pj9m" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/63689?format=api", "purl": "pkg:gem/commonmarker@0.23.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-9q5d-95ws-2uhh" }, { "vulnerability": "VCID-mypd-qfsc-53g3" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/commonmarker@0.23.7" }, { "url": "http://public2.vulnerablecode.io/api/packages/166769?format=api", "purl": "pkg:gem/commonmarker@1.0.0.pre", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/commonmarker@1.0.0.pre" } ], "aliases": [ "GHSA-636f-xm5j-pj9m", "GMS-2023-123" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ryey-1gks-fydw" } ], "risk_score": "3.4", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/commonmarker@0.23.7" }