Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/85077?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/85077?format=api", "purl": "pkg:gem/jruby-openssl@0.12.1", "type": "gem", "namespace": "", "name": "jruby-openssl", "version": "0.12.1", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "0.15.4", "latest_non_vulnerable_version": "0.15.4", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/51615?format=api", "vulnerability_id": "VCID-nxbe-xm3f-ybdq", "summary": "JRuby-OpenSSL has hostname verification disabled by default\nJRuby-OpenSSL is an add-on gem for JRuby that emulates the Ruby\nOpenSSL native library.\n\nStarting in JRuby-OpenSSL version 0.12.1 and prior to version 0.15.4\n(corresponding to JRuby versions starting in 9.3.4.0 prior to 9.4.12.1\nand 10.0.0.0 prior to 10.0.0.1), when verifying SSL certificates,\nJRuby-OpenSSL does not verify that the hostname presented in the\ncertificate matches the one the user tries to connect to.\nThis means a man-in-the-middle could just present any valid cert for\na completely different domain they own, and JRuby would accept the cert.\nAnybody using JRuby to make requests of external APIs, or scraping\nthe web, that depends on https to connect securely.\nJRuby-OpenSSL version 0.15.4 contains a fix for the issue. This fix\nis included in JRuby versions 10.0.0.1 and 9.4.12.1.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-46551.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-46551.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-46551", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00102", "scoring_system": "epss", "scoring_elements": "0.27582", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.00102", "scoring_system": "epss", "scoring_elements": "0.27451", "published_at": "2026-06-09T12:55:00Z" }, { "value": "0.00102", "scoring_system": "epss", "scoring_elements": "0.27444", "published_at": "2026-06-08T12:55:00Z" }, { "value": "0.00102", "scoring_system": "epss", "scoring_elements": "0.27494", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.00102", "scoring_system": "epss", "scoring_elements": "0.27532", "published_at": "2026-06-06T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-46551" }, { "reference_url": "https://github.com/advisories/GHSA-72qj-48g4-5xgx", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-72qj-48g4-5xgx" }, { "reference_url": "https://github.com/jruby/jruby-openssl", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jruby/jruby-openssl" }, { "reference_url": "https://github.com/jruby/jruby-openssl/commit/31a56d690ce9b8af47af09aaaf809081949ed285", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-07T20:15:30Z/" } ], "url": "https://github.com/jruby/jruby-openssl/commit/31a56d690ce9b8af47af09aaaf809081949ed285" }, { "reference_url": "https://github.com/jruby/jruby-openssl/commit/b1fc5d645c0d90891b8865925ac1c15e3f15a055", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/jruby/jruby-openssl/commit/b1fc5d645c0d90891b8865925ac1c15e3f15a055" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2364868", "reference_id": "2364868", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2364868" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46551", "reference_id": "CVE-2025-46551", "reference_type": "", "scores": [ { "value": "5.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46551" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jruby-openssl/CVE-2025-46551.yml", "reference_id": "CVE-2025-46551.YML", "reference_type": "", "scores": [ { "value": "5.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jruby-openssl/CVE-2025-46551.yml" }, { "reference_url": "https://github.com/jruby/jruby-openssl/security/advisories/GHSA-72qj-48g4-5xgx", "reference_id": "GHSA-72qj-48g4-5xgx", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "5.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-07T20:15:30Z/" } ], "url": "https://github.com/jruby/jruby-openssl/security/advisories/GHSA-72qj-48g4-5xgx" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/85078?format=api", "purl": "pkg:gem/jruby-openssl@0.15.4", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/jruby-openssl@0.15.4" } ], "aliases": [ "CVE-2025-46551", "GHSA-72qj-48g4-5xgx" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-nxbe-xm3f-ybdq" } ], "fixing_vulnerabilities": [], "risk_score": "3.1", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/jruby-openssl@0.12.1" }