Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/21608?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/21608?format=api", "purl": "pkg:pypi/salt@3003rc1", "type": "pypi", "namespace": "", "name": "salt", "version": "3003rc1", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "3005.2", "latest_non_vulnerable_version": "3007.9", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/35861?format=api", "vulnerability_id": "VCID-47u4-vdsp-c3ct", "summary": "An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a minion config file at C:\\salt\\conf if that file is in place before the installer is run. This allows for a malicious actor to subvert the proper behaviour of the given minion software.", "references": [ { "reference_url": "https://github.com/advisories/GHSA-xf37-qcvf-7m57", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-xf37-qcvf-7m57" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BUWUF5VTENNP2ZYZBVFKPSUHLKLUBD5/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BUWUF5VTENNP2ZYZBVFKPSUHLKLUBD5/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ACVT7M4YLZRLWWQ6SGRK3C6TOF4FXOXT/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ACVT7M4YLZRLWWQ6SGRK3C6TOF4FXOXT/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MBAHHSGZLEJRCG4DX6J4RBWJAAWH55RQ/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MBAHHSGZLEJRCG4DX6J4RBWJAAWH55RQ/" }, { "reference_url": "https://saltproject.io/security_announcements/salt-security-advisory-2021-sep-02/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://saltproject.io/security_announcements/salt-security-advisory-2021-sep-02/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/23508?format=api", "purl": "pkg:pypi/salt@3003.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-ce2x-ehyk-nufk" }, { "vulnerability": "VCID-nehw-r7zm-j7bb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3003.3" } ], "aliases": [ "CVE-2021-22004", "GHSA-xf37-qcvf-7m57", "PYSEC-2021-346" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-47u4-vdsp-c3ct" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/35860?format=api", "vulnerability_id": "VCID-a8kw-uehx-xfg5", "summary": "An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion.", "references": [ { "reference_url": "https://github.com/advisories/GHSA-pf7h-h2wq-m7pg", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-pf7h-h2wq-m7pg" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2021-318.yaml", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2021-318.yaml" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00017.html", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00017.html" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00019.html", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00019.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BUWUF5VTENNP2ZYZBVFKPSUHLKLUBD5/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6BUWUF5VTENNP2ZYZBVFKPSUHLKLUBD5/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ACVT7M4YLZRLWWQ6SGRK3C6TOF4FXOXT/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ACVT7M4YLZRLWWQ6SGRK3C6TOF4FXOXT/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MBAHHSGZLEJRCG4DX6J4RBWJAAWH55RQ/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MBAHHSGZLEJRCG4DX6J4RBWJAAWH55RQ/" }, { "reference_url": "https://saltproject.io/security_announcements/salt-security-advisory-2021-sep-02/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://saltproject.io/security_announcements/salt-security-advisory-2021-sep-02/" }, { "reference_url": "https://www.debian.org/security/2021/dsa-5011", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.debian.org/security/2021/dsa-5011" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21996", "reference_id": "CVE-2021-21996", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21996" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/23508?format=api", "purl": "pkg:pypi/salt@3003.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-ce2x-ehyk-nufk" }, { "vulnerability": "VCID-nehw-r7zm-j7bb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3003.3" } ], "aliases": [ "CVE-2021-21996", "GHSA-pf7h-h2wq-m7pg", "PYSEC-2021-318" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-a8kw-uehx-xfg5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/36542?format=api", "vulnerability_id": "VCID-ce2x-ehyk-nufk", "summary": "Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data disclosure, wrongful executions, data corruption and/or crash.", "references": [ { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2023-169.yaml", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2023-169.yaml" }, { "reference_url": "https://github.com/saltstack/salt", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/saltstack/salt" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OMWJIHQZXHK6FH2E3IWAZCYIRI7FLVOL", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OMWJIHQZXHK6FH2E3IWAZCYIRI7FLVOL" }, { "reference_url": "https://saltproject.io/security-announcements/2023-08-10-advisory", "reference_id": "", "reference_type": "", "scores": [], "url": "https://saltproject.io/security-announcements/2023-08-10-advisory" }, { "reference_url": "https://saltproject.io/security-announcements/2023-08-10-advisory/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H" } ], "url": "https://saltproject.io/security-announcements/2023-08-10-advisory/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20898", "reference_id": "CVE-2023-20898", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20898" }, { "reference_url": "https://github.com/advisories/GHSA-qvh6-3j7x-3hq7", "reference_id": "GHSA-qvh6-3j7x-3hq7", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-qvh6-3j7x-3hq7" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/35633?format=api", "purl": "pkg:pypi/salt@3005.2", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3005.2" }, { "url": "http://public2.vulnerablecode.io/api/packages/35632?format=api", "purl": "pkg:pypi/salt@3006.2", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.2" } ], "aliases": [ "CVE-2023-20898", "GHSA-qvh6-3j7x-3hq7", "PYSEC-2023-169" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ce2x-ehyk-nufk" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/36541?format=api", "vulnerability_id": "VCID-nehw-r7zm-j7bb", "summary": "Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted.", "references": [ { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2023-166.yaml", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/salt/PYSEC-2023-166.yaml" }, { "reference_url": "https://github.com/saltstack/salt", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/saltstack/salt" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OMWJIHQZXHK6FH2E3IWAZCYIRI7FLVOL", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OMWJIHQZXHK6FH2E3IWAZCYIRI7FLVOL" }, { "reference_url": "https://saltproject.io/security-announcements/2023-08-10-advisory", "reference_id": "", "reference_type": "", "scores": [], "url": "https://saltproject.io/security-announcements/2023-08-10-advisory" }, { "reference_url": "https://saltproject.io/security-announcements/2023-08-10-advisory/", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://saltproject.io/security-announcements/2023-08-10-advisory/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20897", "reference_id": "CVE-2023-20897", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20897" }, { "reference_url": "https://github.com/advisories/GHSA-vpjg-wmf8-29h9", "reference_id": "GHSA-vpjg-wmf8-29h9", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-vpjg-wmf8-29h9" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/35633?format=api", "purl": "pkg:pypi/salt@3005.2", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3005.2" }, { "url": "http://public2.vulnerablecode.io/api/packages/35632?format=api", "purl": "pkg:pypi/salt@3006.2", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3006.2" } ], "aliases": [ "CVE-2023-20897", "GHSA-vpjg-wmf8-29h9", "PYSEC-2023-166" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-nehw-r7zm-j7bb" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/36382?format=api", "vulnerability_id": "VCID-saff-gz5j-8kex", "summary": "Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/modules/status.py file.", "references": [ { "reference_url": "https://github.com/saltstack/salt/blob/master/salt/modules/status.py", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/saltstack/salt/blob/master/salt/modules/status.py" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33226", "reference_id": "CVE-2021-33226", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33226" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/23506?format=api", "purl": "pkg:pypi/salt@3003.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-47u4-vdsp-c3ct" }, { "vulnerability": "VCID-a8kw-uehx-xfg5" }, { "vulnerability": "VCID-ce2x-ehyk-nufk" }, { "vulnerability": "VCID-nehw-r7zm-j7bb" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3003.1" } ], "aliases": [ "CVE-2021-33226", "PYSEC-2023-47" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-saff-gz5j-8kex" } ], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/35783?format=api", "vulnerability_id": "VCID-48r4-3qds-bbhv", "summary": "In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).", "references": [ { "reference_url": "https://github.com/advisories/GHSA-hcjf-rp5h-g5h3", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-hcjf-rp5h-g5h3" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LDKMAJXYFHM4USVX3H5V2GCCBGASWUSM/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LDKMAJXYFHM4USVX3H5V2GCCBGASWUSM/" }, { "reference_url": "https://sec.stealthcopter.com/saltstack-snapper-minion-privledge-escaltion/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://sec.stealthcopter.com/saltstack-snapper-minion-privledge-escaltion/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/21608?format=api", "purl": "pkg:pypi/salt@3003rc1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-47u4-vdsp-c3ct" }, { "vulnerability": "VCID-a8kw-uehx-xfg5" }, { "vulnerability": "VCID-ce2x-ehyk-nufk" }, { "vulnerability": "VCID-nehw-r7zm-j7bb" }, { "vulnerability": "VCID-saff-gz5j-8kex" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3003rc1" } ], "aliases": [ "CVE-2021-31607", "GHSA-hcjf-rp5h-g5h3", "PYSEC-2021-56" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-48r4-3qds-bbhv" } ], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/salt@3003rc1" }