Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/69374?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/69374?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@8.5.99", "type": "maven", "namespace": "org.apache.tomcat", "name": "tomcat-websocket", "version": "8.5.99", "qualifiers": {}, "subpath": "", "is_vulnerable": false, "next_non_vulnerable_version": "9.0.86", "latest_non_vulnerable_version": "11.0.0-M17", "affected_by_vulnerabilities": [], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/47246?format=api", "vulnerability_id": "VCID-uuya-uqgv-kyfb", "summary": "Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.", "references": [ { "reference_url": "https://github.com/apache/tomcat", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/apache/tomcat" }, { "reference_url": "https://github.com/apache/tomcat/commit/0052b374684b613b0c849899b325ebe334ac6501", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/apache/tomcat/commit/0052b374684b613b0c849899b325ebe334ac6501" }, { "reference_url": "https://github.com/apache/tomcat/commit/3631adb1342d8bbd8598802a12b63ad02c37d591", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/apache/tomcat/commit/3631adb1342d8bbd8598802a12b63ad02c37d591" }, { "reference_url": "https://github.com/apache/tomcat/commit/52d6650e062d880704898d7d8c1b2b7a3efe8068", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/apache/tomcat/commit/52d6650e062d880704898d7d8c1b2b7a3efe8068" }, { "reference_url": "https://github.com/apache/tomcat/commit/b0e3b1bd78de270d53e319d7cb79eb282aa53cb9", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/apache/tomcat/commit/b0e3b1bd78de270d53e319d7cb79eb282aa53cb9" }, { "reference_url": "https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55" }, { "reference_url": "https://security.netapp.com/advisory/ntap-20240402-0002", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.netapp.com/advisory/ntap-20240402-0002" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23672", "reference_id": "CVE-2024-23672", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23672" }, { "reference_url": "https://github.com/advisories/GHSA-v682-8vv8-vpwr", "reference_id": "GHSA-v682-8vv8-vpwr", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-v682-8vv8-vpwr" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/69374?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@8.5.99", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat-websocket@8.5.99" }, { "url": "http://public2.vulnerablecode.io/api/packages/69373?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@9.0.86", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat-websocket@9.0.86" }, { "url": "http://public2.vulnerablecode.io/api/packages/69372?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.19", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat-websocket@10.1.19" }, { "url": "http://public2.vulnerablecode.io/api/packages/69371?format=api", "purl": "pkg:maven/org.apache.tomcat/tomcat-websocket@11.0.0-M17", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat-websocket@11.0.0-M17" } ], "aliases": [ "CVE-2024-23672", "GHSA-v682-8vv8-vpwr" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-uuya-uqgv-kyfb" } ], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat-websocket@8.5.99" }