Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/58893?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/58893?format=api", "purl": "pkg:maven/org.http4s/http4s-server_2.13@0.22.0", "type": "maven", "namespace": "org.http4s", "name": "http4s-server_2.13", "version": "0.22.0", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "0.22.3", "latest_non_vulnerable_version": "0.23.4", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/41494?format=api", "vulnerability_id": "VCID-1ykn-yyp7-wbgg", "summary": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')\nhttp4s is an open source scala interface for HTTP. Header values (`Header.value`), Status reason phrases (`Status.reason`), URI paths (`Uri.Path`), URI authority registered names (`URI.RegName`).", "references": [ { "reference_url": "https://github.com/http4s/http4s", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/http4s/http4s" }, { "reference_url": "https://github.com/http4s/http4s/commit/d02007db1da4f8f3df2dbf11f1db9ac7afc3f9d8", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/http4s/http4s/commit/d02007db1da4f8f3df2dbf11f1db9ac7afc3f9d8" }, { "reference_url": "https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#fields.values", "reference_id": "", "reference_type": "", "scores": [], "url": "https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#fields.values" }, { "reference_url": "https://owasp.org/www-community/attacks/HTTP_Response_Splitting", "reference_id": "", "reference_type": "", "scores": [], "url": "https://owasp.org/www-community/attacks/HTTP_Response_Splitting" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41084", "reference_id": "CVE-2021-41084", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41084" }, { "reference_url": "https://github.com/advisories/GHSA-5vcm-3xc3-w7x3", "reference_id": "GHSA-5vcm-3xc3-w7x3", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-5vcm-3xc3-w7x3" }, { "reference_url": "https://github.com/http4s/http4s/security/advisories/GHSA-5vcm-3xc3-w7x3", "reference_id": "GHSA-5vcm-3xc3-w7x3", "reference_type": "", "scores": [], "url": "https://github.com/http4s/http4s/security/advisories/GHSA-5vcm-3xc3-w7x3" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/59089?format=api", "purl": "pkg:maven/org.http4s/http4s-server_2.13@0.22.5", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.http4s/http4s-server_2.13@0.22.5" }, { "url": "http://public2.vulnerablecode.io/api/packages/59090?format=api", "purl": "pkg:maven/org.http4s/http4s-server_2.13@0.23.4", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.http4s/http4s-server_2.13@0.23.4" } ], "aliases": [ "CVE-2021-41084", "GHSA-5vcm-3xc3-w7x3" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-1ykn-yyp7-wbgg" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/41404?format=api", "vulnerability_id": "VCID-83r2-kxmr-zucc", "summary": "Origin Validation Error\nThe original `CORS` implementation and `CORSConfig` are deprecated.", "references": [ { "reference_url": "https://github.com/http4s/http4s", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/http4s/http4s" }, { "reference_url": "https://github.com/http4s/http4s/releases/tag/v0.23.2", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/http4s/http4s/releases/tag/v0.23.2" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39185", "reference_id": "CVE-2021-39185", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39185" }, { "reference_url": "https://github.com/advisories/GHSA-52cf-226f-rhr6", "reference_id": "GHSA-52cf-226f-rhr6", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-52cf-226f-rhr6" }, { "reference_url": "https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6", "reference_id": "GHSA-52cf-226f-rhr6", "reference_type": "", "scores": [], "url": "https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/58896?format=api", "purl": "pkg:maven/org.http4s/http4s-server_2.13@0.22.3", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.http4s/http4s-server_2.13@0.22.3" }, { "url": "http://public2.vulnerablecode.io/api/packages/58897?format=api", "purl": "pkg:maven/org.http4s/http4s-server_2.13@0.23.2", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.http4s/http4s-server_2.13@0.23.2" } ], "aliases": [ "CVE-2021-39185", "GHSA-52cf-226f-rhr6" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-83r2-kxmr-zucc" } ], "fixing_vulnerabilities": [], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.http4s/http4s-server_2.13@0.22.0" }