Package Instance

HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/packages/67250?format=api",
    "purl": "pkg:maven/org.apache.tomcat/coyote@10.1.14",
    "type": "maven",
    "namespace": "org.apache.tomcat",
    "name": "coyote",
    "version": "10.1.14",
    "qualifiers": {},
    "subpath": "",
    "is_vulnerable": true,
    "next_non_vulnerable_version": null,
    "latest_non_vulnerable_version": null,
    "affected_by_vulnerabilities": [
        {
            "url": "http://public2.vulnerablecode.io/api/vulnerabilities/46175?format=api",
            "vulnerability_id": "VCID-h6f2-qgnu-bqf4",
            "summary": "Apache Tomcat Improper Input Validation vulnerability\nImproper Input Validation vulnerability in Apache Tomcat.\n\nTomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single\nrequest as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.",
            "references": [
                {
                    "reference_url": "https://github.com/apache/tomcat",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/apache/tomcat"
                },
                {
                    "reference_url": "https://github.com/apache/tomcat/commit/59583245639d8c42ae0009f4a4a70464d3ea70a0",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/apache/tomcat/commit/59583245639d8c42ae0009f4a4a70464d3ea70a0"
                },
                {
                    "reference_url": "https://github.com/apache/tomcat/commit/8ecff306507be8e4fd3adee1ae5de1ea6661a8f4",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/apache/tomcat/commit/8ecff306507be8e4fd3adee1ae5de1ea6661a8f4"
                },
                {
                    "reference_url": "https://github.com/apache/tomcat/commit/c83fe47725f7ae9ae213568d9039171124fb7ec6",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/apache/tomcat/commit/c83fe47725f7ae9ae213568d9039171124fb7ec6"
                },
                {
                    "reference_url": "https://github.com/apache/tomcat/commit/eb5c094e5560764cda436362254997511a3ca1f6",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/apache/tomcat/commit/eb5c094e5560764cda436362254997511a3ca1f6"
                },
                {
                    "reference_url": "https://lists.apache.org/thread/2pv8yz1pyp088tsxfb7ogltk9msk0jdp",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://lists.apache.org/thread/2pv8yz1pyp088tsxfb7ogltk9msk0jdp"
                },
                {
                    "reference_url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html"
                },
                {
                    "reference_url": "https://security.netapp.com/advisory/ntap-20231103-0007",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://security.netapp.com/advisory/ntap-20231103-0007"
                },
                {
                    "reference_url": "https://www.debian.org/security/2023/dsa-5521",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://www.debian.org/security/2023/dsa-5521"
                },
                {
                    "reference_url": "https://www.debian.org/security/2023/dsa-5522",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://www.debian.org/security/2023/dsa-5522"
                },
                {
                    "reference_url": "http://www.openwall.com/lists/oss-security/2023/10/10/10",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "http://www.openwall.com/lists/oss-security/2023/10/10/10"
                },
                {
                    "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45648",
                    "reference_id": "CVE-2023-45648",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45648"
                },
                {
                    "reference_url": "https://github.com/advisories/GHSA-r6j3-px5g-cq3x",
                    "reference_id": "GHSA-r6j3-px5g-cq3x",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/advisories/GHSA-r6j3-px5g-cq3x"
                }
            ],
            "fixed_packages": [],
            "aliases": [
                "CVE-2023-45648",
                "GHSA-r6j3-px5g-cq3x"
            ],
            "risk_score": null,
            "exploitability": null,
            "weighted_severity": null,
            "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-h6f2-qgnu-bqf4"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/vulnerabilities/46176?format=api",
            "vulnerability_id": "VCID-jsyt-cmxf-gbh3",
            "summary": "Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could \ncause Tomcat to skip some parts of the recycling process leading to \ninformation leaking from the current request/response to the next.\n\nUsers are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.",
            "references": [
                {
                    "reference_url": "https://github.com/apache/tomcat",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/apache/tomcat"
                },
                {
                    "reference_url": "https://github.com/apache/tomcat/commit/30f8063d7a9b4c43ae4722f5e382a76af1d7a6bf",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/apache/tomcat/commit/30f8063d7a9b4c43ae4722f5e382a76af1d7a6bf"
                },
                {
                    "reference_url": "https://github.com/apache/tomcat/commit/44d05d75d696ca10ce251e4e370511e38f20ae75",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/apache/tomcat/commit/44d05d75d696ca10ce251e4e370511e38f20ae75"
                },
                {
                    "reference_url": "https://github.com/apache/tomcat/commit/9375d67106f8df9eb9d7b360b2bef052fe67d3d4",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/apache/tomcat/commit/9375d67106f8df9eb9d7b360b2bef052fe67d3d4"
                },
                {
                    "reference_url": "https://github.com/apache/tomcat/commit/d6db22e411307c97ddf78315c15d5889356eca38",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/apache/tomcat/commit/d6db22e411307c97ddf78315c15d5889356eca38"
                },
                {
                    "reference_url": "https://lists.apache.org/thread/065jfyo583490r9j2v73nhpyxdob56lw",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://lists.apache.org/thread/065jfyo583490r9j2v73nhpyxdob56lw"
                },
                {
                    "reference_url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html"
                },
                {
                    "reference_url": "https://security.netapp.com/advisory/ntap-20231103-0007",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://security.netapp.com/advisory/ntap-20231103-0007"
                },
                {
                    "reference_url": "https://www.debian.org/security/2023/dsa-5521",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://www.debian.org/security/2023/dsa-5521"
                },
                {
                    "reference_url": "https://www.debian.org/security/2023/dsa-5522",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://www.debian.org/security/2023/dsa-5522"
                },
                {
                    "reference_url": "http://www.openwall.com/lists/oss-security/2023/10/10/9",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "http://www.openwall.com/lists/oss-security/2023/10/10/9"
                },
                {
                    "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42795",
                    "reference_id": "CVE-2023-42795",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42795"
                },
                {
                    "reference_url": "https://github.com/advisories/GHSA-g8pj-r55q-5c2v",
                    "reference_id": "GHSA-g8pj-r55q-5c2v",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/advisories/GHSA-g8pj-r55q-5c2v"
                }
            ],
            "fixed_packages": [],
            "aliases": [
                "CVE-2023-42795",
                "GHSA-g8pj-r55q-5c2v"
            ],
            "risk_score": null,
            "exploitability": null,
            "weighted_severity": null,
            "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-jsyt-cmxf-gbh3"
        }
    ],
    "fixing_vulnerabilities": [],
    "risk_score": null,
    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/coyote@10.1.14"
}