diff --git a/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap b/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap index 42402af15d0..5c4059cd2b5 100755 --- a/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap +++ b/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap @@ -32,20 +32,19 @@ Scanning image "alpine:3.18.9" Container Scanning Result (Alpine Linux v3.18) (Based on "alpine" image): -Total 3 packages affected by 8 known vulnerabilities (0 Critical, 4 High, 4 Medium, 0 Low, 0 Unknown) from 1 ecosystem. +Total 2 packages affected by 3 known vulnerabilities (0 Critical, 1 High, 2 Medium, 0 Low, 0 Unknown) from 1 ecosystem. 3 vulnerabilities can be fixed. Alpine:v3.18 -+----------------------------------------------------------------------------------------------------------------------------------------+ -| Source:os:/lib/apk/db/installed | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| busybox | 1.36.1-r7 | No fix available | 1 | busybox... (3) | # 0 Layer | alpine | -| musl | 1.2.4-r2 | Fix Available | 1 | musl, musl-utils | # 0 Layer | alpine | -| openssl | 3.1.7-r0 | Partial fixes Available | 6 | libcrypto3, libssl3 | # 0 Layer | alpine | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ ++------------------------------------------------------------------------------------------------------------------------------+ +| Source:os:/lib/apk/db/installed | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| musl | 1.2.4-r2 | Fix Available | 1 | musl, musl-utils | # 0 Layer | alpine | +| openssl | 3.1.7-r0 | Fix Available | 2 | libcrypto3, libssl3 | # 0 Layer | alpine | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve `. You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical `. @@ -286,22 +285,22 @@ Scanning local image tarball "./testdata/test-alpine.tar" Container Scanning Result (Alpine Linux v3.18) (Based on "alpine" image): -Total 5 packages affected by 51 known vulnerabilities (6 Critical, 24 High, 21 Medium, 0 Low, 0 Unknown) from 1 ecosystem. -46 vulnerabilities can be fixed. +Total 5 packages affected by 65 known vulnerabilities (6 Critical, 33 High, 26 Medium, 0 Low, 0 Unknown) from 1 ecosystem. +65 vulnerabilities can be fixed. Alpine:v3.18 -+----------------------------------------------------------------------------------------------------------------------------------------+ -| Source:os:/lib/apk/db/installed | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| apk-tools | 2.10.6-r0 | Fix Available | 1 | apk-tools | # 3 Layer | -- | -| busybox | 1.30.1-r5 | Partial fixes Available | 19 | busybox, ssl_client | # 3 Layer | -- | -| musl | 1.1.22-r4 | Fix Available | 3 | musl, musl-utils | # 3 Layer | -- | -| openssl | 1.1.1k-r0 | Partial fixes Available | 26 | libcrypto1.1... (2) | # 3 Layer | -- | -| zlib | 1.2.11-r1 | Fix Available | 2 | zlib | # 3 Layer | -- | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ ++------------------------------------------------------------------------------------------------------------------------------+ +| Source:os:/lib/apk/db/installed | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| apk-tools | 2.10.6-r0 | Fix Available | 2 | apk-tools | # 3 Layer | -- | +| busybox | 1.30.1-r5 | Fix Available | 19 | busybox, ssl_client | # 3 Layer | -- | +| musl | 1.1.22-r4 | Fix Available | 3 | musl, musl-utils | # 3 Layer | -- | +| openssl | 1.1.1k-r0 | Fix Available | 39 | libcrypto1.1... (2) | # 3 Layer | -- | +| zlib | 1.2.11-r1 | Fix Available | 2 | zlib | # 3 Layer | -- | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve `. You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical `. @@ -321,9 +320,6 @@ Package Ubuntu:20.04/dpkg/1.19.7ubuntu3.2 has been filtered out because: Just wa Package Ubuntu:20.04/util-linux/2.34-0.1ubuntu9.6 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/gcc-10/10.5.0-1ubuntu1~20.04 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/gnupg2/2.2.19-3ubuntu2.4 has been filtered out because: Just want to test only unimportant vulns -Package Ubuntu:20.04/gzip/1.10-0ubuntu4.1 has been filtered out because: Just want to test only unimportant vulns -Package Ubuntu:20.04/acl/2.2.53-6 has been filtered out because: Just want to test only unimportant vulns -Package Ubuntu:20.04/attr/1:2.4.48-5 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/util-linux/2.34-0.1ubuntu9.6 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/bzip2/1.0.8-2 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/glibc/2.31-0ubuntu9.17 has been filtered out because: Just want to test only unimportant vulns @@ -337,7 +333,6 @@ Package Ubuntu:20.04/xz-utils/5.2.4-1ubuntu1.1 has been filtered out because: Ju Package Ubuntu:20.04/util-linux/2.34-0.1ubuntu9.6 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/ncurses/6.2-0ubuntu2.1 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/ncurses/6.2-0ubuntu2.1 has been filtered out because: Just want to test only unimportant vulns -Package Ubuntu:20.04/p11-kit/0.23.20-1ubuntu0.1 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/pam/1.3.1-5ubuntu4.7 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/pam/1.3.1-5ubuntu4.7 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/pam/1.3.1-5ubuntu4.7 has been filtered out because: Just want to test only unimportant vulns @@ -360,7 +355,7 @@ Package Ubuntu:20.04/sed/4.7-1 has been filtered out because: Just want to test Package Ubuntu:20.04/tar/1.30+dfsg-7ubuntu0.20.04.4 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/util-linux/2.34-0.1ubuntu9.6 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/zlib/1:1.2.11.dfsg-2ubuntu1.5 has been filtered out because: Just want to test only unimportant vulns -Filtered 46 ignored package/s from the scan. +Filtered 42 ignored package/s from the scan. Container Scanning Result (Ubuntu 20.04.6 LTS) (Based on "google/ubuntu2004" image): @@ -388,9 +383,6 @@ Package Ubuntu:20.04/dpkg/1.19.7ubuntu3.2 has been filtered out because: Just wa Package Ubuntu:20.04/util-linux/2.34-0.1ubuntu9.6 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/gcc-10/10.5.0-1ubuntu1~20.04 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/gnupg2/2.2.19-3ubuntu2.4 has been filtered out because: Just want to test only unimportant vulns -Package Ubuntu:20.04/gzip/1.10-0ubuntu4.1 has been filtered out because: Just want to test only unimportant vulns -Package Ubuntu:20.04/acl/2.2.53-6 has been filtered out because: Just want to test only unimportant vulns -Package Ubuntu:20.04/attr/1:2.4.48-5 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/util-linux/2.34-0.1ubuntu9.6 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/bzip2/1.0.8-2 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/glibc/2.31-0ubuntu9.17 has been filtered out because: Just want to test only unimportant vulns @@ -404,7 +396,6 @@ Package Ubuntu:20.04/xz-utils/5.2.4-1ubuntu1.1 has been filtered out because: Ju Package Ubuntu:20.04/util-linux/2.34-0.1ubuntu9.6 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/ncurses/6.2-0ubuntu2.1 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/ncurses/6.2-0ubuntu2.1 has been filtered out because: Just want to test only unimportant vulns -Package Ubuntu:20.04/p11-kit/0.23.20-1ubuntu0.1 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/pam/1.3.1-5ubuntu4.7 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/pam/1.3.1-5ubuntu4.7 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/pam/1.3.1-5ubuntu4.7 has been filtered out because: Just want to test only unimportant vulns @@ -427,7 +418,7 @@ Package Ubuntu:20.04/sed/4.7-1 has been filtered out because: Just want to test Package Ubuntu:20.04/tar/1.30+dfsg-7ubuntu0.20.04.4 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/util-linux/2.34-0.1ubuntu9.6 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/zlib/1:1.2.11.dfsg-2ubuntu1.5 has been filtered out because: Just want to test only unimportant vulns -Filtered 46 ignored package/s from the scan. +Filtered 42 ignored package/s from the scan. Container Scanning Result (Ubuntu 20.04.6 LTS) (Based on "google/ubuntu2004" image): @@ -457,8 +448,8 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" Container Scanning Result (Ubuntu 22.04.5 LTS) (Based on "ubuntu" image): -Total 29 packages affected by 91 known vulnerabilities (11 Critical, 28 High, 36 Medium, 6 Low, 10 Unknown) from 1 ecosystem. -39 vulnerabilities can be fixed. +Total 26 packages affected by 83 known vulnerabilities (10 Critical, 21 High, 36 Medium, 5 Low, 11 Unknown) from 1 ecosystem. +33 vulnerabilities can be fixed. Ubuntu:22.04 @@ -467,35 +458,32 @@ Ubuntu:22.04 +----------------+------------------------------+-------------------------+------------+-------------------------+------------------+---------------+ | SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | +----------------+------------------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| acl | 2.3.1-1 | No fix available | 2 | libacl1 | # 4 Layer | ubuntu | -| attr | 1:2.5.1-1build1 | No fix available | 1 | libattr1 | # 4 Layer | ubuntu | | bzip2 | 1.0.8-5build1 | No fix available | 1 | libbz2-1.0 | # 4 Layer | ubuntu | | coreutils | 8.32-4.1ubuntu1.2 | No fix available | 2 | coreutils | # 4 Layer | ubuntu | | dpkg | 1.21.1ubuntu2.3 | Fix Available | 1 | dpkg | # 4 Layer | ubuntu | | gcc-12 | 12.3.0-1ubuntu1~22.04 | Partial fixes Available | 2 | gcc-12-base... (3) | # 4 Layer | ubuntu | | glibc | 2.35-0ubuntu3.8 | Partial fixes Available | 8 | libc-bin, libc6 | # 4 Layer | ubuntu | -| gnupg2 | 2.2.27-3ubuntu2.1 | Partial fixes Available | 5 | gpgv | # 4 Layer | ubuntu | +| gnupg2 | 2.2.27-3ubuntu2.1 | Partial fixes Available | 4 | gpgv | # 4 Layer | ubuntu | | gnutls28 | 3.7.3-4ubuntu1.5 | Fix Available | 4 | libgnutls30 | # 4 Layer | ubuntu | -| gzip | 1.10-4ubuntu4.1 | Fix Available | 1 | gzip | # 4 Layer | ubuntu | | krb5 | 1.19.2-2ubuntu0.4 | Partial fixes Available | 5 | libgssapi-krb5-2... (4) | # 4 Layer | ubuntu | | libcap2 | 1:2.44-1ubuntu0.22.04.1 | Fix Available | 2 | libcap2 | # 4 Layer | ubuntu | | libgcrypt20 | 1.9.4-3ubuntu3 | Partial fixes Available | 2 | libgcrypt20 | # 4 Layer | ubuntu | | libtasn1-6 | 4.18.0-4build1 | Fix Available | 2 | libtasn1-6 | # 4 Layer | ubuntu | | libzstd | 1.4.8+dfsg-3build1 | No fix available | 1 | libzstd1 | # 4 Layer | ubuntu | | lz4 | 1.9.3-2build2 | No fix available | 1 | liblz4-1 | # 4 Layer | ubuntu | -| ncurses | 6.3-2ubuntu0.1 | Partial fixes Available | 3 | libncurses6... (5) | # 4 Layer | ubuntu | +| ncurses | 6.3-2ubuntu0.1 | No fix available | 3 | libncurses6... (5) | # 4 Layer | ubuntu | | openssl | 3.0.2-0ubuntu1.18 | Partial fixes Available | 7 | libssl3 | # 4 Layer | ubuntu | -| p11-kit | 0.24.0-6build1 | No fix available | 1 | libp11-kit0 | # 4 Layer | ubuntu | | pam | 1.4.0-11ubuntu2.5 | Partial fixes Available | 3 | libpam-modules... (4) | # 4 Layer | ubuntu | | pcre2 | 10.39-3ubuntu0.1 | No fix available | 1 | libpcre2-8-0 | # 4 Layer | ubuntu | -| perl | 5.34.0-3ubuntu1.3 | Partial fixes Available | 13 | perl-base | # 4 Layer | ubuntu | +| perl | 5.34.0-3ubuntu1.3 | Partial fixes Available | 12 | perl-base | # 4 Layer | ubuntu | | sed | 4.8-1ubuntu2 | Fix Available | 1 | sed | # 4 Layer | ubuntu | | shadow | 1:4.8.1-2ubuntu2.2 | No fix available | 2 | login, passwd | # 4 Layer | ubuntu | | systemd | 249.11-0ubuntu3.12 | Partial fixes Available | 4 | libsystemd0... (2) | # 4 Layer | ubuntu | -| tar | 1.34+dfsg-1ubuntu0.1.22.04.2 | Fix Available | 2 | tar | # 4 Layer | ubuntu | -| util-linux | 1:2.37.2-4ubuntu3.4 | No fix available | 6 | bsdutils | # 4 Layer | ubuntu | -| util-linux | 2.37.2-4ubuntu3.4 | Partial fixes Available | 7 | libblkid1... (6) | # 4 Layer | ubuntu | +| tar | 1.34+dfsg-1ubuntu0.1.22.04.2 | No fix available | 2 | tar | # 4 Layer | ubuntu | +| util-linux | 1:2.37.2-4ubuntu3.4 | No fix available | 5 | bsdutils | # 4 Layer | ubuntu | +| util-linux | 2.37.2-4ubuntu3.4 | Partial fixes Available | 6 | libblkid1... (6) | # 4 Layer | ubuntu | | xz-utils | 5.2.5-2ubuntu1 | Fix Available | 1 | liblzma5 | # 4 Layer | ubuntu | +| zlib | 1:1.2.11.dfsg-2ubuntu9.2 | No fix available | 1 | zlib1g | # 4 Layer | ubuntu | +----------------+------------------------------+-------------------------+------------+-------------------------+------------------+---------------+ Hiding 5 number of vulnerabilities deemed unimportant, use --all-vulns to show them. @@ -513,8 +501,8 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" Container Scanning Result (Ubuntu 22.04.5 LTS) (Based on "ubuntu" image): -Total 29 packages affected by 91 known vulnerabilities (11 Critical, 28 High, 36 Medium, 6 Low, 10 Unknown) from 1 ecosystem. -39 vulnerabilities can be fixed. +Total 26 packages affected by 83 known vulnerabilities (10 Critical, 21 High, 36 Medium, 5 Low, 11 Unknown) from 1 ecosystem. +33 vulnerabilities can be fixed. Ubuntu:22.04 @@ -523,35 +511,32 @@ Ubuntu:22.04 +----------------+------------------------------+-------------------------+------------+-------------------------+------------------+---------------+ | SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | +----------------+------------------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| acl | 2.3.1-1 | No fix available | 2 | libacl1 | # 4 Layer | ubuntu | -| attr | 1:2.5.1-1build1 | No fix available | 1 | libattr1 | # 4 Layer | ubuntu | | bzip2 | 1.0.8-5build1 | No fix available | 1 | libbz2-1.0 | # 4 Layer | ubuntu | | coreutils | 8.32-4.1ubuntu1.2 | No fix available | 2 | coreutils | # 4 Layer | ubuntu | | dpkg | 1.21.1ubuntu2.3 | Fix Available | 1 | dpkg | # 4 Layer | ubuntu | | gcc-12 | 12.3.0-1ubuntu1~22.04 | Partial fixes Available | 2 | gcc-12-base... (3) | # 4 Layer | ubuntu | | glibc | 2.35-0ubuntu3.8 | Partial fixes Available | 8 | libc-bin, libc6 | # 4 Layer | ubuntu | -| gnupg2 | 2.2.27-3ubuntu2.1 | Partial fixes Available | 5 | gpgv | # 4 Layer | ubuntu | +| gnupg2 | 2.2.27-3ubuntu2.1 | Partial fixes Available | 4 | gpgv | # 4 Layer | ubuntu | | gnutls28 | 3.7.3-4ubuntu1.5 | Fix Available | 4 | libgnutls30 | # 4 Layer | ubuntu | -| gzip | 1.10-4ubuntu4.1 | Fix Available | 1 | gzip | # 4 Layer | ubuntu | | krb5 | 1.19.2-2ubuntu0.4 | Partial fixes Available | 5 | libgssapi-krb5-2... (4) | # 4 Layer | ubuntu | | libcap2 | 1:2.44-1ubuntu0.22.04.1 | Fix Available | 2 | libcap2 | # 4 Layer | ubuntu | | libgcrypt20 | 1.9.4-3ubuntu3 | Partial fixes Available | 2 | libgcrypt20 | # 4 Layer | ubuntu | | libtasn1-6 | 4.18.0-4build1 | Fix Available | 2 | libtasn1-6 | # 4 Layer | ubuntu | | libzstd | 1.4.8+dfsg-3build1 | No fix available | 1 | libzstd1 | # 4 Layer | ubuntu | | lz4 | 1.9.3-2build2 | No fix available | 1 | liblz4-1 | # 4 Layer | ubuntu | -| ncurses | 6.3-2ubuntu0.1 | Partial fixes Available | 3 | libncurses6... (5) | # 4 Layer | ubuntu | +| ncurses | 6.3-2ubuntu0.1 | No fix available | 3 | libncurses6... (5) | # 4 Layer | ubuntu | | openssl | 3.0.2-0ubuntu1.18 | Partial fixes Available | 7 | libssl3 | # 4 Layer | ubuntu | -| p11-kit | 0.24.0-6build1 | No fix available | 1 | libp11-kit0 | # 4 Layer | ubuntu | | pam | 1.4.0-11ubuntu2.5 | Partial fixes Available | 3 | libpam-modules... (4) | # 4 Layer | ubuntu | | pcre2 | 10.39-3ubuntu0.1 | No fix available | 1 | libpcre2-8-0 | # 4 Layer | ubuntu | -| perl | 5.34.0-3ubuntu1.3 | Partial fixes Available | 13 | perl-base | # 4 Layer | ubuntu | +| perl | 5.34.0-3ubuntu1.3 | Partial fixes Available | 12 | perl-base | # 4 Layer | ubuntu | | sed | 4.8-1ubuntu2 | Fix Available | 1 | sed | # 4 Layer | ubuntu | | shadow | 1:4.8.1-2ubuntu2.2 | No fix available | 2 | login, passwd | # 4 Layer | ubuntu | | systemd | 249.11-0ubuntu3.12 | Partial fixes Available | 4 | libsystemd0... (2) | # 4 Layer | ubuntu | -| tar | 1.34+dfsg-1ubuntu0.1.22.04.2 | Fix Available | 2 | tar | # 4 Layer | ubuntu | -| util-linux | 1:2.37.2-4ubuntu3.4 | No fix available | 6 | bsdutils | # 4 Layer | ubuntu | -| util-linux | 2.37.2-4ubuntu3.4 | Partial fixes Available | 7 | libblkid1... (6) | # 4 Layer | ubuntu | +| tar | 1.34+dfsg-1ubuntu0.1.22.04.2 | No fix available | 2 | tar | # 4 Layer | ubuntu | +| util-linux | 1:2.37.2-4ubuntu3.4 | No fix available | 5 | bsdutils | # 4 Layer | ubuntu | +| util-linux | 2.37.2-4ubuntu3.4 | Partial fixes Available | 6 | libblkid1... (6) | # 4 Layer | ubuntu | | xz-utils | 5.2.5-2ubuntu1 | Fix Available | 1 | liblzma5 | # 4 Layer | ubuntu | +| zlib | 1:1.2.11.dfsg-2ubuntu9.2 | No fix available | 1 | zlib1g | # 4 Layer | ubuntu | +----------------+------------------------------+-------------------------+------------+-------------------------+------------------+---------------+ Filtered Vulnerabilities: @@ -583,13 +568,120 @@ failed to load image from tarball with path "../../testdata/locks-manyoci-image/ --- +[TestCommand_OCIImage/Scanning_AlmaLinux_9_image - 1] +Scanning local image tarball "./testdata/test-almalinux-9.tar" + + +Container Scanning Result (AlmaLinux 9.0 (Emerald Puma)) (Based on "almalinux" image): +Total 68 packages affected by 282 known vulnerabilities (0 Critical, 3 High, 5 Medium, 1 Low, 273 Unknown) from 2 ecosystems. +282 vulnerabilities can be fixed. + + +AlmaLinux:9 ++----------------------------------------------------------------------------------------------------------------------------------------------+ +| Source:os:/var/lib/rpm/rpmdb.sqlite | ++--------------------------+---------------------+---------------+------------+-----------------------------+------------------+---------------+ +| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | ++--------------------------+---------------------+---------------+------------+-----------------------------+------------------+---------------+ +| bash | 5.1.8-4.el9 | Fix Available | 1 | bash | # 0 Layer | almalinux | +| binutils | 2.35.2-17.el9 | Fix Available | 2 | binutils | # 0 Layer | almalinux | +| binutils-gold | 2.35.2-17.el9 | Fix Available | 2 | binutils-gold | # 0 Layer | almalinux | +| bzip2-libs | 1.0.8-8.el9 | Fix Available | 1 | bzip2-libs | # 0 Layer | almalinux | +| curl-minimal | 7.76.1-14.el9_0.5 | Fix Available | 12 | curl-minimal | # 0 Layer | almalinux | +| dbus | 1.12.20-5.el9 | Fix Available | 2 | dbus | # 0 Layer | almalinux | +| dbus-common | 1.12.20-5.el9 | Fix Available | 2 | dbus-common | # 0 Layer | almalinux | +| expat | 2.2.10-12.el9_0.3 | Fix Available | 8 | expat | # 0 Layer | almalinux | +| file-libs | 5.39-8.el9 | Fix Available | 1 | file-libs | # 0 Layer | almalinux | +| glib2 | 2.68.4-5.el9 | Fix Available | 6 | glib2 | # 0 Layer | almalinux | +| glibc | 2.34-28.el9_0.2 | Fix Available | 6 | glibc | # 0 Layer | almalinux | +| glibc-common | 2.34-28.el9_0.2 | Fix Available | 6 | glibc-common | # 0 Layer | almalinux | +| glibc-minimal-langpack | 2.34-28.el9_0.2 | Fix Available | 6 | glibc-minimal-langpa... (1) | # 0 Layer | almalinux | +| gmp | 6.2.0-10.el9 | Fix Available | 1 | gmp | # 0 Layer | almalinux | +| gnupg2 | 2.3.3-2.el9_0 | Fix Available | 1 | gnupg2 | # 0 Layer | almalinux | +| gnutls | 3.7.6-12.el9_0 | Fix Available | 7 | gnutls | # 0 Layer | almalinux | +| iputils | 20210202-7.el9 | Fix Available | 2 | iputils | # 0 Layer | almalinux | +| krb5-libs | 1.19.1-15.el9_0 | Fix Available | 9 | krb5-libs | # 0 Layer | almalinux | +| less | 590-1.el9_0 | Fix Available | 3 | less | # 0 Layer | almalinux | +| libarchive | 3.5.3-2.el9_0 | Fix Available | 5 | libarchive | # 0 Layer | almalinux | +| libblkid | 2.37.4-3.el9 | Fix Available | 1 | libblkid | # 0 Layer | almalinux | +| libcap | 2.48-8.el9 | Fix Available | 3 | libcap | # 0 Layer | almalinux | +| libcom_err | 1.46.5-2.el9 | Fix Available | 1 | libcom_err | # 0 Layer | almalinux | +| libcurl-minimal | 7.76.1-14.el9_0.5 | Fix Available | 12 | libcurl-minimal | # 0 Layer | almalinux | +| libeconf | 0.4.1-2.el9 | Fix Available | 1 | libeconf | # 0 Layer | almalinux | +| libfdisk | 2.37.4-3.el9 | Fix Available | 1 | libfdisk | # 0 Layer | almalinux | +| libgcc | 11.2.1-9.4.el9.alma | Fix Available | 1 | libgcc | # 0 Layer | almalinux | +| libgcrypt | 1.10.0-5.el9_0 | Fix Available | 1 | libgcrypt | # 0 Layer | almalinux | +| libgomp | 11.2.1-9.4.el9.alma | Fix Available | 1 | libgomp | # 0 Layer | almalinux | +| libksba | 1.5.1-5.el9_0 | Fix Available | 1 | libksba | # 0 Layer | almalinux | +| libmount | 2.37.4-3.el9 | Fix Available | 1 | libmount | # 0 Layer | almalinux | +| libnghttp2 | 1.43.0-5.el9 | Fix Available | 4 | libnghttp2 | # 0 Layer | almalinux | +| libsmartcols | 2.37.4-3.el9 | Fix Available | 1 | libsmartcols | # 0 Layer | almalinux | +| libstdc++ | 11.2.1-9.4.el9.alma | Fix Available | 1 | libstdc++ | # 0 Layer | almalinux | +| libtasn1 | 4.16.0-7.el9 | Fix Available | 2 | libtasn1 | # 0 Layer | almalinux | +| libuuid | 2.37.4-3.el9 | Fix Available | 1 | libuuid | # 0 Layer | almalinux | +| libxml2 | 2.9.13-1.el9_0.1 | Fix Available | 10 | libxml2 | # 0 Layer | almalinux | +| lua-libs | 5.4.2-4.el9 | Fix Available | 3 | lua-libs | # 0 Layer | almalinux | +| ncurses-base | 6.2-8.20210508.el9 | Fix Available | 1 | ncurses-base | # 0 Layer | almalinux | +| ncurses-libs | 6.2-8.20210508.el9 | Fix Available | 1 | ncurses-libs | # 0 Layer | almalinux | +| openssl | 3.0.1-43.el9_0 | Fix Available | 15 | openssl | # 0 Layer | almalinux | +| openssl-libs | 3.0.1-43.el9_0 | Fix Available | 15 | openssl-libs | # 0 Layer | almalinux | +| p11-kit | 0.24.1-2.el9 | Fix Available | 1 | p11-kit | # 0 Layer | almalinux | +| p11-kit-trust | 0.24.1-2.el9 | Fix Available | 1 | p11-kit-trust | # 0 Layer | almalinux | +| pam | 1.5.1-9.el9_0.1 | Fix Available | 5 | pam | # 0 Layer | almalinux | +| python3 | 3.9.10-2.el9 | Fix Available | 24 | python3 | # 0 Layer | almalinux | +| python3-libs | 3.9.10-2.el9 | Fix Available | 24 | python3-libs | # 0 Layer | almalinux | +| python3-pip-wheel | 21.2.3-6.el9 | Fix Available | 1 | python3-pip-wheel | # 0 Layer | almalinux | +| python3-rpm | 4.16.1.3-12.el9_0 | Fix Available | 1 | python3-rpm | # 0 Layer | almalinux | +| python3-setuptools-wheel | 53.0.0-10.el9 | Fix Available | 3 | python3-setuptools-w... (1) | # 0 Layer | almalinux | +| rpm | 4.16.1.3-12.el9_0 | Fix Available | 1 | rpm | # 0 Layer | almalinux | +| rpm-build-libs | 4.16.1.3-12.el9_0 | Fix Available | 1 | rpm-build-libs | # 0 Layer | almalinux | +| rpm-libs | 4.16.1.3-12.el9_0 | Fix Available | 1 | rpm-libs | # 0 Layer | almalinux | +| rpm-sign-libs | 4.16.1.3-12.el9_0 | Fix Available | 1 | rpm-sign-libs | # 0 Layer | almalinux | +| shadow-utils | 4.9-3.el9 | Fix Available | 2 | shadow-utils | # 0 Layer | almalinux | +| sqlite-libs | 3.34.1-5.el9 | Fix Available | 4 | sqlite-libs | # 0 Layer | almalinux | +| systemd | 250-6.el9_0.1 | Fix Available | 6 | systemd | # 0 Layer | almalinux | +| systemd-libs | 250-6.el9_0.1 | Fix Available | 6 | systemd-libs | # 0 Layer | almalinux | +| systemd-pam | 250-6.el9_0.1 | Fix Available | 6 | systemd-pam | # 0 Layer | almalinux | +| systemd-rpm-macros | 250-6.el9_0.1 | Fix Available | 6 | systemd-rpm-macros | # 0 Layer | almalinux | +| tar | 1.34-3.el9 | Fix Available | 2 | tar | # 0 Layer | almalinux | +| tpm2-tss | 3.0.3-7.el9 | Fix Available | 1 | tpm2-tss | # 0 Layer | almalinux | +| util-linux | 2.37.4-3.el9 | Fix Available | 1 | util-linux | # 0 Layer | almalinux | +| util-linux-core | 2.37.4-3.el9 | Fix Available | 1 | util-linux-core | # 0 Layer | almalinux | +| vim-minimal | 8.2.2637-16.el9_0.3 | Fix Available | 12 | vim-minimal | # 0 Layer | almalinux | +| zlib | 1.2.11-31.el9_0.1 | Fix Available | 1 | zlib | # 0 Layer | almalinux | ++--------------------------+---------------------+---------------+------------+-----------------------------+------------------+---------------+ +PyPI ++---------------------------------------------------------------------------------------------+ +| Source:artifact:/usr/share/python3-wheels/pip-21.2.3-py3-none-any.whl | ++---------+-------------------+---------------+------------+------------------+---------------+ +| PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | ++---------+-------------------+---------------+------------+------------------+---------------+ +| pip | 21.2.3 | Fix Available | 6 | # 0 Layer | almalinux | ++---------+-------------------+---------------+------------+------------------+---------------+ ++------------------------------------------------------------------------------------------------+ +| Source:artifact:/usr/share/python3-wheels/setuptools-53.0.0-py3-none-any.whl | ++------------+-------------------+---------------+------------+------------------+---------------+ +| PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | ++------------+-------------------+---------------+------------+------------------+---------------+ +| setuptools | 53.0.0 | Fix Available | 3 | # 0 Layer | almalinux | ++------------+-------------------+---------------+------------+------------------+---------------+ + +For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve `. +You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical `. + +--- + +[TestCommand_OCIImage/Scanning_AlmaLinux_9_image - 2] + +--- + [TestCommand_OCIImage/Scanning_Ubuntu_image_with_go_OS_packages_json - 1] Scanning local image tarball "./testdata/test-ubuntu-with-packages.tar" Container Scanning Result (Ubuntu 22.04.5 LTS) (Based on "ubuntu" image): -Total 30 packages affected by 93 known vulnerabilities (11 Critical, 30 High, 36 Medium, 6 Low, 10 Unknown) from 1 ecosystem. -39 vulnerabilities can be fixed. +Total 26 packages affected by 83 known vulnerabilities (10 Critical, 21 High, 36 Medium, 5 Low, 11 Unknown) from 1 ecosystem. +33 vulnerabilities can be fixed. Ubuntu:22.04 @@ -598,36 +690,32 @@ Ubuntu:22.04 +----------------+------------------------------+-------------------------+------------+-------------------------+------------------+---------------+ | SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | +----------------+------------------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| acl | 2.3.1-1 | No fix available | 2 | libacl1 | # 4 Layer | ubuntu | -| attr | 1:2.5.1-1build1 | No fix available | 1 | libattr1 | # 4 Layer | ubuntu | | bzip2 | 1.0.8-5build1 | No fix available | 1 | libbz2-1.0 | # 4 Layer | ubuntu | | coreutils | 8.32-4.1ubuntu1.2 | No fix available | 2 | coreutils | # 4 Layer | ubuntu | | dpkg | 1.21.1ubuntu2.3 | Fix Available | 1 | dpkg | # 4 Layer | ubuntu | -| fzf | 0.29.0-1ubuntu0.1 | No fix available | 2 | fzf | # 7 Layer | -- | | gcc-12 | 12.3.0-1ubuntu1~22.04 | Partial fixes Available | 2 | gcc-12-base... (3) | # 4 Layer | ubuntu | | glibc | 2.35-0ubuntu3.8 | Partial fixes Available | 8 | libc-bin, libc6 | # 4 Layer | ubuntu | -| gnupg2 | 2.2.27-3ubuntu2.1 | Partial fixes Available | 5 | gpgv | # 4 Layer | ubuntu | +| gnupg2 | 2.2.27-3ubuntu2.1 | Partial fixes Available | 4 | gpgv | # 4 Layer | ubuntu | | gnutls28 | 3.7.3-4ubuntu1.5 | Fix Available | 4 | libgnutls30 | # 4 Layer | ubuntu | -| gzip | 1.10-4ubuntu4.1 | Fix Available | 1 | gzip | # 4 Layer | ubuntu | | krb5 | 1.19.2-2ubuntu0.4 | Partial fixes Available | 5 | libgssapi-krb5-2... (4) | # 4 Layer | ubuntu | | libcap2 | 1:2.44-1ubuntu0.22.04.1 | Fix Available | 2 | libcap2 | # 4 Layer | ubuntu | | libgcrypt20 | 1.9.4-3ubuntu3 | Partial fixes Available | 2 | libgcrypt20 | # 4 Layer | ubuntu | | libtasn1-6 | 4.18.0-4build1 | Fix Available | 2 | libtasn1-6 | # 4 Layer | ubuntu | | libzstd | 1.4.8+dfsg-3build1 | No fix available | 1 | libzstd1 | # 4 Layer | ubuntu | | lz4 | 1.9.3-2build2 | No fix available | 1 | liblz4-1 | # 4 Layer | ubuntu | -| ncurses | 6.3-2ubuntu0.1 | Partial fixes Available | 3 | libncurses6... (5) | # 4 Layer | ubuntu | +| ncurses | 6.3-2ubuntu0.1 | No fix available | 3 | libncurses6... (5) | # 4 Layer | ubuntu | | openssl | 3.0.2-0ubuntu1.18 | Partial fixes Available | 7 | libssl3 | # 4 Layer | ubuntu | -| p11-kit | 0.24.0-6build1 | No fix available | 1 | libp11-kit0 | # 4 Layer | ubuntu | | pam | 1.4.0-11ubuntu2.5 | Partial fixes Available | 3 | libpam-modules... (4) | # 4 Layer | ubuntu | | pcre2 | 10.39-3ubuntu0.1 | No fix available | 1 | libpcre2-8-0 | # 4 Layer | ubuntu | -| perl | 5.34.0-3ubuntu1.3 | Partial fixes Available | 13 | perl-base | # 4 Layer | ubuntu | +| perl | 5.34.0-3ubuntu1.3 | Partial fixes Available | 12 | perl-base | # 4 Layer | ubuntu | | sed | 4.8-1ubuntu2 | Fix Available | 1 | sed | # 4 Layer | ubuntu | | shadow | 1:4.8.1-2ubuntu2.2 | No fix available | 2 | login, passwd | # 4 Layer | ubuntu | | systemd | 249.11-0ubuntu3.12 | Partial fixes Available | 4 | libsystemd0... (2) | # 4 Layer | ubuntu | -| tar | 1.34+dfsg-1ubuntu0.1.22.04.2 | Fix Available | 2 | tar | # 4 Layer | ubuntu | -| util-linux | 1:2.37.2-4ubuntu3.4 | No fix available | 6 | bsdutils | # 4 Layer | ubuntu | -| util-linux | 2.37.2-4ubuntu3.4 | Partial fixes Available | 7 | libblkid1... (6) | # 4 Layer | ubuntu | +| tar | 1.34+dfsg-1ubuntu0.1.22.04.2 | No fix available | 2 | tar | # 4 Layer | ubuntu | +| util-linux | 1:2.37.2-4ubuntu3.4 | No fix available | 5 | bsdutils | # 4 Layer | ubuntu | +| util-linux | 2.37.2-4ubuntu3.4 | Partial fixes Available | 6 | libblkid1... (6) | # 4 Layer | ubuntu | | xz-utils | 5.2.5-2ubuntu1 | Fix Available | 1 | liblzma5 | # 4 Layer | ubuntu | +| zlib | 1:1.2.11.dfsg-2ubuntu9.2 | No fix available | 1 | zlib1g | # 4 Layer | ubuntu | +----------------+------------------------------+-------------------------+------------+-------------------------+------------------+---------------+ Hiding 5 number of vulnerabilities deemed unimportant, use --all-vulns to show them. @@ -645,62 +733,60 @@ Scanning local image tarball "./testdata/test-java-full.tar" Container Scanning Result (Alpine Linux v3.21) (Based on "eclipse-temurin" image): -Total 38 packages affected by 164 known vulnerabilities (5 Critical, 76 High, 74 Medium, 8 Low, 1 Unknown) from 2 ecosystems. -157 vulnerabilities can be fixed. +Total 36 packages affected by 138 known vulnerabilities (6 Critical, 68 High, 56 Medium, 7 Low, 1 Unknown) from 2 ecosystems. +138 vulnerabilities can be fixed. Maven -+-------------------------------------------------------------------------------------------------------------------------------------------+ -| Source:artifact:/app/target.jar | -+---------------------------------------------+-------------------+-------------------------+------------+------------------+---------------+ -| PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | -+---------------------------------------------+-------------------+-------------------------+------------+------------------+---------------+ -| com.fasterxml.jackson.core:jackson-core | 2.10.2 | Fix Available | 3 | # 12 Layer | -- | -| com.fasterxml.jackson.core:jackson-databind | 2.12.7.1 | Partial fixes Available | 5 | # 12 Layer | -- | -| com.google.protobuf:protobuf-java | 3.21.12 | Fix Available | 1 | # 12 Layer | -- | -| com.nimbusds:nimbus-jose-jwt | 9.31 | Fix Available | 2 | # 12 Layer | -- | -| commons-beanutils:commons-beanutils | 1.9.4 | Fix Available | 1 | # 12 Layer | -- | -| dnsjava:dnsjava | 3.4.0 | Fix Available | 1 | # 12 Layer | -- | -| io.netty:netty-codec | 4.1.100.Final | Fix Available | 2 | # 12 Layer | -- | -| io.netty:netty-codec-dns | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | -| io.netty:netty-codec-haproxy | 4.1.100.Final | Fix Available | 2 | # 12 Layer | -- | -| io.netty:netty-codec-http | 4.1.100.Final | Fix Available | 11 | # 12 Layer | -- | -| io.netty:netty-codec-http2 | 4.1.100.Final | Fix Available | 6 | # 12 Layer | -- | -| io.netty:netty-codec-mqtt | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | -| io.netty:netty-codec-redis | 4.1.100.Final | Fix Available | 5 | # 12 Layer | -- | -| io.netty:netty-codec-smtp | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | -| io.netty:netty-common | 4.1.100.Final | Fix Available | 2 | # 12 Layer | -- | -| io.netty:netty-handler | 4.1.100.Final | Fix Available | 4 | # 12 Layer | -- | -| io.netty:netty-handler-proxy | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | -| io.netty:netty-resolver-dns | 4.1.100.Final | Fix Available | 3 | # 12 Layer | -- | -| io.netty:netty-transport-native-epoll | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | -| io.netty:netty-transport-native-kqueue | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | -| io.netty:netty-transport-sctp | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | -| org.apache.avro:avro | 1.9.2 | Fix Available | 2 | # 12 Layer | -- | -| org.apache.commons:commons-compress | 1.21 | Fix Available | 2 | # 12 Layer | -- | -| org.apache.commons:commons-configuration2 | 2.8.0 | Fix Available | 3 | # 12 Layer | -- | -| org.apache.commons:commons-lang3 | 3.12.0 | Fix Available | 1 | # 12 Layer | -- | -| org.eclipse.jetty:jetty-http | 9.4.53.v20231009 | Fix Available | 3 | # 12 Layer | -- | -| org.jline:jline-remote-telnet | 3.9.0 | Fix Available | 2 | # 12 Layer | -- | -+---------------------------------------------+-------------------+-------------------------+------------+------------------+---------------+ ++-------------------------------------------------------------------------------------------------------------------------------+ +| Source:artifact:/app/target.jar | ++-------------------------------------------+-------------------+---------------+------------+------------------+---------------+ +| PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | ++-------------------------------------------+-------------------+---------------+------------+------------------+---------------+ +| com.fasterxml.jackson.core:jackson-core | 2.10.2 | Fix Available | 3 | # 12 Layer | -- | +| com.google.protobuf:protobuf-java | 3.21.12 | Fix Available | 1 | # 12 Layer | -- | +| com.nimbusds:nimbus-jose-jwt | 9.31 | Fix Available | 2 | # 12 Layer | -- | +| commons-beanutils:commons-beanutils | 1.9.4 | Fix Available | 1 | # 12 Layer | -- | +| dnsjava:dnsjava | 3.4.0 | Fix Available | 1 | # 12 Layer | -- | +| io.netty:netty-codec | 4.1.100.Final | Fix Available | 2 | # 12 Layer | -- | +| io.netty:netty-codec-dns | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | +| io.netty:netty-codec-haproxy | 4.1.100.Final | Fix Available | 2 | # 12 Layer | -- | +| io.netty:netty-codec-http | 4.1.100.Final | Fix Available | 11 | # 12 Layer | -- | +| io.netty:netty-codec-http2 | 4.1.100.Final | Fix Available | 6 | # 12 Layer | -- | +| io.netty:netty-codec-mqtt | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | +| io.netty:netty-codec-redis | 4.1.100.Final | Fix Available | 5 | # 12 Layer | -- | +| io.netty:netty-codec-smtp | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | +| io.netty:netty-common | 4.1.100.Final | Fix Available | 2 | # 12 Layer | -- | +| io.netty:netty-handler | 4.1.100.Final | Fix Available | 4 | # 12 Layer | -- | +| io.netty:netty-handler-proxy | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | +| io.netty:netty-resolver-dns | 4.1.100.Final | Fix Available | 3 | # 12 Layer | -- | +| io.netty:netty-transport-native-epoll | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | +| io.netty:netty-transport-native-kqueue | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | +| io.netty:netty-transport-sctp | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | +| org.apache.avro:avro | 1.9.2 | Fix Available | 2 | # 12 Layer | -- | +| org.apache.commons:commons-compress | 1.21 | Fix Available | 2 | # 12 Layer | -- | +| org.apache.commons:commons-configuration2 | 2.8.0 | Fix Available | 3 | # 12 Layer | -- | +| org.apache.commons:commons-lang3 | 3.12.0 | Fix Available | 1 | # 12 Layer | -- | +| org.eclipse.jetty:jetty-http | 9.4.53.v20231009 | Fix Available | 3 | # 12 Layer | -- | +| org.jline:jline-remote-telnet | 3.9.0 | Fix Available | 2 | # 12 Layer | -- | ++-------------------------------------------+-------------------+---------------+------------+------------------+---------------+ Alpine:v3.21 -+---------------------------------------------------------------------------------------------------------------------------------------------+ -| Source:os:/lib/apk/db/installed | -+----------------+-------------------+-------------------------+------------+----------------------------+------------------+-----------------+ -| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | -+----------------+-------------------+-------------------------+------------+----------------------------+------------------+-----------------+ -| busybox | 1.37.0-r9 | Partial fixes Available | 3 | busybox... (3) | # 0 Layer | alpine | -| expat | 2.6.4-r0 | Fix Available | 22 | libexpat | # 5 Layer | eclipse-temurin | -| gnupg | 2.4.7-r0 | Fix Available | 2 | gnupg... (11) | # 5 Layer | eclipse-temurin | -| gnutls | 3.8.8-r0 | Fix Available | 21 | gnutls | # 5 Layer | eclipse-temurin | -| libpng | 1.6.44-r0 | Fix Available | 10 | libpng | # 5 Layer | eclipse-temurin | -| libtasn1 | 4.19.0-r2 | Fix Available | 2 | libtasn1 | # 5 Layer | eclipse-temurin | -| musl | 1.2.5-r8 | Fix Available | 3 | musl, musl-utils | # 0 Layer | alpine | -| openssl | 3.3.2-r4 | Partial fixes Available | 25 | libcrypto3, libssl3... (3) | # 0 Layer | alpine | -| p11-kit | 0.25.5-r2 | Fix Available | 1 | p11-kit... (2) | # 5 Layer | eclipse-temurin | -| sqlite | 3.47.1-r0 | Partial fixes Available | 5 | sqlite-libs | # 5 Layer | eclipse-temurin | -| zlib | 1.3.1-r2 | Fix Available | 2 | zlib | # 0 Layer | alpine | -+----------------+-------------------+-------------------------+------------+----------------------------+------------------+-----------------+ ++-----------------------------------------------------------------------------------------------------------------------------------+ +| Source:os:/lib/apk/db/installed | ++----------------+-------------------+---------------+------------+----------------------------+------------------+-----------------+ +| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | ++----------------+-------------------+---------------+------------+----------------------------+------------------+-----------------+ +| busybox | 1.37.0-r9 | Fix Available | 2 | busybox... (3) | # 0 Layer | alpine | +| expat | 2.6.4-r0 | Fix Available | 7 | libexpat | # 5 Layer | eclipse-temurin | +| gnupg | 2.4.7-r0 | Fix Available | 2 | gnupg... (11) | # 5 Layer | eclipse-temurin | +| gnutls | 3.8.8-r0 | Fix Available | 21 | gnutls | # 5 Layer | eclipse-temurin | +| libpng | 1.6.44-r0 | Fix Available | 11 | libpng | # 5 Layer | eclipse-temurin | +| libtasn1 | 4.19.0-r2 | Fix Available | 2 | libtasn1 | # 5 Layer | eclipse-temurin | +| musl | 1.2.5-r8 | Fix Available | 3 | musl, musl-utils | # 0 Layer | alpine | +| openssl | 3.3.2-r4 | Fix Available | 21 | libcrypto3, libssl3... (3) | # 0 Layer | alpine | +| sqlite | 3.47.1-r0 | Fix Available | 4 | sqlite-libs | # 5 Layer | eclipse-temurin | +| zlib | 1.3.1-r2 | Fix Available | 2 | zlib | # 0 Layer | alpine | ++----------------+-------------------+---------------+------------+----------------------------+------------------+-----------------+ For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve `. You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical `. @@ -716,7 +802,7 @@ Scanning local image tarball "./testdata/test-python-empty.tar" Container Scanning Result (Debian GNU/Linux 10 (buster)) (Based on "python" image): -Total 15 packages affected by 33 known vulnerabilities (0 Critical, 9 High, 8 Medium, 2 Low, 14 Unknown) from 2 ecosystems. +Total 15 packages affected by 33 known vulnerabilities (0 Critical, 7 High, 10 Medium, 2 Low, 14 Unknown) from 2 ecosystems. 33 vulnerabilities can be fixed. @@ -788,7 +874,7 @@ Scanning local image tarball "./testdata/test-python-full.tar" Container Scanning Result (Debian GNU/Linux 10 (buster)) (Based on "python" image): -Total 21 packages affected by 61 known vulnerabilities (1 Critical, 21 High, 22 Medium, 3 Low, 14 Unknown) from 2 ecosystems. +Total 21 packages affected by 61 known vulnerabilities (1 Critical, 19 High, 24 Medium, 3 Low, 14 Unknown) from 2 ecosystems. 61 vulnerabilities can be fixed. @@ -902,8 +988,8 @@ Scanning local image tarball "./testdata/test-package-tracing.tar" Container Scanning Result (Alpine Linux v3.20) (Based on "alpine" image): -Total 10 packages affected by 348 known vulnerabilities (2 Critical, 17 High, 15 Medium, 2 Low, 312 Unknown) from 2 ecosystems. -343 vulnerabilities can be fixed. +Total 10 packages affected by 331 known vulnerabilities (2 Critical, 14 High, 13 Medium, 2 Low, 300 Unknown) from 2 ecosystems. +331 vulnerabilities can be fixed. Go @@ -912,54 +998,54 @@ Go +---------+-------------------+---------------+------------+------------------+---------------+ | PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | +---------+-------------------+---------------+------------+------------------+---------------+ -| stdlib | 1.22.4 | Fix Available | 52 | # 9 Layer | -- | +| stdlib | 1.22.4 | Fix Available | 50 | # 9 Layer | -- | +---------+-------------------+---------------+------------+------------------+---------------+ +---------------------------------------------------------------------------------------------+ | Source:artifact:/go/bin/ptf-1.2.0 | +---------+-------------------+---------------+------------+------------------+---------------+ | PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | +---------+-------------------+---------------+------------+------------------+---------------+ -| stdlib | 1.22.4 | Fix Available | 52 | # 2 Layer | -- | +| stdlib | 1.22.4 | Fix Available | 50 | # 2 Layer | -- | +---------+-------------------+---------------+------------+------------------+---------------+ +---------------------------------------------------------------------------------------------+ | Source:artifact:/go/bin/ptf-1.3.0 | +---------+-------------------+---------------+------------+------------------+---------------+ | PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | +---------+-------------------+---------------+------------+------------------+---------------+ -| stdlib | 1.22.4 | Fix Available | 52 | # 4 Layer | -- | +| stdlib | 1.22.4 | Fix Available | 50 | # 4 Layer | -- | +---------+-------------------+---------------+------------+------------------+---------------+ +---------------------------------------------------------------------------------------------+ | Source:artifact:/go/bin/ptf-1.3.0-moved | +---------+-------------------+---------------+------------+------------------+---------------+ | PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | +---------+-------------------+---------------+------------+------------------+---------------+ -| stdlib | 1.22.4 | Fix Available | 52 | # 3 Layer | -- | +| stdlib | 1.22.4 | Fix Available | 50 | # 3 Layer | -- | +---------+-------------------+---------------+------------+------------------+---------------+ +---------------------------------------------------------------------------------------------+ | Source:artifact:/go/bin/ptf-1.4.0 | +---------+-------------------+---------------+------------+------------------+---------------+ | PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | +---------+-------------------+---------------+------------+------------------+---------------+ -| stdlib | 1.22.4 | Fix Available | 52 | # 2 Layer | -- | +| stdlib | 1.22.4 | Fix Available | 50 | # 2 Layer | -- | +---------+-------------------+---------------+------------+------------------+---------------+ +---------------------------------------------------------------------------------------------+ | Source:artifact:/go/bin/ptf-vulnerable | +---------+-------------------+---------------+------------+------------------+---------------+ | PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | +---------+-------------------+---------------+------------+------------------+---------------+ -| stdlib | 1.22.4 | Fix Available | 52 | # 7 Layer | -- | +| stdlib | 1.22.4 | Fix Available | 50 | # 7 Layer | -- | +---------+-------------------+---------------+------------+------------------+---------------+ Alpine:v3.20 -+----------------------------------------------------------------------------------------------------------------------------------------+ -| Source:os:/lib/apk/db/installed | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| busybox | 1.36.1-r29 | Partial fixes Available | 3 | busybox... (3) | # 0 Layer | alpine | -| musl | 1.2.5-r0 | Fix Available | 3 | musl, musl-utils | # 0 Layer | alpine | -| openssl | 3.3.1-r0 | Partial fixes Available | 28 | libcrypto3, libssl3 | # 0 Layer | alpine | -| zlib | 1.3.1-r1 | Fix Available | 2 | zlib | # 0 Layer | alpine | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ ++------------------------------------------------------------------------------------------------------------------------------+ +| Source:os:/lib/apk/db/installed | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| busybox | 1.36.1-r29 | Fix Available | 2 | busybox... (3) | # 0 Layer | alpine | +| musl | 1.2.5-r0 | Fix Available | 3 | musl, musl-utils | # 0 Layer | alpine | +| openssl | 3.3.1-r0 | Fix Available | 24 | libcrypto3, libssl3 | # 0 Layer | alpine | +| zlib | 1.3.1-r1 | Fix Available | 2 | zlib | # 0 Layer | alpine | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve `. You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical `. @@ -1083,52 +1169,52 @@ Scanning local image tarball "./testdata/test-chisel.tar" Container Scanning Result (Ubuntu 26.04 LTS): -Total 7 packages affected by 151 known vulnerabilities (0 Critical, 0 High, 1 Medium, 0 Low, 150 Unknown) from 2 ecosystems. -150 vulnerabilities can be fixed. +Total 7 packages affected by 121 known vulnerabilities (0 Critical, 0 High, 1 Medium, 0 Low, 120 Unknown) from 2 ecosystems. +120 vulnerabilities can be fixed. Go +---------------------------------------------------------------------------------------------+ -| Source:artifact:/usr/lib/go-1.26/bin/go | +| Source:artifact:/usr/lib/go-1.25/bin/go | +---------+-------------------+---------------+------------+------------------+---------------+ | PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | +---------+-------------------+---------------+------------+------------------+---------------+ -| stdlib | 1.26.0 | Fix Available | 25 | # 0 Layer | -- | +| stdlib | 1.25.7 | Fix Available | 20 | # 0 Layer | -- | +---------+-------------------+---------------+------------+------------------+---------------+ +---------------------------------------------------------------------------------------------+ -| Source:artifact:/usr/lib/go-1.26/bin/gofmt | +| Source:artifact:/usr/lib/go-1.25/bin/gofmt | +---------+-------------------+---------------+------------+------------------+---------------+ | PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | +---------+-------------------+---------------+------------+------------------+---------------+ -| stdlib | 1.26.0 | Fix Available | 25 | # 0 Layer | -- | +| stdlib | 1.25.7 | Fix Available | 20 | # 0 Layer | -- | +---------+-------------------+---------------+------------+------------------+---------------+ +---------------------------------------------------------------------------------------------+ -| Source:artifact:/usr/lib/go-1.26/pkg/tool/linux_amd64/asm | +| Source:artifact:/usr/lib/go-1.25/pkg/tool/linux_amd64/asm | +---------+-------------------+---------------+------------+------------------+---------------+ | PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | +---------+-------------------+---------------+------------+------------------+---------------+ -| stdlib | 1.26.0 | Fix Available | 25 | # 0 Layer | -- | +| stdlib | 1.25.7 | Fix Available | 20 | # 0 Layer | -- | +---------+-------------------+---------------+------------+------------------+---------------+ +---------------------------------------------------------------------------------------------+ -| Source:artifact:/usr/lib/go-1.26/pkg/tool/linux_amd64/compile | +| Source:artifact:/usr/lib/go-1.25/pkg/tool/linux_amd64/compile | +---------+-------------------+---------------+------------+------------------+---------------+ | PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | +---------+-------------------+---------------+------------+------------------+---------------+ -| stdlib | 1.26.0 | Fix Available | 25 | # 0 Layer | -- | +| stdlib | 1.25.7 | Fix Available | 20 | # 0 Layer | -- | +---------+-------------------+---------------+------------+------------------+---------------+ +---------------------------------------------------------------------------------------------+ -| Source:artifact:/usr/lib/go-1.26/pkg/tool/linux_amd64/link | +| Source:artifact:/usr/lib/go-1.25/pkg/tool/linux_amd64/link | +---------+-------------------+---------------+------------+------------------+---------------+ | PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | +---------+-------------------+---------------+------------+------------------+---------------+ -| stdlib | 1.26.0 | Fix Available | 25 | # 0 Layer | -- | +| stdlib | 1.25.7 | Fix Available | 20 | # 0 Layer | -- | +---------+-------------------+---------------+------------+------------------+---------------+ +---------------------------------------------------------------------------------------------+ -| Source:artifact:/usr/lib/go-1.26/pkg/tool/linux_amd64/vet | +| Source:artifact:/usr/lib/go-1.25/pkg/tool/linux_amd64/vet | +---------+-------------------+---------------+------------+------------------+---------------+ | PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | +---------+-------------------+---------------+------------+------------------+---------------+ -| stdlib | 1.26.0 | Fix Available | 25 | # 0 Layer | -- | +| stdlib | 1.25.7 | Fix Available | 20 | # 0 Layer | -- | +---------+-------------------+---------------+------------+------------------+---------------+ Ubuntu:26.04 +-------------------------------------------------------------------------------------------------------------------------------------------+ @@ -1153,19 +1239,19 @@ Scanning local image tarball "./testdata/test-node_modules-npm-empty.tar" Container Scanning Result (Alpine Linux v3.19) (Based on "node" image): -Total 2 packages affected by 20 known vulnerabilities (1 Critical, 6 High, 11 Medium, 2 Low, 0 Unknown) from 1 ecosystem. +Total 2 packages affected by 15 known vulnerabilities (1 Critical, 3 High, 9 Medium, 2 Low, 0 Unknown) from 1 ecosystem. 15 vulnerabilities can be fixed. Alpine:v3.19 -+----------------------------------------------------------------------------------------------------------------------------------------+ -| Source:os:/lib/apk/db/installed | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| busybox | 1.36.1-r15 | Partial fixes Available | 7 | busybox... (3) | # 0 Layer | alpine | -| openssl | 3.1.4-r5 | Partial fixes Available | 13 | libcrypto3, libssl3 | # 0 Layer | alpine | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ ++------------------------------------------------------------------------------------------------------------------------------+ +| Source:os:/lib/apk/db/installed | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| busybox | 1.36.1-r15 | Fix Available | 6 | busybox... (3) | # 0 Layer | alpine | +| openssl | 3.1.4-r5 | Fix Available | 9 | libcrypto3, libssl3 | # 0 Layer | alpine | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve `. You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical `. @@ -1181,7 +1267,7 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" Container Scanning Result (Alpine Linux v3.19) (Based on "node" image): -Total 4 packages affected by 23 known vulnerabilities (3 Critical, 6 High, 12 Medium, 2 Low, 0 Unknown) from 2 ecosystems. +Total 4 packages affected by 18 known vulnerabilities (3 Critical, 3 High, 10 Medium, 2 Low, 0 Unknown) from 2 ecosystems. 17 vulnerabilities can be fixed. @@ -1195,14 +1281,14 @@ npm | minimist | 0.0.8 | Fix Available | 2 | # 13 Layer | -- | +----------+-------------------+------------------+------------+------------------+---------------+ Alpine:v3.19 -+----------------------------------------------------------------------------------------------------------------------------------------+ -| Source:os:/lib/apk/db/installed | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| busybox | 1.36.1-r15 | Partial fixes Available | 7 | busybox... (3) | # 0 Layer | alpine | -| openssl | 3.1.4-r5 | Partial fixes Available | 13 | libcrypto3, libssl3 | # 0 Layer | alpine | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ ++------------------------------------------------------------------------------------------------------------------------------+ +| Source:os:/lib/apk/db/installed | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| busybox | 1.36.1-r15 | Fix Available | 6 | busybox... (3) | # 0 Layer | alpine | +| openssl | 3.1.4-r5 | Fix Available | 9 | libcrypto3, libssl3 | # 0 Layer | alpine | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve `. You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical `. @@ -1218,19 +1304,19 @@ Scanning local image tarball "./testdata/test-node_modules-pnpm-empty.tar" Container Scanning Result (Alpine Linux v3.19) (Based on "node" image): -Total 2 packages affected by 20 known vulnerabilities (1 Critical, 6 High, 11 Medium, 2 Low, 0 Unknown) from 1 ecosystem. +Total 2 packages affected by 15 known vulnerabilities (1 Critical, 3 High, 9 Medium, 2 Low, 0 Unknown) from 1 ecosystem. 15 vulnerabilities can be fixed. Alpine:v3.19 -+----------------------------------------------------------------------------------------------------------------------------------------+ -| Source:os:/lib/apk/db/installed | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| busybox | 1.36.1-r15 | Partial fixes Available | 7 | busybox... (3) | # 0 Layer | alpine | -| openssl | 3.1.4-r5 | Partial fixes Available | 13 | libcrypto3, libssl3 | # 0 Layer | alpine | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ ++------------------------------------------------------------------------------------------------------------------------------+ +| Source:os:/lib/apk/db/installed | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| busybox | 1.36.1-r15 | Fix Available | 6 | busybox... (3) | # 0 Layer | alpine | +| openssl | 3.1.4-r5 | Fix Available | 9 | libcrypto3, libssl3 | # 0 Layer | alpine | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve `. You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical `. @@ -1246,19 +1332,19 @@ Scanning local image tarball "./testdata/test-node_modules-pnpm-full.tar" Container Scanning Result (Alpine Linux v3.19) (Based on "node" image): -Total 2 packages affected by 20 known vulnerabilities (1 Critical, 6 High, 11 Medium, 2 Low, 0 Unknown) from 1 ecosystem. +Total 2 packages affected by 15 known vulnerabilities (1 Critical, 3 High, 9 Medium, 2 Low, 0 Unknown) from 1 ecosystem. 15 vulnerabilities can be fixed. Alpine:v3.19 -+----------------------------------------------------------------------------------------------------------------------------------------+ -| Source:os:/lib/apk/db/installed | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| busybox | 1.36.1-r15 | Partial fixes Available | 7 | busybox... (3) | # 0 Layer | alpine | -| openssl | 3.1.4-r5 | Partial fixes Available | 13 | libcrypto3, libssl3 | # 0 Layer | alpine | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ ++------------------------------------------------------------------------------------------------------------------------------+ +| Source:os:/lib/apk/db/installed | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| busybox | 1.36.1-r15 | Fix Available | 6 | busybox... (3) | # 0 Layer | alpine | +| openssl | 3.1.4-r5 | Fix Available | 9 | libcrypto3, libssl3 | # 0 Layer | alpine | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve `. You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical `. @@ -1274,19 +1360,19 @@ Scanning local image tarball "./testdata/test-node_modules-yarn-empty.tar" Container Scanning Result (Alpine Linux v3.19) (Based on "node" image): -Total 2 packages affected by 20 known vulnerabilities (1 Critical, 6 High, 11 Medium, 2 Low, 0 Unknown) from 1 ecosystem. +Total 2 packages affected by 15 known vulnerabilities (1 Critical, 3 High, 9 Medium, 2 Low, 0 Unknown) from 1 ecosystem. 15 vulnerabilities can be fixed. Alpine:v3.19 -+----------------------------------------------------------------------------------------------------------------------------------------+ -| Source:os:/lib/apk/db/installed | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| busybox | 1.36.1-r15 | Partial fixes Available | 7 | busybox... (3) | # 0 Layer | alpine | -| openssl | 3.1.4-r5 | Partial fixes Available | 13 | libcrypto3, libssl3 | # 0 Layer | alpine | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ ++------------------------------------------------------------------------------------------------------------------------------+ +| Source:os:/lib/apk/db/installed | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| busybox | 1.36.1-r15 | Fix Available | 6 | busybox... (3) | # 0 Layer | alpine | +| openssl | 3.1.4-r5 | Fix Available | 9 | libcrypto3, libssl3 | # 0 Layer | alpine | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve `. You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical `. @@ -1302,19 +1388,19 @@ Scanning local image tarball "./testdata/test-node_modules-yarn-full.tar" Container Scanning Result (Alpine Linux v3.19) (Based on "node" image): -Total 2 packages affected by 20 known vulnerabilities (1 Critical, 6 High, 11 Medium, 2 Low, 0 Unknown) from 1 ecosystem. +Total 2 packages affected by 15 known vulnerabilities (1 Critical, 3 High, 9 Medium, 2 Low, 0 Unknown) from 1 ecosystem. 15 vulnerabilities can be fixed. Alpine:v3.19 -+----------------------------------------------------------------------------------------------------------------------------------------+ -| Source:os:/lib/apk/db/installed | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| busybox | 1.36.1-r15 | Partial fixes Available | 7 | busybox... (3) | # 0 Layer | alpine | -| openssl | 3.1.4-r5 | Partial fixes Available | 13 | libcrypto3, libssl3 | # 0 Layer | alpine | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ ++------------------------------------------------------------------------------------------------------------------------------+ +| Source:os:/lib/apk/db/installed | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| busybox | 1.36.1-r15 | Fix Available | 6 | busybox... (3) | # 0 Layer | alpine | +| openssl | 3.1.4-r5 | Fix Available | 9 | libcrypto3, libssl3 | # 0 Layer | alpine | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve `. You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical `. @@ -1331,7 +1417,7 @@ skipping file "home/linuxbrew/.linuxbrew/Homebrew/Library/Taps/homebrew/homebrew Container Scanning Result (Ubuntu 22.04.5 LTS): -Total 1 package affected by 3 known vulnerabilities (1 Critical, 1 High, 0 Medium, 1 Low, 0 Unknown) from 1 ecosystem. +Total 1 package affected by 3 known vulnerabilities (1 Critical, 1 High, 1 Medium, 0 Low, 0 Unknown) from 1 ecosystem. 0 vulnerabilities can be fixed. @@ -1374,15 +1460,12 @@ You can also view the full vulnerability list in your terminal with: `osv-scanne "groups": 6, "vulnerabilities": [ "PYSEC-2023-228", - "PYSEC-2026-1795", - "PYSEC-2026-1796", "PYSEC-2026-196", "GHSA-4xh5-x5gv-qwph", "GHSA-58qw-9mgm-455v", "GHSA-6vgw-5pg2-w6jp", "GHSA-jp4c-xjxw-mgf9", - "GHSA-mq26-g339-26xf", - "GHSA-wf93-45jw-7689" + "GHSA-mq26-g339-26xf" ] } ] @@ -1406,7 +1489,6 @@ You can also view the full vulnerability list in your terminal with: `osv-scanne "vulnerabilities": [ "PYSEC-2022-43012", "PYSEC-2025-49", - "PYSEC-2026-1918", "GHSA-5rjg-fvgr-3xxf", "GHSA-cx63-2mw6-8hw5", "GHSA-r9hx-vwmv-q579" @@ -1432,7 +1514,6 @@ You can also view the full vulnerability list in your terminal with: `osv-scanne "groups": 7, "vulnerabilities": [ "PYSEC-2021-98", - "PYSEC-2026-1297", "GHSA-68w8-qjq3-2gfm", "GHSA-6w2r-r2m5-xq5w", "GHSA-7xr5-9hcq-chf9", @@ -1515,15 +1596,12 @@ You can also view the full vulnerability list in your terminal with: `osv-scanne "groups": 6, "vulnerabilities": [ "PYSEC-2023-228", - "PYSEC-2026-1795", - "PYSEC-2026-1796", "PYSEC-2026-196", "GHSA-4xh5-x5gv-qwph", "GHSA-58qw-9mgm-455v", "GHSA-6vgw-5pg2-w6jp", "GHSA-jp4c-xjxw-mgf9", - "GHSA-mq26-g339-26xf", - "GHSA-wf93-45jw-7689" + "GHSA-mq26-g339-26xf" ] } ] @@ -1546,8 +1624,6 @@ You can also view the full vulnerability list in your terminal with: `osv-scanne "groups": 4, "vulnerabilities": [ "PYSEC-2023-74", - "PYSEC-2026-1872", - "PYSEC-2026-1873", "GHSA-9hjg-9r4m-mvj7", "GHSA-9wx4-h78v-vm56", "GHSA-gc5v-m9x4-r6x2", @@ -1575,7 +1651,6 @@ You can also view the full vulnerability list in your terminal with: `osv-scanne "vulnerabilities": [ "PYSEC-2022-43012", "PYSEC-2025-49", - "PYSEC-2026-1918", "GHSA-5rjg-fvgr-3xxf", "GHSA-cx63-2mw6-8hw5", "GHSA-r9hx-vwmv-q579" @@ -1604,11 +1679,6 @@ You can also view the full vulnerability list in your terminal with: `osv-scanne "PYSEC-2023-192", "PYSEC-2023-212", "PYSEC-2026-141", - "PYSEC-2026-1994", - "PYSEC-2026-1995", - "PYSEC-2026-1996", - "PYSEC-2026-1998", - "PYSEC-2026-1999", "GHSA-2xpw-w6gg-jr37", "GHSA-34jh-p97f-mpxf", "GHSA-38jv-5279-wg99", @@ -1639,7 +1709,6 @@ You can also view the full vulnerability list in your terminal with: `osv-scanne }, "groups": 2, "vulnerabilities": [ - "PYSEC-2026-2044", "GHSA-29vq-49wr-vm6x", "GHSA-87hc-h4r5-73f7" ] @@ -1663,7 +1732,6 @@ You can also view the full vulnerability list in your terminal with: `osv-scanne }, "groups": 1, "vulnerabilities": [ - "PYSEC-2026-2047", "GHSA-8rrh-rw8j-w5fx" ] } @@ -2138,19 +2206,19 @@ You can also view the full vulnerability list in your terminal with: `osv-scanne }, { "diff_id": "sha256:...", - "command": "COPY ./python-fixture/req...", + "command": "COPY file:ac7d7ae19a2bef3...", "is_empty": false, "base_image_index": 0 }, { "diff_id": "sha256:...", - "command": "RUN /bin/sh -c pip instal...", + "command": "RUN /0pip install --no-ca...", "is_empty": false, "base_image_index": 0 }, { "diff_id": "sha256:...", - "command": "COPY python-fixture/main....", + "command": "COPY file:0f8c0400baa4c00...", "is_empty": false, "base_image_index": 0 }, @@ -2182,226 +2250,1546 @@ Scanning local image tarball "./testdata/test-python-full.tar" --- -[TestCommand_OCIImage_JSONFormat/scanning_image_with_deprecated_packages - 1] +[TestCommand_OCIImage_JSONFormat/scanning_almalinux_9_image - 1] { "results": [ { "source": { - "path": "/app/rust_novuln_deprecated", + "path": "/usr/share/python3-wheels/pip-21.2.3-py3-none-any.whl", "type": "artifact" }, "packages": [ { "package": { - "name": "url", - "version": "2.5.3", - "ecosystem": "crates.io", - "deprecated": true, + "name": "pip", + "version": "21.2.3", + "ecosystem": "PyPI", "image_origin_details": { - "index": 2 + "index": 0 } - } + }, + "groups": 6, + "vulnerabilities": [ + "PYSEC-2023-228", + "PYSEC-2026-1795", + "PYSEC-2026-1796", + "PYSEC-2026-196", + "GHSA-4xh5-x5gv-qwph", + "GHSA-58qw-9mgm-455v", + "GHSA-6vgw-5pg2-w6jp", + "GHSA-jp4c-xjxw-mgf9", + "GHSA-mq26-g339-26xf", + "GHSA-wf93-45jw-7689" + ] } ] }, { "source": { - "path": "/lib/apk/db/installed", - "type": "os" + "path": "/usr/share/python3-wheels/setuptools-53.0.0-py3-none-any.whl", + "type": "artifact" }, "packages": [ { "package": { - "name": "busybox", - "os_package_name": "busybox", - "version": "1.37.0-r19", - "ecosystem": "Alpine:v3.22", - "commit": "bd8ab811155a6087ba7480103d89e2500e3cb0eb", + "name": "setuptools", + "version": "53.0.0", + "ecosystem": "PyPI", "image_origin_details": { "index": 0 } }, "groups": 3, "vulnerabilities": [ - "ALPINE-CVE-2021-42376", - "ALPINE-CVE-2024-58251", - "ALPINE-CVE-2025-46394" + "PYSEC-2022-43012", + "PYSEC-2025-49", + "PYSEC-2026-1918", + "GHSA-5rjg-fvgr-3xxf", + "GHSA-cx63-2mw6-8hw5", + "GHSA-r9hx-vwmv-q579" ] - }, + } + ] + }, + { + "source": { + "path": "/var/lib/rpm/rpmdb.sqlite", + "type": "os" + }, + "packages": [ { "package": { - "name": "busybox", - "os_package_name": "busybox-binsh", - "version": "1.37.0-r19", - "ecosystem": "Alpine:v3.22", - "commit": "bd8ab811155a6087ba7480103d89e2500e3cb0eb", + "name": "bash", + "os_package_name": "bash", + "version": "5.1.8-4.el9", + "ecosystem": "AlmaLinux:9", "image_origin_details": { "index": 0 } }, - "groups": 3, + "groups": 1, "vulnerabilities": [ - "ALPINE-CVE-2021-42376", - "ALPINE-CVE-2024-58251", - "ALPINE-CVE-2025-46394" + "ALSA-2023:0340" ] }, { "package": { - "name": "openssl", - "os_package_name": "libcrypto3", - "version": "3.5.4-r0", - "ecosystem": "Alpine:v3.22", - "commit": "8f330e62bd41c2ac23dbd866fea36fb8e22f8422", + "name": "binutils", + "os_package_name": "binutils", + "version": "2.35.2-17.el9", + "ecosystem": "AlmaLinux:9", "image_origin_details": { "index": 0 } }, - "groups": 38, + "groups": 2, "vulnerabilities": [ - "ALPINE-CVE-2022-1292", - "ALPINE-CVE-2022-2068", - "ALPINE-CVE-2023-0466", - "ALPINE-CVE-2023-4807", - "ALPINE-CVE-2025-11187", - "ALPINE-CVE-2025-15467", - "ALPINE-CVE-2025-15468", - "ALPINE-CVE-2025-15469", - "ALPINE-CVE-2025-66199", - "ALPINE-CVE-2025-68160", - "ALPINE-CVE-2025-69418", - "ALPINE-CVE-2025-69419", - "ALPINE-CVE-2025-69420", - "ALPINE-CVE-2025-69421", - "ALPINE-CVE-2026-22795", - "ALPINE-CVE-2026-22796", - "ALPINE-CVE-2026-2673", - "ALPINE-CVE-2026-28387", - "ALPINE-CVE-2026-28388", - "ALPINE-CVE-2026-28389", - "ALPINE-CVE-2026-28390", - "ALPINE-CVE-2026-31789", - "ALPINE-CVE-2026-31790", - "ALPINE-CVE-2026-34180", - "ALPINE-CVE-2026-34181", - "ALPINE-CVE-2026-34182", - "ALPINE-CVE-2026-34183", - "ALPINE-CVE-2026-42764", - "ALPINE-CVE-2026-42766", - "ALPINE-CVE-2026-42767", - "ALPINE-CVE-2026-42768", - "ALPINE-CVE-2026-42769", - "ALPINE-CVE-2026-42770", - "ALPINE-CVE-2026-45445", - "ALPINE-CVE-2026-45446", - "ALPINE-CVE-2026-45447", - "ALPINE-CVE-2026-7383", - "ALPINE-CVE-2026-9076" + "ALSA-2023:6593", + "ALSA-2025:23343" ] }, { "package": { - "name": "openssl", - "os_package_name": "libssl3", - "version": "3.5.4-r0", - "ecosystem": "Alpine:v3.22", - "commit": "8f330e62bd41c2ac23dbd866fea36fb8e22f8422", + "name": "binutils-gold", + "os_package_name": "binutils-gold", + "version": "2.35.2-17.el9", + "ecosystem": "AlmaLinux:9", "image_origin_details": { "index": 0 } }, - "groups": 38, + "groups": 2, "vulnerabilities": [ - "ALPINE-CVE-2022-1292", - "ALPINE-CVE-2022-2068", - "ALPINE-CVE-2023-0466", - "ALPINE-CVE-2023-4807", - "ALPINE-CVE-2025-11187", - "ALPINE-CVE-2025-15467", - "ALPINE-CVE-2025-15468", - "ALPINE-CVE-2025-15469", - "ALPINE-CVE-2025-66199", - "ALPINE-CVE-2025-68160", - "ALPINE-CVE-2025-69418", - "ALPINE-CVE-2025-69419", - "ALPINE-CVE-2025-69420", - "ALPINE-CVE-2025-69421", - "ALPINE-CVE-2026-22795", - "ALPINE-CVE-2026-22796", - "ALPINE-CVE-2026-2673", - "ALPINE-CVE-2026-28387", - "ALPINE-CVE-2026-28388", - "ALPINE-CVE-2026-28389", - "ALPINE-CVE-2026-28390", - "ALPINE-CVE-2026-31789", - "ALPINE-CVE-2026-31790", - "ALPINE-CVE-2026-34180", - "ALPINE-CVE-2026-34181", - "ALPINE-CVE-2026-34182", - "ALPINE-CVE-2026-34183", - "ALPINE-CVE-2026-42764", - "ALPINE-CVE-2026-42766", - "ALPINE-CVE-2026-42767", - "ALPINE-CVE-2026-42768", - "ALPINE-CVE-2026-42769", - "ALPINE-CVE-2026-42770", - "ALPINE-CVE-2026-45445", - "ALPINE-CVE-2026-45446", - "ALPINE-CVE-2026-45447", - "ALPINE-CVE-2026-7383", - "ALPINE-CVE-2026-9076" + "ALSA-2023:6593", + "ALSA-2025:23343" ] }, { "package": { - "name": "musl", - "os_package_name": "musl", - "version": "1.2.5-r10", - "ecosystem": "Alpine:v3.22", - "commit": "1a5f5e699b2eae883e73c93a789f87bd89a2a190", + "name": "bzip2-libs", + "os_package_name": "bzip2-libs", + "version": "1.0.8-8.el9", + "ecosystem": "AlmaLinux:9", "image_origin_details": { "index": 0 } }, - "groups": 2, + "groups": 1, "vulnerabilities": [ - "ALPINE-CVE-2026-40200", - "ALPINE-CVE-2026-6042" + "ALSA-2025:0925" ] }, { "package": { - "name": "musl", - "os_package_name": "musl-utils", - "version": "1.2.5-r10", - "ecosystem": "Alpine:v3.22", - "commit": "1a5f5e699b2eae883e73c93a789f87bd89a2a190", + "name": "coreutils-single", + "os_package_name": "coreutils-single", + "version": "8.32-31.el9", + "ecosystem": "AlmaLinux:9", "image_origin_details": { "index": 0 } }, - "groups": 2, + "groups": 1, "vulnerabilities": [ - "ALPINE-CVE-2026-40200", - "ALPINE-CVE-2026-6042" + "ALSA-2026:28911" ] }, { "package": { - "name": "busybox", - "os_package_name": "ssl_client", - "version": "1.37.0-r19", - "ecosystem": "Alpine:v3.22", - "commit": "bd8ab811155a6087ba7480103d89e2500e3cb0eb", + "name": "curl-minimal", + "os_package_name": "curl-minimal", + "version": "7.76.1-14.el9_0.5", + "ecosystem": "AlmaLinux:9", "image_origin_details": { "index": 0 } }, - "groups": 3, + "groups": 12, "vulnerabilities": [ - "ALPINE-CVE-2021-42376", - "ALPINE-CVE-2024-58251", - "ALPINE-CVE-2025-46394" + "ALSA-2022:8299", + "ALSA-2023:0333", + "ALSA-2023:1701", + "ALSA-2023:2478", + "ALSA-2023:2650", + "ALSA-2023:4354", + "ALSA-2023:5763", + "ALSA-2023:6679", + "ALSA-2023:6745", + "ALSA-2024:1129", + "ALSA-2024:5529", + "ALSA-2026:1350" + ] + }, + { + "package": { + "name": "dbus", + "os_package_name": "dbus", + "version": "1.12.20-5.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 2, + "vulnerabilities": [ + "ALSA-2023:0335", + "ALSA-2023:4569" + ] + }, + { + "package": { + "name": "dbus-common", + "os_package_name": "dbus-common", + "version": "1.12.20-5.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 2, + "vulnerabilities": [ + "ALSA-2023:0335", + "ALSA-2023:4569" + ] + }, + { + "package": { + "name": "expat", + "os_package_name": "expat", + "version": "2.2.10-12.el9_0.3", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 8, + "vulnerabilities": [ + "ALSA-2023:0337", + "ALSA-2024:1530", + "ALSA-2024:6754", + "ALSA-2024:9541", + "ALSA-2025:22175", + "ALSA-2025:3531", + "ALSA-2025:7444", + "ALSA-2026:23230" + ] + }, + { + "package": { + "name": "file-libs", + "os_package_name": "file-libs", + "version": "5.39-8.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2024:2512" + ] + }, + { + "package": { + "name": "glib2", + "os_package_name": "glib2", + "version": "2.68.4-5.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 6, + "vulnerabilities": [ + "ALSA-2023:6631", + "ALSA-2024:6464", + "ALSA-2025:11140", + "ALSA-2026:0936", + "ALSA-2026:15971", + "ALSA-2026:19361" + ] + }, + { + "package": { + "name": "glibc", + "os_package_name": "glibc", + "version": "2.34-28.el9_0.2", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 8, + "vulnerabilities": [ + "ALSA-2023:5453", + "ALSA-2024:3339", + "ALSA-2025:4244", + "ALSA-2025:8655", + "ALSA-2025:9877", + "ALSA-2026:20597", + "ALSA-2026:2786", + "ALSA-2026:33226" + ] + }, + { + "package": { + "name": "glibc-common", + "os_package_name": "glibc-common", + "version": "2.34-28.el9_0.2", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 8, + "vulnerabilities": [ + "ALSA-2023:5453", + "ALSA-2024:3339", + "ALSA-2025:4244", + "ALSA-2025:8655", + "ALSA-2025:9877", + "ALSA-2026:20597", + "ALSA-2026:2786", + "ALSA-2026:33226" + ] + }, + { + "package": { + "name": "glibc-minimal-langpack", + "os_package_name": "glibc-minimal-langpack", + "version": "2.34-28.el9_0.2", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 8, + "vulnerabilities": [ + "ALSA-2023:5453", + "ALSA-2024:3339", + "ALSA-2025:4244", + "ALSA-2025:8655", + "ALSA-2025:9877", + "ALSA-2026:20597", + "ALSA-2026:2786", + "ALSA-2026:33226" + ] + }, + { + "package": { + "name": "gmp", + "os_package_name": "gmp", + "version": "6.2.0-10.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2023:6661" + ] + }, + { + "package": { + "name": "gnupg2", + "os_package_name": "gnupg2", + "version": "2.3.3-2.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2026:0719" + ] + }, + { + "package": { + "name": "gnutls", + "os_package_name": "gnutls", + "version": "3.7.6-12.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 8, + "vulnerabilities": [ + "ALSA-2023:1141", + "ALSA-2024:0533", + "ALSA-2024:1879", + "ALSA-2024:2570", + "ALSA-2025:16116", + "ALSA-2025:7076", + "ALSA-2026:20612", + "ALSA-2026:4188" + ] + }, + { + "package": { + "name": "iputils", + "os_package_name": "iputils", + "version": "20210202-7.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 2, + "vulnerabilities": [ + "ALSA-2025:17558", + "ALSA-2025:9432" + ] + }, + { + "package": { + "name": "krb5-libs", + "os_package_name": "krb5-libs", + "version": "1.19.1-15.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 9, + "vulnerabilities": [ + "ALSA-2022:8637", + "ALSA-2023:2570", + "ALSA-2023:6699", + "ALSA-2024:6166", + "ALSA-2024:9331", + "ALSA-2024:9474", + "ALSA-2025:7067", + "ALSA-2025:9430", + "ALSA-2026:19357" + ] + }, + { + "package": { + "name": "less", + "os_package_name": "less", + "version": "590-1.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 3, + "vulnerabilities": [ + "ALSA-2023:3725", + "ALSA-2024:1692", + "ALSA-2024:3513" + ] + }, + { + "package": { + "name": "libarchive", + "os_package_name": "libarchive", + "version": "3.5.3-2.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 5, + "vulnerabilities": [ + "ALSA-2023:2532", + "ALSA-2025:14130", + "ALSA-2025:9431", + "ALSA-2026:5080", + "ALSA-2026:8510" + ] + }, + { + "package": { + "name": "libblkid", + "os_package_name": "libblkid", + "version": "2.37.4-3.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2026:1913" + ] + }, + { + "package": { + "name": "libcap", + "os_package_name": "libcap", + "version": "2.48-8.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 3, + "vulnerabilities": [ + "ALSA-2023:5071", + "ALSA-2026:12441", + "ALSA-2026:19346" + ] + }, + { + "package": { + "name": "libcom_err", + "os_package_name": "libcom_err", + "version": "1.46.5-2.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2022:8361" + ] + }, + { + "package": { + "name": "libcurl-minimal", + "os_package_name": "libcurl-minimal", + "version": "7.76.1-14.el9_0.5", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 12, + "vulnerabilities": [ + "ALSA-2022:8299", + "ALSA-2023:0333", + "ALSA-2023:1701", + "ALSA-2023:2478", + "ALSA-2023:2650", + "ALSA-2023:4354", + "ALSA-2023:5763", + "ALSA-2023:6679", + "ALSA-2023:6745", + "ALSA-2024:1129", + "ALSA-2024:5529", + "ALSA-2026:1350" + ] + }, + { + "package": { + "name": "libeconf", + "os_package_name": "libeconf", + "version": "0.4.1-2.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2023:4347" + ] + }, + { + "package": { + "name": "libfdisk", + "os_package_name": "libfdisk", + "version": "2.37.4-3.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2026:1913" + ] + }, + { + "package": { + "name": "libgcc", + "os_package_name": "libgcc", + "version": "11.2.1-9.4.el9.alma", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2025:1346" + ] + }, + { + "package": { + "name": "libgcrypt", + "os_package_name": "libgcrypt", + "version": "1.10.0-5.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2024:9404" + ] + }, + { + "package": { + "name": "libgomp", + "os_package_name": "libgomp", + "version": "11.2.1-9.4.el9.alma", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2025:1346" + ] + }, + { + "package": { + "name": "libksba", + "os_package_name": "libksba", + "version": "1.5.1-5.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2023:0626" + ] + }, + { + "package": { + "name": "libmount", + "os_package_name": "libmount", + "version": "2.37.4-3.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2026:1913" + ] + }, + { + "package": { + "name": "libnghttp2", + "os_package_name": "libnghttp2", + "version": "1.43.0-5.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 4, + "vulnerabilities": [ + "ALSA-2023:5838", + "ALSA-2023:6746", + "ALSA-2024:3501", + "ALSA-2026:7668" + ] + }, + { + "package": { + "name": "libsmartcols", + "os_package_name": "libsmartcols", + "version": "2.37.4-3.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2026:1913" + ] + }, + { + "package": { + "name": "libstdc++", + "os_package_name": "libstdc++", + "version": "11.2.1-9.4.el9.alma", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2025:1346" + ] + }, + { + "package": { + "name": "libtasn1", + "os_package_name": "libtasn1", + "version": "4.16.0-7.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 3, + "vulnerabilities": [ + "ALSA-2023:0343", + "ALSA-2025:7077", + "ALSA-2026:28253" + ] + }, + { + "package": { + "name": "libuuid", + "os_package_name": "libuuid", + "version": "2.37.4-3.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2026:1913" + ] + }, + { + "package": { + "name": "libxml2", + "os_package_name": "libxml2", + "version": "2.9.13-1.el9_0.1", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 11, + "vulnerabilities": [ + "ALSA-2023:0338", + "ALSA-2023:4349", + "ALSA-2023:7747", + "ALSA-2024:2679", + "ALSA-2025:10699", + "ALSA-2025:12447", + "ALSA-2025:13428", + "ALSA-2025:1350", + "ALSA-2025:22376", + "ALSA-2025:2679", + "ALSA-2026:28254" + ] + }, + { + "package": { + "name": "lua-libs", + "os_package_name": "lua-libs", + "version": "5.4.2-4.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 3, + "vulnerabilities": [ + "ALSA-2022:7329", + "ALSA-2023:0957", + "ALSA-2023:2582" + ] + }, + { + "package": { + "name": "ncurses-base", + "os_package_name": "ncurses-base", + "version": "6.2-8.20210508.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2023:6698" + ] + }, + { + "package": { + "name": "ncurses-libs", + "os_package_name": "ncurses-libs", + "version": "6.2-8.20210508.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2023:6698" + ] + }, + { + "package": { + "name": "openssl", + "os_package_name": "openssl", + "version": "3.0.1-43.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 15, + "vulnerabilities": [ + "ALSA-2022:6224", + "ALSA-2022:7288", + "ALSA-2023:0946", + "ALSA-2023:2523", + "ALSA-2023:3722", + "ALSA-2024:0310", + "ALSA-2024:2447", + "ALSA-2024:6783", + "ALSA-2024:9333", + "ALSA-2025:1330", + "ALSA-2025:21255", + "ALSA-2026:1473", + "ALSA-2026:19218", + "ALSA-2026:22312", + "ALSA-2026:25239" + ] + }, + { + "package": { + "name": "openssl-libs", + "os_package_name": "openssl-libs", + "version": "3.0.1-43.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 15, + "vulnerabilities": [ + "ALSA-2022:6224", + "ALSA-2022:7288", + "ALSA-2023:0946", + "ALSA-2023:2523", + "ALSA-2023:3722", + "ALSA-2024:0310", + "ALSA-2024:2447", + "ALSA-2024:6783", + "ALSA-2024:9333", + "ALSA-2025:1330", + "ALSA-2025:21255", + "ALSA-2026:1473", + "ALSA-2026:19218", + "ALSA-2026:22312", + "ALSA-2026:25239" + ] + }, + { + "package": { + "name": "p11-kit", + "os_package_name": "p11-kit", + "version": "0.24.1-2.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2026:18599" + ] + }, + { + "package": { + "name": "p11-kit-trust", + "os_package_name": "p11-kit-trust", + "version": "0.24.1-2.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2026:18599" + ] + }, + { + "package": { + "name": "pam", + "os_package_name": "pam", + "version": "1.5.1-9.el9_0.1", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 5, + "vulnerabilities": [ + "ALSA-2024:10244", + "ALSA-2024:11250", + "ALSA-2024:2438", + "ALSA-2025:15099", + "ALSA-2025:9526" + ] + }, + { + "package": { + "name": "python3", + "os_package_name": "python3", + "version": "3.9.10-2.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 24, + "vulnerabilities": [ + "ALSA-2022:7323", + "ALSA-2022:8353", + "ALSA-2022:8493", + "ALSA-2023:0953", + "ALSA-2023:3595", + "ALSA-2023:5462", + "ALSA-2023:6659", + "ALSA-2024:0466", + "ALSA-2024:10983", + "ALSA-2024:4078", + "ALSA-2024:4779", + "ALSA-2024:6163", + "ALSA-2024:8446", + "ALSA-2024:9371", + "ALSA-2024:9468", + "ALSA-2025:10136", + "ALSA-2025:15019", + "ALSA-2025:23342", + "ALSA-2025:6977", + "ALSA-2026:10949", + "ALSA-2026:1478", + "ALSA-2026:19216", + "ALSA-2026:4168", + "ALSA-2026:6766" + ] + }, + { + "package": { + "name": "python3-libs", + "os_package_name": "python3-libs", + "version": "3.9.10-2.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 24, + "vulnerabilities": [ + "ALSA-2022:7323", + "ALSA-2022:8353", + "ALSA-2022:8493", + "ALSA-2023:0953", + "ALSA-2023:3595", + "ALSA-2023:5462", + "ALSA-2023:6659", + "ALSA-2024:0466", + "ALSA-2024:10983", + "ALSA-2024:4078", + "ALSA-2024:4779", + "ALSA-2024:6163", + "ALSA-2024:8446", + "ALSA-2024:9371", + "ALSA-2024:9468", + "ALSA-2025:10136", + "ALSA-2025:15019", + "ALSA-2025:23342", + "ALSA-2025:6977", + "ALSA-2026:10949", + "ALSA-2026:1478", + "ALSA-2026:19216", + "ALSA-2026:4168", + "ALSA-2026:6766" + ] + }, + { + "package": { + "name": "python3-pip-wheel", + "os_package_name": "python3-pip-wheel", + "version": "21.2.3-6.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2023:6694" + ] + }, + { + "package": { + "name": "python3-rpm", + "os_package_name": "python3-rpm", + "version": "4.16.1.3-12.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2024:0463" + ] + }, + { + "package": { + "name": "python3-setuptools-wheel", + "os_package_name": "python3-setuptools-wheel", + "version": "53.0.0-10.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 3, + "vulnerabilities": [ + "ALSA-2023:0952", + "ALSA-2024:5534", + "ALSA-2025:10407" + ] + }, + { + "package": { + "name": "rpm", + "os_package_name": "rpm", + "version": "4.16.1.3-12.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2024:0463" + ] + }, + { + "package": { + "name": "rpm-build-libs", + "os_package_name": "rpm-build-libs", + "version": "4.16.1.3-12.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2024:0463" + ] + }, + { + "package": { + "name": "rpm-libs", + "os_package_name": "rpm-libs", + "version": "4.16.1.3-12.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2024:0463" + ] + }, + { + "package": { + "name": "rpm-sign-libs", + "os_package_name": "rpm-sign-libs", + "version": "4.16.1.3-12.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2024:0463" + ] + }, + { + "package": { + "name": "shadow-utils", + "os_package_name": "shadow-utils", + "version": "4.9-3.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 2, + "vulnerabilities": [ + "ALSA-2023:6632", + "ALSA-2025:20559" + ] + }, + { + "package": { + "name": "sqlite-libs", + "os_package_name": "sqlite-libs", + "version": "3.34.1-5.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 4, + "vulnerabilities": [ + "ALSA-2023:0339", + "ALSA-2024:0465", + "ALSA-2025:11992", + "ALSA-2025:20936" + ] + }, + { + "package": { + "name": "systemd", + "os_package_name": "systemd", + "version": "250-6.el9_0.1", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 6, + "vulnerabilities": [ + "ALSA-2023:0336", + "ALSA-2023:0954", + "ALSA-2024:2463", + "ALSA-2025:22660", + "ALSA-2026:13677", + "ALSA-2026:19213" + ] + }, + { + "package": { + "name": "systemd-libs", + "os_package_name": "systemd-libs", + "version": "250-6.el9_0.1", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 6, + "vulnerabilities": [ + "ALSA-2023:0336", + "ALSA-2023:0954", + "ALSA-2024:2463", + "ALSA-2025:22660", + "ALSA-2026:13677", + "ALSA-2026:19213" + ] + }, + { + "package": { + "name": "systemd-pam", + "os_package_name": "systemd-pam", + "version": "250-6.el9_0.1", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 6, + "vulnerabilities": [ + "ALSA-2023:0336", + "ALSA-2023:0954", + "ALSA-2024:2463", + "ALSA-2025:22660", + "ALSA-2026:13677", + "ALSA-2026:19213" + ] + }, + { + "package": { + "name": "systemd-rpm-macros", + "os_package_name": "systemd-rpm-macros", + "version": "250-6.el9_0.1", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 6, + "vulnerabilities": [ + "ALSA-2023:0336", + "ALSA-2023:0954", + "ALSA-2024:2463", + "ALSA-2025:22660", + "ALSA-2026:13677", + "ALSA-2026:19213" + ] + }, + { + "package": { + "name": "tar", + "os_package_name": "tar", + "version": "1.34-3.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 2, + "vulnerabilities": [ + "ALSA-2023:0959", + "ALSA-2026:0067" + ] + }, + { + "package": { + "name": "tpm2-tss", + "os_package_name": "tpm2-tss", + "version": "3.0.3-7.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2023:6685" + ] + }, + { + "package": { + "name": "util-linux", + "os_package_name": "util-linux", + "version": "2.37.4-3.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2026:1913" + ] + }, + { + "package": { + "name": "util-linux-core", + "os_package_name": "util-linux-core", + "version": "2.37.4-3.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2026:1913" + ] + }, + { + "package": { + "name": "vim-minimal", + "os_package_name": "vim-minimal", + "version": "8.2.2637-16.el9_0.3", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 13, + "vulnerabilities": [ + "ALSA-2022:5242", + "ALSA-2022:5942", + "ALSA-2023:0958", + "ALSA-2024:9405", + "ALSA-2025:17742", + "ALSA-2025:20945", + "ALSA-2025:7440", + "ALSA-2026:11510", + "ALSA-2026:19224", + "ALSA-2026:22717", + "ALSA-2026:28209", + "ALSA-2026:5602", + "ALSA-2026:8259" + ] + }, + { + "package": { + "name": "zlib", + "os_package_name": "zlib", + "version": "1.2.11-31.el9_0.1", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2022:7314" + ] + } + ] + } + ], + "experimental_config": { + "licenses": { + "summary": false, + "allowlist": null + } + }, + "image_metadata": { + "os": "AlmaLinux 9.0 (Emerald Puma)", + "layer_metadata": [ + { + "diff_id": "sha256:...", + "command": "/bin/sh -c #(nop) ADD file:cdf5c88acfb05424d5a6583dd0a107526beb2cd9fda2ac5d4a586b74630305a2 in / ", + "is_empty": false, + "base_image_index": 1 + }, + { + "diff_id": "", + "command": "/bin/sh -c #(nop) CMD [/"/bin/bash/"]", + "is_empty": true, + "base_image_index": 1 + } + ], + "base_images": [ + {}, + { + "name": "almalinux", + "tags": null + } + ] + } +} + +--- + +[TestCommand_OCIImage_JSONFormat/scanning_almalinux_9_image - 2] +Scanning local image tarball "./testdata/test-almalinux-9.tar" + +--- + +[TestCommand_OCIImage_JSONFormat/scanning_image_with_deprecated_packages - 1] +{ + "results": [ + { + "source": { + "path": "/app/rust_novuln_deprecated", + "type": "artifact" + }, + "packages": [ + { + "package": { + "name": "url", + "version": "2.5.3", + "ecosystem": "crates.io", + "deprecated": true, + "image_origin_details": { + "index": 2 + } + } + } + ] + }, + { + "source": { + "path": "/lib/apk/db/installed", + "type": "os" + }, + "packages": [ + { + "package": { + "name": "busybox", + "os_package_name": "busybox", + "version": "1.37.0-r19", + "ecosystem": "Alpine:v3.22", + "commit": "bd8ab811155a6087ba7480103d89e2500e3cb0eb", + "image_origin_details": { + "index": 0 + } + }, + "groups": 2, + "vulnerabilities": [ + "ALPINE-CVE-2024-58251", + "ALPINE-CVE-2025-46394" + ] + }, + { + "package": { + "name": "busybox", + "os_package_name": "busybox-binsh", + "version": "1.37.0-r19", + "ecosystem": "Alpine:v3.22", + "commit": "bd8ab811155a6087ba7480103d89e2500e3cb0eb", + "image_origin_details": { + "index": 0 + } + }, + "groups": 2, + "vulnerabilities": [ + "ALPINE-CVE-2024-58251", + "ALPINE-CVE-2025-46394" + ] + }, + { + "package": { + "name": "openssl", + "os_package_name": "libcrypto3", + "version": "3.5.4-r0", + "ecosystem": "Alpine:v3.22", + "commit": "8f330e62bd41c2ac23dbd866fea36fb8e22f8422", + "image_origin_details": { + "index": 0 + } + }, + "groups": 34, + "vulnerabilities": [ + "ALPINE-CVE-2025-11187", + "ALPINE-CVE-2025-15467", + "ALPINE-CVE-2025-15468", + "ALPINE-CVE-2025-15469", + "ALPINE-CVE-2025-66199", + "ALPINE-CVE-2025-68160", + "ALPINE-CVE-2025-69418", + "ALPINE-CVE-2025-69419", + "ALPINE-CVE-2025-69420", + "ALPINE-CVE-2025-69421", + "ALPINE-CVE-2026-22795", + "ALPINE-CVE-2026-22796", + "ALPINE-CVE-2026-2673", + "ALPINE-CVE-2026-28387", + "ALPINE-CVE-2026-28388", + "ALPINE-CVE-2026-28389", + "ALPINE-CVE-2026-28390", + "ALPINE-CVE-2026-31789", + "ALPINE-CVE-2026-31790", + "ALPINE-CVE-2026-34180", + "ALPINE-CVE-2026-34181", + "ALPINE-CVE-2026-34182", + "ALPINE-CVE-2026-34183", + "ALPINE-CVE-2026-42764", + "ALPINE-CVE-2026-42766", + "ALPINE-CVE-2026-42767", + "ALPINE-CVE-2026-42768", + "ALPINE-CVE-2026-42769", + "ALPINE-CVE-2026-42770", + "ALPINE-CVE-2026-45445", + "ALPINE-CVE-2026-45446", + "ALPINE-CVE-2026-45447", + "ALPINE-CVE-2026-7383", + "ALPINE-CVE-2026-9076" + ] + }, + { + "package": { + "name": "openssl", + "os_package_name": "libssl3", + "version": "3.5.4-r0", + "ecosystem": "Alpine:v3.22", + "commit": "8f330e62bd41c2ac23dbd866fea36fb8e22f8422", + "image_origin_details": { + "index": 0 + } + }, + "groups": 34, + "vulnerabilities": [ + "ALPINE-CVE-2025-11187", + "ALPINE-CVE-2025-15467", + "ALPINE-CVE-2025-15468", + "ALPINE-CVE-2025-15469", + "ALPINE-CVE-2025-66199", + "ALPINE-CVE-2025-68160", + "ALPINE-CVE-2025-69418", + "ALPINE-CVE-2025-69419", + "ALPINE-CVE-2025-69420", + "ALPINE-CVE-2025-69421", + "ALPINE-CVE-2026-22795", + "ALPINE-CVE-2026-22796", + "ALPINE-CVE-2026-2673", + "ALPINE-CVE-2026-28387", + "ALPINE-CVE-2026-28388", + "ALPINE-CVE-2026-28389", + "ALPINE-CVE-2026-28390", + "ALPINE-CVE-2026-31789", + "ALPINE-CVE-2026-31790", + "ALPINE-CVE-2026-34180", + "ALPINE-CVE-2026-34181", + "ALPINE-CVE-2026-34182", + "ALPINE-CVE-2026-34183", + "ALPINE-CVE-2026-42764", + "ALPINE-CVE-2026-42766", + "ALPINE-CVE-2026-42767", + "ALPINE-CVE-2026-42768", + "ALPINE-CVE-2026-42769", + "ALPINE-CVE-2026-42770", + "ALPINE-CVE-2026-45445", + "ALPINE-CVE-2026-45446", + "ALPINE-CVE-2026-45447", + "ALPINE-CVE-2026-7383", + "ALPINE-CVE-2026-9076" + ] + }, + { + "package": { + "name": "musl", + "os_package_name": "musl", + "version": "1.2.5-r10", + "ecosystem": "Alpine:v3.22", + "commit": "1a5f5e699b2eae883e73c93a789f87bd89a2a190", + "image_origin_details": { + "index": 0 + } + }, + "groups": 2, + "vulnerabilities": [ + "ALPINE-CVE-2026-40200", + "ALPINE-CVE-2026-6042" + ] + }, + { + "package": { + "name": "musl", + "os_package_name": "musl-utils", + "version": "1.2.5-r10", + "ecosystem": "Alpine:v3.22", + "commit": "1a5f5e699b2eae883e73c93a789f87bd89a2a190", + "image_origin_details": { + "index": 0 + } + }, + "groups": 2, + "vulnerabilities": [ + "ALPINE-CVE-2026-40200", + "ALPINE-CVE-2026-6042" + ] + }, + { + "package": { + "name": "busybox", + "os_package_name": "ssl_client", + "version": "1.37.0-r19", + "ecosystem": "Alpine:v3.22", + "commit": "bd8ab811155a6087ba7480103d89e2500e3cb0eb", + "image_origin_details": { + "index": 0 + } + }, + "groups": 2, + "vulnerabilities": [ + "ALPINE-CVE-2024-58251", + "ALPINE-CVE-2025-46394" ] }, { @@ -2447,7 +3835,7 @@ Scanning local image tarball "./testdata/test-python-full.tar" }, { "diff_id": "sha256:...", - "command": "COPY /app/target/release/rust_novuln_deprecated /app/rust_novuln_deprecated # buildkit", + "command": "/bin/sh -c #(nop) COPY file:e0bac7c4525c896bfb37d9b34630a6644b68ef9ccc3e05a4d00efc9e596e37ef in /app/rust_novuln_deprecated ", "is_empty": false, "base_image_index": 0 } @@ -2501,7 +3889,7 @@ Scanning local image tarball "./testdata/test-image-with-deprecated.tar" "index": 2 } }, - "groups": 52, + "groups": 50, "vulnerabilities": [ "GO-2024-2963", "GO-2024-3105", @@ -2543,7 +3931,6 @@ Scanning local image tarball "./testdata/test-image-with-deprecated.tar" "GO-2026-4918", "GO-2026-4946", "GO-2026-4947", - "GO-2026-4970", "GO-2026-4971", "GO-2026-4976", "GO-2026-4977", @@ -2553,8 +3940,7 @@ Scanning local image tarball "./testdata/test-image-with-deprecated.tar" "GO-2026-4986", "GO-2026-5037", "GO-2026-5038", - "GO-2026-5039", - "GO-2026-5856" + "GO-2026-5039" ] }, { @@ -2634,9 +4020,8 @@ Scanning local image tarball "./testdata/test-image-with-deprecated.tar" "index": 0 } }, - "groups": 3, + "groups": 2, "vulnerabilities": [ - "ALPINE-CVE-2021-42376", "ALPINE-CVE-2024-58251", "ALPINE-CVE-2025-46394" ] @@ -2652,9 +4037,8 @@ Scanning local image tarball "./testdata/test-image-with-deprecated.tar" "index": 0 } }, - "groups": 3, + "groups": 2, "vulnerabilities": [ - "ALPINE-CVE-2021-42376", "ALPINE-CVE-2024-58251", "ALPINE-CVE-2025-46394" ] @@ -2682,12 +4066,8 @@ Scanning local image tarball "./testdata/test-image-with-deprecated.tar" "index": 0 } }, - "groups": 28, + "groups": 24, "vulnerabilities": [ - "ALPINE-CVE-2022-1292", - "ALPINE-CVE-2022-2068", - "ALPINE-CVE-2023-0466", - "ALPINE-CVE-2023-4807", "ALPINE-CVE-2024-12797", "ALPINE-CVE-2024-13176", "ALPINE-CVE-2024-5535", @@ -2725,12 +4105,8 @@ Scanning local image tarball "./testdata/test-image-with-deprecated.tar" "index": 0 } }, - "groups": 28, + "groups": 24, "vulnerabilities": [ - "ALPINE-CVE-2022-1292", - "ALPINE-CVE-2022-2068", - "ALPINE-CVE-2023-0466", - "ALPINE-CVE-2023-4807", "ALPINE-CVE-2024-12797", "ALPINE-CVE-2024-13176", "ALPINE-CVE-2024-5535", @@ -2816,9 +4192,8 @@ Scanning local image tarball "./testdata/test-image-with-deprecated.tar" "index": 0 } }, - "groups": 3, + "groups": 2, "vulnerabilities": [ - "ALPINE-CVE-2021-42376", "ALPINE-CVE-2024-58251", "ALPINE-CVE-2025-46394" ] @@ -2860,117 +4235,13 @@ Scanning local image tarball "./testdata/test-image-with-deprecated.tar" }, { "diff_id": "", - "command": "CMD [/"/bin/sh/"]", - "is_empty": true, - "base_image_index": 1 - }, - { - "diff_id": "sha256:...", - "command": "COPY /work/ptf-1.4.0 /go/bin/ # buildkit", - "is_empty": false, - "base_image_index": 0 - } - ], - "base_images": [ - {}, - { - "name": "alpine", - "tags": null - }, - { - "name": "alpine", - "tags": null - } - ] - } -} - ---- - -[TestCommand_OCIImage_JSONFormat/scanning_image_with_go_binary - 2] -Scanning local image tarball "./testdata/test-go-binary.tar" - ---- - -[TestCommand_OCIImage_JSONFormat/scanning_insecure_alpine_image_with_detector_preset - 1] -{ - "results": [ - { - "source": { - "path": "/lib/apk/db/installed", - "type": "os" - }, - "packages": [ - { - "package": { - "name": "apk-tools", - "os_package_name": "apk-tools", - "version": "2.10.6-r0", - "ecosystem": "Alpine:v3.10", - "commit": "ee458ccae264321745e9622c759baf110130eb2f", - "image_origin_details": { - "index": 0 - } - }, - "groups": 1, - "vulnerabilities": [ - "ALPINE-CVE-2021-36159" - ] - } - ] - } - ], - "experimental_config": { - "licenses": { - "summary": false, - "allowlist": null - } - }, - "experimental_generic_findings": [ - { - "Adv": { - "ID": { - "Publisher": "SCALIBR", - "Reference": "etc-shadow-weakcredentials" - }, - "Title": "Ensure all users have strong passwords configured", - "Description": "The /etc/shadow file contains user account password hashes. These passwords must be strong and not easily guessable.", - "Recommendation": "Run the following command to reset password for the reported users:/n# change password for USER: sudo passwd USER", - "Sev": 5 - }, - "Target": { - "Extra": "/etc/shadow: The following users have weak passwords:/nuser-bcrypt/n" - }, - "Plugins": [ - "weakcredentials/etcshadow" - ], - "ExploitabilitySignals": null - } - ], - "image_metadata": { - "os": "Alpine Linux v3.10", - "layer_metadata": [ - { - "diff_id": "sha256:...", - "command": "/bin/sh -c #(nop) ADD file:c5377eaa926bf412dd8d4a08b0a1f2399cfd708743533b0aa03b53d14cb4bb4e in / ", - "is_empty": false, - "base_image_index": 2 - }, - { - "diff_id": "", - "command": "/bin/sh -c #(nop) CMD [/"/bin/sh/"]", - "is_empty": true, - "base_image_index": 1 - }, - { - "diff_id": "sha256:...", - "command": "RUN /bin/sh -c echo 'user-bcrypt:$2b$05$IYDlXvHmeORyyiUwu8KKuek2LE8VrxIYZ2skPvRDDNngpXJHRq7sG' /u003e/u003e /etc/shadow # buildkit", - "is_empty": false, - "base_image_index": 0 + "command": "CMD [/"/bin/sh/"]", + "is_empty": true, + "base_image_index": 1 }, { "diff_id": "sha256:...", - "command": "RUN /bin/sh -c echo 'user-descrypt:chERDiI95PGCQ' /u003e/u003e /etc/shadow # buildkit", + "command": "COPY file:ebcf25e0dd60192f650632ee1757c00542fcea8440c0114b434811029d21d791 in /go/bin/ ", "is_empty": false, "base_image_index": 0 } @@ -2991,12 +4262,12 @@ Scanning local image tarball "./testdata/test-go-binary.tar" --- -[TestCommand_OCIImage_JSONFormat/scanning_insecure_alpine_image_with_detector_preset - 2] -Scanning local image tarball "./testdata/test-alpine-etcshadow.tar" +[TestCommand_OCIImage_JSONFormat/scanning_image_with_go_binary - 2] +Scanning local image tarball "./testdata/test-go-binary.tar" --- -[TestCommand_OCIImage_JSONFormat/scanning_insecure_alpine_image_with_specific_detector_enabled - 1] +[TestCommand_OCIImage_JSONFormat/scanning_insecure_alpine_image_with_detector_preset - 1] { "results": [ { @@ -3068,336 +4339,61 @@ Scanning local image tarball "./testdata/test-alpine-etcshadow.tar" }, { "diff_id": "sha256:...", - "command": "RUN /bin/sh -c echo 'user-bcrypt:$2b$05$IYDlXvHmeORyyiUwu8KKuek2LE8VrxIYZ2skPvRDDNngpXJHRq7sG' /u003e/u003e /etc/shadow # buildkit", + "command": "/bin/sh -c echo 'user-bcrypt:$2b$05$IYDlXvHmeORyyiUwu8KKuek2LE8VrxIYZ2skPvRDDNngpXJHRq7sG' /u003e/u003e /etc/shadow", "is_empty": false, "base_image_index": 0 }, { "diff_id": "sha256:...", - "command": "RUN /bin/sh -c echo 'user-descrypt:chERDiI95PGCQ' /u003e/u003e /etc/shadow # buildkit", + "command": "/bin/sh -c echo 'user-descrypt:chERDiI95PGCQ' /u003e/u003e /etc/shadow", "is_empty": false, "base_image_index": 0 - } - ], - "base_images": [ - {}, - { - "name": "alpine", - "tags": null - }, - { - "name": "alpine", - "tags": null - } - ] - } -} - ---- - -[TestCommand_OCIImage_JSONFormat/scanning_insecure_alpine_image_with_specific_detector_enabled - 2] -Scanning local image tarball "./testdata/test-alpine-etcshadow.tar" - ---- - -[TestCommand_OCIImage_JSONFormat/scanning_insecure_chiseled_ubuntu_image - 1] -{ - "results": [ - { - "source": { - "path": "/usr/lib/go-1.26/bin/go", - "type": "artifact" - }, - "packages": [ - { - "package": { - "name": "stdlib", - "version": "1.26.0", - "ecosystem": "Go", - "image_origin_details": { - "index": 0 - } - }, - "groups": 25, - "vulnerabilities": [ - "GO-2026-4599", - "GO-2026-4600", - "GO-2026-4601", - "GO-2026-4602", - "GO-2026-4603", - "GO-2026-4864", - "GO-2026-4865", - "GO-2026-4866", - "GO-2026-4869", - "GO-2026-4870", - "GO-2026-4918", - "GO-2026-4946", - "GO-2026-4947", - "GO-2026-4970", - "GO-2026-4971", - "GO-2026-4976", - "GO-2026-4977", - "GO-2026-4980", - "GO-2026-4981", - "GO-2026-4982", - "GO-2026-4986", - "GO-2026-5037", - "GO-2026-5038", - "GO-2026-5039", - "GO-2026-5856" - ] - } - ] - }, - { - "source": { - "path": "/usr/lib/go-1.26/bin/gofmt", - "type": "artifact" - }, - "packages": [ - { - "package": { - "name": "stdlib", - "version": "1.26.0", - "ecosystem": "Go", - "image_origin_details": { - "index": 0 - } - }, - "groups": 25, - "vulnerabilities": [ - "GO-2026-4599", - "GO-2026-4600", - "GO-2026-4601", - "GO-2026-4602", - "GO-2026-4603", - "GO-2026-4864", - "GO-2026-4865", - "GO-2026-4866", - "GO-2026-4869", - "GO-2026-4870", - "GO-2026-4918", - "GO-2026-4946", - "GO-2026-4947", - "GO-2026-4970", - "GO-2026-4971", - "GO-2026-4976", - "GO-2026-4977", - "GO-2026-4980", - "GO-2026-4981", - "GO-2026-4982", - "GO-2026-4986", - "GO-2026-5037", - "GO-2026-5038", - "GO-2026-5039", - "GO-2026-5856" - ] - } - ] - }, - { - "source": { - "path": "/usr/lib/go-1.26/pkg/tool/linux_amd64/asm", - "type": "artifact" - }, - "packages": [ - { - "package": { - "name": "stdlib", - "version": "1.26.0", - "ecosystem": "Go", - "image_origin_details": { - "index": 0 - } - }, - "groups": 25, - "vulnerabilities": [ - "GO-2026-4599", - "GO-2026-4600", - "GO-2026-4601", - "GO-2026-4602", - "GO-2026-4603", - "GO-2026-4864", - "GO-2026-4865", - "GO-2026-4866", - "GO-2026-4869", - "GO-2026-4870", - "GO-2026-4918", - "GO-2026-4946", - "GO-2026-4947", - "GO-2026-4970", - "GO-2026-4971", - "GO-2026-4976", - "GO-2026-4977", - "GO-2026-4980", - "GO-2026-4981", - "GO-2026-4982", - "GO-2026-4986", - "GO-2026-5037", - "GO-2026-5038", - "GO-2026-5039", - "GO-2026-5856" - ] - } - ] - }, - { - "source": { - "path": "/usr/lib/go-1.26/pkg/tool/linux_amd64/compile", - "type": "artifact" - }, - "packages": [ - { - "package": { - "name": "stdlib", - "version": "1.26.0", - "ecosystem": "Go", - "image_origin_details": { - "index": 0 - } - }, - "groups": 25, - "vulnerabilities": [ - "GO-2026-4599", - "GO-2026-4600", - "GO-2026-4601", - "GO-2026-4602", - "GO-2026-4603", - "GO-2026-4864", - "GO-2026-4865", - "GO-2026-4866", - "GO-2026-4869", - "GO-2026-4870", - "GO-2026-4918", - "GO-2026-4946", - "GO-2026-4947", - "GO-2026-4970", - "GO-2026-4971", - "GO-2026-4976", - "GO-2026-4977", - "GO-2026-4980", - "GO-2026-4981", - "GO-2026-4982", - "GO-2026-4986", - "GO-2026-5037", - "GO-2026-5038", - "GO-2026-5039", - "GO-2026-5856" - ] - } - ] - }, - { - "source": { - "path": "/usr/lib/go-1.26/pkg/tool/linux_amd64/link", - "type": "artifact" - }, - "packages": [ - { - "package": { - "name": "stdlib", - "version": "1.26.0", - "ecosystem": "Go", - "image_origin_details": { - "index": 0 - } - }, - "groups": 25, - "vulnerabilities": [ - "GO-2026-4599", - "GO-2026-4600", - "GO-2026-4601", - "GO-2026-4602", - "GO-2026-4603", - "GO-2026-4864", - "GO-2026-4865", - "GO-2026-4866", - "GO-2026-4869", - "GO-2026-4870", - "GO-2026-4918", - "GO-2026-4946", - "GO-2026-4947", - "GO-2026-4970", - "GO-2026-4971", - "GO-2026-4976", - "GO-2026-4977", - "GO-2026-4980", - "GO-2026-4981", - "GO-2026-4982", - "GO-2026-4986", - "GO-2026-5037", - "GO-2026-5038", - "GO-2026-5039", - "GO-2026-5856" - ] - } - ] - }, - { - "source": { - "path": "/usr/lib/go-1.26/pkg/tool/linux_amd64/vet", - "type": "artifact" - }, - "packages": [ - { - "package": { - "name": "stdlib", - "version": "1.26.0", - "ecosystem": "Go", - "image_origin_details": { - "index": 0 - } - }, - "groups": 25, - "vulnerabilities": [ - "GO-2026-4599", - "GO-2026-4600", - "GO-2026-4601", - "GO-2026-4602", - "GO-2026-4603", - "GO-2026-4864", - "GO-2026-4865", - "GO-2026-4866", - "GO-2026-4869", - "GO-2026-4870", - "GO-2026-4918", - "GO-2026-4946", - "GO-2026-4947", - "GO-2026-4970", - "GO-2026-4971", - "GO-2026-4976", - "GO-2026-4977", - "GO-2026-4980", - "GO-2026-4981", - "GO-2026-4982", - "GO-2026-4986", - "GO-2026-5037", - "GO-2026-5038", - "GO-2026-5039", - "GO-2026-5856" - ] - } - ] - }, + } + ], + "base_images": [ + {}, + { + "name": "alpine", + "tags": null + }, + { + "name": "alpine", + "tags": null + } + ] + } +} + +--- + +[TestCommand_OCIImage_JSONFormat/scanning_insecure_alpine_image_with_detector_preset - 2] +Scanning local image tarball "./testdata/test-alpine-etcshadow.tar" + +--- + +[TestCommand_OCIImage_JSONFormat/scanning_insecure_alpine_image_with_specific_detector_enabled - 1] +{ + "results": [ { "source": { - "path": "/var/lib/chisel/manifest.wall", + "path": "/lib/apk/db/installed", "type": "os" }, "packages": [ { "package": { - "name": "coreutils", - "os_package_name": "coreutils", - "version": "9.5-1ubuntu2+0.0.0~ubuntu25", - "ecosystem": "Ubuntu:26.04", + "name": "apk-tools", + "os_package_name": "apk-tools", + "version": "2.10.6-r0", + "ecosystem": "Alpine:v3.10", + "commit": "ee458ccae264321745e9622c759baf110130eb2f", "image_origin_details": { "index": 0 } }, "groups": 1, "vulnerabilities": [ - "UBUNTU-CVE-2025-5278" + "ALPINE-CVE-2021-36159" ] } ] @@ -3409,26 +4405,73 @@ Scanning local image tarball "./testdata/test-alpine-etcshadow.tar" "allowlist": null } }, + "experimental_generic_findings": [ + { + "Adv": { + "ID": { + "Publisher": "SCALIBR", + "Reference": "etc-shadow-weakcredentials" + }, + "Title": "Ensure all users have strong passwords configured", + "Description": "The /etc/shadow file contains user account password hashes. These passwords must be strong and not easily guessable.", + "Recommendation": "Run the following command to reset password for the reported users:/n# change password for USER: sudo passwd USER", + "Sev": 5 + }, + "Target": { + "Extra": "/etc/shadow: The following users have weak passwords:/nuser-bcrypt/n" + }, + "Plugins": [ + "weakcredentials/etcshadow" + ], + "ExploitabilitySignals": null + } + ], "image_metadata": { - "os": "Ubuntu 26.04 LTS", + "os": "Alpine Linux v3.10", "layer_metadata": [ { "diff_id": "sha256:...", - "command": "COPY /rootfs/ / # buildkit", + "command": "/bin/sh -c #(nop) ADD file:c5377eaa926bf412dd8d4a08b0a1f2399cfd708743533b0aa03b53d14cb4bb4e in / ", + "is_empty": false, + "base_image_index": 2 + }, + { + "diff_id": "", + "command": "/bin/sh -c #(nop) CMD [/"/bin/sh/"]", + "is_empty": true, + "base_image_index": 1 + }, + { + "diff_id": "sha256:...", + "command": "/bin/sh -c echo 'user-bcrypt:$2b$05$IYDlXvHmeORyyiUwu8KKuek2LE8VrxIYZ2skPvRDDNngpXJHRq7sG' /u003e/u003e /etc/shadow", + "is_empty": false, + "base_image_index": 0 + }, + { + "diff_id": "sha256:...", + "command": "/bin/sh -c echo 'user-descrypt:chERDiI95PGCQ' /u003e/u003e /etc/shadow", "is_empty": false, "base_image_index": 0 } ], "base_images": [ - {} + {}, + { + "name": "alpine", + "tags": null + }, + { + "name": "alpine", + "tags": null + } ] } } --- -[TestCommand_OCIImage_JSONFormat/scanning_insecure_chiseled_ubuntu_image - 2] -Scanning local image tarball "./testdata/test-chisel.tar" +[TestCommand_OCIImage_JSONFormat/scanning_insecure_alpine_image_with_specific_detector_enabled - 2] +Scanning local image tarball "./testdata/test-alpine-etcshadow.tar" --- @@ -3452,9 +4495,8 @@ Scanning local image tarball "./testdata/test-chisel.tar" "index": 0 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "ALPINE-CVE-2021-42376", "ALPINE-CVE-2023-42363", "ALPINE-CVE-2023-42364", "ALPINE-CVE-2023-42365", @@ -3474,9 +4516,8 @@ Scanning local image tarball "./testdata/test-chisel.tar" "index": 0 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "ALPINE-CVE-2021-42376", "ALPINE-CVE-2023-42363", "ALPINE-CVE-2023-42364", "ALPINE-CVE-2023-42365", @@ -3496,12 +4537,8 @@ Scanning local image tarball "./testdata/test-chisel.tar" "index": 0 } }, - "groups": 13, + "groups": 9, "vulnerabilities": [ - "ALPINE-CVE-2022-1292", - "ALPINE-CVE-2022-2068", - "ALPINE-CVE-2023-0466", - "ALPINE-CVE-2023-4807", "ALPINE-CVE-2024-13176", "ALPINE-CVE-2024-2511", "ALPINE-CVE-2024-4603", @@ -3524,12 +4561,8 @@ Scanning local image tarball "./testdata/test-chisel.tar" "index": 0 } }, - "groups": 13, + "groups": 9, "vulnerabilities": [ - "ALPINE-CVE-2022-1292", - "ALPINE-CVE-2022-2068", - "ALPINE-CVE-2023-0466", - "ALPINE-CVE-2023-4807", "ALPINE-CVE-2024-13176", "ALPINE-CVE-2024-2511", "ALPINE-CVE-2024-4603", @@ -3552,9 +4585,8 @@ Scanning local image tarball "./testdata/test-chisel.tar" "index": 0 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "ALPINE-CVE-2021-42376", "ALPINE-CVE-2023-42363", "ALPINE-CVE-2023-42364", "ALPINE-CVE-2023-42365", @@ -3680,31 +4712,31 @@ Scanning local image tarball "./testdata/test-chisel.tar" }, { "diff_id": "sha256:...", - "command": "RUN |1 MANAGER_VERSION=10...", + "command": "|1 MANAGER_VERSION=10.2.4...", "is_empty": false, "base_image_index": 0 }, { "diff_id": "sha256:...", - "command": "RUN |1 MANAGER_VERSION=10...", + "command": "|1 MANAGER_VERSION=10.2.4...", "is_empty": false, "base_image_index": 0 }, { "diff_id": "sha256:...", - "command": "RUN |1 MANAGER_VERSION=10...", + "command": "|1 MANAGER_VERSION=10.2.4...", "is_empty": false, "base_image_index": 0 }, { "diff_id": "sha256:...", - "command": "RUN |1 MANAGER_VERSION=10...", + "command": "|1 MANAGER_VERSION=10.2.4...", "is_empty": false, "base_image_index": 0 }, { "diff_id": "sha256:...", - "command": "RUN |1 MANAGER_VERSION=10...", + "command": "|1 MANAGER_VERSION=10.2.4...", "is_empty": false, "base_image_index": 0 } @@ -3757,9 +4789,8 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" "index": 4 } }, - "groups": 6, + "groups": 5, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -3826,65 +4857,16 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" "index": 4 } }, - "groups": 5, + "groups": 4, "vulnerabilities": [ "USN-7412-1", "USN-7946-1", "UBUNTU-CVE-2022-3219", "UBUNTU-CVE-2025-30258", "UBUNTU-CVE-2025-68973", - "UBUNTU-CVE-2026-57062", "USN-7412-2" ] }, - { - "package": { - "name": "gzip", - "os_package_name": "gzip", - "version": "1.10-4ubuntu4.1", - "ecosystem": "Ubuntu:22.04", - "image_origin_details": { - "index": 4 - } - }, - "groups": 1, - "vulnerabilities": [ - "USN-8512-1", - "UBUNTU-CVE-2026-41991", - "UBUNTU-CVE-2026-41992" - ] - }, - { - "package": { - "name": "acl", - "os_package_name": "libacl1", - "version": "2.3.1-1", - "ecosystem": "Ubuntu:22.04", - "image_origin_details": { - "index": 4 - } - }, - "groups": 2, - "vulnerabilities": [ - "UBUNTU-CVE-2026-54369", - "UBUNTU-CVE-2026-54370" - ] - }, - { - "package": { - "name": "attr", - "os_package_name": "libattr1", - "version": "1:2.5.1-1build1", - "ecosystem": "Ubuntu:22.04", - "image_origin_details": { - "index": 4 - } - }, - "groups": 1, - "vulnerabilities": [ - "UBUNTU-CVE-2026-54371" - ] - }, { "package": { "name": "util-linux", @@ -3895,9 +4877,8 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" "index": 4 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -4215,9 +5196,8 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" "index": 4 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -4260,21 +5240,6 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" "UBUNTU-CVE-2025-69720" ] }, - { - "package": { - "name": "p11-kit", - "os_package_name": "libp11-kit0", - "version": "0.24.0-6build1", - "ecosystem": "Ubuntu:22.04", - "image_origin_details": { - "index": 4 - } - }, - "groups": 1, - "vulnerabilities": [ - "UBUNTU-CVE-2026-13757" - ] - }, { "package": { "name": "pam", @@ -4387,9 +5352,8 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" "index": 4 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -4555,9 +5519,8 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" "index": 4 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -4607,9 +5570,8 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" "index": 4 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -4678,7 +5640,7 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" "index": 4 } }, - "groups": 14, + "groups": 13, "vulnerabilities": [ "USN-7434-1", "USN-7678-1", @@ -4693,7 +5655,6 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" "UBUNTU-CVE-2026-48959", "UBUNTU-CVE-2026-48961", "UBUNTU-CVE-2026-48962", - "UBUNTU-CVE-2026-7017", "UBUNTU-CVE-2026-8376", "UBUNTU-CVE-2026-9538" ] @@ -4726,8 +5687,6 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" }, "groups": 2, "vulnerabilities": [ - "USN-8510-1", - "USN-8477-1", "UBUNTU-CVE-2025-45582", "UBUNTU-CVE-2026-5704" ] @@ -4742,9 +5701,8 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" "index": 4 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -4752,6 +5710,21 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" "UBUNTU-CVE-2026-53615", "USN-8091-1" ] + }, + { + "package": { + "name": "zlib", + "os_package_name": "zlib1g", + "version": "1:1.2.11.dfsg-2ubuntu9.2", + "ecosystem": "Ubuntu:22.04", + "image_origin_details": { + "index": 4 + } + }, + "groups": 1, + "vulnerabilities": [ + "UBUNTU-CVE-2026-27171" + ] } ] } @@ -4849,7 +5822,7 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "index": 7 } }, - "groups": 104, + "groups": 102, "vulnerabilities": [ "GO-2022-0477", "GO-2022-0493", @@ -4943,7 +5916,6 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "GO-2026-4918", "GO-2026-4946", "GO-2026-4947", - "GO-2026-4970", "GO-2026-4971", "GO-2026-4976", "GO-2026-4977", @@ -4953,8 +5925,7 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "GO-2026-4986", "GO-2026-5037", "GO-2026-5038", - "GO-2026-5039", - "GO-2026-5856" + "GO-2026-5039" ] } ] @@ -4975,9 +5946,8 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "index": 4 } }, - "groups": 6, + "groups": 5, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -5017,22 +5987,6 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "UBUNTU-CVE-2025-6297" ] }, - { - "package": { - "name": "fzf", - "os_package_name": "fzf", - "version": "0.29.0-1ubuntu0.1", - "ecosystem": "Ubuntu:22.04", - "image_origin_details": { - "index": 7 - } - }, - "groups": 2, - "vulnerabilities": [ - "UBUNTU-CVE-2026-53432", - "UBUNTU-CVE-2026-53433" - ] - }, { "package": { "name": "gcc-12", @@ -5060,65 +6014,16 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "index": 4 } }, - "groups": 5, + "groups": 4, "vulnerabilities": [ "USN-7412-1", "USN-7946-1", "UBUNTU-CVE-2022-3219", "UBUNTU-CVE-2025-30258", "UBUNTU-CVE-2025-68973", - "UBUNTU-CVE-2026-57062", "USN-7412-2" ] }, - { - "package": { - "name": "gzip", - "os_package_name": "gzip", - "version": "1.10-4ubuntu4.1", - "ecosystem": "Ubuntu:22.04", - "image_origin_details": { - "index": 4 - } - }, - "groups": 1, - "vulnerabilities": [ - "USN-8512-1", - "UBUNTU-CVE-2026-41991", - "UBUNTU-CVE-2026-41992" - ] - }, - { - "package": { - "name": "acl", - "os_package_name": "libacl1", - "version": "2.3.1-1", - "ecosystem": "Ubuntu:22.04", - "image_origin_details": { - "index": 4 - } - }, - "groups": 2, - "vulnerabilities": [ - "UBUNTU-CVE-2026-54369", - "UBUNTU-CVE-2026-54370" - ] - }, - { - "package": { - "name": "attr", - "os_package_name": "libattr1", - "version": "1:2.5.1-1build1", - "ecosystem": "Ubuntu:22.04", - "image_origin_details": { - "index": 4 - } - }, - "groups": 1, - "vulnerabilities": [ - "UBUNTU-CVE-2026-54371" - ] - }, { "package": { "name": "util-linux", @@ -5129,9 +6034,8 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "index": 4 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -5449,9 +6353,8 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "index": 4 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -5494,21 +6397,6 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "UBUNTU-CVE-2025-69720" ] }, - { - "package": { - "name": "p11-kit", - "os_package_name": "libp11-kit0", - "version": "0.24.0-6build1", - "ecosystem": "Ubuntu:22.04", - "image_origin_details": { - "index": 4 - } - }, - "groups": 1, - "vulnerabilities": [ - "UBUNTU-CVE-2026-13757" - ] - }, { "package": { "name": "pam", @@ -5621,9 +6509,8 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "index": 4 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -5789,9 +6676,8 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "index": 4 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -5841,9 +6727,8 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "index": 4 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -5912,7 +6797,7 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "index": 4 } }, - "groups": 14, + "groups": 13, "vulnerabilities": [ "USN-7434-1", "USN-7678-1", @@ -5927,7 +6812,6 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "UBUNTU-CVE-2026-48959", "UBUNTU-CVE-2026-48961", "UBUNTU-CVE-2026-48962", - "UBUNTU-CVE-2026-7017", "UBUNTU-CVE-2026-8376", "UBUNTU-CVE-2026-9538" ] @@ -5960,8 +6844,6 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" }, "groups": 2, "vulnerabilities": [ - "USN-8510-1", - "USN-8477-1", "UBUNTU-CVE-2025-45582", "UBUNTU-CVE-2026-5704" ] @@ -5976,9 +6858,8 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "index": 4 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -5986,6 +6867,21 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "UBUNTU-CVE-2026-53615", "USN-8091-1" ] + }, + { + "package": { + "name": "zlib", + "os_package_name": "zlib1g", + "version": "1:1.2.11.dfsg-2ubuntu9.2", + "ecosystem": "Ubuntu:22.04", + "image_origin_details": { + "index": 4 + } + }, + "groups": 1, + "vulnerabilities": [ + "UBUNTU-CVE-2026-27171" + ] } ] } @@ -6037,13 +6933,13 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" }, { "diff_id": "sha256:...", - "command": "COPY ./sample-pkgs/fzf_0.29.0-1ubuntu0.1_amd64.deb /tmp/fzf_0.29.0-1ubuntu0.1_amd64.deb # buildkit", + "command": "/bin/sh -c #(nop) COPY file:e099eb298fe3dfbad8c2324167a33e9e74588d4638b7c6563cc931c288ff04b7 in /tmp/fzf_0.29.0-1ubuntu0.1_amd64.deb ", "is_empty": false, "base_image_index": 0 }, { "diff_id": "sha256:...", - "command": "RUN /bin/sh -c dpkg -i /tmp/fzf_0.29.0-1ubuntu0.1_amd64.deb /u0026/u0026 rm /tmp/fzf_0.29.0-1ubuntu0.1_amd64.deb # buildkit", + "command": "/bin/sh -c dpkg -i /tmp/fzf_0.29.0-1ubuntu0.1_amd64.deb /u0026/u0026 rm /tmp/fzf_0.29.0-1ubuntu0.1_amd64.deb", "is_empty": false, "base_image_index": 0 } diff --git a/cmd/osv-scanner/scan/image/command_test.go b/cmd/osv-scanner/scan/image/command_test.go index 07b8c895ddb..c7c441e10bc 100644 --- a/cmd/osv-scanner/scan/image/command_test.go +++ b/cmd/osv-scanner/scan/image/command_test.go @@ -235,6 +235,11 @@ func TestCommand_OCIImage(t *testing.T) { Args: []string{"", "image", "--archive", "./testdata/test-ubuntu.tar"}, Exit: 1, }, + { + Name: "Scanning_AlmaLinux_9_image", + Args: []string{"", "image", "--archive", "./testdata/test-almalinux-9.tar"}, + Exit: 1, + }, { Name: "Empty_Ubuntu_22.04_image_tar_with_unimportant_vulns", Args: []string{"", "image", "--all-vulns", "--archive", "./testdata/test-ubuntu.tar"}, @@ -448,6 +453,17 @@ func TestCommand_OCIImage_JSONFormat(t *testing.T) { testutility.AnyDiffID, }, }, + { + Name: "scanning_almalinux_9_image", + Args: []string{"", "image", "--archive", "--format=json", "./testdata/test-almalinux-9.tar"}, + Exit: 1, + ReplaceRules: []testutility.JSONReplaceRule{ + testutility.GroupsAsArrayLen, + testutility.OnlyIDVulnsRule, + testutility.OnlyFirstBaseImage, + testutility.AnyDiffID, + }, + }, { // This tests that the fzf go binary is not being reported because it's a OS package Name: "ubuntu_image_with_go_OS_packages_json", diff --git a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage.yaml b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage.yaml index fabd5f39f6a..a5f7ef6f937 100644 --- a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage.yaml +++ b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage.yaml @@ -100,7 +100,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 3738 + content_length: 4733 body: | { "results": [ @@ -108,6 +108,10 @@ interactions: {}, { "vulns": [ + { + "id": "ALPINE-CVE-2021-30139", + "modified": "2026-06-15T18:18:08.714073Z" + }, { "id": "ALPINE-CVE-2021-36159", "modified": "2026-06-15T18:18:08.746967Z" @@ -116,37 +120,37 @@ interactions: }, { "vulns": [ + { + "id": "ALPINE-CVE-2021-28831", + "modified": "2026-06-15T18:18:08.705695Z" + }, { "id": "ALPINE-CVE-2021-42374", - "modified": "2026-07-08T04:31:02.060256Z" + "modified": "2026-06-15T18:18:08.840660Z" }, { "id": "ALPINE-CVE-2021-42375", "modified": "2026-06-15T18:18:08.840395Z" }, - { - "id": "ALPINE-CVE-2021-42376", - "modified": "2026-07-08T04:32:12.032317Z" - }, { "id": "ALPINE-CVE-2021-42378", - "modified": "2026-07-08T04:31:06.769201Z" + "modified": "2026-06-15T18:18:08.841880Z" }, { "id": "ALPINE-CVE-2021-42379", - "modified": "2026-07-08T04:32:19.104411Z" + "modified": "2026-06-15T18:18:08.842644Z" }, { "id": "ALPINE-CVE-2021-42380", - "modified": "2026-07-08T04:31:00.322675Z" + "modified": "2026-06-15T18:18:08.841997Z" }, { "id": "ALPINE-CVE-2021-42381", - "modified": "2026-07-08T04:32:10.785299Z" + "modified": "2026-06-15T18:18:08.834974Z" }, { "id": "ALPINE-CVE-2021-42382", - "modified": "2026-07-08T04:32:12.046933Z" + "modified": "2026-06-15T18:18:08.835028Z" }, { "id": "ALPINE-CVE-2021-42383", @@ -154,15 +158,15 @@ interactions: }, { "id": "ALPINE-CVE-2021-42384", - "modified": "2026-07-08T04:31:06.790570Z" + "modified": "2026-06-15T18:18:08.836234Z" }, { "id": "ALPINE-CVE-2021-42385", - "modified": "2026-07-08T04:32:19.172204Z" + "modified": "2026-06-15T18:18:08.836953Z" }, { "id": "ALPINE-CVE-2021-42386", - "modified": "2026-07-08T04:31:06.765274Z" + "modified": "2026-06-15T18:18:08.836828Z" }, { "id": "ALPINE-CVE-2022-28391", @@ -200,11 +204,11 @@ interactions: "vulns": [ { "id": "ALPINE-CVE-2021-3711", - "modified": "2026-07-08T04:31:24.043051Z" + "modified": "2026-06-15T18:18:08.770439Z" }, { "id": "ALPINE-CVE-2021-3712", - "modified": "2026-07-08T04:31:02.195219Z" + "modified": "2026-06-15T18:18:08.771464Z" }, { "id": "ALPINE-CVE-2021-4044", @@ -212,63 +216,111 @@ interactions: }, { "id": "ALPINE-CVE-2022-0778", - "modified": "2026-07-08T04:31:46.947012Z" + "modified": "2026-06-15T18:18:09.135371Z" + }, + { + "id": "ALPINE-CVE-2022-1343", + "modified": "2026-06-15T18:18:09.138212Z" }, { - "id": "ALPINE-CVE-2022-1292", - "modified": "2026-07-08T04:31:47.244657Z" + "id": "ALPINE-CVE-2022-1434", + "modified": "2026-06-15T18:18:09.138825Z" }, { - "id": "ALPINE-CVE-2022-2068", - "modified": "2026-07-08T04:31:47.874039Z" + "id": "ALPINE-CVE-2022-1473", + "modified": "2026-06-15T18:18:09.138856Z" }, { "id": "ALPINE-CVE-2022-2097", - "modified": "2026-07-08T04:32:01.661758Z" + "modified": "2026-06-15T18:18:09.146422Z" + }, + { + "id": "ALPINE-CVE-2022-3358", + "modified": "2026-06-15T18:18:09.390102Z" + }, + { + "id": "ALPINE-CVE-2022-3602", + "modified": "2026-06-15T18:18:09.517800Z" + }, + { + "id": "ALPINE-CVE-2022-3786", + "modified": "2026-06-15T18:18:09.522195Z" + }, + { + "id": "ALPINE-CVE-2022-3996", + "modified": "2026-06-15T18:18:09.525255Z" + }, + { + "id": "ALPINE-CVE-2022-4203", + "modified": "2026-06-15T18:18:09.533823Z" }, { "id": "ALPINE-CVE-2022-4304", - "modified": "2026-07-08T04:32:21.270247Z" + "modified": "2026-06-15T18:18:09.620489Z" }, { "id": "ALPINE-CVE-2022-4450", - "modified": "2026-07-08T04:32:21.375815Z" + "modified": "2026-06-15T18:18:09.672426Z" }, { "id": "ALPINE-CVE-2023-0215", - "modified": "2026-07-08T04:32:27.003292Z" + "modified": "2026-06-15T18:18:09.698845Z" + }, + { + "id": "ALPINE-CVE-2023-0216", + "modified": "2026-06-15T18:18:09.699437Z" + }, + { + "id": "ALPINE-CVE-2023-0217", + "modified": "2026-06-15T18:18:09.699949Z" }, { "id": "ALPINE-CVE-2023-0286", - "modified": "2026-07-08T04:31:25.525715Z" + "modified": "2026-06-15T18:18:09.700482Z" + }, + { + "id": "ALPINE-CVE-2023-0401", + "modified": "2026-06-15T18:18:09.701357Z" }, { "id": "ALPINE-CVE-2023-0464", - "modified": "2026-07-08T04:31:25.527188Z" + "modified": "2026-06-15T18:18:09.705418Z" }, { "id": "ALPINE-CVE-2023-0465", - "modified": "2026-07-08T04:31:25.554087Z" + "modified": "2026-06-15T18:18:09.706166Z" }, { - "id": "ALPINE-CVE-2023-0466", - "modified": "2026-07-08T04:31:25.432482Z" + "id": "ALPINE-CVE-2023-1255", + "modified": "2026-06-15T18:18:09.827455Z" }, { "id": "ALPINE-CVE-2023-2650", - "modified": "2026-07-08T04:32:01.995144Z" + "modified": "2026-06-15T18:18:09.897706Z" + }, + { + "id": "ALPINE-CVE-2023-2975", + "modified": "2026-06-15T18:18:09.910135Z" }, { "id": "ALPINE-CVE-2023-3446", "modified": "2026-06-15T18:18:09.921734Z" }, { - "id": "ALPINE-CVE-2023-4807", - "modified": "2026-07-08T04:32:27.043928Z" + "id": "ALPINE-CVE-2023-3817", + "modified": "2026-06-15T18:18:09.950857Z" + }, + { + "id": "ALPINE-CVE-2023-5363", + "modified": "2026-06-15T18:18:10.091465Z" }, { "id": "ALPINE-CVE-2023-5678", - "modified": "2026-07-08T04:32:27.736265Z" + "modified": "2026-06-15T18:18:10.107790Z" + }, + { + "id": "ALPINE-CVE-2023-6129", + "modified": "2026-06-15T18:18:10.151147Z" }, { "id": "ALPINE-CVE-2023-6237", @@ -276,7 +328,7 @@ interactions: }, { "id": "ALPINE-CVE-2024-0727", - "modified": "2026-07-08T04:32:27.704640Z" + "modified": "2026-06-15T18:18:10.233116Z" }, { "id": "ALPINE-CVE-2024-13176", @@ -298,6 +350,10 @@ interactions: "id": "ALPINE-CVE-2024-5535", "modified": "2026-06-15T18:18:10.502278Z" }, + { + "id": "ALPINE-CVE-2024-6119", + "modified": "2026-06-15T18:18:10.508459Z" + }, { "id": "ALPINE-CVE-2024-9143", "modified": "2026-06-15T18:18:10.531917Z" @@ -309,7 +365,7 @@ interactions: "vulns": [ { "id": "ALPINE-CVE-2019-14697", - "modified": "2026-07-08T04:30:41.388027Z" + "modified": "2026-06-09T21:31:30.348443Z" }, { "id": "ALPINE-CVE-2020-28928", @@ -317,7 +373,7 @@ interactions: }, { "id": "ALPINE-CVE-2025-26519", - "modified": "2026-07-08T04:32:24.548042Z" + "modified": "2026-06-15T18:18:10.600004Z" } ] }, @@ -326,7 +382,7 @@ interactions: "vulns": [ { "id": "ALPINE-CVE-2018-25032", - "modified": "2026-07-08T04:30:24.690369Z" + "modified": "2026-06-09T21:31:29.987152Z" }, { "id": "ALPINE-CVE-2022-37434", @@ -338,7 +394,7 @@ interactions: } headers: Content-Length: - - "3738" + - "4733" Content-Type: - application/json status: 200 OK @@ -348,7 +404,7 @@ interactions: proto: HTTP/1.1 proto_major: 1 proto_minor: 1 - content_length: 5113 + content_length: 5650 host: api.osv.dev body: | { @@ -437,6 +493,13 @@ interactions: }, "version": "3.4-1" }, + { + "package": { + "ecosystem": "Ubuntu:20.04", + "name": "gzip" + }, + "version": "1.10-0ubuntu4.1" + }, { "package": { "ecosystem": "Ubuntu:20.04", @@ -451,6 +514,20 @@ interactions: }, "version": "1.57" }, + { + "package": { + "ecosystem": "Ubuntu:20.04", + "name": "acl" + }, + "version": "2.2.53-6" + }, + { + "package": { + "ecosystem": "Ubuntu:20.04", + "name": "attr" + }, + "version": "1:2.4.48-5" + }, { "package": { "ecosystem": "Ubuntu:20.04", @@ -521,6 +598,13 @@ interactions: }, "version": "2.2.0-2" }, + { + "package": { + "ecosystem": "Ubuntu:20.04", + "name": "p11-kit" + }, + "version": "0.23.20-1ubuntu0.1" + }, { "package": { "ecosystem": "Ubuntu:20.04", @@ -625,7 +709,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 205 + content_length: 217 body: | { "results": [ @@ -653,6 +737,10 @@ interactions: {}, {}, {}, + {}, + {}, + {}, + {}, { "vulns": [ { @@ -677,7 +765,7 @@ interactions: } headers: Content-Length: - - "205" + - "217" Content-Type: - application/json status: 200 OK @@ -687,7 +775,7 @@ interactions: proto: HTTP/1.1 proto_major: 1 proto_minor: 1 - content_length: 5113 + content_length: 5650 host: api.osv.dev body: | { @@ -776,6 +864,13 @@ interactions: }, "version": "3.4-1" }, + { + "package": { + "ecosystem": "Ubuntu:20.04", + "name": "gzip" + }, + "version": "1.10-0ubuntu4.1" + }, { "package": { "ecosystem": "Ubuntu:20.04", @@ -790,6 +885,20 @@ interactions: }, "version": "1.57" }, + { + "package": { + "ecosystem": "Ubuntu:20.04", + "name": "acl" + }, + "version": "2.2.53-6" + }, + { + "package": { + "ecosystem": "Ubuntu:20.04", + "name": "attr" + }, + "version": "1:2.4.48-5" + }, { "package": { "ecosystem": "Ubuntu:20.04", @@ -860,6 +969,13 @@ interactions: }, "version": "2.2.0-2" }, + { + "package": { + "ecosystem": "Ubuntu:20.04", + "name": "p11-kit" + }, + "version": "0.23.20-1ubuntu0.1" + }, { "package": { "ecosystem": "Ubuntu:20.04", @@ -964,7 +1080,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 205 + content_length: 217 body: | { "results": [ @@ -992,6 +1108,10 @@ interactions: {}, {}, {}, + {}, + {}, + {}, + {}, { "vulns": [ { @@ -1016,7 +1136,7 @@ interactions: } headers: Content-Length: - - "205" + - "217" Content-Type: - application/json status: 200 OK @@ -1541,7 +1661,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 12798 + content_length: 11969 body: | { "results": [ @@ -1552,10 +1672,6 @@ interactions: {}, { "vulns": [ - { - "id": "UBUNTU-CVE-2026-13595", - "modified": "2026-07-09T17:15:27.672147Z" - }, { "id": "UBUNTU-CVE-2026-27456", "modified": "2026-05-20T16:24:53.388662Z" @@ -1638,10 +1754,6 @@ interactions: "id": "UBUNTU-CVE-2025-68973", "modified": "2026-02-05T00:30:28.335358Z" }, - { - "id": "UBUNTU-CVE-2026-57062", - "modified": "2026-06-29T18:15:10.272222Z" - }, { "id": "USN-7412-1", "modified": "2026-02-10T04:47:47Z" @@ -1652,56 +1764,19 @@ interactions: }, { "id": "USN-7946-1", - "modified": "2026-06-25T13:32:31.788231Z" + "modified": "2026-05-20T16:03:55.565581Z" } ] }, {}, - { - "vulns": [ - { - "id": "UBUNTU-CVE-2026-41991", - "modified": "2026-07-06T20:30:58.394348Z" - }, - { - "id": "UBUNTU-CVE-2026-41992", - "modified": "2026-07-06T20:30:59.127897Z" - }, - { - "id": "USN-8512-1", - "modified": "2026-07-06T20:44:29.397826Z" - } - ] - }, {}, {}, - { - "vulns": [ - { - "id": "UBUNTU-CVE-2026-54369", - "modified": "2026-07-01T21:27:56Z" - }, - { - "id": "UBUNTU-CVE-2026-54370", - "modified": "2026-07-01T21:27:56Z" - } - ] - }, - { - "vulns": [ - { - "id": "UBUNTU-CVE-2026-54371", - "modified": "2026-07-06T20:31:13.100309Z" - } - ] - }, + {}, + {}, + {}, {}, { "vulns": [ - { - "id": "UBUNTU-CVE-2026-13595", - "modified": "2026-07-09T17:15:27.672147Z" - }, { "id": "UBUNTU-CVE-2026-27456", "modified": "2026-05-20T16:24:53.388662Z" @@ -1740,7 +1815,7 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2016-20013", - "modified": "2026-07-08T22:45:12.334407Z" + "modified": "2026-06-01T15:45:11.069074Z" }, { "id": "UBUNTU-CVE-2025-0395", @@ -1784,7 +1859,7 @@ interactions: }, { "id": "UBUNTU-CVE-2026-6238", - "modified": "2026-06-24T11:00:25.318641Z" + "modified": "2026-05-29T19:15:06.810342Z" }, { "id": "USN-7259-1", @@ -1800,7 +1875,7 @@ interactions: }, { "id": "USN-8005-1", - "modified": "2026-06-25T13:32:31.787765Z" + "modified": "2026-05-20T16:03:57.629529Z" } ] }, @@ -1809,11 +1884,11 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2025-1390", - "modified": "2026-06-23T22:00:07.953148Z" + "modified": "2026-04-22T15:31:21.010462Z" }, { "id": "UBUNTU-CVE-2026-4878", - "modified": "2026-06-24T02:29:23.557692Z" + "modified": "2026-04-29T11:29:22.138592Z" }, { "id": "USN-7287-1", @@ -1833,11 +1908,11 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2024-2236", - "modified": "2026-07-01T23:40:15.314704Z" + "modified": "2026-06-02T14:00:10.803243Z" }, { "id": "UBUNTU-CVE-2026-41989", - "modified": "2026-06-26T19:30:06.785492Z" + "modified": "2026-06-02T14:00:20.958338Z" }, { "id": "USN-8319-1", @@ -1850,11 +1925,11 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2024-12243", - "modified": "2026-07-06T20:44:27.631542Z" + "modified": "2026-04-22T14:37:38.949616Z" }, { "id": "UBUNTU-CVE-2025-14831", - "modified": "2026-07-06T20:44:29.080707Z" + "modified": "2026-05-11T10:46:40.301990Z" }, { "id": "UBUNTU-CVE-2025-32988", @@ -1874,55 +1949,55 @@ interactions: }, { "id": "UBUNTU-CVE-2025-9820", - "modified": "2026-07-06T20:44:29.852110Z" + "modified": "2026-05-11T10:40:33.804944Z" }, { "id": "UBUNTU-CVE-2026-33845", - "modified": "2026-07-06T20:44:27.233455Z" + "modified": "2026-06-02T12:00:06.980060Z" }, { "id": "UBUNTU-CVE-2026-33846", - "modified": "2026-07-06T20:44:28.879211Z" + "modified": "2026-06-02T12:00:06.967548Z" }, { "id": "UBUNTU-CVE-2026-3832", - "modified": "2026-06-30T03:45:07.126536Z" + "modified": "2026-06-02T12:00:06.982846Z" }, { "id": "UBUNTU-CVE-2026-3833", - "modified": "2026-07-06T20:44:29.145695Z" + "modified": "2026-06-02T12:00:06.885767Z" }, { "id": "UBUNTU-CVE-2026-42009", - "modified": "2026-07-06T20:44:28.218328Z" + "modified": "2026-06-02T12:00:08.420027Z" }, { "id": "UBUNTU-CVE-2026-42010", - "modified": "2026-07-06T20:44:27.505571Z" + "modified": "2026-06-02T12:00:08.351396Z" }, { "id": "UBUNTU-CVE-2026-42011", - "modified": "2026-07-06T16:02:54.226888Z" + "modified": "2026-06-02T12:00:08.463825Z" }, { "id": "UBUNTU-CVE-2026-42012", - "modified": "2026-07-06T16:02:54.199597Z" + "modified": "2026-06-02T12:00:08.689551Z" }, { "id": "UBUNTU-CVE-2026-42013", - "modified": "2026-07-06T16:02:54.272277Z" + "modified": "2026-06-02T12:00:08.530311Z" }, { "id": "UBUNTU-CVE-2026-42014", - "modified": "2026-07-06T16:02:52.889534Z" + "modified": "2026-06-17T11:01:28.854907Z" }, { "id": "UBUNTU-CVE-2026-42015", - "modified": "2026-07-06T16:02:53.058495Z" + "modified": "2026-06-02T12:00:08.586508Z" }, { "id": "UBUNTU-CVE-2026-5260", - "modified": "2026-07-06T20:44:27.171088Z" + "modified": "2026-06-02T12:00:09.990926Z" }, { "id": "USN-7281-1", @@ -1975,15 +2050,15 @@ interactions: }, { "id": "UBUNTU-CVE-2026-40355", - "modified": "2026-07-09T21:30:58.285031Z" + "modified": "2026-05-29T10:45:29.205811Z" }, { "id": "UBUNTU-CVE-2026-40356", - "modified": "2026-07-09T21:30:58.537034Z" + "modified": "2026-05-29T10:45:29.281566Z" }, { "id": "USN-7257-1", - "modified": "2026-06-25T13:32:30.106589Z" + "modified": "2026-05-20T16:03:28.032877Z" }, { "id": "USN-7314-1", @@ -1991,7 +2066,7 @@ interactions: }, { "id": "USN-7542-1", - "modified": "2026-06-25T13:32:30.616782Z" + "modified": "2026-05-20T16:03:46.356475Z" } ] }, @@ -2022,27 +2097,20 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2023-50495", - "modified": "2026-07-02T22:45:21.903948Z" + "modified": "2026-04-22T14:15:03.155150Z" }, { "id": "UBUNTU-CVE-2025-6141", - "modified": "2026-07-07T21:03:19.257825Z" + "modified": "2026-04-22T16:08:19.927561Z" }, { "id": "UBUNTU-CVE-2025-69720", - "modified": "2026-07-08T18:30:10.365748Z" + "modified": "2026-04-22T16:13:35.392426Z" } ] }, {}, - { - "vulns": [ - { - "id": "UBUNTU-CVE-2026-13757", - "modified": "2026-07-01T21:19:39Z" - } - ] - }, + {}, { "vulns": [ { @@ -2055,7 +2123,7 @@ interactions: }, { "id": "UBUNTU-CVE-2026-54411", - "modified": "2026-06-24T09:03:12Z" + "modified": "2026-06-17T11:02:56.948731Z" }, { "id": "USN-7580-1", @@ -2092,7 +2160,7 @@ interactions: }, { "id": "UBUNTU-CVE-2024-41996", - "modified": "2026-07-08T22:45:14.910732Z" + "modified": "2026-06-16T13:30:41.910018Z" }, { "id": "UBUNTU-CVE-2024-9143", @@ -2100,7 +2168,7 @@ interactions: }, { "id": "UBUNTU-CVE-2025-15467", - "modified": "2026-07-08T22:45:12.561148Z" + "modified": "2026-06-18T04:30:07.553679Z" }, { "id": "UBUNTU-CVE-2025-27587", @@ -2108,15 +2176,15 @@ interactions: }, { "id": "UBUNTU-CVE-2025-68160", - "modified": "2026-07-08T22:45:11.201806Z" + "modified": "2026-05-20T16:23:45.899710Z" }, { "id": "UBUNTU-CVE-2025-69418", - "modified": "2026-07-08T22:45:10.238757Z" + "modified": "2026-05-20T16:23:51.325414Z" }, { "id": "UBUNTU-CVE-2025-69419", - "modified": "2026-07-08T22:45:10.652331Z" + "modified": "2026-05-20T16:23:51.080907Z" }, { "id": "UBUNTU-CVE-2025-69420", @@ -2136,71 +2204,71 @@ interactions: }, { "id": "UBUNTU-CVE-2026-22796", - "modified": "2026-07-08T22:45:13.369897Z" + "modified": "2026-05-20T16:24:15.294811Z" }, { "id": "UBUNTU-CVE-2026-28387", - "modified": "2026-07-08T22:45:14.045974Z" + "modified": "2026-05-20T16:24:53.583373Z" }, { "id": "UBUNTU-CVE-2026-28388", - "modified": "2026-07-08T22:45:13.947607Z" + "modified": "2026-05-20T16:24:55.415353Z" }, { "id": "UBUNTU-CVE-2026-28389", - "modified": "2026-07-08T22:45:14.128002Z" + "modified": "2026-05-20T16:24:55.036642Z" }, { "id": "UBUNTU-CVE-2026-28390", - "modified": "2026-07-08T22:45:14.501164Z" + "modified": "2026-05-20T16:24:54.756018Z" }, { "id": "UBUNTU-CVE-2026-31789", - "modified": "2026-07-08T22:45:08.612244Z" + "modified": "2026-06-16T13:30:43.522021Z" }, { "id": "UBUNTU-CVE-2026-31790", - "modified": "2026-07-08T22:45:15.194189Z" + "modified": "2026-06-16T13:30:47.743687Z" }, { "id": "UBUNTU-CVE-2026-34180", - "modified": "2026-07-08T22:45:16.182260Z" + "modified": "2026-06-17T16:15:20.130456Z" }, { "id": "UBUNTU-CVE-2026-34182", - "modified": "2026-07-08T22:45:16.771546Z" + "modified": "2026-06-17T16:15:21.278388Z" }, { "id": "UBUNTU-CVE-2026-42766", - "modified": "2026-07-08T22:45:18.180633Z" + "modified": "2026-06-17T16:15:12.063144Z" }, { "id": "UBUNTU-CVE-2026-42767", - "modified": "2026-07-08T22:45:18.595864Z" + "modified": "2026-06-17T16:15:10.718836Z" }, { "id": "UBUNTU-CVE-2026-42770", - "modified": "2026-07-08T22:45:20.235150Z" + "modified": "2026-06-17T16:15:10.643613Z" }, { "id": "UBUNTU-CVE-2026-45445", - "modified": "2026-07-08T22:45:20.031829Z" + "modified": "2026-06-17T16:15:15.523263Z" }, { "id": "UBUNTU-CVE-2026-45446", - "modified": "2026-07-08T22:45:20.225145Z" + "modified": "2026-06-17T16:15:13.306370Z" }, { "id": "UBUNTU-CVE-2026-45447", - "modified": "2026-07-08T22:45:20.175237Z" + "modified": "2026-06-17T16:15:13.449894Z" }, { "id": "UBUNTU-CVE-2026-7383", - "modified": "2026-07-08T22:45:20.213109Z" + "modified": "2026-06-17T16:15:24.043621Z" }, { "id": "UBUNTU-CVE-2026-9076", - "modified": "2026-07-08T22:45:20.169764Z" + "modified": "2026-06-17T16:15:14.309841Z" }, { "id": "USN-7278-1", @@ -2208,11 +2276,11 @@ interactions: }, { "id": "USN-7786-1", - "modified": "2026-06-25T13:32:31.234820Z" + "modified": "2026-05-20T16:03:48.800001Z" }, { "id": "USN-7980-1", - "modified": "2026-06-30T18:15:13.934266Z" + "modified": "2026-06-18T04:30:17.825715Z" }, { "id": "USN-8155-1", @@ -2220,7 +2288,7 @@ interactions: }, { "id": "USN-8414-1", - "modified": "2026-06-30T18:17:25.786836Z" + "modified": "2026-06-17T11:01:06.567847Z" } ] }, @@ -2317,11 +2385,11 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2023-31486", - "modified": "2026-06-24T15:30:22.242365Z" + "modified": "2026-05-20T16:13:34.139215Z" }, { "id": "UBUNTU-CVE-2023-47039", - "modified": "2026-06-24T15:30:22.223640Z" + "modified": "2026-04-22T14:15:27.303492Z" }, { "id": "UBUNTU-CVE-2024-56406", @@ -2329,47 +2397,43 @@ interactions: }, { "id": "UBUNTU-CVE-2025-15649", - "modified": "2026-07-01T13:50:56.760041Z" + "modified": "2026-06-01T07:15:36.150813Z" }, { "id": "UBUNTU-CVE-2025-40909", - "modified": "2026-06-24T15:30:22.288512Z" + "modified": "2026-04-22T16:02:28.067448Z" }, { "id": "UBUNTU-CVE-2026-12087", - "modified": "2026-07-01T13:51:29.763714Z" + "modified": "2026-06-17T06:31:05.062220Z" }, { "id": "UBUNTU-CVE-2026-42496", - "modified": "2026-07-01T18:56:57.544972Z" + "modified": "2026-05-29T18:00:44.834841Z" }, { "id": "UBUNTU-CVE-2026-42497", - "modified": "2026-07-01T13:53:02.335741Z" + "modified": "2026-05-29T18:00:44.772881Z" }, { "id": "UBUNTU-CVE-2026-48959", - "modified": "2026-07-01T13:53:12.524471Z" + "modified": "2026-06-01T07:15:44.250395Z" }, { "id": "UBUNTU-CVE-2026-48961", - "modified": "2026-07-01T13:53:13.376190Z" + "modified": "2026-06-01T07:15:44.261753Z" }, { "id": "UBUNTU-CVE-2026-48962", - "modified": "2026-07-01T13:53:13.252080Z" - }, - { - "id": "UBUNTU-CVE-2026-7017", - "modified": "2026-07-09T17:15:52.841661Z" + "modified": "2026-05-29T18:01:00.200422Z" }, { "id": "UBUNTU-CVE-2026-8376", - "modified": "2026-07-01T18:57:39.513466Z" + "modified": "2026-05-29T18:01:03.136712Z" }, { "id": "UBUNTU-CVE-2026-9538", - "modified": "2026-07-01T13:53:19.355510Z" + "modified": "2026-05-29T18:01:01.753968Z" }, { "id": "USN-7434-1", @@ -2399,30 +2463,29 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2025-45582", - "modified": "2026-07-06T16:00:24.944880Z" + "modified": "2026-05-20T16:23:29.580676Z" }, { "id": "UBUNTU-CVE-2026-5704", - "modified": "2026-06-26T14:47:36.043245Z" - }, - { - "id": "USN-8477-1", - "modified": "2026-06-26T14:59:24.298942Z" - }, - { - "id": "USN-8510-1", - "modified": "2026-07-06T20:34:34.654931Z" + "modified": "2026-05-20T16:26:24.372107Z" } ] }, {}, {}, - {} + { + "vulns": [ + { + "id": "UBUNTU-CVE-2026-27171", + "modified": "2026-06-16T13:30:42.791654Z" + } + ] + } ] } headers: Content-Length: - - "12798" + - "11969" Content-Type: - application/json status: 200 OK @@ -2947,7 +3010,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 12798 + content_length: 11969 body: | { "results": [ @@ -2958,10 +3021,6 @@ interactions: {}, { "vulns": [ - { - "id": "UBUNTU-CVE-2026-13595", - "modified": "2026-07-09T17:15:27.672147Z" - }, { "id": "UBUNTU-CVE-2026-27456", "modified": "2026-05-20T16:24:53.388662Z" @@ -3044,10 +3103,6 @@ interactions: "id": "UBUNTU-CVE-2025-68973", "modified": "2026-02-05T00:30:28.335358Z" }, - { - "id": "UBUNTU-CVE-2026-57062", - "modified": "2026-06-29T18:15:10.272222Z" - }, { "id": "USN-7412-1", "modified": "2026-02-10T04:47:47Z" @@ -3058,56 +3113,19 @@ interactions: }, { "id": "USN-7946-1", - "modified": "2026-06-25T13:32:31.788231Z" + "modified": "2026-05-20T16:03:55.565581Z" } ] }, {}, - { - "vulns": [ - { - "id": "UBUNTU-CVE-2026-41991", - "modified": "2026-07-06T20:30:58.394348Z" - }, - { - "id": "UBUNTU-CVE-2026-41992", - "modified": "2026-07-06T20:30:59.127897Z" - }, - { - "id": "USN-8512-1", - "modified": "2026-07-06T20:44:29.397826Z" - } - ] - }, {}, {}, - { - "vulns": [ - { - "id": "UBUNTU-CVE-2026-54369", - "modified": "2026-07-01T21:27:56Z" - }, - { - "id": "UBUNTU-CVE-2026-54370", - "modified": "2026-07-01T21:27:56Z" - } - ] - }, - { - "vulns": [ - { - "id": "UBUNTU-CVE-2026-54371", - "modified": "2026-07-06T20:31:13.100309Z" - } - ] - }, + {}, + {}, + {}, {}, { "vulns": [ - { - "id": "UBUNTU-CVE-2026-13595", - "modified": "2026-07-09T17:15:27.672147Z" - }, { "id": "UBUNTU-CVE-2026-27456", "modified": "2026-05-20T16:24:53.388662Z" @@ -3146,7 +3164,7 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2016-20013", - "modified": "2026-07-08T22:45:12.334407Z" + "modified": "2026-06-01T15:45:11.069074Z" }, { "id": "UBUNTU-CVE-2025-0395", @@ -3190,7 +3208,7 @@ interactions: }, { "id": "UBUNTU-CVE-2026-6238", - "modified": "2026-06-24T11:00:25.318641Z" + "modified": "2026-05-29T19:15:06.810342Z" }, { "id": "USN-7259-1", @@ -3206,7 +3224,7 @@ interactions: }, { "id": "USN-8005-1", - "modified": "2026-06-25T13:32:31.787765Z" + "modified": "2026-05-20T16:03:57.629529Z" } ] }, @@ -3215,11 +3233,11 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2025-1390", - "modified": "2026-06-23T22:00:07.953148Z" + "modified": "2026-04-22T15:31:21.010462Z" }, { "id": "UBUNTU-CVE-2026-4878", - "modified": "2026-06-24T02:29:23.557692Z" + "modified": "2026-04-29T11:29:22.138592Z" }, { "id": "USN-7287-1", @@ -3239,11 +3257,11 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2024-2236", - "modified": "2026-07-01T23:40:15.314704Z" + "modified": "2026-06-02T14:00:10.803243Z" }, { "id": "UBUNTU-CVE-2026-41989", - "modified": "2026-06-26T19:30:06.785492Z" + "modified": "2026-06-02T14:00:20.958338Z" }, { "id": "USN-8319-1", @@ -3256,11 +3274,11 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2024-12243", - "modified": "2026-07-06T20:44:27.631542Z" + "modified": "2026-04-22T14:37:38.949616Z" }, { "id": "UBUNTU-CVE-2025-14831", - "modified": "2026-07-06T20:44:29.080707Z" + "modified": "2026-05-11T10:46:40.301990Z" }, { "id": "UBUNTU-CVE-2025-32988", @@ -3280,55 +3298,55 @@ interactions: }, { "id": "UBUNTU-CVE-2025-9820", - "modified": "2026-07-06T20:44:29.852110Z" + "modified": "2026-05-11T10:40:33.804944Z" }, { "id": "UBUNTU-CVE-2026-33845", - "modified": "2026-07-06T20:44:27.233455Z" + "modified": "2026-06-02T12:00:06.980060Z" }, { "id": "UBUNTU-CVE-2026-33846", - "modified": "2026-07-06T20:44:28.879211Z" + "modified": "2026-06-02T12:00:06.967548Z" }, { "id": "UBUNTU-CVE-2026-3832", - "modified": "2026-06-30T03:45:07.126536Z" + "modified": "2026-06-02T12:00:06.982846Z" }, { "id": "UBUNTU-CVE-2026-3833", - "modified": "2026-07-06T20:44:29.145695Z" + "modified": "2026-06-02T12:00:06.885767Z" }, { "id": "UBUNTU-CVE-2026-42009", - "modified": "2026-07-06T20:44:28.218328Z" + "modified": "2026-06-02T12:00:08.420027Z" }, { "id": "UBUNTU-CVE-2026-42010", - "modified": "2026-07-06T20:44:27.505571Z" + "modified": "2026-06-02T12:00:08.351396Z" }, { "id": "UBUNTU-CVE-2026-42011", - "modified": "2026-07-06T16:02:54.226888Z" + "modified": "2026-06-02T12:00:08.463825Z" }, { "id": "UBUNTU-CVE-2026-42012", - "modified": "2026-07-06T16:02:54.199597Z" + "modified": "2026-06-02T12:00:08.689551Z" }, { "id": "UBUNTU-CVE-2026-42013", - "modified": "2026-07-06T16:02:54.272277Z" + "modified": "2026-06-02T12:00:08.530311Z" }, { "id": "UBUNTU-CVE-2026-42014", - "modified": "2026-07-06T16:02:52.889534Z" + "modified": "2026-06-17T11:01:28.854907Z" }, { "id": "UBUNTU-CVE-2026-42015", - "modified": "2026-07-06T16:02:53.058495Z" + "modified": "2026-06-02T12:00:08.586508Z" }, { "id": "UBUNTU-CVE-2026-5260", - "modified": "2026-07-06T20:44:27.171088Z" + "modified": "2026-06-02T12:00:09.990926Z" }, { "id": "USN-7281-1", @@ -3381,15 +3399,15 @@ interactions: }, { "id": "UBUNTU-CVE-2026-40355", - "modified": "2026-07-09T21:30:58.285031Z" + "modified": "2026-05-29T10:45:29.205811Z" }, { "id": "UBUNTU-CVE-2026-40356", - "modified": "2026-07-09T21:30:58.537034Z" + "modified": "2026-05-29T10:45:29.281566Z" }, { "id": "USN-7257-1", - "modified": "2026-06-25T13:32:30.106589Z" + "modified": "2026-05-20T16:03:28.032877Z" }, { "id": "USN-7314-1", @@ -3397,7 +3415,7 @@ interactions: }, { "id": "USN-7542-1", - "modified": "2026-06-25T13:32:30.616782Z" + "modified": "2026-05-20T16:03:46.356475Z" } ] }, @@ -3428,27 +3446,20 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2023-50495", - "modified": "2026-07-02T22:45:21.903948Z" + "modified": "2026-04-22T14:15:03.155150Z" }, { "id": "UBUNTU-CVE-2025-6141", - "modified": "2026-07-07T21:03:19.257825Z" + "modified": "2026-04-22T16:08:19.927561Z" }, { "id": "UBUNTU-CVE-2025-69720", - "modified": "2026-07-08T18:30:10.365748Z" + "modified": "2026-04-22T16:13:35.392426Z" } ] }, {}, - { - "vulns": [ - { - "id": "UBUNTU-CVE-2026-13757", - "modified": "2026-07-01T21:19:39Z" - } - ] - }, + {}, { "vulns": [ { @@ -3461,7 +3472,7 @@ interactions: }, { "id": "UBUNTU-CVE-2026-54411", - "modified": "2026-06-24T09:03:12Z" + "modified": "2026-06-17T11:02:56.948731Z" }, { "id": "USN-7580-1", @@ -3498,7 +3509,7 @@ interactions: }, { "id": "UBUNTU-CVE-2024-41996", - "modified": "2026-07-08T22:45:14.910732Z" + "modified": "2026-06-16T13:30:41.910018Z" }, { "id": "UBUNTU-CVE-2024-9143", @@ -3506,7 +3517,7 @@ interactions: }, { "id": "UBUNTU-CVE-2025-15467", - "modified": "2026-07-08T22:45:12.561148Z" + "modified": "2026-06-18T04:30:07.553679Z" }, { "id": "UBUNTU-CVE-2025-27587", @@ -3514,15 +3525,15 @@ interactions: }, { "id": "UBUNTU-CVE-2025-68160", - "modified": "2026-07-08T22:45:11.201806Z" + "modified": "2026-05-20T16:23:45.899710Z" }, { "id": "UBUNTU-CVE-2025-69418", - "modified": "2026-07-08T22:45:10.238757Z" + "modified": "2026-05-20T16:23:51.325414Z" }, { "id": "UBUNTU-CVE-2025-69419", - "modified": "2026-07-08T22:45:10.652331Z" + "modified": "2026-05-20T16:23:51.080907Z" }, { "id": "UBUNTU-CVE-2025-69420", @@ -3542,71 +3553,71 @@ interactions: }, { "id": "UBUNTU-CVE-2026-22796", - "modified": "2026-07-08T22:45:13.369897Z" + "modified": "2026-05-20T16:24:15.294811Z" }, { "id": "UBUNTU-CVE-2026-28387", - "modified": "2026-07-08T22:45:14.045974Z" + "modified": "2026-05-20T16:24:53.583373Z" }, { "id": "UBUNTU-CVE-2026-28388", - "modified": "2026-07-08T22:45:13.947607Z" + "modified": "2026-05-20T16:24:55.415353Z" }, { "id": "UBUNTU-CVE-2026-28389", - "modified": "2026-07-08T22:45:14.128002Z" + "modified": "2026-05-20T16:24:55.036642Z" }, { "id": "UBUNTU-CVE-2026-28390", - "modified": "2026-07-08T22:45:14.501164Z" + "modified": "2026-05-20T16:24:54.756018Z" }, { "id": "UBUNTU-CVE-2026-31789", - "modified": "2026-07-08T22:45:08.612244Z" + "modified": "2026-06-16T13:30:43.522021Z" }, { "id": "UBUNTU-CVE-2026-31790", - "modified": "2026-07-08T22:45:15.194189Z" + "modified": "2026-06-16T13:30:47.743687Z" }, { "id": "UBUNTU-CVE-2026-34180", - "modified": "2026-07-08T22:45:16.182260Z" + "modified": "2026-06-17T16:15:20.130456Z" }, { "id": "UBUNTU-CVE-2026-34182", - "modified": "2026-07-08T22:45:16.771546Z" + "modified": "2026-06-17T16:15:21.278388Z" }, { "id": "UBUNTU-CVE-2026-42766", - "modified": "2026-07-08T22:45:18.180633Z" + "modified": "2026-06-17T16:15:12.063144Z" }, { "id": "UBUNTU-CVE-2026-42767", - "modified": "2026-07-08T22:45:18.595864Z" + "modified": "2026-06-17T16:15:10.718836Z" }, { "id": "UBUNTU-CVE-2026-42770", - "modified": "2026-07-08T22:45:20.235150Z" + "modified": "2026-06-17T16:15:10.643613Z" }, { "id": "UBUNTU-CVE-2026-45445", - "modified": "2026-07-08T22:45:20.031829Z" + "modified": "2026-06-17T16:15:15.523263Z" }, { "id": "UBUNTU-CVE-2026-45446", - "modified": "2026-07-08T22:45:20.225145Z" + "modified": "2026-06-17T16:15:13.306370Z" }, { "id": "UBUNTU-CVE-2026-45447", - "modified": "2026-07-08T22:45:20.175237Z" + "modified": "2026-06-17T16:15:13.449894Z" }, { "id": "UBUNTU-CVE-2026-7383", - "modified": "2026-07-08T22:45:20.213109Z" + "modified": "2026-06-17T16:15:24.043621Z" }, { "id": "UBUNTU-CVE-2026-9076", - "modified": "2026-07-08T22:45:20.169764Z" + "modified": "2026-06-17T16:15:14.309841Z" }, { "id": "USN-7278-1", @@ -3614,11 +3625,11 @@ interactions: }, { "id": "USN-7786-1", - "modified": "2026-06-25T13:32:31.234820Z" + "modified": "2026-05-20T16:03:48.800001Z" }, { "id": "USN-7980-1", - "modified": "2026-06-30T18:15:13.934266Z" + "modified": "2026-06-18T04:30:17.825715Z" }, { "id": "USN-8155-1", @@ -3626,7 +3637,7 @@ interactions: }, { "id": "USN-8414-1", - "modified": "2026-06-30T18:17:25.786836Z" + "modified": "2026-06-17T11:01:06.567847Z" } ] }, @@ -3723,11 +3734,11 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2023-31486", - "modified": "2026-06-24T15:30:22.242365Z" + "modified": "2026-05-20T16:13:34.139215Z" }, { "id": "UBUNTU-CVE-2023-47039", - "modified": "2026-06-24T15:30:22.223640Z" + "modified": "2026-04-22T14:15:27.303492Z" }, { "id": "UBUNTU-CVE-2024-56406", @@ -3735,47 +3746,43 @@ interactions: }, { "id": "UBUNTU-CVE-2025-15649", - "modified": "2026-07-01T13:50:56.760041Z" + "modified": "2026-06-01T07:15:36.150813Z" }, { "id": "UBUNTU-CVE-2025-40909", - "modified": "2026-06-24T15:30:22.288512Z" + "modified": "2026-04-22T16:02:28.067448Z" }, { "id": "UBUNTU-CVE-2026-12087", - "modified": "2026-07-01T13:51:29.763714Z" + "modified": "2026-06-17T06:31:05.062220Z" }, { "id": "UBUNTU-CVE-2026-42496", - "modified": "2026-07-01T18:56:57.544972Z" + "modified": "2026-05-29T18:00:44.834841Z" }, { "id": "UBUNTU-CVE-2026-42497", - "modified": "2026-07-01T13:53:02.335741Z" + "modified": "2026-05-29T18:00:44.772881Z" }, { "id": "UBUNTU-CVE-2026-48959", - "modified": "2026-07-01T13:53:12.524471Z" + "modified": "2026-06-01T07:15:44.250395Z" }, { "id": "UBUNTU-CVE-2026-48961", - "modified": "2026-07-01T13:53:13.376190Z" + "modified": "2026-06-01T07:15:44.261753Z" }, { "id": "UBUNTU-CVE-2026-48962", - "modified": "2026-07-01T13:53:13.252080Z" - }, - { - "id": "UBUNTU-CVE-2026-7017", - "modified": "2026-07-09T17:15:52.841661Z" + "modified": "2026-05-29T18:01:00.200422Z" }, { "id": "UBUNTU-CVE-2026-8376", - "modified": "2026-07-01T18:57:39.513466Z" + "modified": "2026-05-29T18:01:03.136712Z" }, { "id": "UBUNTU-CVE-2026-9538", - "modified": "2026-07-01T13:53:19.355510Z" + "modified": "2026-05-29T18:01:01.753968Z" }, { "id": "USN-7434-1", @@ -3805,30 +3812,2673 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2025-45582", - "modified": "2026-07-06T16:00:24.944880Z" + "modified": "2026-05-20T16:23:29.580676Z" }, { "id": "UBUNTU-CVE-2026-5704", - "modified": "2026-06-26T14:47:36.043245Z" - }, - { - "id": "USN-8477-1", - "modified": "2026-06-26T14:59:24.298942Z" - }, - { - "id": "USN-8510-1", - "modified": "2026-07-06T20:34:34.654931Z" + "modified": "2026-05-20T16:26:24.372107Z" } ] }, {}, {}, - {} + { + "vulns": [ + { + "id": "UBUNTU-CVE-2026-27171", + "modified": "2026-06-16T13:30:42.791654Z" + } + ] + } + ] + } + headers: + Content-Length: + - "11969" + Content-Type: + - application/json + status: 200 OK + code: 200 + duration: 0s + - request: + proto: HTTP/1.1 + proto_major: 1 + proto_minor: 1 + content_length: 21849 + host: api.osv.dev + body: | + { + "queries": [ + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "acl" + }, + "version": "2.3.1-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "almalinux-gpg-keys" + }, + "version": "9.0-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "almalinux-release" + }, + "version": "9.0-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "almalinux-repos" + }, + "version": "9.0-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "alternatives" + }, + "version": "1.20-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "audit-libs" + }, + "version": "3.0.7-101.el9_0.2" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "basesystem" + }, + "version": "11-13.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "bash" + }, + "version": "5.1.8-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "binutils" + }, + "version": "2.35.2-17.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "binutils-gold" + }, + "version": "2.35.2-17.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "bzip2-libs" + }, + "version": "1.0.8-8.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "ca-certificates" + }, + "version": "2022.2.54-90.2.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "coreutils-single" + }, + "version": "8.32-31.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "cracklib" + }, + "version": "2.9.6-27.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "cracklib-dicts" + }, + "version": "2.9.6-27.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "crypto-policies" + }, + "version": "20220223-1.git5203b41.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "crypto-policies-scripts" + }, + "version": "20220223-1.git5203b41.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "cryptsetup-libs" + }, + "version": "2.4.3-4.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "curl-minimal" + }, + "version": "7.76.1-14.el9_0.5" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "cyrus-sasl-lib" + }, + "version": "2.1.27-20.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "dbus" + }, + "version": "1.12.20-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "dbus-broker" + }, + "version": "28-5.1.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "dbus-common" + }, + "version": "1.12.20-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "device-mapper" + }, + "version": "1.02.183-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "device-mapper-libs" + }, + "version": "1.02.183-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "dnf" + }, + "version": "4.10.0-5.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "dnf-data" + }, + "version": "4.10.0-5.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "elfutils-debuginfod-client" + }, + "version": "0.186-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "elfutils-default-yama-scope" + }, + "version": "0.186-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "elfutils-libelf" + }, + "version": "0.186-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "elfutils-libs" + }, + "version": "0.186-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "expat" + }, + "version": "2.2.10-12.el9_0.3" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "file-libs" + }, + "version": "5.39-8.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "filesystem" + }, + "version": "3.16-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "findutils" + }, + "version": "4.8.0-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gawk" + }, + "version": "5.1.0-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gdbm-libs" + }, + "version": "1.19-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "glib2" + }, + "version": "2.68.4-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "glibc" + }, + "version": "2.34-28.el9_0.2" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "glibc-common" + }, + "version": "2.34-28.el9_0.2" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "glibc-minimal-langpack" + }, + "version": "2.34-28.el9_0.2" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gmp" + }, + "version": "6.2.0-10.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gnupg2" + }, + "version": "2.3.3-2.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gnutls" + }, + "version": "3.7.6-12.el9_0" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "gpg" + }, + "version": "1.15.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gpg-pubkey" + }, + "version": "b86b3716-61e69f29" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gpgme" + }, + "version": "1.15.1-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "grep" + }, + "version": "3.6-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gzip" + }, + "version": "1.10-9.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "hostname" + }, + "version": "3.23-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "ima-evm-utils" + }, + "version": "1.4-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "iputils" + }, + "version": "20210202-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "json-c" + }, + "version": "0.14-11.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "keyutils-libs" + }, + "version": "1.6.1-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "kmod-libs" + }, + "version": "28-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "krb5-libs" + }, + "version": "1.19.1-15.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "less" + }, + "version": "590-1.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libacl" + }, + "version": "2.3.1-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libarchive" + }, + "version": "3.5.3-2.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libassuan" + }, + "version": "2.5.5-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libattr" + }, + "version": "2.5.1-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libblkid" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libcap" + }, + "version": "2.48-8.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libcap-ng" + }, + "version": "0.8.2-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libcom_err" + }, + "version": "1.46.5-2.el9" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "libcomps" + }, + "version": "0.1.18" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libcomps" + }, + "version": "0.1.18-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libcurl-minimal" + }, + "version": "7.76.1-14.el9_0.5" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libdb" + }, + "version": "5.3.28-53.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libdnf" + }, + "version": "0.65.0-5.1.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libeconf" + }, + "version": "0.4.1-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libevent" + }, + "version": "2.1.12-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libfdisk" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libffi" + }, + "version": "3.4.2-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libgcc" + }, + "version": "11.2.1-9.4.el9.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libgcrypt" + }, + "version": "1.10.0-5.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libgomp" + }, + "version": "11.2.1-9.4.el9.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libgpg-error" + }, + "version": "1.42-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libidn2" + }, + "version": "2.3.0-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libksba" + }, + "version": "1.5.1-5.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libmodulemd" + }, + "version": "2.13.0-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libmount" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libnghttp2" + }, + "version": "1.43.0-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libpwquality" + }, + "version": "1.4.4-8.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "librepo" + }, + "version": "1.14.2-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libreport-filesystem" + }, + "version": "2.15.2-6.el9.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libseccomp" + }, + "version": "2.5.2-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libselinux" + }, + "version": "3.3-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libsemanage" + }, + "version": "3.3-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libsepol" + }, + "version": "3.3-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libsigsegv" + }, + "version": "2.13-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libsmartcols" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libsolv" + }, + "version": "0.7.20-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libstdc++" + }, + "version": "11.2.1-9.4.el9.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libtasn1" + }, + "version": "4.16.0-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libunistring" + }, + "version": "0.9.10-15.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libutempter" + }, + "version": "1.2.1-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libuuid" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libverto" + }, + "version": "0.3.2-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libxcrypt" + }, + "version": "4.4.18-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libxml2" + }, + "version": "2.9.13-1.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libyaml" + }, + "version": "0.2.5-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libzstd" + }, + "version": "1.5.1-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "lua-libs" + }, + "version": "5.4.2-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "lz4-libs" + }, + "version": "1.9.3-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "mpfr" + }, + "version": "4.1.0-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "ncurses-base" + }, + "version": "6.2-8.20210508.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "ncurses-libs" + }, + "version": "6.2-8.20210508.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "nettle" + }, + "version": "3.8-3.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "npth" + }, + "version": "1.6-8.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "openldap" + }, + "version": "2.6.2-1.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "openldap-compat" + }, + "version": "2.6.2-1.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "openssl" + }, + "version": "3.0.1-43.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "openssl-libs" + }, + "version": "3.0.1-43.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "p11-kit" + }, + "version": "0.24.1-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "p11-kit-trust" + }, + "version": "0.24.1-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "pam" + }, + "version": "1.5.1-9.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "pcre" + }, + "version": "8.44-3.el9.3" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "pcre2" + }, + "version": "10.37-5.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "pcre2-syntax" + }, + "version": "10.37-5.el9_0" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "pip" + }, + "version": "21.2.3" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "popt" + }, + "version": "1.18-8.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3" + }, + "version": "3.9.10-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-dnf" + }, + "version": "4.10.0-5.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-gpg" + }, + "version": "1.15.1-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-hawkey" + }, + "version": "0.65.0-5.1.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-libcomps" + }, + "version": "0.1.18-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-libdnf" + }, + "version": "0.65.0-5.1.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-libs" + }, + "version": "3.9.10-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-pip-wheel" + }, + "version": "21.2.3-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-rpm" + }, + "version": "4.16.1.3-12.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-setuptools-wheel" + }, + "version": "53.0.0-10.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "readline" + }, + "version": "8.1-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "rootfiles" + }, + "version": "8.1-31.el9" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "rpm" + }, + "version": "4.16.1.3" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "rpm" + }, + "version": "4.16.1.3-12.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "rpm-build-libs" + }, + "version": "4.16.1.3-12.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "rpm-libs" + }, + "version": "4.16.1.3-12.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "rpm-sign-libs" + }, + "version": "4.16.1.3-12.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "sed" + }, + "version": "4.8-9.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "setup" + }, + "version": "2.13.7-6.el9" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "setuptools" + }, + "version": "53.0.0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "shadow-utils" + }, + "version": "4.9-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "sqlite-libs" + }, + "version": "3.34.1-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "systemd" + }, + "version": "250-6.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "systemd-libs" + }, + "version": "250-6.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "systemd-pam" + }, + "version": "250-6.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "systemd-rpm-macros" + }, + "version": "250-6.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "tar" + }, + "version": "1.34-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "tpm2-tss" + }, + "version": "3.0.3-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "tzdata" + }, + "version": "2022e-1.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "util-linux" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "util-linux-core" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "vim-minimal" + }, + "version": "8.2.2637-16.el9_0.3" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "xz" + }, + "version": "5.2.5-8.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "xz-libs" + }, + "version": "5.2.5-8.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "yum" + }, + "version": "4.10.0-5.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "zlib" + }, + "version": "1.2.11-31.el9_0.1" + } + ] + } + headers: + Content-Type: + - application/json + X-Test-Name: + - TestCommand_OCIImage/Scanning_AlmaLinux_9_image + url: https://api.osv.dev/v1/querybatch + method: POST + response: + proto: HTTP/2.0 + proto_major: 2 + proto_minor: 0 + content_length: 19728 + body: | + { + "results": [ + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:0340", + "modified": "2026-02-04T02:39:05.013813Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6593", + "modified": "2026-02-04T02:56:42.748728Z" + }, + { + "id": "ALSA-2025:23343", + "modified": "2026-02-04T03:10:06.598841Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6593", + "modified": "2026-02-04T02:56:42.748728Z" + }, + { + "id": "ALSA-2025:23343", + "modified": "2026-02-04T03:10:06.598841Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2025:0925", + "modified": "2026-02-04T04:23:04.673700Z" + } + ] + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:8299", + "modified": "2026-02-04T02:59:29.832450Z" + }, + { + "id": "ALSA-2023:0333", + "modified": "2026-02-04T03:11:09.993172Z" + }, + { + "id": "ALSA-2023:1701", + "modified": "2026-02-04T03:40:34.154961Z" + }, + { + "id": "ALSA-2023:2478", + "modified": "2026-02-04T03:01:23.945523Z" + }, + { + "id": "ALSA-2023:2650", + "modified": "2026-02-04T02:24:48.187396Z" + }, + { + "id": "ALSA-2023:4354", + "modified": "2026-02-04T02:39:53.202728Z" + }, + { + "id": "ALSA-2023:5763", + "modified": "2026-02-04T02:26:05.028011Z" + }, + { + "id": "ALSA-2023:6679", + "modified": "2026-02-04T02:19:52.904090Z" + }, + { + "id": "ALSA-2023:6745", + "modified": "2026-02-04T04:12:41.383421Z" + }, + { + "id": "ALSA-2024:1129", + "modified": "2026-02-04T02:19:53.688709Z" + }, + { + "id": "ALSA-2024:5529", + "modified": "2026-02-04T04:36:30.483834Z" + }, + { + "id": "ALSA-2026:1350", + "modified": "2026-02-04T04:20:42.080175Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:0335", + "modified": "2026-02-04T02:43:39.771637Z" + }, + { + "id": "ALSA-2023:4569", + "modified": "2026-02-04T03:26:40.249723Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:0335", + "modified": "2026-02-04T02:43:39.771637Z" + }, + { + "id": "ALSA-2023:4569", + "modified": "2026-02-04T03:26:40.249723Z" + } + ] + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:0337", + "modified": "2026-02-04T02:41:37.038356Z" + }, + { + "id": "ALSA-2024:1530", + "modified": "2026-02-04T03:35:33.402240Z" + }, + { + "id": "ALSA-2024:6754", + "modified": "2026-02-04T02:22:22.919987Z" + }, + { + "id": "ALSA-2024:9541", + "modified": "2026-02-04T03:35:28.908623Z" + }, + { + "id": "ALSA-2025:22175", + "modified": "2026-02-04T04:22:01.629753Z" + }, + { + "id": "ALSA-2025:3531", + "modified": "2026-02-04T04:35:39.307337Z" + }, + { + "id": "ALSA-2025:7444", + "modified": "2026-02-04T03:11:34.139518Z" + }, + { + "id": "ALSA-2026:23230", + "modified": "2026-06-11T16:00:04.147520Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:2512", + "modified": "2026-02-04T04:24:23.275314Z" + } + ] + }, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:6631", + "modified": "2026-02-04T04:27:47.395873Z" + }, + { + "id": "ALSA-2024:6464", + "modified": "2026-02-04T03:27:15.983684Z" + }, + { + "id": "ALSA-2025:11140", + "modified": "2026-02-04T02:55:31.495927Z" + }, + { + "id": "ALSA-2026:0936", + "modified": "2026-02-04T02:25:08.416995Z" + }, + { + "id": "ALSA-2026:15971", + "modified": "2026-05-11T20:00:09.038847Z" + }, + { + "id": "ALSA-2026:19361", + "modified": "2026-05-26T16:00:28.465116Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:5453", + "modified": "2026-02-04T03:26:19.807241Z" + }, + { + "id": "ALSA-2024:3339", + "modified": "2026-02-04T03:30:53.986917Z" + }, + { + "id": "ALSA-2025:4244", + "modified": "2026-02-04T04:07:40.504176Z" + }, + { + "id": "ALSA-2025:8655", + "modified": "2026-02-04T03:01:36.256559Z" + }, + { + "id": "ALSA-2025:9877", + "modified": "2026-02-04T04:14:28.182476Z" + }, + { + "id": "ALSA-2026:2786", + "modified": "2026-02-24T21:44:00.377003Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:5453", + "modified": "2026-02-04T03:26:19.807241Z" + }, + { + "id": "ALSA-2024:3339", + "modified": "2026-02-04T03:30:53.986917Z" + }, + { + "id": "ALSA-2025:4244", + "modified": "2026-02-04T04:07:40.504176Z" + }, + { + "id": "ALSA-2025:8655", + "modified": "2026-02-04T03:01:36.256559Z" + }, + { + "id": "ALSA-2025:9877", + "modified": "2026-02-04T04:14:28.182476Z" + }, + { + "id": "ALSA-2026:2786", + "modified": "2026-02-24T21:44:00.377003Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:5453", + "modified": "2026-02-04T03:26:19.807241Z" + }, + { + "id": "ALSA-2024:3339", + "modified": "2026-02-04T03:30:53.986917Z" + }, + { + "id": "ALSA-2025:4244", + "modified": "2026-02-04T04:07:40.504176Z" + }, + { + "id": "ALSA-2025:8655", + "modified": "2026-02-04T03:01:36.256559Z" + }, + { + "id": "ALSA-2025:9877", + "modified": "2026-02-04T04:14:28.182476Z" + }, + { + "id": "ALSA-2026:2786", + "modified": "2026-02-24T21:44:00.377003Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6661", + "modified": "2026-02-04T02:21:41.980408Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2026:0719", + "modified": "2026-02-04T04:34:34.329237Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:1141", + "modified": "2026-02-04T03:18:59.660613Z" + }, + { + "id": "ALSA-2024:0533", + "modified": "2026-02-04T03:48:34.100512Z" + }, + { + "id": "ALSA-2024:1879", + "modified": "2026-02-04T03:31:06.672839Z" + }, + { + "id": "ALSA-2024:2570", + "modified": "2026-02-04T04:01:53.202219Z" + }, + { + "id": "ALSA-2025:16116", + "modified": "2026-02-04T03:15:22.241525Z" + }, + { + "id": "ALSA-2025:7076", + "modified": "2026-02-04T04:25:27.782684Z" + }, + { + "id": "ALSA-2026:4188", + "modified": "2026-03-16T08:43:59.018031Z" + } + ] + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2025:17558", + "modified": "2026-02-04T03:25:13.978615Z" + }, + { + "id": "ALSA-2025:9432", + "modified": "2026-02-04T02:18:41.302098Z" + } + ] + }, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:8637", + "modified": "2026-02-04T04:01:02.274891Z" + }, + { + "id": "ALSA-2023:2570", + "modified": "2026-02-04T03:25:10.056435Z" + }, + { + "id": "ALSA-2023:6699", + "modified": "2026-02-04T03:59:17.349120Z" + }, + { + "id": "ALSA-2024:6166", + "modified": "2026-02-04T04:13:16.807291Z" + }, + { + "id": "ALSA-2024:9331", + "modified": "2026-02-04T02:40:52.136074Z" + }, + { + "id": "ALSA-2024:9474", + "modified": "2026-02-04T04:30:53.060846Z" + }, + { + "id": "ALSA-2025:7067", + "modified": "2026-02-04T02:48:22.293400Z" + }, + { + "id": "ALSA-2025:9430", + "modified": "2026-02-04T03:20:09.135780Z" + }, + { + "id": "ALSA-2026:19357", + "modified": "2026-05-26T16:14:26.075210Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:3725", + "modified": "2026-02-04T02:57:26.406617Z" + }, + { + "id": "ALSA-2024:1692", + "modified": "2026-02-04T03:07:17.609765Z" + }, + { + "id": "ALSA-2024:3513", + "modified": "2026-02-04T04:02:37.699304Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:2532", + "modified": "2026-02-04T03:30:59.962630Z" + }, + { + "id": "ALSA-2025:14130", + "modified": "2026-02-04T02:59:02.777670Z" + }, + { + "id": "ALSA-2025:9431", + "modified": "2026-02-04T04:26:59.474540Z" + }, + { + "id": "ALSA-2026:5080", + "modified": "2026-03-24T11:41:56.671370Z" + }, + { + "id": "ALSA-2026:8510", + "modified": "2026-04-17T13:19:53.082048Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:5071", + "modified": "2026-02-04T03:18:20.022576Z" + }, + { + "id": "ALSA-2026:12441", + "modified": "2026-05-01T20:45:11.742990Z" + }, + { + "id": "ALSA-2026:19346", + "modified": "2026-05-26T16:00:23.989197Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:8361", + "modified": "2026-02-04T04:00:37.440096Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:8299", + "modified": "2026-02-04T02:59:29.832450Z" + }, + { + "id": "ALSA-2023:0333", + "modified": "2026-02-04T03:11:09.993172Z" + }, + { + "id": "ALSA-2023:1701", + "modified": "2026-02-04T03:40:34.154961Z" + }, + { + "id": "ALSA-2023:2478", + "modified": "2026-02-04T03:01:23.945523Z" + }, + { + "id": "ALSA-2023:2650", + "modified": "2026-02-04T02:24:48.187396Z" + }, + { + "id": "ALSA-2023:4354", + "modified": "2026-02-04T02:39:53.202728Z" + }, + { + "id": "ALSA-2023:5763", + "modified": "2026-02-04T02:26:05.028011Z" + }, + { + "id": "ALSA-2023:6679", + "modified": "2026-02-04T02:19:52.904090Z" + }, + { + "id": "ALSA-2023:6745", + "modified": "2026-02-04T04:12:41.383421Z" + }, + { + "id": "ALSA-2024:1129", + "modified": "2026-02-04T02:19:53.688709Z" + }, + { + "id": "ALSA-2024:5529", + "modified": "2026-02-04T04:36:30.483834Z" + }, + { + "id": "ALSA-2026:1350", + "modified": "2026-02-04T04:20:42.080175Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:4347", + "modified": "2026-02-04T04:26:55.222844Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2025:1346", + "modified": "2026-02-04T02:42:19.300480Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:9404", + "modified": "2026-02-04T04:39:46.445150Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2025:1346", + "modified": "2026-02-04T02:42:19.300480Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:0626", + "modified": "2026-02-04T03:37:23.910138Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:5838", + "modified": "2026-02-04T03:21:23.106321Z" + }, + { + "id": "ALSA-2023:6746", + "modified": "2026-02-04T02:52:20.689534Z" + }, + { + "id": "ALSA-2024:3501", + "modified": "2026-02-04T04:30:58.924693Z" + }, + { + "id": "ALSA-2026:7668", + "modified": "2026-04-17T13:19:22.946826Z" + } + ] + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2025:1346", + "modified": "2026-02-04T02:42:19.300480Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0343", + "modified": "2026-02-04T02:58:56.421179Z" + }, + { + "id": "ALSA-2025:7077", + "modified": "2026-02-04T02:57:21.340790Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:0338", + "modified": "2026-02-04T04:15:50.026698Z" + }, + { + "id": "ALSA-2023:4349", + "modified": "2026-02-04T03:56:40.445151Z" + }, + { + "id": "ALSA-2023:7747", + "modified": "2026-02-04T02:47:05.174021Z" + }, + { + "id": "ALSA-2024:2679", + "modified": "2026-02-04T03:53:53.131809Z" + }, + { + "id": "ALSA-2025:10699", + "modified": "2026-02-04T03:45:10.417784Z" + }, + { + "id": "ALSA-2025:12447", + "modified": "2026-02-04T04:08:24.796808Z" + }, + { + "id": "ALSA-2025:13428", + "modified": "2026-02-04T03:51:53.872437Z" + }, + { + "id": "ALSA-2025:1350", + "modified": "2026-02-04T04:02:12.419510Z" + }, + { + "id": "ALSA-2025:22376", + "modified": "2026-02-04T04:03:23.679067Z" + }, + { + "id": "ALSA-2025:2679", + "modified": "2026-02-04T02:16:14.070103Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:7329", + "modified": "2026-02-04T02:28:25.713104Z" + }, + { + "id": "ALSA-2023:0957", + "modified": "2026-02-04T02:27:45.919035Z" + }, + { + "id": "ALSA-2023:2582", + "modified": "2026-02-04T03:10:44.508101Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:6698", + "modified": "2026-02-04T02:56:09.576007Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6698", + "modified": "2026-02-04T02:56:09.576007Z" + } + ] + }, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:6224", + "modified": "2026-02-04T02:51:14.255262Z" + }, + { + "id": "ALSA-2022:7288", + "modified": "2026-02-04T03:59:27.389573Z" + }, + { + "id": "ALSA-2023:0946", + "modified": "2026-02-04T03:23:22.425826Z" + }, + { + "id": "ALSA-2023:2523", + "modified": "2026-02-04T02:26:35.380325Z" + }, + { + "id": "ALSA-2023:3722", + "modified": "2026-02-04T02:13:18.469496Z" + }, + { + "id": "ALSA-2024:0310", + "modified": "2026-02-04T02:42:39.967487Z" + }, + { + "id": "ALSA-2024:2447", + "modified": "2026-02-04T02:13:54.975229Z" + }, + { + "id": "ALSA-2024:6783", + "modified": "2026-02-04T03:31:16.933411Z" + }, + { + "id": "ALSA-2024:9333", + "modified": "2026-02-04T03:31:00.023073Z" + }, + { + "id": "ALSA-2025:1330", + "modified": "2026-02-04T04:15:39.208441Z" + }, + { + "id": "ALSA-2025:21255", + "modified": "2026-02-04T03:44:31.901825Z" + }, + { + "id": "ALSA-2026:1473", + "modified": "2026-02-04T02:57:39.180220Z" + }, + { + "id": "ALSA-2026:19218", + "modified": "2026-05-26T16:00:21.304009Z" + }, + { + "id": "ALSA-2026:22312", + "modified": "2026-06-03T14:30:04.577840Z" + }, + { + "id": "ALSA-2026:25239", + "modified": "2026-06-12T12:29:12.486131Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2022:6224", + "modified": "2026-02-04T02:51:14.255262Z" + }, + { + "id": "ALSA-2022:7288", + "modified": "2026-02-04T03:59:27.389573Z" + }, + { + "id": "ALSA-2023:0946", + "modified": "2026-02-04T03:23:22.425826Z" + }, + { + "id": "ALSA-2023:2523", + "modified": "2026-02-04T02:26:35.380325Z" + }, + { + "id": "ALSA-2023:3722", + "modified": "2026-02-04T02:13:18.469496Z" + }, + { + "id": "ALSA-2024:0310", + "modified": "2026-02-04T02:42:39.967487Z" + }, + { + "id": "ALSA-2024:2447", + "modified": "2026-02-04T02:13:54.975229Z" + }, + { + "id": "ALSA-2024:6783", + "modified": "2026-02-04T03:31:16.933411Z" + }, + { + "id": "ALSA-2024:9333", + "modified": "2026-02-04T03:31:00.023073Z" + }, + { + "id": "ALSA-2025:1330", + "modified": "2026-02-04T04:15:39.208441Z" + }, + { + "id": "ALSA-2025:21255", + "modified": "2026-02-04T03:44:31.901825Z" + }, + { + "id": "ALSA-2026:1473", + "modified": "2026-02-04T02:57:39.180220Z" + }, + { + "id": "ALSA-2026:19218", + "modified": "2026-05-26T16:00:21.304009Z" + }, + { + "id": "ALSA-2026:22312", + "modified": "2026-06-03T14:30:04.577840Z" + }, + { + "id": "ALSA-2026:25239", + "modified": "2026-06-12T12:29:12.486131Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2026:18599", + "modified": "2026-05-26T16:00:16.791061Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2026:18599", + "modified": "2026-05-26T16:00:16.791061Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:10244", + "modified": "2026-02-04T03:21:58.697081Z" + }, + { + "id": "ALSA-2024:11250", + "modified": "2026-02-04T03:37:50.674762Z" + }, + { + "id": "ALSA-2024:2438", + "modified": "2026-02-04T04:21:40.830719Z" + }, + { + "id": "ALSA-2025:15099", + "modified": "2026-02-04T03:59:03.032487Z" + }, + { + "id": "ALSA-2025:9526", + "modified": "2026-02-04T03:35:27.405905Z" + } + ] + }, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "GHSA-4xh5-x5gv-qwph", + "modified": "2026-03-24T01:43:53.135277Z" + }, + { + "id": "GHSA-58qw-9mgm-455v", + "modified": "2026-05-20T21:00:09.920997Z" + }, + { + "id": "GHSA-6vgw-5pg2-w6jp", + "modified": "2026-03-24T01:43:46.425088Z" + }, + { + "id": "GHSA-jp4c-xjxw-mgf9", + "modified": "2026-05-07T16:59:14.079020Z" + }, + { + "id": "GHSA-mq26-g339-26xf", + "modified": "2026-03-24T01:43:05.410801Z" + }, + { + "id": "PYSEC-2023-228", + "modified": "2026-06-10T17:01:27.606909Z" + }, + { + "id": "PYSEC-2026-196", + "modified": "2026-06-05T12:45:14.124059Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:7323", + "modified": "2026-02-04T04:03:11.064433Z" + }, + { + "id": "ALSA-2022:8353", + "modified": "2026-02-04T03:04:32.610389Z" + }, + { + "id": "ALSA-2022:8493", + "modified": "2026-02-04T02:42:36.434701Z" + }, + { + "id": "ALSA-2023:0953", + "modified": "2026-02-04T03:15:58.943787Z" + }, + { + "id": "ALSA-2023:3595", + "modified": "2026-02-04T03:38:14.145750Z" + }, + { + "id": "ALSA-2023:5462", + "modified": "2026-02-04T03:02:52.364518Z" + }, + { + "id": "ALSA-2023:6659", + "modified": "2026-02-04T03:27:32.595876Z" + }, + { + "id": "ALSA-2024:0466", + "modified": "2026-02-04T03:07:57.616188Z" + }, + { + "id": "ALSA-2024:10983", + "modified": "2026-02-04T03:45:08.742373Z" + }, + { + "id": "ALSA-2024:4078", + "modified": "2026-02-04T02:42:46.311908Z" + }, + { + "id": "ALSA-2024:4779", + "modified": "2026-02-04T02:55:36.858364Z" + }, + { + "id": "ALSA-2024:6163", + "modified": "2026-02-04T04:21:08.554450Z" + }, + { + "id": "ALSA-2024:8446", + "modified": "2026-02-04T04:21:06.060988Z" + }, + { + "id": "ALSA-2024:9371", + "modified": "2026-02-04T03:29:13.713576Z" + }, + { + "id": "ALSA-2024:9468", + "modified": "2026-02-04T04:30:10.003749Z" + }, + { + "id": "ALSA-2025:10136", + "modified": "2026-02-04T02:36:14.764339Z" + }, + { + "id": "ALSA-2025:15019", + "modified": "2026-02-04T03:51:57.720222Z" + }, + { + "id": "ALSA-2025:23342", + "modified": "2026-02-04T03:02:34.328985Z" + }, + { + "id": "ALSA-2025:6977", + "modified": "2026-02-04T04:10:56.453210Z" + }, + { + "id": "ALSA-2026:10949", + "modified": "2026-04-30T14:44:32.588488Z" + }, + { + "id": "ALSA-2026:1478", + "modified": "2026-02-04T02:37:56.057268Z" + }, + { + "id": "ALSA-2026:19216", + "modified": "2026-05-26T16:14:18.052221Z" + }, + { + "id": "ALSA-2026:4168", + "modified": "2026-03-16T08:30:08.411931Z" + }, + { + "id": "ALSA-2026:6766", + "modified": "2026-04-17T13:20:11.098125Z" + } + ] + }, + {}, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:7323", + "modified": "2026-02-04T04:03:11.064433Z" + }, + { + "id": "ALSA-2022:8353", + "modified": "2026-02-04T03:04:32.610389Z" + }, + { + "id": "ALSA-2022:8493", + "modified": "2026-02-04T02:42:36.434701Z" + }, + { + "id": "ALSA-2023:0953", + "modified": "2026-02-04T03:15:58.943787Z" + }, + { + "id": "ALSA-2023:3595", + "modified": "2026-02-04T03:38:14.145750Z" + }, + { + "id": "ALSA-2023:5462", + "modified": "2026-02-04T03:02:52.364518Z" + }, + { + "id": "ALSA-2023:6659", + "modified": "2026-02-04T03:27:32.595876Z" + }, + { + "id": "ALSA-2024:0466", + "modified": "2026-02-04T03:07:57.616188Z" + }, + { + "id": "ALSA-2024:10983", + "modified": "2026-02-04T03:45:08.742373Z" + }, + { + "id": "ALSA-2024:4078", + "modified": "2026-02-04T02:42:46.311908Z" + }, + { + "id": "ALSA-2024:4779", + "modified": "2026-02-04T02:55:36.858364Z" + }, + { + "id": "ALSA-2024:6163", + "modified": "2026-02-04T04:21:08.554450Z" + }, + { + "id": "ALSA-2024:8446", + "modified": "2026-02-04T04:21:06.060988Z" + }, + { + "id": "ALSA-2024:9371", + "modified": "2026-02-04T03:29:13.713576Z" + }, + { + "id": "ALSA-2024:9468", + "modified": "2026-02-04T04:30:10.003749Z" + }, + { + "id": "ALSA-2025:10136", + "modified": "2026-02-04T02:36:14.764339Z" + }, + { + "id": "ALSA-2025:15019", + "modified": "2026-02-04T03:51:57.720222Z" + }, + { + "id": "ALSA-2025:23342", + "modified": "2026-02-04T03:02:34.328985Z" + }, + { + "id": "ALSA-2025:6977", + "modified": "2026-02-04T04:10:56.453210Z" + }, + { + "id": "ALSA-2026:10949", + "modified": "2026-04-30T14:44:32.588488Z" + }, + { + "id": "ALSA-2026:1478", + "modified": "2026-02-04T02:37:56.057268Z" + }, + { + "id": "ALSA-2026:19216", + "modified": "2026-05-26T16:14:18.052221Z" + }, + { + "id": "ALSA-2026:4168", + "modified": "2026-03-16T08:30:08.411931Z" + }, + { + "id": "ALSA-2026:6766", + "modified": "2026-04-17T13:20:11.098125Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6694", + "modified": "2026-02-04T02:39:28.003450Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:0463", + "modified": "2026-02-04T03:35:42.720266Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0952", + "modified": "2026-02-04T02:32:42.835672Z" + }, + { + "id": "ALSA-2024:5534", + "modified": "2026-02-04T02:43:30.286669Z" + }, + { + "id": "ALSA-2025:10407", + "modified": "2026-02-04T03:52:34.406526Z" + } + ] + }, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2024:0463", + "modified": "2026-02-04T03:35:42.720266Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:0463", + "modified": "2026-02-04T03:35:42.720266Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:0463", + "modified": "2026-02-04T03:35:42.720266Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:0463", + "modified": "2026-02-04T03:35:42.720266Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "GHSA-5rjg-fvgr-3xxf", + "modified": "2026-05-11T00:26:34.671259Z" + }, + { + "id": "GHSA-cx63-2mw6-8hw5", + "modified": "2026-02-04T03:54:02.259111Z" + }, + { + "id": "GHSA-r9hx-vwmv-q579", + "modified": "2026-02-04T03:03:25.892107Z" + }, + { + "id": "PYSEC-2022-43012", + "modified": "2026-06-10T17:02:40.148961Z" + }, + { + "id": "PYSEC-2025-49", + "modified": "2026-05-11T00:26:34.671259Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6632", + "modified": "2026-02-04T04:16:01.058999Z" + }, + { + "id": "ALSA-2025:20559", + "modified": "2026-02-04T02:22:46.209033Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0339", + "modified": "2026-02-04T03:25:10.768446Z" + }, + { + "id": "ALSA-2024:0465", + "modified": "2026-02-04T02:44:43.937586Z" + }, + { + "id": "ALSA-2025:11992", + "modified": "2026-02-04T03:22:31.337630Z" + }, + { + "id": "ALSA-2025:20936", + "modified": "2026-02-04T04:26:46.773530Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0336", + "modified": "2026-02-04T03:07:15.229260Z" + }, + { + "id": "ALSA-2023:0954", + "modified": "2026-02-04T03:42:34.465389Z" + }, + { + "id": "ALSA-2024:2463", + "modified": "2026-02-04T03:50:31.414728Z" + }, + { + "id": "ALSA-2025:22660", + "modified": "2026-02-04T04:20:35.362485Z" + }, + { + "id": "ALSA-2026:13677", + "modified": "2026-05-06T07:31:02.807439Z" + }, + { + "id": "ALSA-2026:19213", + "modified": "2026-05-26T16:00:21.331376Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0336", + "modified": "2026-02-04T03:07:15.229260Z" + }, + { + "id": "ALSA-2023:0954", + "modified": "2026-02-04T03:42:34.465389Z" + }, + { + "id": "ALSA-2024:2463", + "modified": "2026-02-04T03:50:31.414728Z" + }, + { + "id": "ALSA-2025:22660", + "modified": "2026-02-04T04:20:35.362485Z" + }, + { + "id": "ALSA-2026:13677", + "modified": "2026-05-06T07:31:02.807439Z" + }, + { + "id": "ALSA-2026:19213", + "modified": "2026-05-26T16:00:21.331376Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0336", + "modified": "2026-02-04T03:07:15.229260Z" + }, + { + "id": "ALSA-2023:0954", + "modified": "2026-02-04T03:42:34.465389Z" + }, + { + "id": "ALSA-2024:2463", + "modified": "2026-02-04T03:50:31.414728Z" + }, + { + "id": "ALSA-2025:22660", + "modified": "2026-02-04T04:20:35.362485Z" + }, + { + "id": "ALSA-2026:13677", + "modified": "2026-05-06T07:31:02.807439Z" + }, + { + "id": "ALSA-2026:19213", + "modified": "2026-05-26T16:00:21.331376Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0336", + "modified": "2026-02-04T03:07:15.229260Z" + }, + { + "id": "ALSA-2023:0954", + "modified": "2026-02-04T03:42:34.465389Z" + }, + { + "id": "ALSA-2024:2463", + "modified": "2026-02-04T03:50:31.414728Z" + }, + { + "id": "ALSA-2025:22660", + "modified": "2026-02-04T04:20:35.362485Z" + }, + { + "id": "ALSA-2026:13677", + "modified": "2026-05-06T07:31:02.807439Z" + }, + { + "id": "ALSA-2026:19213", + "modified": "2026-05-26T16:00:21.331376Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0959", + "modified": "2026-02-04T03:24:09.816450Z" + }, + { + "id": "ALSA-2026:0067", + "modified": "2026-02-04T02:19:32.940449Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6685", + "modified": "2026-02-04T04:02:01.414267Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2022:5242", + "modified": "2026-02-04T03:09:49.111890Z" + }, + { + "id": "ALSA-2022:5942", + "modified": "2026-02-04T04:29:25.863952Z" + }, + { + "id": "ALSA-2023:0958", + "modified": "2026-02-04T02:48:00.905849Z" + }, + { + "id": "ALSA-2024:9405", + "modified": "2026-02-04T03:08:35.008158Z" + }, + { + "id": "ALSA-2025:17742", + "modified": "2026-02-04T03:32:56.810406Z" + }, + { + "id": "ALSA-2025:20945", + "modified": "2026-02-04T04:32:36.215823Z" + }, + { + "id": "ALSA-2025:7440", + "modified": "2026-02-04T03:33:27.312996Z" + }, + { + "id": "ALSA-2026:11510", + "modified": "2026-04-30T14:30:20.381957Z" + }, + { + "id": "ALSA-2026:19224", + "modified": "2026-05-26T16:00:23.463648Z" + }, + { + "id": "ALSA-2026:22717", + "modified": "2026-06-04T11:15:04.513534Z" + }, + { + "id": "ALSA-2026:5602", + "modified": "2026-03-27T09:01:15.379885Z" + }, + { + "id": "ALSA-2026:8259", + "modified": "2026-04-17T13:19:37.888342Z" + } + ] + }, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:7314", + "modified": "2026-02-04T02:40:45.002131Z" + } + ] + } ] } headers: Content-Length: - - "12798" + - "19728" Content-Type: - application/json status: 200 OK @@ -4367,7 +7017,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 19399 + content_length: 18291 body: | { "results": [ @@ -4378,10 +7028,6 @@ interactions: {}, { "vulns": [ - { - "id": "UBUNTU-CVE-2026-13595", - "modified": "2026-07-09T17:15:27.672147Z" - }, { "id": "UBUNTU-CVE-2026-27456", "modified": "2026-05-20T16:24:53.388662Z" @@ -4434,18 +7080,7 @@ interactions: }, {}, {}, - { - "vulns": [ - { - "id": "UBUNTU-CVE-2026-53432", - "modified": "2026-07-03T21:45:17.460958Z" - }, - { - "id": "UBUNTU-CVE-2026-53433", - "modified": "2026-07-03T21:45:30.861784Z" - } - ] - }, + {}, { "vulns": [ { @@ -4758,7 +7393,7 @@ interactions: }, { "id": "GO-2025-4014", - "modified": "2026-06-26T12:29:46.364453Z" + "modified": "2026-06-04T10:29:16.617520Z" }, { "id": "GO-2025-4015", @@ -4766,7 +7401,7 @@ interactions: }, { "id": "GO-2025-4155", - "modified": "2026-07-09T10:44:32.536665Z" + "modified": "2026-06-12T10:29:15.211985Z" }, { "id": "GO-2025-4175", @@ -4774,7 +7409,7 @@ interactions: }, { "id": "GO-2026-4337", - "modified": "2026-07-07T10:29:23.547454Z" + "modified": "2026-06-12T10:29:15.605437Z" }, { "id": "GO-2026-4340", @@ -4782,11 +7417,11 @@ interactions: }, { "id": "GO-2026-4341", - "modified": "2026-07-07T10:29:23.472772Z" + "modified": "2026-06-12T10:29:15.035295Z" }, { "id": "GO-2026-4342", - "modified": "2026-07-02T10:44:29.686144Z" + "modified": "2026-06-12T10:29:15.283039Z" }, { "id": "GO-2026-4403", @@ -4794,7 +7429,7 @@ interactions: }, { "id": "GO-2026-4601", - "modified": "2026-07-09T10:44:32.269952Z" + "modified": "2026-06-17T10:29:19.633057Z" }, { "id": "GO-2026-4602", @@ -4806,7 +7441,7 @@ interactions: }, { "id": "GO-2026-4864", - "modified": "2026-07-09T10:44:33.381720Z" + "modified": "2026-06-16T10:29:15.527117Z" }, { "id": "GO-2026-4865", @@ -4818,23 +7453,19 @@ interactions: }, { "id": "GO-2026-4870", - "modified": "2026-07-09T10:44:33.055212Z" + "modified": "2026-06-17T10:29:19.204036Z" }, { "id": "GO-2026-4918", - "modified": "2026-06-27T10:44:20.771417Z" + "modified": "2026-05-11T08:11:05.383192Z" }, { "id": "GO-2026-4946", - "modified": "2026-07-09T10:44:33.129570Z" + "modified": "2026-06-17T10:29:19.549582Z" }, { "id": "GO-2026-4947", - "modified": "2026-07-09T10:44:33.192298Z" - }, - { - "id": "GO-2026-4970", - "modified": "2026-07-08T20:29:26.853236Z" + "modified": "2026-06-17T10:29:19.948808Z" }, { "id": "GO-2026-4971", @@ -4842,7 +7473,7 @@ interactions: }, { "id": "GO-2026-4976", - "modified": "2026-06-27T10:44:21.221469Z" + "modified": "2026-05-11T08:11:26.883618Z" }, { "id": "GO-2026-4977", @@ -4854,11 +7485,11 @@ interactions: }, { "id": "GO-2026-4981", - "modified": "2026-07-09T10:44:32.677126Z" + "modified": "2026-06-09T10:29:17.671297Z" }, { "id": "GO-2026-4982", - "modified": "2026-06-27T10:44:21.066171Z" + "modified": "2026-05-11T08:11:21.041304Z" }, { "id": "GO-2026-4986", @@ -4866,7 +7497,7 @@ interactions: }, { "id": "GO-2026-5037", - "modified": "2026-07-09T10:44:33.680614Z" + "modified": "2026-06-05T07:56:06.303534Z" }, { "id": "GO-2026-5038", @@ -4874,11 +7505,7 @@ interactions: }, { "id": "GO-2026-5039", - "modified": "2026-06-27T10:44:21.143168Z" - }, - { - "id": "GO-2026-5856", - "modified": "2026-07-08T20:29:26.756890Z" + "modified": "2026-06-05T07:56:26.571479Z" } ] }, @@ -4896,10 +7523,6 @@ interactions: "id": "UBUNTU-CVE-2025-68973", "modified": "2026-02-05T00:30:28.335358Z" }, - { - "id": "UBUNTU-CVE-2026-57062", - "modified": "2026-06-29T18:15:10.272222Z" - }, { "id": "USN-7412-1", "modified": "2026-02-10T04:47:47Z" @@ -4910,56 +7533,19 @@ interactions: }, { "id": "USN-7946-1", - "modified": "2026-06-25T13:32:31.788231Z" + "modified": "2026-05-20T16:03:55.565581Z" } ] }, {}, - { - "vulns": [ - { - "id": "UBUNTU-CVE-2026-41991", - "modified": "2026-07-06T20:30:58.394348Z" - }, - { - "id": "UBUNTU-CVE-2026-41992", - "modified": "2026-07-06T20:30:59.127897Z" - }, - { - "id": "USN-8512-1", - "modified": "2026-07-06T20:44:29.397826Z" - } - ] - }, {}, {}, - { - "vulns": [ - { - "id": "UBUNTU-CVE-2026-54369", - "modified": "2026-07-01T21:27:56Z" - }, - { - "id": "UBUNTU-CVE-2026-54370", - "modified": "2026-07-01T21:27:56Z" - } - ] - }, - { - "vulns": [ - { - "id": "UBUNTU-CVE-2026-54371", - "modified": "2026-07-06T20:31:13.100309Z" - } - ] - }, + {}, + {}, + {}, {}, { "vulns": [ - { - "id": "UBUNTU-CVE-2026-13595", - "modified": "2026-07-09T17:15:27.672147Z" - }, { "id": "UBUNTU-CVE-2026-27456", "modified": "2026-05-20T16:24:53.388662Z" @@ -4998,7 +7584,7 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2016-20013", - "modified": "2026-07-08T22:45:12.334407Z" + "modified": "2026-06-01T15:45:11.069074Z" }, { "id": "UBUNTU-CVE-2025-0395", @@ -5042,7 +7628,7 @@ interactions: }, { "id": "UBUNTU-CVE-2026-6238", - "modified": "2026-06-24T11:00:25.318641Z" + "modified": "2026-05-29T19:15:06.810342Z" }, { "id": "USN-7259-1", @@ -5058,7 +7644,7 @@ interactions: }, { "id": "USN-8005-1", - "modified": "2026-06-25T13:32:31.787765Z" + "modified": "2026-05-20T16:03:57.629529Z" } ] }, @@ -5067,11 +7653,11 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2025-1390", - "modified": "2026-06-23T22:00:07.953148Z" + "modified": "2026-04-22T15:31:21.010462Z" }, { "id": "UBUNTU-CVE-2026-4878", - "modified": "2026-06-24T02:29:23.557692Z" + "modified": "2026-04-29T11:29:22.138592Z" }, { "id": "USN-7287-1", @@ -5091,11 +7677,11 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2024-2236", - "modified": "2026-07-01T23:40:15.314704Z" + "modified": "2026-06-02T14:00:10.803243Z" }, { "id": "UBUNTU-CVE-2026-41989", - "modified": "2026-06-26T19:30:06.785492Z" + "modified": "2026-06-02T14:00:20.958338Z" }, { "id": "USN-8319-1", @@ -5108,11 +7694,11 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2024-12243", - "modified": "2026-07-06T20:44:27.631542Z" + "modified": "2026-04-22T14:37:38.949616Z" }, { "id": "UBUNTU-CVE-2025-14831", - "modified": "2026-07-06T20:44:29.080707Z" + "modified": "2026-05-11T10:46:40.301990Z" }, { "id": "UBUNTU-CVE-2025-32988", @@ -5132,55 +7718,55 @@ interactions: }, { "id": "UBUNTU-CVE-2025-9820", - "modified": "2026-07-06T20:44:29.852110Z" + "modified": "2026-05-11T10:40:33.804944Z" }, { "id": "UBUNTU-CVE-2026-33845", - "modified": "2026-07-06T20:44:27.233455Z" + "modified": "2026-06-02T12:00:06.980060Z" }, { "id": "UBUNTU-CVE-2026-33846", - "modified": "2026-07-06T20:44:28.879211Z" + "modified": "2026-06-02T12:00:06.967548Z" }, { "id": "UBUNTU-CVE-2026-3832", - "modified": "2026-06-30T03:45:07.126536Z" + "modified": "2026-06-02T12:00:06.982846Z" }, { "id": "UBUNTU-CVE-2026-3833", - "modified": "2026-07-06T20:44:29.145695Z" + "modified": "2026-06-02T12:00:06.885767Z" }, { "id": "UBUNTU-CVE-2026-42009", - "modified": "2026-07-06T20:44:28.218328Z" + "modified": "2026-06-02T12:00:08.420027Z" }, { "id": "UBUNTU-CVE-2026-42010", - "modified": "2026-07-06T20:44:27.505571Z" + "modified": "2026-06-02T12:00:08.351396Z" }, { "id": "UBUNTU-CVE-2026-42011", - "modified": "2026-07-06T16:02:54.226888Z" + "modified": "2026-06-02T12:00:08.463825Z" }, { "id": "UBUNTU-CVE-2026-42012", - "modified": "2026-07-06T16:02:54.199597Z" + "modified": "2026-06-02T12:00:08.689551Z" }, { "id": "UBUNTU-CVE-2026-42013", - "modified": "2026-07-06T16:02:54.272277Z" + "modified": "2026-06-02T12:00:08.530311Z" }, { "id": "UBUNTU-CVE-2026-42014", - "modified": "2026-07-06T16:02:52.889534Z" + "modified": "2026-06-17T11:01:28.854907Z" }, { "id": "UBUNTU-CVE-2026-42015", - "modified": "2026-07-06T16:02:53.058495Z" + "modified": "2026-06-02T12:00:08.586508Z" }, { "id": "UBUNTU-CVE-2026-5260", - "modified": "2026-07-06T20:44:27.171088Z" + "modified": "2026-06-02T12:00:09.990926Z" }, { "id": "USN-7281-1", @@ -5233,15 +7819,15 @@ interactions: }, { "id": "UBUNTU-CVE-2026-40355", - "modified": "2026-07-09T21:30:58.285031Z" + "modified": "2026-05-29T10:45:29.205811Z" }, { "id": "UBUNTU-CVE-2026-40356", - "modified": "2026-07-09T21:30:58.537034Z" + "modified": "2026-05-29T10:45:29.281566Z" }, { "id": "USN-7257-1", - "modified": "2026-06-25T13:32:30.106589Z" + "modified": "2026-05-20T16:03:28.032877Z" }, { "id": "USN-7314-1", @@ -5249,7 +7835,7 @@ interactions: }, { "id": "USN-7542-1", - "modified": "2026-06-25T13:32:30.616782Z" + "modified": "2026-05-20T16:03:46.356475Z" } ] }, @@ -5280,27 +7866,20 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2023-50495", - "modified": "2026-07-02T22:45:21.903948Z" + "modified": "2026-04-22T14:15:03.155150Z" }, { "id": "UBUNTU-CVE-2025-6141", - "modified": "2026-07-07T21:03:19.257825Z" + "modified": "2026-04-22T16:08:19.927561Z" }, { "id": "UBUNTU-CVE-2025-69720", - "modified": "2026-07-08T18:30:10.365748Z" + "modified": "2026-04-22T16:13:35.392426Z" } ] }, {}, - { - "vulns": [ - { - "id": "UBUNTU-CVE-2026-13757", - "modified": "2026-07-01T21:19:39Z" - } - ] - }, + {}, { "vulns": [ { @@ -5313,7 +7892,7 @@ interactions: }, { "id": "UBUNTU-CVE-2026-54411", - "modified": "2026-06-24T09:03:12Z" + "modified": "2026-06-17T11:02:56.948731Z" }, { "id": "USN-7580-1", @@ -5350,7 +7929,7 @@ interactions: }, { "id": "UBUNTU-CVE-2024-41996", - "modified": "2026-07-08T22:45:14.910732Z" + "modified": "2026-06-16T13:30:41.910018Z" }, { "id": "UBUNTU-CVE-2024-9143", @@ -5358,7 +7937,7 @@ interactions: }, { "id": "UBUNTU-CVE-2025-15467", - "modified": "2026-07-08T22:45:12.561148Z" + "modified": "2026-06-18T04:30:07.553679Z" }, { "id": "UBUNTU-CVE-2025-27587", @@ -5366,15 +7945,15 @@ interactions: }, { "id": "UBUNTU-CVE-2025-68160", - "modified": "2026-07-08T22:45:11.201806Z" + "modified": "2026-05-20T16:23:45.899710Z" }, { "id": "UBUNTU-CVE-2025-69418", - "modified": "2026-07-08T22:45:10.238757Z" + "modified": "2026-05-20T16:23:51.325414Z" }, { "id": "UBUNTU-CVE-2025-69419", - "modified": "2026-07-08T22:45:10.652331Z" + "modified": "2026-05-20T16:23:51.080907Z" }, { "id": "UBUNTU-CVE-2025-69420", @@ -5394,71 +7973,71 @@ interactions: }, { "id": "UBUNTU-CVE-2026-22796", - "modified": "2026-07-08T22:45:13.369897Z" + "modified": "2026-05-20T16:24:15.294811Z" }, { "id": "UBUNTU-CVE-2026-28387", - "modified": "2026-07-08T22:45:14.045974Z" + "modified": "2026-05-20T16:24:53.583373Z" }, { "id": "UBUNTU-CVE-2026-28388", - "modified": "2026-07-08T22:45:13.947607Z" + "modified": "2026-05-20T16:24:55.415353Z" }, { "id": "UBUNTU-CVE-2026-28389", - "modified": "2026-07-08T22:45:14.128002Z" + "modified": "2026-05-20T16:24:55.036642Z" }, { "id": "UBUNTU-CVE-2026-28390", - "modified": "2026-07-08T22:45:14.501164Z" + "modified": "2026-05-20T16:24:54.756018Z" }, { "id": "UBUNTU-CVE-2026-31789", - "modified": "2026-07-08T22:45:08.612244Z" + "modified": "2026-06-16T13:30:43.522021Z" }, { "id": "UBUNTU-CVE-2026-31790", - "modified": "2026-07-08T22:45:15.194189Z" + "modified": "2026-06-16T13:30:47.743687Z" }, { "id": "UBUNTU-CVE-2026-34180", - "modified": "2026-07-08T22:45:16.182260Z" + "modified": "2026-06-17T16:15:20.130456Z" }, { "id": "UBUNTU-CVE-2026-34182", - "modified": "2026-07-08T22:45:16.771546Z" + "modified": "2026-06-17T16:15:21.278388Z" }, { "id": "UBUNTU-CVE-2026-42766", - "modified": "2026-07-08T22:45:18.180633Z" + "modified": "2026-06-17T16:15:12.063144Z" }, { "id": "UBUNTU-CVE-2026-42767", - "modified": "2026-07-08T22:45:18.595864Z" + "modified": "2026-06-17T16:15:10.718836Z" }, { "id": "UBUNTU-CVE-2026-42770", - "modified": "2026-07-08T22:45:20.235150Z" + "modified": "2026-06-17T16:15:10.643613Z" }, { "id": "UBUNTU-CVE-2026-45445", - "modified": "2026-07-08T22:45:20.031829Z" + "modified": "2026-06-17T16:15:15.523263Z" }, { "id": "UBUNTU-CVE-2026-45446", - "modified": "2026-07-08T22:45:20.225145Z" + "modified": "2026-06-17T16:15:13.306370Z" }, { "id": "UBUNTU-CVE-2026-45447", - "modified": "2026-07-08T22:45:20.175237Z" + "modified": "2026-06-17T16:15:13.449894Z" }, { "id": "UBUNTU-CVE-2026-7383", - "modified": "2026-07-08T22:45:20.213109Z" + "modified": "2026-06-17T16:15:24.043621Z" }, { "id": "UBUNTU-CVE-2026-9076", - "modified": "2026-07-08T22:45:20.169764Z" + "modified": "2026-06-17T16:15:14.309841Z" }, { "id": "USN-7278-1", @@ -5466,11 +8045,11 @@ interactions: }, { "id": "USN-7786-1", - "modified": "2026-06-25T13:32:31.234820Z" + "modified": "2026-05-20T16:03:48.800001Z" }, { "id": "USN-7980-1", - "modified": "2026-06-30T18:15:13.934266Z" + "modified": "2026-06-18T04:30:17.825715Z" }, { "id": "USN-8155-1", @@ -5478,7 +8057,7 @@ interactions: }, { "id": "USN-8414-1", - "modified": "2026-06-30T18:17:25.786836Z" + "modified": "2026-06-17T11:01:06.567847Z" } ] }, @@ -5575,11 +8154,11 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2023-31486", - "modified": "2026-06-24T15:30:22.242365Z" + "modified": "2026-05-20T16:13:34.139215Z" }, { "id": "UBUNTU-CVE-2023-47039", - "modified": "2026-06-24T15:30:22.223640Z" + "modified": "2026-04-22T14:15:27.303492Z" }, { "id": "UBUNTU-CVE-2024-56406", @@ -5587,47 +8166,43 @@ interactions: }, { "id": "UBUNTU-CVE-2025-15649", - "modified": "2026-07-01T13:50:56.760041Z" + "modified": "2026-06-01T07:15:36.150813Z" }, { "id": "UBUNTU-CVE-2025-40909", - "modified": "2026-06-24T15:30:22.288512Z" + "modified": "2026-04-22T16:02:28.067448Z" }, { "id": "UBUNTU-CVE-2026-12087", - "modified": "2026-07-01T13:51:29.763714Z" + "modified": "2026-06-17T06:31:05.062220Z" }, { "id": "UBUNTU-CVE-2026-42496", - "modified": "2026-07-01T18:56:57.544972Z" + "modified": "2026-05-29T18:00:44.834841Z" }, { "id": "UBUNTU-CVE-2026-42497", - "modified": "2026-07-01T13:53:02.335741Z" + "modified": "2026-05-29T18:00:44.772881Z" }, { "id": "UBUNTU-CVE-2026-48959", - "modified": "2026-07-01T13:53:12.524471Z" + "modified": "2026-06-01T07:15:44.250395Z" }, { "id": "UBUNTU-CVE-2026-48961", - "modified": "2026-07-01T13:53:13.376190Z" + "modified": "2026-06-01T07:15:44.261753Z" }, { "id": "UBUNTU-CVE-2026-48962", - "modified": "2026-07-01T13:53:13.252080Z" - }, - { - "id": "UBUNTU-CVE-2026-7017", - "modified": "2026-07-09T17:15:52.841661Z" + "modified": "2026-05-29T18:01:00.200422Z" }, { "id": "UBUNTU-CVE-2026-8376", - "modified": "2026-07-01T18:57:39.513466Z" + "modified": "2026-05-29T18:01:03.136712Z" }, { "id": "UBUNTU-CVE-2026-9538", - "modified": "2026-07-01T13:53:19.355510Z" + "modified": "2026-05-29T18:01:01.753968Z" }, { "id": "USN-7434-1", @@ -5657,30 +8232,29 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2025-45582", - "modified": "2026-07-06T16:00:24.944880Z" + "modified": "2026-05-20T16:23:29.580676Z" }, { "id": "UBUNTU-CVE-2026-5704", - "modified": "2026-06-26T14:47:36.043245Z" - }, - { - "id": "USN-8477-1", - "modified": "2026-06-26T14:59:24.298942Z" - }, - { - "id": "USN-8510-1", - "modified": "2026-07-06T20:34:34.654931Z" + "modified": "2026-05-20T16:26:24.372107Z" } ] }, {}, {}, - {} + { + "vulns": [ + { + "id": "UBUNTU-CVE-2026-27171", + "modified": "2026-06-16T13:30:42.791654Z" + } + ] + } ] } headers: Content-Length: - - "19399" + - "18291" Content-Type: - application/json status: 200 OK @@ -6975,7 +9549,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 12548 + content_length: 10676 body: | { "results": [ @@ -6987,10 +9561,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2021-42376", - "modified": "2026-07-08T04:32:12.032317Z" - }, { "id": "ALPINE-CVE-2024-58251", "modified": "2026-06-15T18:18:10.508036Z" @@ -7020,30 +9590,7 @@ interactions: } ] }, - { - "vulns": [ - { - "id": "GHSA-3wrr-7qpf-2prh", - "modified": "2026-06-30T05:59:24.605767Z" - }, - { - "id": "GHSA-5jmj-h7xm-6q6v", - "modified": "2026-06-30T21:15:09.170694Z" - }, - { - "id": "GHSA-hgj6-7826-r7m5", - "modified": "2026-06-25T00:29:24.783131Z" - }, - { - "id": "GHSA-j3rv-43j4-c7qm", - "modified": "2026-06-25T00:29:23.656899Z" - }, - { - "id": "GHSA-rmj7-2vxq-3g9f", - "modified": "2026-06-25T00:29:23.888358Z" - } - ] - }, + {}, {}, {}, {}, @@ -7240,7 +9787,7 @@ interactions: }, { "id": "GHSA-h2qv-fj59-j46j", - "modified": "2026-07-09T15:45:32.592357Z" + "modified": "2026-06-12T22:29:19.482629Z" } ] }, @@ -7304,7 +9851,7 @@ interactions: }, { "id": "GHSA-c2gf-v879-257j", - "modified": "2026-07-09T15:45:32.546754Z" + "modified": "2026-06-12T19:45:11.448753Z" }, { "id": "GHSA-f6hv-jmp6-3vwv", @@ -7345,7 +9892,7 @@ interactions: }, { "id": "GHSA-6jv9-x5w9-2ccm", - "modified": "2026-07-07T13:15:14.336923Z" + "modified": "2026-06-13T00:29:28.808735Z" }, { "id": "GHSA-rgrr-p7gp-5xj7", @@ -7410,11 +9957,11 @@ interactions: "vulns": [ { "id": "GHSA-5pvg-856g-cp85", - "modified": "2026-07-07T13:15:14.354147Z" + "modified": "2026-06-12T19:45:11.459442Z" }, { "id": "GHSA-676x-f7gg-47vc", - "modified": "2026-07-07T13:15:14.331855Z" + "modified": "2026-06-12T19:45:11.461282Z" }, { "id": "GHSA-xmv7-r254-6q78", @@ -7464,22 +10011,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2022-1292", - "modified": "2026-07-08T04:31:47.244657Z" - }, - { - "id": "ALPINE-CVE-2022-2068", - "modified": "2026-07-08T04:31:47.874039Z" - }, - { - "id": "ALPINE-CVE-2023-0466", - "modified": "2026-07-08T04:31:25.432482Z" - }, - { - "id": "ALPINE-CVE-2023-4807", - "modified": "2026-07-08T04:32:27.043928Z" - }, { "id": "ALPINE-CVE-2024-12797", "modified": "2026-06-15T18:18:10.256734Z" @@ -7490,35 +10021,35 @@ interactions: }, { "id": "ALPINE-CVE-2025-15467", - "modified": "2026-07-08T04:31:54.237773Z" + "modified": "2026-06-15T18:18:10.574070Z" }, { "id": "ALPINE-CVE-2025-15468", - "modified": "2026-07-08T04:31:54.236044Z" + "modified": "2026-06-15T18:18:10.574416Z" }, { "id": "ALPINE-CVE-2025-66199", - "modified": "2026-07-08T04:30:11.899340Z" + "modified": "2026-06-15T18:18:10.877115Z" }, { "id": "ALPINE-CVE-2025-68160", - "modified": "2026-07-08T04:32:27.950152Z" + "modified": "2026-06-15T18:18:10.890200Z" }, { "id": "ALPINE-CVE-2025-69418", - "modified": "2026-07-08T04:31:55.406338Z" + "modified": "2026-06-15T18:18:10.901963Z" }, { "id": "ALPINE-CVE-2025-69419", - "modified": "2026-07-08T04:31:54.597659Z" + "modified": "2026-06-15T18:18:10.902306Z" }, { "id": "ALPINE-CVE-2025-69420", - "modified": "2026-07-08T04:31:55.393Z" + "modified": "2026-06-15T18:18:10.902344Z" }, { "id": "ALPINE-CVE-2025-69421", - "modified": "2026-07-08T04:30:11.908070Z" + "modified": "2026-06-15T18:18:10.907897Z" }, { "id": "ALPINE-CVE-2025-9230", @@ -7534,35 +10065,35 @@ interactions: }, { "id": "ALPINE-CVE-2026-22795", - "modified": "2026-07-08T04:32:28.331714Z" + "modified": "2026-06-15T18:18:11.004265Z" }, { "id": "ALPINE-CVE-2026-22796", - "modified": "2026-07-08T04:32:29.030190Z" + "modified": "2026-06-15T18:18:11.007022Z" }, { "id": "ALPINE-CVE-2026-28387", - "modified": "2026-07-08T04:32:29.167238Z" + "modified": "2026-06-15T18:18:11.052819Z" }, { "id": "ALPINE-CVE-2026-28388", - "modified": "2026-07-08T04:32:29.169509Z" + "modified": "2026-06-15T18:18:11.053496Z" }, { "id": "ALPINE-CVE-2026-28389", - "modified": "2026-07-08T04:31:56.091480Z" + "modified": "2026-06-15T18:18:11.053742Z" }, { "id": "ALPINE-CVE-2026-28390", - "modified": "2026-07-08T04:31:57.860412Z" + "modified": "2026-06-15T18:18:11.053815Z" }, { "id": "ALPINE-CVE-2026-31789", - "modified": "2026-07-08T04:30:12.004739Z" + "modified": "2026-06-15T18:18:11.056839Z" }, { "id": "ALPINE-CVE-2026-31790", - "modified": "2026-07-08T04:32:29.132271Z" + "modified": "2026-06-15T18:18:11.057167Z" } ] }, @@ -7595,66 +10126,6 @@ interactions: { "id": "ALPINE-CVE-2026-32778", "modified": "2026-06-15T18:18:11.072930Z" - }, - { - "id": "ALPINE-CVE-2026-41080", - "modified": "2026-06-20T12:30:05.052957Z" - }, - { - "id": "ALPINE-CVE-2026-45186", - "modified": "2026-06-20T12:30:05.157190Z" - }, - { - "id": "ALPINE-CVE-2026-50219", - "modified": "2026-06-29T15:30:06.451101Z" - }, - { - "id": "ALPINE-CVE-2026-56131", - "modified": "2026-06-29T15:30:04.915303Z" - }, - { - "id": "ALPINE-CVE-2026-56132", - "modified": "2026-06-29T15:30:04.969406Z" - }, - { - "id": "ALPINE-CVE-2026-56403", - "modified": "2026-06-29T15:30:04.960433Z" - }, - { - "id": "ALPINE-CVE-2026-56404", - "modified": "2026-06-29T15:30:04.962121Z" - }, - { - "id": "ALPINE-CVE-2026-56405", - "modified": "2026-06-29T15:30:06.454363Z" - }, - { - "id": "ALPINE-CVE-2026-56406", - "modified": "2026-06-29T15:30:04.954590Z" - }, - { - "id": "ALPINE-CVE-2026-56407", - "modified": "2026-06-29T15:30:06.448330Z" - }, - { - "id": "ALPINE-CVE-2026-56408", - "modified": "2026-06-29T15:30:04.922465Z" - }, - { - "id": "ALPINE-CVE-2026-56409", - "modified": "2026-06-29T15:30:04.923913Z" - }, - { - "id": "ALPINE-CVE-2026-56410", - "modified": "2026-06-29T15:30:04.962352Z" - }, - { - "id": "ALPINE-CVE-2026-56411", - "modified": "2026-06-29T15:30:04.965868Z" - }, - { - "id": "ALPINE-CVE-2026-56412", - "modified": "2026-06-29T15:30:06.451950Z" } ] }, @@ -7675,23 +10146,27 @@ interactions: }, { "id": "ALPINE-CVE-2025-64506", - "modified": "2026-07-08T04:32:27.903394Z" + "modified": "2026-06-15T18:18:10.872647Z" }, { "id": "ALPINE-CVE-2025-64720", - "modified": "2026-07-08T04:32:27.945381Z" + "modified": "2026-06-15T18:18:10.873143Z" }, { "id": "ALPINE-CVE-2025-65018", - "modified": "2026-07-08T04:30:11.929041Z" + "modified": "2026-06-15T18:18:10.876130Z" }, { "id": "ALPINE-CVE-2025-66293", "modified": "2026-06-15T18:18:10.877635Z" }, + { + "id": "ALPINE-CVE-2026-22695", + "modified": "2026-06-15T18:18:11.003841Z" + }, { "id": "ALPINE-CVE-2026-22801", - "modified": "2026-07-08T04:32:29.119736Z" + "modified": "2026-06-15T18:18:11.007538Z" }, { "id": "ALPINE-CVE-2026-25646", @@ -7699,15 +10174,15 @@ interactions: }, { "id": "ALPINE-CVE-2026-33416", - "modified": "2026-07-08T04:32:29.121861Z" + "modified": "2026-06-15T18:18:11.088019Z" }, { "id": "ALPINE-CVE-2026-33636", - "modified": "2026-07-08T04:32:29.247323Z" + "modified": "2026-06-15T18:18:11.123880Z" }, { "id": "ALPINE-CVE-2026-34757", - "modified": "2026-07-08T04:31:57.961613Z" + "modified": "2026-06-15T18:18:11.210982Z" } ] }, @@ -7730,7 +10205,7 @@ interactions: "vulns": [ { "id": "ALPINE-CVE-2025-26519", - "modified": "2026-07-08T04:32:24.548042Z" + "modified": "2026-06-15T18:18:10.600004Z" }, { "id": "ALPINE-CVE-2026-40200", @@ -7866,11 +10341,11 @@ interactions: "vulns": [ { "id": "GHSA-2r2c-cx56-8933", - "modified": "2026-06-25T22:29:16.891915Z" + "modified": "2026-06-18T13:16:13.190648Z" }, { "id": "GHSA-47qp-hqvx-6r3f", - "modified": "2026-06-25T22:29:17.064782Z" + "modified": "2026-06-18T13:15:38.857601Z" } ] }, @@ -7880,26 +10355,15 @@ interactions: {}, {}, {}, - { - "vulns": [ - { - "id": "ALPINE-CVE-2026-2100", - "modified": "2026-06-25T10:30:05.031172Z" - } - ] - }, + {}, {}, {}, {}, { "vulns": [ - { - "id": "ALPINE-CVE-2022-35737", - "modified": "2026-07-08T04:31:20.295531Z" - }, { "id": "ALPINE-CVE-2025-29087", - "modified": "2026-07-08T04:31:54.511793Z" + "modified": "2026-06-15T18:27:20.198775Z" }, { "id": "ALPINE-CVE-2025-29088", @@ -7907,11 +10371,11 @@ interactions: }, { "id": "ALPINE-CVE-2025-3277", - "modified": "2026-07-08T04:32:24.444840Z" + "modified": "2026-06-15T18:26:20.400157Z" }, { "id": "ALPINE-CVE-2025-6965", - "modified": "2026-06-27T10:30:06.109296Z" + "modified": "2026-06-15T18:27:21.155416Z" } ] }, @@ -7926,7 +10390,7 @@ interactions: }, { "id": "ALPINE-CVE-2026-27171", - "modified": "2026-07-08T04:31:57.846862Z" + "modified": "2026-06-15T18:18:11.041363Z" } ] } @@ -7934,7 +10398,7 @@ interactions: } headers: Content-Length: - - "12548" + - "10676" Content-Type: - application/json status: 200 OK @@ -8452,7 +10916,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 2419 + content_length: 2085 body: | { "results": [ @@ -8590,7 +11054,7 @@ interactions: "vulns": [ { "id": "GHSA-4xh5-x5gv-qwph", - "modified": "2026-07-07T17:57:29.434622Z" + "modified": "2026-03-24T01:43:53.135277Z" }, { "id": "GHSA-58qw-9mgm-455v", @@ -8598,7 +11062,7 @@ interactions: }, { "id": "GHSA-6vgw-5pg2-w6jp", - "modified": "2026-07-07T17:56:16.480954Z" + "modified": "2026-03-24T01:43:46.425088Z" }, { "id": "GHSA-jp4c-xjxw-mgf9", @@ -8608,25 +11072,13 @@ interactions: "id": "GHSA-mq26-g339-26xf", "modified": "2026-03-24T01:43:05.410801Z" }, - { - "id": "GHSA-wf93-45jw-7689", - "modified": "2026-07-08T21:26:17.521856Z" - }, { "id": "PYSEC-2023-228", "modified": "2026-06-10T17:01:27.606909Z" }, - { - "id": "PYSEC-2026-1795", - "modified": "2026-07-07T17:48:06.199964Z" - }, - { - "id": "PYSEC-2026-1796", - "modified": "2026-07-07T17:48:06.240646Z" - }, { "id": "PYSEC-2026-196", - "modified": "2026-07-08T21:26:17.521856Z" + "modified": "2026-06-05T12:45:14.124059Z" } ] }, @@ -8639,7 +11091,7 @@ interactions: }, { "id": "GHSA-cx63-2mw6-8hw5", - "modified": "2026-07-07T17:57:13.326243Z" + "modified": "2026-02-04T03:54:02.259111Z" }, { "id": "GHSA-r9hx-vwmv-q579", @@ -8652,10 +11104,6 @@ interactions: { "id": "PYSEC-2025-49", "modified": "2026-05-11T00:26:34.671259Z" - }, - { - "id": "PYSEC-2026-1918", - "modified": "2026-07-07T17:57:13.326243Z" } ] }, @@ -8684,11 +11132,7 @@ interactions: "vulns": [ { "id": "GHSA-8rrh-rw8j-w5fx", - "modified": "2026-07-07T17:56:06.063831Z" - }, - { - "id": "PYSEC-2026-2047", - "modified": "2026-07-07T17:47:43.451695Z" + "modified": "2026-02-04T03:06:55.268134Z" } ] }, @@ -8697,7 +11141,7 @@ interactions: } headers: Content-Length: - - "2419" + - "2085" Content-Type: - application/json status: 200 OK @@ -9306,7 +11750,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 5776 + content_length: 4848 body: | { "results": [ @@ -9338,15 +11782,11 @@ interactions: }, { "id": "GHSA-rrqc-c2jx-6jgv", - "modified": "2026-07-07T17:57:34.018251Z" + "modified": "2024-10-30T19:23:59.139649Z" }, { "id": "PYSEC-2021-98", "modified": "2023-12-06T01:01:16.755410Z" - }, - { - "id": "PYSEC-2026-1297", - "modified": "2026-07-07T17:57:34.018251Z" } ] }, @@ -9392,11 +11832,7 @@ interactions: }, { "id": "GHSA-87hc-h4r5-73f7", - "modified": "2026-07-07T17:56:19.044748Z" - }, - { - "id": "PYSEC-2026-2044", - "modified": "2026-07-07T17:47:56.418445Z" + "modified": "2026-02-04T03:18:07.993642Z" } ] }, @@ -9443,7 +11879,7 @@ interactions: "vulns": [ { "id": "GHSA-65pc-fj4g-8rjx", - "modified": "2026-07-08T17:45:15.021597Z" + "modified": "2026-06-16T16:26:11.904403Z" }, { "id": "GHSA-jjg7-2v4v-x38h", @@ -9558,7 +11994,7 @@ interactions: "vulns": [ { "id": "GHSA-4xh5-x5gv-qwph", - "modified": "2026-07-07T17:57:29.434622Z" + "modified": "2026-03-24T01:43:53.135277Z" }, { "id": "GHSA-58qw-9mgm-455v", @@ -9566,7 +12002,7 @@ interactions: }, { "id": "GHSA-6vgw-5pg2-w6jp", - "modified": "2026-07-07T17:56:16.480954Z" + "modified": "2026-03-24T01:43:46.425088Z" }, { "id": "GHSA-jp4c-xjxw-mgf9", @@ -9576,25 +12012,13 @@ interactions: "id": "GHSA-mq26-g339-26xf", "modified": "2026-03-24T01:43:05.410801Z" }, - { - "id": "GHSA-wf93-45jw-7689", - "modified": "2026-07-08T21:26:17.521856Z" - }, { "id": "PYSEC-2023-228", "modified": "2026-06-10T17:01:27.606909Z" }, - { - "id": "PYSEC-2026-1795", - "modified": "2026-07-07T17:48:06.199964Z" - }, - { - "id": "PYSEC-2026-1796", - "modified": "2026-07-07T17:48:06.240646Z" - }, { "id": "PYSEC-2026-196", - "modified": "2026-07-08T21:26:17.521856Z" + "modified": "2026-06-05T12:45:14.124059Z" } ] }, @@ -9603,11 +12027,11 @@ interactions: "vulns": [ { "id": "GHSA-9hjg-9r4m-mvj7", - "modified": "2026-07-07T17:56:56.234172Z" + "modified": "2026-02-04T03:44:00.676479Z" }, { "id": "GHSA-9wx4-h78v-vm56", - "modified": "2026-07-07T17:57:17.012984Z" + "modified": "2026-02-04T02:43:42.271895Z" }, { "id": "GHSA-gc5v-m9x4-r6x2", @@ -9620,14 +12044,6 @@ interactions: { "id": "PYSEC-2023-74", "modified": "2023-11-08T04:12:35.436175Z" - }, - { - "id": "PYSEC-2026-1872", - "modified": "2026-07-07T17:47:00.332079Z" - }, - { - "id": "PYSEC-2026-1873", - "modified": "2026-07-07T17:46:36.762141Z" } ] }, @@ -9640,7 +12056,7 @@ interactions: }, { "id": "GHSA-cx63-2mw6-8hw5", - "modified": "2026-07-07T17:57:13.326243Z" + "modified": "2026-02-04T03:54:02.259111Z" }, { "id": "GHSA-r9hx-vwmv-q579", @@ -9653,10 +12069,6 @@ interactions: { "id": "PYSEC-2025-49", "modified": "2026-05-11T00:26:34.671259Z" - }, - { - "id": "PYSEC-2026-1918", - "modified": "2026-07-07T17:57:13.326243Z" } ] }, @@ -9685,15 +12097,15 @@ interactions: "vulns": [ { "id": "GHSA-2xpw-w6gg-jr37", - "modified": "2026-07-07T17:56:33.872074Z" + "modified": "2026-02-04T02:36:12.983430Z" }, { "id": "GHSA-34jh-p97f-mpxf", - "modified": "2026-07-07T17:56:53.715123Z" + "modified": "2026-02-04T03:37:44.850742Z" }, { "id": "GHSA-38jv-5279-wg99", - "modified": "2026-07-07T17:56:31.346111Z" + "modified": "2026-02-04T03:51:36.162029Z" }, { "id": "GHSA-g4mx-q9vg-27p4", @@ -9701,11 +12113,11 @@ interactions: }, { "id": "GHSA-gm62-xv2j-4w53", - "modified": "2026-07-07T17:57:28.931610Z" + "modified": "2026-02-04T03:37:15.919661Z" }, { "id": "GHSA-pq67-6m6q-mj2v", - "modified": "2026-07-07T17:56:41.872294Z" + "modified": "2026-02-04T04:38:01.163387Z" }, { "id": "GHSA-qccp-gfcp-xxvc", @@ -9734,26 +12146,6 @@ interactions: { "id": "PYSEC-2026-141", "modified": "2026-05-20T09:19:20.983812Z" - }, - { - "id": "PYSEC-2026-1994", - "modified": "2026-07-07T17:48:15.379954Z" - }, - { - "id": "PYSEC-2026-1995", - "modified": "2026-07-07T17:48:15.400192Z" - }, - { - "id": "PYSEC-2026-1996", - "modified": "2026-07-07T17:48:15.382053Z" - }, - { - "id": "PYSEC-2026-1998", - "modified": "2026-07-07T17:47:54.140852Z" - }, - { - "id": "PYSEC-2026-1999", - "modified": "2026-07-07T17:47:54.161376Z" } ] }, @@ -9761,11 +12153,7 @@ interactions: "vulns": [ { "id": "GHSA-8rrh-rw8j-w5fx", - "modified": "2026-07-07T17:56:06.063831Z" - }, - { - "id": "PYSEC-2026-2047", - "modified": "2026-07-07T17:47:43.451695Z" + "modified": "2026-02-04T03:06:55.268134Z" } ] }, @@ -9774,7 +12162,7 @@ interactions: } headers: Content-Length: - - "5776" + - "4848" Content-Type: - application/json status: 200 OK @@ -9900,7 +12288,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 5954 + content_length: 5475 body: | { "results": [ @@ -9909,10 +12297,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2021-42376", - "modified": "2026-07-08T04:32:12.032317Z" - }, { "id": "ALPINE-CVE-2024-58251", "modified": "2026-06-15T18:18:10.508036Z" @@ -10015,7 +12399,7 @@ interactions: }, { "id": "GO-2025-4014", - "modified": "2026-06-26T12:29:46.364453Z" + "modified": "2026-06-04T10:29:16.617520Z" }, { "id": "GO-2025-4015", @@ -10023,7 +12407,7 @@ interactions: }, { "id": "GO-2025-4155", - "modified": "2026-07-09T10:44:32.536665Z" + "modified": "2026-06-12T10:29:15.211985Z" }, { "id": "GO-2025-4175", @@ -10031,7 +12415,7 @@ interactions: }, { "id": "GO-2026-4337", - "modified": "2026-07-07T10:29:23.547454Z" + "modified": "2026-06-12T10:29:15.605437Z" }, { "id": "GO-2026-4340", @@ -10039,11 +12423,11 @@ interactions: }, { "id": "GO-2026-4341", - "modified": "2026-07-07T10:29:23.472772Z" + "modified": "2026-06-12T10:29:15.035295Z" }, { "id": "GO-2026-4342", - "modified": "2026-07-02T10:44:29.686144Z" + "modified": "2026-06-12T10:29:15.283039Z" }, { "id": "GO-2026-4403", @@ -10051,7 +12435,7 @@ interactions: }, { "id": "GO-2026-4601", - "modified": "2026-07-09T10:44:32.269952Z" + "modified": "2026-06-17T10:29:19.633057Z" }, { "id": "GO-2026-4602", @@ -10063,7 +12447,7 @@ interactions: }, { "id": "GO-2026-4864", - "modified": "2026-07-09T10:44:33.381720Z" + "modified": "2026-06-16T10:29:15.527117Z" }, { "id": "GO-2026-4865", @@ -10075,23 +12459,19 @@ interactions: }, { "id": "GO-2026-4870", - "modified": "2026-07-09T10:44:33.055212Z" + "modified": "2026-06-17T10:29:19.204036Z" }, { "id": "GO-2026-4918", - "modified": "2026-06-27T10:44:20.771417Z" + "modified": "2026-05-11T08:11:05.383192Z" }, { "id": "GO-2026-4946", - "modified": "2026-07-09T10:44:33.129570Z" + "modified": "2026-06-17T10:29:19.549582Z" }, { "id": "GO-2026-4947", - "modified": "2026-07-09T10:44:33.192298Z" - }, - { - "id": "GO-2026-4970", - "modified": "2026-07-08T20:29:26.853236Z" + "modified": "2026-06-17T10:29:19.948808Z" }, { "id": "GO-2026-4971", @@ -10099,7 +12479,7 @@ interactions: }, { "id": "GO-2026-4976", - "modified": "2026-06-27T10:44:21.221469Z" + "modified": "2026-05-11T08:11:26.883618Z" }, { "id": "GO-2026-4977", @@ -10111,11 +12491,11 @@ interactions: }, { "id": "GO-2026-4981", - "modified": "2026-07-09T10:44:32.677126Z" + "modified": "2026-06-09T10:29:17.671297Z" }, { "id": "GO-2026-4982", - "modified": "2026-06-27T10:44:21.066171Z" + "modified": "2026-05-11T08:11:21.041304Z" }, { "id": "GO-2026-4986", @@ -10123,7 +12503,7 @@ interactions: }, { "id": "GO-2026-5037", - "modified": "2026-07-09T10:44:33.680614Z" + "modified": "2026-06-05T07:56:06.303534Z" }, { "id": "GO-2026-5038", @@ -10131,32 +12511,12 @@ interactions: }, { "id": "GO-2026-5039", - "modified": "2026-06-27T10:44:21.143168Z" - }, - { - "id": "GO-2026-5856", - "modified": "2026-07-08T20:29:26.756890Z" + "modified": "2026-06-05T07:56:26.571479Z" } ] }, { "vulns": [ - { - "id": "ALPINE-CVE-2022-1292", - "modified": "2026-07-08T04:31:47.244657Z" - }, - { - "id": "ALPINE-CVE-2022-2068", - "modified": "2026-07-08T04:31:47.874039Z" - }, - { - "id": "ALPINE-CVE-2023-0466", - "modified": "2026-07-08T04:31:25.432482Z" - }, - { - "id": "ALPINE-CVE-2023-4807", - "modified": "2026-07-08T04:32:27.043928Z" - }, { "id": "ALPINE-CVE-2024-12797", "modified": "2026-06-15T18:18:10.256734Z" @@ -10171,7 +12531,7 @@ interactions: }, { "id": "ALPINE-CVE-2024-6119", - "modified": "2026-07-08T04:32:23.263115Z" + "modified": "2026-06-15T18:18:10.508459Z" }, { "id": "ALPINE-CVE-2024-9143", @@ -10179,35 +12539,35 @@ interactions: }, { "id": "ALPINE-CVE-2025-15467", - "modified": "2026-07-08T04:31:54.237773Z" + "modified": "2026-06-15T18:18:10.574070Z" }, { "id": "ALPINE-CVE-2025-15468", - "modified": "2026-07-08T04:31:54.236044Z" + "modified": "2026-06-15T18:18:10.574416Z" }, { "id": "ALPINE-CVE-2025-66199", - "modified": "2026-07-08T04:30:11.899340Z" + "modified": "2026-06-15T18:18:10.877115Z" }, { "id": "ALPINE-CVE-2025-68160", - "modified": "2026-07-08T04:32:27.950152Z" + "modified": "2026-06-15T18:18:10.890200Z" }, { "id": "ALPINE-CVE-2025-69418", - "modified": "2026-07-08T04:31:55.406338Z" + "modified": "2026-06-15T18:18:10.901963Z" }, { "id": "ALPINE-CVE-2025-69419", - "modified": "2026-07-08T04:31:54.597659Z" + "modified": "2026-06-15T18:18:10.902306Z" }, { "id": "ALPINE-CVE-2025-69420", - "modified": "2026-07-08T04:31:55.393Z" + "modified": "2026-06-15T18:18:10.902344Z" }, { "id": "ALPINE-CVE-2025-69421", - "modified": "2026-07-08T04:30:11.908070Z" + "modified": "2026-06-15T18:18:10.907897Z" }, { "id": "ALPINE-CVE-2025-9230", @@ -10223,35 +12583,35 @@ interactions: }, { "id": "ALPINE-CVE-2026-22795", - "modified": "2026-07-08T04:32:28.331714Z" + "modified": "2026-06-15T18:18:11.004265Z" }, { "id": "ALPINE-CVE-2026-22796", - "modified": "2026-07-08T04:32:29.030190Z" + "modified": "2026-06-15T18:18:11.007022Z" }, { "id": "ALPINE-CVE-2026-28387", - "modified": "2026-07-08T04:32:29.167238Z" + "modified": "2026-06-15T18:18:11.052819Z" }, { "id": "ALPINE-CVE-2026-28388", - "modified": "2026-07-08T04:32:29.169509Z" + "modified": "2026-06-15T18:18:11.053496Z" }, { "id": "ALPINE-CVE-2026-28389", - "modified": "2026-07-08T04:31:56.091480Z" + "modified": "2026-06-15T18:18:11.053742Z" }, { "id": "ALPINE-CVE-2026-28390", - "modified": "2026-07-08T04:31:57.860412Z" + "modified": "2026-06-15T18:18:11.053815Z" }, { "id": "ALPINE-CVE-2026-31789", - "modified": "2026-07-08T04:30:12.004739Z" + "modified": "2026-06-15T18:18:11.056839Z" }, { "id": "ALPINE-CVE-2026-31790", - "modified": "2026-07-08T04:32:29.132271Z" + "modified": "2026-06-15T18:18:11.057167Z" } ] }, @@ -10259,7 +12619,7 @@ interactions: "vulns": [ { "id": "ALPINE-CVE-2025-26519", - "modified": "2026-07-08T04:32:24.548042Z" + "modified": "2026-06-15T18:18:10.600004Z" }, { "id": "ALPINE-CVE-2026-40200", @@ -10281,7 +12641,7 @@ interactions: }, { "id": "ALPINE-CVE-2026-27171", - "modified": "2026-07-08T04:31:57.846862Z" + "modified": "2026-06-15T18:18:11.041363Z" } ] } @@ -10289,7 +12649,7 @@ interactions: } headers: Content-Length: - - "5954" + - "5475" Content-Type: - application/json status: 200 OK @@ -10875,7 +13235,7 @@ interactions: "ecosystem": "Go", "name": "stdlib" }, - "version": "1.26.0" + "version": "1.25.7" }, { "package": { @@ -10887,16 +13247,16 @@ interactions: { "package": { "ecosystem": "Ubuntu:26.04", - "name": "golang-1.26-go" + "name": "golang-1.25-go" }, - "version": "1.26.0-1" + "version": "1.25.7-2" }, { "package": { "ecosystem": "Ubuntu:26.04", - "name": "golang-1.26-src" + "name": "golang-1.25-src" }, - "version": "1.26.0-1" + "version": "1.25.7-2" }, { "package": { @@ -11030,7 +13390,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 1758 + content_length: 1443 body: | { "results": [ @@ -11049,17 +13409,9 @@ interactions: {}, { "vulns": [ - { - "id": "GO-2026-4599", - "modified": "2026-07-09T10:44:32.987177Z" - }, - { - "id": "GO-2026-4600", - "modified": "2026-05-15T10:59:23.758905Z" - }, { "id": "GO-2026-4601", - "modified": "2026-07-09T10:44:32.269952Z" + "modified": "2026-06-17T10:29:19.633057Z" }, { "id": "GO-2026-4602", @@ -11071,39 +13423,31 @@ interactions: }, { "id": "GO-2026-4864", - "modified": "2026-07-09T10:44:33.381720Z" + "modified": "2026-06-16T10:29:15.527117Z" }, { "id": "GO-2026-4865", "modified": "2026-05-15T10:59:24.648972Z" }, - { - "id": "GO-2026-4866", - "modified": "2026-07-09T10:44:32.922860Z" - }, { "id": "GO-2026-4869", "modified": "2026-05-15T10:59:23.054049Z" }, { "id": "GO-2026-4870", - "modified": "2026-07-09T10:44:33.055212Z" + "modified": "2026-06-17T10:29:19.204036Z" }, { "id": "GO-2026-4918", - "modified": "2026-06-27T10:44:20.771417Z" + "modified": "2026-05-11T08:11:05.383192Z" }, { "id": "GO-2026-4946", - "modified": "2026-07-09T10:44:33.129570Z" + "modified": "2026-06-17T10:29:19.549582Z" }, { "id": "GO-2026-4947", - "modified": "2026-07-09T10:44:33.192298Z" - }, - { - "id": "GO-2026-4970", - "modified": "2026-07-08T20:29:26.853236Z" + "modified": "2026-06-17T10:29:19.948808Z" }, { "id": "GO-2026-4971", @@ -11111,7 +13455,7 @@ interactions: }, { "id": "GO-2026-4976", - "modified": "2026-06-27T10:44:21.221469Z" + "modified": "2026-05-11T08:11:26.883618Z" }, { "id": "GO-2026-4977", @@ -11123,11 +13467,11 @@ interactions: }, { "id": "GO-2026-4981", - "modified": "2026-07-09T10:44:32.677126Z" + "modified": "2026-06-09T10:29:17.671297Z" }, { "id": "GO-2026-4982", - "modified": "2026-06-27T10:44:21.066171Z" + "modified": "2026-05-11T08:11:21.041304Z" }, { "id": "GO-2026-4986", @@ -11135,7 +13479,7 @@ interactions: }, { "id": "GO-2026-5037", - "modified": "2026-07-09T10:44:33.680614Z" + "modified": "2026-06-05T07:56:06.303534Z" }, { "id": "GO-2026-5038", @@ -11143,11 +13487,7 @@ interactions: }, { "id": "GO-2026-5039", - "modified": "2026-06-27T10:44:21.143168Z" - }, - { - "id": "GO-2026-5856", - "modified": "2026-07-08T20:29:26.756890Z" + "modified": "2026-06-05T07:56:26.571479Z" } ] }, @@ -11175,7 +13515,7 @@ interactions: } headers: Content-Length: - - "1758" + - "1443" Content-Type: - application/json status: 200 OK @@ -11280,7 +13620,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 1492 + content_length: 1136 body: | { "results": [ @@ -11289,10 +13629,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2021-42376", - "modified": "2026-07-08T04:32:12.032317Z" - }, { "id": "ALPINE-CVE-2023-42363", "modified": "2026-06-15T18:18:10.016406Z" @@ -11323,22 +13659,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2022-1292", - "modified": "2026-07-08T04:31:47.244657Z" - }, - { - "id": "ALPINE-CVE-2022-2068", - "modified": "2026-07-08T04:31:47.874039Z" - }, - { - "id": "ALPINE-CVE-2023-0466", - "modified": "2026-07-08T04:31:25.432482Z" - }, - { - "id": "ALPINE-CVE-2023-4807", - "modified": "2026-07-08T04:32:27.043928Z" - }, { "id": "ALPINE-CVE-2024-13176", "modified": "2026-06-15T18:18:10.257313Z" @@ -11361,7 +13681,7 @@ interactions: }, { "id": "ALPINE-CVE-2024-6119", - "modified": "2026-07-08T04:32:23.263115Z" + "modified": "2026-06-15T18:18:10.508459Z" }, { "id": "ALPINE-CVE-2024-9143", @@ -11385,7 +13705,7 @@ interactions: } headers: Content-Length: - - "1492" + - "1136" Content-Type: - application/json status: 200 OK @@ -11511,7 +13831,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 1729 + content_length: 1373 body: | { "results": [ @@ -11520,10 +13840,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2021-42376", - "modified": "2026-07-08T04:32:12.032317Z" - }, { "id": "ALPINE-CVE-2023-42363", "modified": "2026-06-15T18:18:10.016406Z" @@ -11562,22 +13878,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2022-1292", - "modified": "2026-07-08T04:31:47.244657Z" - }, - { - "id": "ALPINE-CVE-2022-2068", - "modified": "2026-07-08T04:31:47.874039Z" - }, - { - "id": "ALPINE-CVE-2023-0466", - "modified": "2026-07-08T04:31:25.432482Z" - }, - { - "id": "ALPINE-CVE-2023-4807", - "modified": "2026-07-08T04:32:27.043928Z" - }, { "id": "ALPINE-CVE-2024-13176", "modified": "2026-06-15T18:18:10.257313Z" @@ -11600,7 +13900,7 @@ interactions: }, { "id": "ALPINE-CVE-2024-6119", - "modified": "2026-07-08T04:32:23.263115Z" + "modified": "2026-06-15T18:18:10.508459Z" }, { "id": "ALPINE-CVE-2024-9143", @@ -11637,7 +13937,7 @@ interactions: } headers: Content-Length: - - "1729" + - "1373" Content-Type: - application/json status: 200 OK @@ -11742,7 +14042,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 1492 + content_length: 1136 body: | { "results": [ @@ -11751,10 +14051,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2021-42376", - "modified": "2026-07-08T04:32:12.032317Z" - }, { "id": "ALPINE-CVE-2023-42363", "modified": "2026-06-15T18:18:10.016406Z" @@ -11785,22 +14081,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2022-1292", - "modified": "2026-07-08T04:31:47.244657Z" - }, - { - "id": "ALPINE-CVE-2022-2068", - "modified": "2026-07-08T04:31:47.874039Z" - }, - { - "id": "ALPINE-CVE-2023-0466", - "modified": "2026-07-08T04:31:25.432482Z" - }, - { - "id": "ALPINE-CVE-2023-4807", - "modified": "2026-07-08T04:32:27.043928Z" - }, { "id": "ALPINE-CVE-2024-13176", "modified": "2026-06-15T18:18:10.257313Z" @@ -11823,7 +14103,7 @@ interactions: }, { "id": "ALPINE-CVE-2024-6119", - "modified": "2026-07-08T04:32:23.263115Z" + "modified": "2026-06-15T18:18:10.508459Z" }, { "id": "ALPINE-CVE-2024-9143", @@ -11847,7 +14127,7 @@ interactions: } headers: Content-Length: - - "1492" + - "1136" Content-Type: - application/json status: 200 OK @@ -11952,7 +14232,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 1492 + content_length: 1136 body: | { "results": [ @@ -11961,10 +14241,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2021-42376", - "modified": "2026-07-08T04:32:12.032317Z" - }, { "id": "ALPINE-CVE-2023-42363", "modified": "2026-06-15T18:18:10.016406Z" @@ -11995,22 +14271,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2022-1292", - "modified": "2026-07-08T04:31:47.244657Z" - }, - { - "id": "ALPINE-CVE-2022-2068", - "modified": "2026-07-08T04:31:47.874039Z" - }, - { - "id": "ALPINE-CVE-2023-0466", - "modified": "2026-07-08T04:31:25.432482Z" - }, - { - "id": "ALPINE-CVE-2023-4807", - "modified": "2026-07-08T04:32:27.043928Z" - }, { "id": "ALPINE-CVE-2024-13176", "modified": "2026-06-15T18:18:10.257313Z" @@ -12033,7 +14293,7 @@ interactions: }, { "id": "ALPINE-CVE-2024-6119", - "modified": "2026-07-08T04:32:23.263115Z" + "modified": "2026-06-15T18:18:10.508459Z" }, { "id": "ALPINE-CVE-2024-9143", @@ -12057,7 +14317,7 @@ interactions: } headers: Content-Length: - - "1492" + - "1136" Content-Type: - application/json status: 200 OK @@ -12162,7 +14422,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 1492 + content_length: 1136 body: | { "results": [ @@ -12171,10 +14431,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2021-42376", - "modified": "2026-07-08T04:32:12.032317Z" - }, { "id": "ALPINE-CVE-2023-42363", "modified": "2026-06-15T18:18:10.016406Z" @@ -12205,22 +14461,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2022-1292", - "modified": "2026-07-08T04:31:47.244657Z" - }, - { - "id": "ALPINE-CVE-2022-2068", - "modified": "2026-07-08T04:31:47.874039Z" - }, - { - "id": "ALPINE-CVE-2023-0466", - "modified": "2026-07-08T04:31:25.432482Z" - }, - { - "id": "ALPINE-CVE-2023-4807", - "modified": "2026-07-08T04:32:27.043928Z" - }, { "id": "ALPINE-CVE-2024-13176", "modified": "2026-06-15T18:18:10.257313Z" @@ -12243,7 +14483,7 @@ interactions: }, { "id": "ALPINE-CVE-2024-6119", - "modified": "2026-07-08T04:32:23.263115Z" + "modified": "2026-06-15T18:18:10.508459Z" }, { "id": "ALPINE-CVE-2024-9143", @@ -12267,7 +14507,7 @@ interactions: } headers: Content-Length: - - "1492" + - "1136" Content-Type: - application/json status: 200 OK @@ -12372,7 +14612,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 1492 + content_length: 1136 body: | { "results": [ @@ -12381,10 +14621,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2021-42376", - "modified": "2026-07-08T04:32:12.032317Z" - }, { "id": "ALPINE-CVE-2023-42363", "modified": "2026-06-15T18:18:10.016406Z" @@ -12415,22 +14651,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2022-1292", - "modified": "2026-07-08T04:31:47.244657Z" - }, - { - "id": "ALPINE-CVE-2022-2068", - "modified": "2026-07-08T04:31:47.874039Z" - }, - { - "id": "ALPINE-CVE-2023-0466", - "modified": "2026-07-08T04:31:25.432482Z" - }, - { - "id": "ALPINE-CVE-2023-4807", - "modified": "2026-07-08T04:32:27.043928Z" - }, { "id": "ALPINE-CVE-2024-13176", "modified": "2026-06-15T18:18:10.257313Z" @@ -12453,7 +14673,7 @@ interactions: }, { "id": "ALPINE-CVE-2024-6119", - "modified": "2026-07-08T04:32:23.263115Z" + "modified": "2026-06-15T18:18:10.508459Z" }, { "id": "ALPINE-CVE-2024-9143", @@ -12477,7 +14697,7 @@ interactions: } headers: Content-Length: - - "1492" + - "1136" Content-Type: - application/json status: 200 OK @@ -12520,15 +14740,15 @@ interactions: "vulns": [ { "id": "CVE-2023-53154", - "modified": "2026-07-08T06:26:38.454222Z" + "modified": "2026-03-14T12:23:16.581554Z" }, { "id": "CVE-2024-31755", - "modified": "2026-07-08T07:33:43.941104Z" + "modified": "2026-04-16T04:31:52.195461Z" }, { "id": "CVE-2025-57052", - "modified": "2026-07-08T07:01:33.149073Z" + "modified": "2026-04-10T05:30:21.542728Z" } ] } diff --git a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml index b64e77f150c..f68398ba111 100644 --- a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml +++ b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml @@ -1078,6 +1078,2713 @@ interactions: status: 200 OK code: 200 duration: 0s + - request: + proto: HTTP/1.1 + proto_major: 1 + proto_minor: 1 + content_length: 21849 + host: api.osv.dev + body: | + { + "queries": [ + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "acl" + }, + "version": "2.3.1-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "almalinux-gpg-keys" + }, + "version": "9.0-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "almalinux-release" + }, + "version": "9.0-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "almalinux-repos" + }, + "version": "9.0-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "alternatives" + }, + "version": "1.20-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "audit-libs" + }, + "version": "3.0.7-101.el9_0.2" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "basesystem" + }, + "version": "11-13.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "bash" + }, + "version": "5.1.8-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "binutils" + }, + "version": "2.35.2-17.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "binutils-gold" + }, + "version": "2.35.2-17.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "bzip2-libs" + }, + "version": "1.0.8-8.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "ca-certificates" + }, + "version": "2022.2.54-90.2.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "coreutils-single" + }, + "version": "8.32-31.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "cracklib" + }, + "version": "2.9.6-27.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "cracklib-dicts" + }, + "version": "2.9.6-27.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "crypto-policies" + }, + "version": "20220223-1.git5203b41.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "crypto-policies-scripts" + }, + "version": "20220223-1.git5203b41.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "cryptsetup-libs" + }, + "version": "2.4.3-4.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "curl-minimal" + }, + "version": "7.76.1-14.el9_0.5" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "cyrus-sasl-lib" + }, + "version": "2.1.27-20.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "dbus" + }, + "version": "1.12.20-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "dbus-broker" + }, + "version": "28-5.1.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "dbus-common" + }, + "version": "1.12.20-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "device-mapper" + }, + "version": "1.02.183-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "device-mapper-libs" + }, + "version": "1.02.183-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "dnf" + }, + "version": "4.10.0-5.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "dnf-data" + }, + "version": "4.10.0-5.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "elfutils-debuginfod-client" + }, + "version": "0.186-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "elfutils-default-yama-scope" + }, + "version": "0.186-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "elfutils-libelf" + }, + "version": "0.186-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "elfutils-libs" + }, + "version": "0.186-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "expat" + }, + "version": "2.2.10-12.el9_0.3" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "file-libs" + }, + "version": "5.39-8.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "filesystem" + }, + "version": "3.16-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "findutils" + }, + "version": "4.8.0-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gawk" + }, + "version": "5.1.0-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gdbm-libs" + }, + "version": "1.19-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "glib2" + }, + "version": "2.68.4-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "glibc" + }, + "version": "2.34-28.el9_0.2" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "glibc-common" + }, + "version": "2.34-28.el9_0.2" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "glibc-minimal-langpack" + }, + "version": "2.34-28.el9_0.2" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gmp" + }, + "version": "6.2.0-10.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gnupg2" + }, + "version": "2.3.3-2.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gnutls" + }, + "version": "3.7.6-12.el9_0" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "gpg" + }, + "version": "1.15.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gpg-pubkey" + }, + "version": "b86b3716-61e69f29" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gpgme" + }, + "version": "1.15.1-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "grep" + }, + "version": "3.6-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gzip" + }, + "version": "1.10-9.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "hostname" + }, + "version": "3.23-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "ima-evm-utils" + }, + "version": "1.4-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "iputils" + }, + "version": "20210202-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "json-c" + }, + "version": "0.14-11.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "keyutils-libs" + }, + "version": "1.6.1-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "kmod-libs" + }, + "version": "28-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "krb5-libs" + }, + "version": "1.19.1-15.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "less" + }, + "version": "590-1.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libacl" + }, + "version": "2.3.1-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libarchive" + }, + "version": "3.5.3-2.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libassuan" + }, + "version": "2.5.5-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libattr" + }, + "version": "2.5.1-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libblkid" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libcap" + }, + "version": "2.48-8.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libcap-ng" + }, + "version": "0.8.2-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libcom_err" + }, + "version": "1.46.5-2.el9" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "libcomps" + }, + "version": "0.1.18" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libcomps" + }, + "version": "0.1.18-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libcurl-minimal" + }, + "version": "7.76.1-14.el9_0.5" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libdb" + }, + "version": "5.3.28-53.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libdnf" + }, + "version": "0.65.0-5.1.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libeconf" + }, + "version": "0.4.1-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libevent" + }, + "version": "2.1.12-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libfdisk" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libffi" + }, + "version": "3.4.2-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libgcc" + }, + "version": "11.2.1-9.4.el9.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libgcrypt" + }, + "version": "1.10.0-5.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libgomp" + }, + "version": "11.2.1-9.4.el9.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libgpg-error" + }, + "version": "1.42-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libidn2" + }, + "version": "2.3.0-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libksba" + }, + "version": "1.5.1-5.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libmodulemd" + }, + "version": "2.13.0-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libmount" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libnghttp2" + }, + "version": "1.43.0-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libpwquality" + }, + "version": "1.4.4-8.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "librepo" + }, + "version": "1.14.2-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libreport-filesystem" + }, + "version": "2.15.2-6.el9.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libseccomp" + }, + "version": "2.5.2-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libselinux" + }, + "version": "3.3-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libsemanage" + }, + "version": "3.3-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libsepol" + }, + "version": "3.3-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libsigsegv" + }, + "version": "2.13-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libsmartcols" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libsolv" + }, + "version": "0.7.20-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libstdc++" + }, + "version": "11.2.1-9.4.el9.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libtasn1" + }, + "version": "4.16.0-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libunistring" + }, + "version": "0.9.10-15.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libutempter" + }, + "version": "1.2.1-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libuuid" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libverto" + }, + "version": "0.3.2-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libxcrypt" + }, + "version": "4.4.18-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libxml2" + }, + "version": "2.9.13-1.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libyaml" + }, + "version": "0.2.5-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libzstd" + }, + "version": "1.5.1-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "lua-libs" + }, + "version": "5.4.2-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "lz4-libs" + }, + "version": "1.9.3-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "mpfr" + }, + "version": "4.1.0-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "ncurses-base" + }, + "version": "6.2-8.20210508.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "ncurses-libs" + }, + "version": "6.2-8.20210508.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "nettle" + }, + "version": "3.8-3.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "npth" + }, + "version": "1.6-8.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "openldap" + }, + "version": "2.6.2-1.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "openldap-compat" + }, + "version": "2.6.2-1.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "openssl" + }, + "version": "3.0.1-43.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "openssl-libs" + }, + "version": "3.0.1-43.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "p11-kit" + }, + "version": "0.24.1-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "p11-kit-trust" + }, + "version": "0.24.1-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "pam" + }, + "version": "1.5.1-9.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "pcre" + }, + "version": "8.44-3.el9.3" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "pcre2" + }, + "version": "10.37-5.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "pcre2-syntax" + }, + "version": "10.37-5.el9_0" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "pip" + }, + "version": "21.2.3" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "popt" + }, + "version": "1.18-8.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3" + }, + "version": "3.9.10-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-dnf" + }, + "version": "4.10.0-5.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-gpg" + }, + "version": "1.15.1-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-hawkey" + }, + "version": "0.65.0-5.1.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-libcomps" + }, + "version": "0.1.18-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-libdnf" + }, + "version": "0.65.0-5.1.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-libs" + }, + "version": "3.9.10-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-pip-wheel" + }, + "version": "21.2.3-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-rpm" + }, + "version": "4.16.1.3-12.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-setuptools-wheel" + }, + "version": "53.0.0-10.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "readline" + }, + "version": "8.1-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "rootfiles" + }, + "version": "8.1-31.el9" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "rpm" + }, + "version": "4.16.1.3" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "rpm" + }, + "version": "4.16.1.3-12.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "rpm-build-libs" + }, + "version": "4.16.1.3-12.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "rpm-libs" + }, + "version": "4.16.1.3-12.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "rpm-sign-libs" + }, + "version": "4.16.1.3-12.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "sed" + }, + "version": "4.8-9.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "setup" + }, + "version": "2.13.7-6.el9" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "setuptools" + }, + "version": "53.0.0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "shadow-utils" + }, + "version": "4.9-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "sqlite-libs" + }, + "version": "3.34.1-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "systemd" + }, + "version": "250-6.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "systemd-libs" + }, + "version": "250-6.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "systemd-pam" + }, + "version": "250-6.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "systemd-rpm-macros" + }, + "version": "250-6.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "tar" + }, + "version": "1.34-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "tpm2-tss" + }, + "version": "3.0.3-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "tzdata" + }, + "version": "2022e-1.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "util-linux" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "util-linux-core" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "vim-minimal" + }, + "version": "8.2.2637-16.el9_0.3" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "xz" + }, + "version": "5.2.5-8.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "xz-libs" + }, + "version": "5.2.5-8.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "yum" + }, + "version": "4.10.0-5.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "zlib" + }, + "version": "1.2.11-31.el9_0.1" + } + ] + } + headers: + Content-Type: + - application/json + X-Test-Name: + - TestCommand_OCIImage_JSONFormat/scanning_almalinux_9_image + url: https://api.osv.dev/v1/querybatch + method: POST + response: + proto: HTTP/2.0 + proto_major: 2 + proto_minor: 0 + content_length: 20731 + body: | + { + "results": [ + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:0340", + "modified": "2026-02-04T02:39:05.013813Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6593", + "modified": "2026-02-04T02:56:42.748728Z" + }, + { + "id": "ALSA-2025:23343", + "modified": "2026-02-04T03:10:06.598841Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6593", + "modified": "2026-02-04T02:56:42.748728Z" + }, + { + "id": "ALSA-2025:23343", + "modified": "2026-02-04T03:10:06.598841Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2025:0925", + "modified": "2026-02-04T04:23:04.673700Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2026:28911", + "modified": "2026-06-25T14:45:05.932137Z" + } + ] + }, + {}, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:8299", + "modified": "2026-02-04T02:59:29.832450Z" + }, + { + "id": "ALSA-2023:0333", + "modified": "2026-02-04T03:11:09.993172Z" + }, + { + "id": "ALSA-2023:1701", + "modified": "2026-02-04T03:40:34.154961Z" + }, + { + "id": "ALSA-2023:2478", + "modified": "2026-02-04T03:01:23.945523Z" + }, + { + "id": "ALSA-2023:2650", + "modified": "2026-02-04T02:24:48.187396Z" + }, + { + "id": "ALSA-2023:4354", + "modified": "2026-02-04T02:39:53.202728Z" + }, + { + "id": "ALSA-2023:5763", + "modified": "2026-02-04T02:26:05.028011Z" + }, + { + "id": "ALSA-2023:6679", + "modified": "2026-02-04T02:19:52.904090Z" + }, + { + "id": "ALSA-2023:6745", + "modified": "2026-02-04T04:12:41.383421Z" + }, + { + "id": "ALSA-2024:1129", + "modified": "2026-02-04T02:19:53.688709Z" + }, + { + "id": "ALSA-2024:5529", + "modified": "2026-02-04T04:36:30.483834Z" + }, + { + "id": "ALSA-2026:1350", + "modified": "2026-02-04T04:20:42.080175Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:0335", + "modified": "2026-02-04T02:43:39.771637Z" + }, + { + "id": "ALSA-2023:4569", + "modified": "2026-02-04T03:26:40.249723Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:0335", + "modified": "2026-02-04T02:43:39.771637Z" + }, + { + "id": "ALSA-2023:4569", + "modified": "2026-02-04T03:26:40.249723Z" + } + ] + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:0337", + "modified": "2026-02-04T02:41:37.038356Z" + }, + { + "id": "ALSA-2024:1530", + "modified": "2026-02-04T03:35:33.402240Z" + }, + { + "id": "ALSA-2024:6754", + "modified": "2026-02-04T02:22:22.919987Z" + }, + { + "id": "ALSA-2024:9541", + "modified": "2026-02-04T03:35:28.908623Z" + }, + { + "id": "ALSA-2025:22175", + "modified": "2026-02-04T04:22:01.629753Z" + }, + { + "id": "ALSA-2025:3531", + "modified": "2026-02-04T04:35:39.307337Z" + }, + { + "id": "ALSA-2025:7444", + "modified": "2026-02-04T03:11:34.139518Z" + }, + { + "id": "ALSA-2026:23230", + "modified": "2026-06-11T16:00:04.147520Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:2512", + "modified": "2026-02-04T04:24:23.275314Z" + } + ] + }, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:6631", + "modified": "2026-02-04T04:27:47.395873Z" + }, + { + "id": "ALSA-2024:6464", + "modified": "2026-02-04T03:27:15.983684Z" + }, + { + "id": "ALSA-2025:11140", + "modified": "2026-02-04T02:55:31.495927Z" + }, + { + "id": "ALSA-2026:0936", + "modified": "2026-02-04T02:25:08.416995Z" + }, + { + "id": "ALSA-2026:15971", + "modified": "2026-05-11T20:00:09.038847Z" + }, + { + "id": "ALSA-2026:19361", + "modified": "2026-05-26T16:00:28.465116Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:5453", + "modified": "2026-02-04T03:26:19.807241Z" + }, + { + "id": "ALSA-2024:3339", + "modified": "2026-02-04T03:30:53.986917Z" + }, + { + "id": "ALSA-2025:4244", + "modified": "2026-02-04T04:07:40.504176Z" + }, + { + "id": "ALSA-2025:8655", + "modified": "2026-02-04T03:01:36.256559Z" + }, + { + "id": "ALSA-2025:9877", + "modified": "2026-02-04T04:14:28.182476Z" + }, + { + "id": "ALSA-2026:20597", + "modified": "2026-06-30T16:59:33.885701Z" + }, + { + "id": "ALSA-2026:2786", + "modified": "2026-02-24T21:44:00.377003Z" + }, + { + "id": "ALSA-2026:33226", + "modified": "2026-06-30T16:45:03.718056Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:5453", + "modified": "2026-02-04T03:26:19.807241Z" + }, + { + "id": "ALSA-2024:3339", + "modified": "2026-02-04T03:30:53.986917Z" + }, + { + "id": "ALSA-2025:4244", + "modified": "2026-02-04T04:07:40.504176Z" + }, + { + "id": "ALSA-2025:8655", + "modified": "2026-02-04T03:01:36.256559Z" + }, + { + "id": "ALSA-2025:9877", + "modified": "2026-02-04T04:14:28.182476Z" + }, + { + "id": "ALSA-2026:20597", + "modified": "2026-06-30T16:59:33.885701Z" + }, + { + "id": "ALSA-2026:2786", + "modified": "2026-02-24T21:44:00.377003Z" + }, + { + "id": "ALSA-2026:33226", + "modified": "2026-06-30T16:45:03.718056Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:5453", + "modified": "2026-02-04T03:26:19.807241Z" + }, + { + "id": "ALSA-2024:3339", + "modified": "2026-02-04T03:30:53.986917Z" + }, + { + "id": "ALSA-2025:4244", + "modified": "2026-02-04T04:07:40.504176Z" + }, + { + "id": "ALSA-2025:8655", + "modified": "2026-02-04T03:01:36.256559Z" + }, + { + "id": "ALSA-2025:9877", + "modified": "2026-02-04T04:14:28.182476Z" + }, + { + "id": "ALSA-2026:20597", + "modified": "2026-06-30T16:59:33.885701Z" + }, + { + "id": "ALSA-2026:2786", + "modified": "2026-02-24T21:44:00.377003Z" + }, + { + "id": "ALSA-2026:33226", + "modified": "2026-06-30T16:45:03.718056Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6661", + "modified": "2026-02-04T02:21:41.980408Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2026:0719", + "modified": "2026-02-04T04:34:34.329237Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:1141", + "modified": "2026-02-04T03:18:59.660613Z" + }, + { + "id": "ALSA-2024:0533", + "modified": "2026-02-04T03:48:34.100512Z" + }, + { + "id": "ALSA-2024:1879", + "modified": "2026-02-04T03:31:06.672839Z" + }, + { + "id": "ALSA-2024:2570", + "modified": "2026-02-04T04:01:53.202219Z" + }, + { + "id": "ALSA-2025:16116", + "modified": "2026-02-04T03:15:22.241525Z" + }, + { + "id": "ALSA-2025:7076", + "modified": "2026-02-04T04:25:27.782684Z" + }, + { + "id": "ALSA-2026:20612", + "modified": "2026-07-02T13:44:28.594241Z" + }, + { + "id": "ALSA-2026:4188", + "modified": "2026-03-16T08:43:59.018031Z" + } + ] + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2025:17558", + "modified": "2026-02-04T03:25:13.978615Z" + }, + { + "id": "ALSA-2025:9432", + "modified": "2026-02-04T02:18:41.302098Z" + } + ] + }, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:8637", + "modified": "2026-02-04T04:01:02.274891Z" + }, + { + "id": "ALSA-2023:2570", + "modified": "2026-02-04T03:25:10.056435Z" + }, + { + "id": "ALSA-2023:6699", + "modified": "2026-02-04T03:59:17.349120Z" + }, + { + "id": "ALSA-2024:6166", + "modified": "2026-02-04T04:13:16.807291Z" + }, + { + "id": "ALSA-2024:9331", + "modified": "2026-02-04T02:40:52.136074Z" + }, + { + "id": "ALSA-2024:9474", + "modified": "2026-02-04T04:30:53.060846Z" + }, + { + "id": "ALSA-2025:7067", + "modified": "2026-02-04T02:48:22.293400Z" + }, + { + "id": "ALSA-2025:9430", + "modified": "2026-02-04T03:20:09.135780Z" + }, + { + "id": "ALSA-2026:19357", + "modified": "2026-05-26T16:14:26.075210Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:3725", + "modified": "2026-02-04T02:57:26.406617Z" + }, + { + "id": "ALSA-2024:1692", + "modified": "2026-02-04T03:07:17.609765Z" + }, + { + "id": "ALSA-2024:3513", + "modified": "2026-02-04T04:02:37.699304Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:2532", + "modified": "2026-02-04T03:30:59.962630Z" + }, + { + "id": "ALSA-2025:14130", + "modified": "2026-02-04T02:59:02.777670Z" + }, + { + "id": "ALSA-2025:9431", + "modified": "2026-02-04T04:26:59.474540Z" + }, + { + "id": "ALSA-2026:5080", + "modified": "2026-03-24T11:41:56.671370Z" + }, + { + "id": "ALSA-2026:8510", + "modified": "2026-04-17T13:19:53.082048Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:5071", + "modified": "2026-02-04T03:18:20.022576Z" + }, + { + "id": "ALSA-2026:12441", + "modified": "2026-05-01T20:45:11.742990Z" + }, + { + "id": "ALSA-2026:19346", + "modified": "2026-05-26T16:00:23.989197Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:8361", + "modified": "2026-02-04T04:00:37.440096Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:8299", + "modified": "2026-02-04T02:59:29.832450Z" + }, + { + "id": "ALSA-2023:0333", + "modified": "2026-02-04T03:11:09.993172Z" + }, + { + "id": "ALSA-2023:1701", + "modified": "2026-02-04T03:40:34.154961Z" + }, + { + "id": "ALSA-2023:2478", + "modified": "2026-02-04T03:01:23.945523Z" + }, + { + "id": "ALSA-2023:2650", + "modified": "2026-02-04T02:24:48.187396Z" + }, + { + "id": "ALSA-2023:4354", + "modified": "2026-02-04T02:39:53.202728Z" + }, + { + "id": "ALSA-2023:5763", + "modified": "2026-02-04T02:26:05.028011Z" + }, + { + "id": "ALSA-2023:6679", + "modified": "2026-02-04T02:19:52.904090Z" + }, + { + "id": "ALSA-2023:6745", + "modified": "2026-02-04T04:12:41.383421Z" + }, + { + "id": "ALSA-2024:1129", + "modified": "2026-02-04T02:19:53.688709Z" + }, + { + "id": "ALSA-2024:5529", + "modified": "2026-02-04T04:36:30.483834Z" + }, + { + "id": "ALSA-2026:1350", + "modified": "2026-02-04T04:20:42.080175Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:4347", + "modified": "2026-02-04T04:26:55.222844Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2025:1346", + "modified": "2026-02-04T02:42:19.300480Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:9404", + "modified": "2026-02-04T04:39:46.445150Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2025:1346", + "modified": "2026-02-04T02:42:19.300480Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:0626", + "modified": "2026-02-04T03:37:23.910138Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:5838", + "modified": "2026-02-04T03:21:23.106321Z" + }, + { + "id": "ALSA-2023:6746", + "modified": "2026-02-04T02:52:20.689534Z" + }, + { + "id": "ALSA-2024:3501", + "modified": "2026-02-04T04:30:58.924693Z" + }, + { + "id": "ALSA-2026:7668", + "modified": "2026-04-17T13:19:22.946826Z" + } + ] + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2025:1346", + "modified": "2026-02-04T02:42:19.300480Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0343", + "modified": "2026-02-04T02:58:56.421179Z" + }, + { + "id": "ALSA-2025:7077", + "modified": "2026-02-04T02:57:21.340790Z" + }, + { + "id": "ALSA-2026:28253", + "modified": "2026-06-25T14:45:03.934430Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:0338", + "modified": "2026-02-04T04:15:50.026698Z" + }, + { + "id": "ALSA-2023:4349", + "modified": "2026-02-04T03:56:40.445151Z" + }, + { + "id": "ALSA-2023:7747", + "modified": "2026-02-04T02:47:05.174021Z" + }, + { + "id": "ALSA-2024:2679", + "modified": "2026-02-04T03:53:53.131809Z" + }, + { + "id": "ALSA-2025:10699", + "modified": "2026-02-04T03:45:10.417784Z" + }, + { + "id": "ALSA-2025:12447", + "modified": "2026-02-04T04:08:24.796808Z" + }, + { + "id": "ALSA-2025:13428", + "modified": "2026-02-04T03:51:53.872437Z" + }, + { + "id": "ALSA-2025:1350", + "modified": "2026-02-04T04:02:12.419510Z" + }, + { + "id": "ALSA-2025:22376", + "modified": "2026-02-04T04:03:23.679067Z" + }, + { + "id": "ALSA-2025:2679", + "modified": "2026-02-04T02:16:14.070103Z" + }, + { + "id": "ALSA-2026:28254", + "modified": "2026-06-25T14:45:05.928604Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:7329", + "modified": "2026-02-04T02:28:25.713104Z" + }, + { + "id": "ALSA-2023:0957", + "modified": "2026-02-04T02:27:45.919035Z" + }, + { + "id": "ALSA-2023:2582", + "modified": "2026-02-04T03:10:44.508101Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:6698", + "modified": "2026-02-04T02:56:09.576007Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6698", + "modified": "2026-02-04T02:56:09.576007Z" + } + ] + }, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:6224", + "modified": "2026-02-04T02:51:14.255262Z" + }, + { + "id": "ALSA-2022:7288", + "modified": "2026-02-04T03:59:27.389573Z" + }, + { + "id": "ALSA-2023:0946", + "modified": "2026-02-04T03:23:22.425826Z" + }, + { + "id": "ALSA-2023:2523", + "modified": "2026-02-04T02:26:35.380325Z" + }, + { + "id": "ALSA-2023:3722", + "modified": "2026-02-04T02:13:18.469496Z" + }, + { + "id": "ALSA-2024:0310", + "modified": "2026-02-04T02:42:39.967487Z" + }, + { + "id": "ALSA-2024:2447", + "modified": "2026-02-04T02:13:54.975229Z" + }, + { + "id": "ALSA-2024:6783", + "modified": "2026-02-04T03:31:16.933411Z" + }, + { + "id": "ALSA-2024:9333", + "modified": "2026-02-04T03:31:00.023073Z" + }, + { + "id": "ALSA-2025:1330", + "modified": "2026-02-04T04:15:39.208441Z" + }, + { + "id": "ALSA-2025:21255", + "modified": "2026-02-04T03:44:31.901825Z" + }, + { + "id": "ALSA-2026:1473", + "modified": "2026-02-04T02:57:39.180220Z" + }, + { + "id": "ALSA-2026:19218", + "modified": "2026-05-26T16:00:21.304009Z" + }, + { + "id": "ALSA-2026:22312", + "modified": "2026-06-03T14:30:04.577840Z" + }, + { + "id": "ALSA-2026:25239", + "modified": "2026-06-12T12:29:12.486131Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2022:6224", + "modified": "2026-02-04T02:51:14.255262Z" + }, + { + "id": "ALSA-2022:7288", + "modified": "2026-02-04T03:59:27.389573Z" + }, + { + "id": "ALSA-2023:0946", + "modified": "2026-02-04T03:23:22.425826Z" + }, + { + "id": "ALSA-2023:2523", + "modified": "2026-02-04T02:26:35.380325Z" + }, + { + "id": "ALSA-2023:3722", + "modified": "2026-02-04T02:13:18.469496Z" + }, + { + "id": "ALSA-2024:0310", + "modified": "2026-02-04T02:42:39.967487Z" + }, + { + "id": "ALSA-2024:2447", + "modified": "2026-02-04T02:13:54.975229Z" + }, + { + "id": "ALSA-2024:6783", + "modified": "2026-02-04T03:31:16.933411Z" + }, + { + "id": "ALSA-2024:9333", + "modified": "2026-02-04T03:31:00.023073Z" + }, + { + "id": "ALSA-2025:1330", + "modified": "2026-02-04T04:15:39.208441Z" + }, + { + "id": "ALSA-2025:21255", + "modified": "2026-02-04T03:44:31.901825Z" + }, + { + "id": "ALSA-2026:1473", + "modified": "2026-02-04T02:57:39.180220Z" + }, + { + "id": "ALSA-2026:19218", + "modified": "2026-05-26T16:00:21.304009Z" + }, + { + "id": "ALSA-2026:22312", + "modified": "2026-06-03T14:30:04.577840Z" + }, + { + "id": "ALSA-2026:25239", + "modified": "2026-06-12T12:29:12.486131Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2026:18599", + "modified": "2026-05-26T16:00:16.791061Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2026:18599", + "modified": "2026-05-26T16:00:16.791061Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:10244", + "modified": "2026-02-04T03:21:58.697081Z" + }, + { + "id": "ALSA-2024:11250", + "modified": "2026-02-04T03:37:50.674762Z" + }, + { + "id": "ALSA-2024:2438", + "modified": "2026-02-04T04:21:40.830719Z" + }, + { + "id": "ALSA-2025:15099", + "modified": "2026-02-04T03:59:03.032487Z" + }, + { + "id": "ALSA-2025:9526", + "modified": "2026-02-04T03:35:27.405905Z" + } + ] + }, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "GHSA-4xh5-x5gv-qwph", + "modified": "2026-07-07T17:57:29.434622Z" + }, + { + "id": "GHSA-58qw-9mgm-455v", + "modified": "2026-05-20T21:00:09.920997Z" + }, + { + "id": "GHSA-6vgw-5pg2-w6jp", + "modified": "2026-07-07T17:56:16.480954Z" + }, + { + "id": "GHSA-jp4c-xjxw-mgf9", + "modified": "2026-05-07T16:59:14.079020Z" + }, + { + "id": "GHSA-mq26-g339-26xf", + "modified": "2026-03-24T01:43:05.410801Z" + }, + { + "id": "GHSA-wf93-45jw-7689", + "modified": "2026-07-10T12:45:24.283380Z" + }, + { + "id": "PYSEC-2023-228", + "modified": "2026-06-10T17:01:27.606909Z" + }, + { + "id": "PYSEC-2026-1795", + "modified": "2026-07-07T17:48:06.199964Z" + }, + { + "id": "PYSEC-2026-1796", + "modified": "2026-07-07T17:48:06.240646Z" + }, + { + "id": "PYSEC-2026-196", + "modified": "2026-07-08T21:26:17.521856Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:7323", + "modified": "2026-02-04T04:03:11.064433Z" + }, + { + "id": "ALSA-2022:8353", + "modified": "2026-02-04T03:04:32.610389Z" + }, + { + "id": "ALSA-2022:8493", + "modified": "2026-02-04T02:42:36.434701Z" + }, + { + "id": "ALSA-2023:0953", + "modified": "2026-02-04T03:15:58.943787Z" + }, + { + "id": "ALSA-2023:3595", + "modified": "2026-02-04T03:38:14.145750Z" + }, + { + "id": "ALSA-2023:5462", + "modified": "2026-02-04T03:02:52.364518Z" + }, + { + "id": "ALSA-2023:6659", + "modified": "2026-02-04T03:27:32.595876Z" + }, + { + "id": "ALSA-2024:0466", + "modified": "2026-02-04T03:07:57.616188Z" + }, + { + "id": "ALSA-2024:10983", + "modified": "2026-02-04T03:45:08.742373Z" + }, + { + "id": "ALSA-2024:4078", + "modified": "2026-02-04T02:42:46.311908Z" + }, + { + "id": "ALSA-2024:4779", + "modified": "2026-02-04T02:55:36.858364Z" + }, + { + "id": "ALSA-2024:6163", + "modified": "2026-02-04T04:21:08.554450Z" + }, + { + "id": "ALSA-2024:8446", + "modified": "2026-02-04T04:21:06.060988Z" + }, + { + "id": "ALSA-2024:9371", + "modified": "2026-02-04T03:29:13.713576Z" + }, + { + "id": "ALSA-2024:9468", + "modified": "2026-02-04T04:30:10.003749Z" + }, + { + "id": "ALSA-2025:10136", + "modified": "2026-02-04T02:36:14.764339Z" + }, + { + "id": "ALSA-2025:15019", + "modified": "2026-02-04T03:51:57.720222Z" + }, + { + "id": "ALSA-2025:23342", + "modified": "2026-02-04T03:02:34.328985Z" + }, + { + "id": "ALSA-2025:6977", + "modified": "2026-02-04T04:10:56.453210Z" + }, + { + "id": "ALSA-2026:10949", + "modified": "2026-04-30T14:44:32.588488Z" + }, + { + "id": "ALSA-2026:1478", + "modified": "2026-02-04T02:37:56.057268Z" + }, + { + "id": "ALSA-2026:19216", + "modified": "2026-05-26T16:14:18.052221Z" + }, + { + "id": "ALSA-2026:4168", + "modified": "2026-03-16T08:30:08.411931Z" + }, + { + "id": "ALSA-2026:6766", + "modified": "2026-04-17T13:20:11.098125Z" + } + ] + }, + {}, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:7323", + "modified": "2026-02-04T04:03:11.064433Z" + }, + { + "id": "ALSA-2022:8353", + "modified": "2026-02-04T03:04:32.610389Z" + }, + { + "id": "ALSA-2022:8493", + "modified": "2026-02-04T02:42:36.434701Z" + }, + { + "id": "ALSA-2023:0953", + "modified": "2026-02-04T03:15:58.943787Z" + }, + { + "id": "ALSA-2023:3595", + "modified": "2026-02-04T03:38:14.145750Z" + }, + { + "id": "ALSA-2023:5462", + "modified": "2026-02-04T03:02:52.364518Z" + }, + { + "id": "ALSA-2023:6659", + "modified": "2026-02-04T03:27:32.595876Z" + }, + { + "id": "ALSA-2024:0466", + "modified": "2026-02-04T03:07:57.616188Z" + }, + { + "id": "ALSA-2024:10983", + "modified": "2026-02-04T03:45:08.742373Z" + }, + { + "id": "ALSA-2024:4078", + "modified": "2026-02-04T02:42:46.311908Z" + }, + { + "id": "ALSA-2024:4779", + "modified": "2026-02-04T02:55:36.858364Z" + }, + { + "id": "ALSA-2024:6163", + "modified": "2026-02-04T04:21:08.554450Z" + }, + { + "id": "ALSA-2024:8446", + "modified": "2026-02-04T04:21:06.060988Z" + }, + { + "id": "ALSA-2024:9371", + "modified": "2026-02-04T03:29:13.713576Z" + }, + { + "id": "ALSA-2024:9468", + "modified": "2026-02-04T04:30:10.003749Z" + }, + { + "id": "ALSA-2025:10136", + "modified": "2026-02-04T02:36:14.764339Z" + }, + { + "id": "ALSA-2025:15019", + "modified": "2026-02-04T03:51:57.720222Z" + }, + { + "id": "ALSA-2025:23342", + "modified": "2026-02-04T03:02:34.328985Z" + }, + { + "id": "ALSA-2025:6977", + "modified": "2026-02-04T04:10:56.453210Z" + }, + { + "id": "ALSA-2026:10949", + "modified": "2026-04-30T14:44:32.588488Z" + }, + { + "id": "ALSA-2026:1478", + "modified": "2026-02-04T02:37:56.057268Z" + }, + { + "id": "ALSA-2026:19216", + "modified": "2026-05-26T16:14:18.052221Z" + }, + { + "id": "ALSA-2026:4168", + "modified": "2026-03-16T08:30:08.411931Z" + }, + { + "id": "ALSA-2026:6766", + "modified": "2026-04-17T13:20:11.098125Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6694", + "modified": "2026-02-04T02:39:28.003450Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:0463", + "modified": "2026-02-04T03:35:42.720266Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0952", + "modified": "2026-02-04T02:32:42.835672Z" + }, + { + "id": "ALSA-2024:5534", + "modified": "2026-02-04T02:43:30.286669Z" + }, + { + "id": "ALSA-2025:10407", + "modified": "2026-02-04T03:52:34.406526Z" + } + ] + }, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2024:0463", + "modified": "2026-02-04T03:35:42.720266Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:0463", + "modified": "2026-02-04T03:35:42.720266Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:0463", + "modified": "2026-02-04T03:35:42.720266Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:0463", + "modified": "2026-02-04T03:35:42.720266Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "GHSA-5rjg-fvgr-3xxf", + "modified": "2026-05-11T00:26:34.671259Z" + }, + { + "id": "GHSA-cx63-2mw6-8hw5", + "modified": "2026-07-07T17:57:13.326243Z" + }, + { + "id": "GHSA-r9hx-vwmv-q579", + "modified": "2026-02-04T03:03:25.892107Z" + }, + { + "id": "PYSEC-2022-43012", + "modified": "2026-06-10T17:02:40.148961Z" + }, + { + "id": "PYSEC-2025-49", + "modified": "2026-05-11T00:26:34.671259Z" + }, + { + "id": "PYSEC-2026-1918", + "modified": "2026-07-07T17:57:13.326243Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6632", + "modified": "2026-02-04T04:16:01.058999Z" + }, + { + "id": "ALSA-2025:20559", + "modified": "2026-02-04T02:22:46.209033Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0339", + "modified": "2026-02-04T03:25:10.768446Z" + }, + { + "id": "ALSA-2024:0465", + "modified": "2026-02-04T02:44:43.937586Z" + }, + { + "id": "ALSA-2025:11992", + "modified": "2026-02-04T03:22:31.337630Z" + }, + { + "id": "ALSA-2025:20936", + "modified": "2026-02-04T04:26:46.773530Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0336", + "modified": "2026-02-04T03:07:15.229260Z" + }, + { + "id": "ALSA-2023:0954", + "modified": "2026-02-04T03:42:34.465389Z" + }, + { + "id": "ALSA-2024:2463", + "modified": "2026-02-04T03:50:31.414728Z" + }, + { + "id": "ALSA-2025:22660", + "modified": "2026-02-04T04:20:35.362485Z" + }, + { + "id": "ALSA-2026:13677", + "modified": "2026-05-06T07:31:02.807439Z" + }, + { + "id": "ALSA-2026:19213", + "modified": "2026-05-26T16:00:21.331376Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0336", + "modified": "2026-02-04T03:07:15.229260Z" + }, + { + "id": "ALSA-2023:0954", + "modified": "2026-02-04T03:42:34.465389Z" + }, + { + "id": "ALSA-2024:2463", + "modified": "2026-02-04T03:50:31.414728Z" + }, + { + "id": "ALSA-2025:22660", + "modified": "2026-02-04T04:20:35.362485Z" + }, + { + "id": "ALSA-2026:13677", + "modified": "2026-05-06T07:31:02.807439Z" + }, + { + "id": "ALSA-2026:19213", + "modified": "2026-05-26T16:00:21.331376Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0336", + "modified": "2026-02-04T03:07:15.229260Z" + }, + { + "id": "ALSA-2023:0954", + "modified": "2026-02-04T03:42:34.465389Z" + }, + { + "id": "ALSA-2024:2463", + "modified": "2026-02-04T03:50:31.414728Z" + }, + { + "id": "ALSA-2025:22660", + "modified": "2026-02-04T04:20:35.362485Z" + }, + { + "id": "ALSA-2026:13677", + "modified": "2026-05-06T07:31:02.807439Z" + }, + { + "id": "ALSA-2026:19213", + "modified": "2026-05-26T16:00:21.331376Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0336", + "modified": "2026-02-04T03:07:15.229260Z" + }, + { + "id": "ALSA-2023:0954", + "modified": "2026-02-04T03:42:34.465389Z" + }, + { + "id": "ALSA-2024:2463", + "modified": "2026-02-04T03:50:31.414728Z" + }, + { + "id": "ALSA-2025:22660", + "modified": "2026-02-04T04:20:35.362485Z" + }, + { + "id": "ALSA-2026:13677", + "modified": "2026-05-06T07:31:02.807439Z" + }, + { + "id": "ALSA-2026:19213", + "modified": "2026-05-26T16:00:21.331376Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0959", + "modified": "2026-02-04T03:24:09.816450Z" + }, + { + "id": "ALSA-2026:0067", + "modified": "2026-02-04T02:19:32.940449Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6685", + "modified": "2026-02-04T04:02:01.414267Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2022:5242", + "modified": "2026-02-04T03:09:49.111890Z" + }, + { + "id": "ALSA-2022:5942", + "modified": "2026-02-04T04:29:25.863952Z" + }, + { + "id": "ALSA-2023:0958", + "modified": "2026-02-04T02:48:00.905849Z" + }, + { + "id": "ALSA-2024:9405", + "modified": "2026-02-04T03:08:35.008158Z" + }, + { + "id": "ALSA-2025:17742", + "modified": "2026-02-04T03:32:56.810406Z" + }, + { + "id": "ALSA-2025:20945", + "modified": "2026-02-04T04:32:36.215823Z" + }, + { + "id": "ALSA-2025:7440", + "modified": "2026-02-04T03:33:27.312996Z" + }, + { + "id": "ALSA-2026:11510", + "modified": "2026-04-30T14:30:20.381957Z" + }, + { + "id": "ALSA-2026:19224", + "modified": "2026-05-26T16:00:23.463648Z" + }, + { + "id": "ALSA-2026:22717", + "modified": "2026-06-04T11:15:04.513534Z" + }, + { + "id": "ALSA-2026:28209", + "modified": "2026-06-25T14:45:03.975900Z" + }, + { + "id": "ALSA-2026:5602", + "modified": "2026-03-27T09:01:15.379885Z" + }, + { + "id": "ALSA-2026:8259", + "modified": "2026-04-17T13:19:37.888342Z" + } + ] + }, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:7314", + "modified": "2026-02-04T02:40:45.002131Z" + } + ] + } + ] + } + headers: + Content-Length: + - "20731" + Content-Type: + - application/json + status: 200 OK + code: 200 + duration: 0s - request: proto: HTTP/1.1 proto_major: 1 diff --git a/cmd/osv-scanner/scan/image/testdata/test-almalinux-9.Dockerfile b/cmd/osv-scanner/scan/image/testdata/test-almalinux-9.Dockerfile new file mode 100644 index 00000000000..cdf2e5c1de5 --- /dev/null +++ b/cmd/osv-scanner/scan/image/testdata/test-almalinux-9.Dockerfile @@ -0,0 +1 @@ +FROM almalinux:9.0@sha256:a95a7766fd056b35f72f7b7f7301bcd46e40a6eecd9017e9c41cb4bf22ecb28b diff --git a/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap b/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap index 724d5c023cc..ae3a54eaba5 100755 --- a/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap +++ b/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap @@ -2039,8 +2039,8 @@ Total 12 packages affected by 52 known vulnerabilities (5 Critical, 20 High, 22 ] }, { - "name": "league/flysystem", - "SPDXID": "SPDXRef-Package-league-flysystem-uuid-placeholder-4", + "name": "flysystem", + "SPDXID": "SPDXRef-Package-flysystem-uuid-placeholder-4", "versionInfo": "1.0.8", "supplier": "NOASSERTION", "downloadLocation": "NOASSERTION", @@ -2052,7 +2052,7 @@ Total 12 packages affected by 52 known vulnerabilities (5 Critical, 20 High, 22 { "referenceCategory": "PACKAGE-MANAGER", "referenceType": "purl", - "referenceLocator": "pkg:composer/league%2Fflysystem@1.0.8" + "referenceLocator": "pkg:composer/league/flysystem@1.0.8" } ] }, @@ -2121,11 +2121,11 @@ Total 12 packages affected by 52 known vulnerabilities (5 Critical, 20 High, 22 }, { "spdxElementId": "SPDXRef-Package-main-uuid-placeholder-1", - "relatedSpdxElement": "SPDXRef-Package-league-flysystem-uuid-placeholder-4", + "relatedSpdxElement": "SPDXRef-Package-flysystem-uuid-placeholder-4", "relationshipType": "CONTAINS" }, { - "spdxElementId": "SPDXRef-Package-league-flysystem-uuid-placeholder-4", + "spdxElementId": "SPDXRef-Package-flysystem-uuid-placeholder-4", "relatedSpdxElement": "NOASSERTION", "relationshipType": "CONTAINS" }, @@ -5110,7 +5110,7 @@ Filtered 1 local/unscannable package/s from the scan. Loaded Debian local db from /osv-scanner/Debian/all.zip Loaded Go local db from /osv-scanner/Go/all.zip -Total 22 packages affected by 221 known vulnerabilities (23 Critical, 94 High, 70 Medium, 6 Low, 28 Unknown) from 2 ecosystems. +Total 22 packages affected by 224 known vulnerabilities (26 Critical, 94 High, 70 Medium, 6 Low, 28 Unknown) from 2 ecosystems. 13 vulnerabilities can be fixed. +---------------------------------------+------+-----------+--------------------------------+------------------------------------+-----------------------------------+-------------------------------------------------+ @@ -5211,7 +5211,7 @@ Total 22 packages affected by 221 known vulnerabilities (23 Critical, 94 High, 7 | https://osv.dev/DEBIAN-CVE-2026-0989 | 3.7 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-0990 | 5.9 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-0992 | 2.9 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | -| https://osv.dev/DEBIAN-CVE-2026-6653 | 7.0 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | +| https://osv.dev/DEBIAN-CVE-2026-6653 | 9.8 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-6732 | 7.5 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DSA-4539-1 | 4.7 | Debian | openssl | 1.1.0l-1~deb9u5 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DSA-4539-3 | | Debian | openssl | 1.1.0l-1~deb9u5 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | @@ -5318,11 +5318,14 @@ Total 22 packages affected by 221 known vulnerabilities (23 Critical, 94 High, 7 | https://osv.dev/DEBIAN-CVE-2025-15649 | 5.5 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2025-40909 | 5.9 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-12087 | 9.1 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | +| https://osv.dev/DEBIAN-CVE-2026-13221 | 9.1 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-42496 | 9.1 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-42497 | 7.5 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-48959 | 7.5 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-48961 | 7.3 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-48962 | 7.3 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | +| https://osv.dev/DEBIAN-CVE-2026-57432 | 8.4 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | +| https://osv.dev/DEBIAN-CVE-2026-57433 | 9.8 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-7010 | 6.5 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-7017 | 7.1 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-8376 | 9.8 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | @@ -5382,7 +5385,7 @@ Filtered 1 local/unscannable package/s from the scan. Loaded Debian local db from /osv-scanner/Debian/all.zip Loaded Go local db from /osv-scanner/Go/all.zip -Total 22 packages affected by 221 known vulnerabilities (23 Critical, 94 High, 70 Medium, 6 Low, 28 Unknown) from 2 ecosystems. +Total 22 packages affected by 224 known vulnerabilities (26 Critical, 94 High, 70 Medium, 6 Low, 28 Unknown) from 2 ecosystems. 13 vulnerabilities can be fixed. +---------------------------------------+------+-----------+--------------------------------+------------------------------------+-----------------------------------+-------------------------------------------------+ @@ -5483,7 +5486,7 @@ Total 22 packages affected by 221 known vulnerabilities (23 Critical, 94 High, 7 | https://osv.dev/DEBIAN-CVE-2026-0989 | 3.7 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-0990 | 5.9 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-0992 | 2.9 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | -| https://osv.dev/DEBIAN-CVE-2026-6653 | 7.0 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | +| https://osv.dev/DEBIAN-CVE-2026-6653 | 9.8 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-6732 | 7.5 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DSA-4539-1 | 4.7 | Debian | openssl | 1.1.0l-1~deb9u5 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DSA-4539-3 | | Debian | openssl | 1.1.0l-1~deb9u5 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | @@ -5590,11 +5593,14 @@ Total 22 packages affected by 221 known vulnerabilities (23 Critical, 94 High, 7 | https://osv.dev/DEBIAN-CVE-2025-15649 | 5.5 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2025-40909 | 5.9 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-12087 | 9.1 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | +| https://osv.dev/DEBIAN-CVE-2026-13221 | 9.1 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-42496 | 9.1 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-42497 | 7.5 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-48959 | 7.5 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-48961 | 7.3 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-48962 | 7.3 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | +| https://osv.dev/DEBIAN-CVE-2026-57432 | 8.4 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | +| https://osv.dev/DEBIAN-CVE-2026-57433 | 9.8 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-7010 | 6.5 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-7017 | 7.1 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-8376 | 9.8 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | @@ -6437,7 +6443,7 @@ Scanning dir ./testdata/locks-requirements/requirements.txt Scanned /testdata/locks-requirements/requirements.txt file and found 3 packages Loaded PyPI local db from /osv-scanner/PyPI/all.zip -Total 3 packages affected by 13 known vulnerabilities (1 Critical, 4 High, 7 Medium, 1 Low, 0 Unknown) from 1 ecosystem. +Total 3 packages affected by 13 known vulnerabilities (1 Critical, 4 High, 8 Medium, 0 Low, 0 Unknown) from 1 ecosystem. 13 vulnerabilities can be fixed. +-------------------------------------+------+-----------+----------+---------+---------------+----------------------------------------------+ @@ -6452,7 +6458,8 @@ Total 3 packages affected by 13 known vulnerabilities (1 Critical, 4 High, 7 Med | https://osv.dev/GHSA-8x94-hmjh-97hq | 8.8 | PyPI | django | 1.11.29 | 3.2.15 | testdata/locks-requirements/requirements.txt | | https://osv.dev/GHSA-frmv-pr5f-9mcr | 9.1 | PyPI | django | 1.11.29 | 4.2.26 | testdata/locks-requirements/requirements.txt | | https://osv.dev/GHSA-qw25-v68c-qjf3 | 7.5 | PyPI | django | 1.11.29 | 4.2.26 | testdata/locks-requirements/requirements.txt | -| https://osv.dev/GHSA-68rp-wp8r-4726 | 2.3 | PyPI | flask | 1.0.0 | 3.1.3 | testdata/locks-requirements/requirements.txt | +| https://osv.dev/PYSEC-2026-2151 | 4.3 | PyPI | flask | 1.0.0 | 3.1.3 | testdata/locks-requirements/requirements.txt | +| https://osv.dev/GHSA-68rp-wp8r-4726 | | | | | | | | https://osv.dev/GHSA-m2qf-hxjv-5gpq | 8.7 | PyPI | flask | 1.0.0 | 2.2.5 | testdata/locks-requirements/requirements.txt | | https://osv.dev/PYSEC-2023-74 | 6.1 | PyPI | requests | 2.20.0 | 2.31.0 | testdata/locks-requirements/requirements.txt | | https://osv.dev/GHSA-j8r2-6x86-q33q | | | | | | | @@ -6460,7 +6467,8 @@ Total 3 packages affected by 13 known vulnerabilities (1 Critical, 4 High, 7 Med | https://osv.dev/GHSA-9hjg-9r4m-mvj7 | | | | | | | | https://osv.dev/PYSEC-2026-1873 | 5.6 | PyPI | requests | 2.20.0 | 2.32.0 | testdata/locks-requirements/requirements.txt | | https://osv.dev/GHSA-9wx4-h78v-vm56 | | | | | | | -| https://osv.dev/GHSA-gc5v-m9x4-r6x2 | 4.4 | PyPI | requests | 2.20.0 | 2.33.0 | testdata/locks-requirements/requirements.txt | +| https://osv.dev/PYSEC-2026-2275 | 5.5 | PyPI | requests | 2.20.0 | 2.33.0 | testdata/locks-requirements/requirements.txt | +| https://osv.dev/GHSA-gc5v-m9x4-r6x2 | | | | | | | +-------------------------------------+------+-----------+----------+---------+---------------+----------------------------------------------+ --- diff --git a/go.mod b/go.mod index bd251985178..6fc3ef50525 100644 --- a/go.mod +++ b/go.mod @@ -13,7 +13,7 @@ require ( github.com/go-git/go-git/v5 v5.19.1 github.com/gobwas/glob v0.2.3 github.com/google/go-cmp v0.7.0 - github.com/google/osv-scalibr v0.4.6-0.20260612031204-164402d9140e + github.com/google/osv-scalibr v0.4.6-0.20260713000915-500ad84f4ed1 github.com/ianlancetaylor/demangle v0.0.0-20260505044615-1ff4bf46051f github.com/jedib0t/go-pretty/v6 v6.7.10 github.com/modelcontextprotocol/go-sdk v1.6.1 @@ -214,4 +214,3 @@ require ( www.velocidex.com/golang/go-ntfs v0.2.0 // indirect www.velocidex.com/golang/regparser v0.0.0-20250203141505-31e704a67ef7 // indirect ) - diff --git a/go.sum b/go.sum index 011959e3f7e..333924428fd 100644 --- a/go.sum +++ b/go.sum @@ -247,8 +247,8 @@ github.com/google/go-cpy v0.0.0-20211218193943-a9c933c06932 h1:5/4TSDzpDnHQ8rKEE github.com/google/go-cpy v0.0.0-20211218193943-a9c933c06932/go.mod h1:cC6EdPbj/17GFCPDK39NRarlMI+kt+O60S12cNB5J9Y= github.com/google/jsonschema-go v0.4.3 h1:/DBOLZTfDow7pe2GmaJNhltueGTtDKICi8V8p+DQPd0= github.com/google/jsonschema-go v0.4.3/go.mod h1:r5quNTdLOYEz95Ru18zA0ydNbBuYoo9tgaYcxEYhJVE= -github.com/google/osv-scalibr v0.4.6-0.20260612031204-164402d9140e h1:cQTtydMwNMniteU1xth8JECOBS6vtw0FIjZVZUAqAJo= -github.com/google/osv-scalibr v0.4.6-0.20260612031204-164402d9140e/go.mod h1:7NVYCBa6Uu7S2GvVj/kacQ8Bib8KhdIxU6+cf3aIIVI= +github.com/google/osv-scalibr v0.4.6-0.20260713000915-500ad84f4ed1 h1:yHo18phm3Xy56T1ngXgNqCMJR7uFWVWrnWyvTbzD+Ak= +github.com/google/osv-scalibr v0.4.6-0.20260713000915-500ad84f4ed1/go.mod h1:7NVYCBa6Uu7S2GvVj/kacQ8Bib8KhdIxU6+cf3aIIVI= github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6 h1:EEHtgt9IwisQ2AZ4pIsMjahcegHh6rmhqxzIRQIyepY= github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6/go.mod h1:I6V7YzU0XDpsHqbsyrghnFZLO1gwK6NPTNvmetQIk9U= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= diff --git a/internal/output/__snapshots__/spdx_test.snap b/internal/output/__snapshots__/spdx_test.snap index bc664f1d739..bcf9eba441a 100755 --- a/internal/output/__snapshots__/spdx_test.snap +++ b/internal/output/__snapshots__/spdx_test.snap @@ -544,8 +544,8 @@ "filesAnalyzed": false }, { - "name": "author1/mine1", - "SPDXID": "SPDXRef-Package-author1-mine1-", + "name": "mine1", + "SPDXID": "SPDXRef-Package-mine1-", "versionInfo": "1.2.3", "supplier": "NOASSERTION", "downloadLocation": "NOASSERTION", @@ -557,7 +557,7 @@ { "referenceCategory": "PACKAGE-MANAGER", "referenceType": "purl", - "referenceLocator": "pkg:composer/author1%2Fmine1@1.2.3" + "referenceLocator": "pkg:composer/author1/mine1@1.2.3" } ] }, @@ -616,8 +616,8 @@ ] }, { - "name": "author1/mine1", - "SPDXID": "SPDXRef-Package-author1-mine1-", + "name": "mine1", + "SPDXID": "SPDXRef-Package-mine1-", "versionInfo": "1.2.3", "supplier": "NOASSERTION", "downloadLocation": "NOASSERTION", @@ -629,7 +629,7 @@ { "referenceCategory": "PACKAGE-MANAGER", "referenceType": "purl", - "referenceLocator": "pkg:composer/author1%2Fmine1@1.2.3" + "referenceLocator": "pkg:composer/author1/mine1@1.2.3" } ] } @@ -642,11 +642,11 @@ }, { "spdxElementId": "SPDXRef-Package-main-", - "relatedSpdxElement": "SPDXRef-Package-author1-mine1-", + "relatedSpdxElement": "SPDXRef-Package-mine1-", "relationshipType": "CONTAINS" }, { - "spdxElementId": "SPDXRef-Package-author1-mine1-", + "spdxElementId": "SPDXRef-Package-mine1-", "relatedSpdxElement": "NOASSERTION", "relationshipType": "CONTAINS" }, @@ -682,11 +682,11 @@ }, { "spdxElementId": "SPDXRef-Package-main-", - "relatedSpdxElement": "SPDXRef-Package-author1-mine1-", + "relatedSpdxElement": "SPDXRef-Package-mine1-", "relationshipType": "CONTAINS" }, { - "spdxElementId": "SPDXRef-Package-author1-mine1-", + "spdxElementId": "SPDXRef-Package-mine1-", "relatedSpdxElement": "NOASSERTION", "relationshipType": "CONTAINS" } @@ -3262,8 +3262,8 @@ "filesAnalyzed": false }, { - "name": "author1/mine1", - "SPDXID": "SPDXRef-Package-author1-mine1-", + "name": "mine1", + "SPDXID": "SPDXRef-Package-mine1-", "versionInfo": "1.2.3", "supplier": "NOASSERTION", "downloadLocation": "NOASSERTION", @@ -3275,7 +3275,7 @@ { "referenceCategory": "PACKAGE-MANAGER", "referenceType": "purl", - "referenceLocator": "pkg:composer/author1%2Fmine1@1.2.3" + "referenceLocator": "pkg:composer/author1/mine1@1.2.3" } ] }, @@ -3316,8 +3316,8 @@ ] }, { - "name": "author3/mine3", - "SPDXID": "SPDXRef-Package-author3-mine3-", + "name": "mine3", + "SPDXID": "SPDXRef-Package-mine3-", "versionInfo": "0.4.1", "supplier": "NOASSERTION", "downloadLocation": "NOASSERTION", @@ -3329,7 +3329,7 @@ { "referenceCategory": "PACKAGE-MANAGER", "referenceType": "purl", - "referenceLocator": "pkg:composer/author3%2Fmine3@0.4.1" + "referenceLocator": "pkg:composer/author3/mine3@0.4.1" } ] } @@ -3342,11 +3342,11 @@ }, { "spdxElementId": "SPDXRef-Package-main-", - "relatedSpdxElement": "SPDXRef-Package-author1-mine1-", + "relatedSpdxElement": "SPDXRef-Package-mine1-", "relationshipType": "CONTAINS" }, { - "spdxElementId": "SPDXRef-Package-author1-mine1-", + "spdxElementId": "SPDXRef-Package-mine1-", "relatedSpdxElement": "NOASSERTION", "relationshipType": "CONTAINS" }, @@ -3372,11 +3372,11 @@ }, { "spdxElementId": "SPDXRef-Package-main-", - "relatedSpdxElement": "SPDXRef-Package-author3-mine3-", + "relatedSpdxElement": "SPDXRef-Package-mine3-", "relationshipType": "CONTAINS" }, { - "spdxElementId": "SPDXRef-Package-author3-mine3-", + "spdxElementId": "SPDXRef-Package-mine3-", "relatedSpdxElement": "NOASSERTION", "relationshipType": "CONTAINS" } @@ -3408,8 +3408,8 @@ "filesAnalyzed": false }, { - "name": "author1/mine1", - "SPDXID": "SPDXRef-Package-author1-mine1-", + "name": "mine1", + "SPDXID": "SPDXRef-Package-mine1-", "versionInfo": "1.2.3", "supplier": "NOASSERTION", "downloadLocation": "NOASSERTION", @@ -3421,7 +3421,7 @@ { "referenceCategory": "PACKAGE-MANAGER", "referenceType": "purl", - "referenceLocator": "pkg:composer/author1%2Fmine1@1.2.3" + "referenceLocator": "pkg:composer/author1/mine1@1.2.3" } ] }, @@ -3462,8 +3462,8 @@ ] }, { - "name": "author3/mine3", - "SPDXID": "SPDXRef-Package-author3-mine3-", + "name": "mine3", + "SPDXID": "SPDXRef-Package-mine3-", "versionInfo": "0.4.1", "supplier": "NOASSERTION", "downloadLocation": "NOASSERTION", @@ -3475,7 +3475,7 @@ { "referenceCategory": "PACKAGE-MANAGER", "referenceType": "purl", - "referenceLocator": "pkg:composer/author3%2Fmine3@0.4.1" + "referenceLocator": "pkg:composer/author3/mine3@0.4.1" } ] } @@ -3488,11 +3488,11 @@ }, { "spdxElementId": "SPDXRef-Package-main-", - "relatedSpdxElement": "SPDXRef-Package-author1-mine1-", + "relatedSpdxElement": "SPDXRef-Package-mine1-", "relationshipType": "CONTAINS" }, { - "spdxElementId": "SPDXRef-Package-author1-mine1-", + "spdxElementId": "SPDXRef-Package-mine1-", "relatedSpdxElement": "NOASSERTION", "relationshipType": "CONTAINS" }, @@ -3518,11 +3518,11 @@ }, { "spdxElementId": "SPDXRef-Package-main-", - "relatedSpdxElement": "SPDXRef-Package-author3-mine3-", + "relatedSpdxElement": "SPDXRef-Package-mine3-", "relationshipType": "CONTAINS" }, { - "spdxElementId": "SPDXRef-Package-author3-mine3-", + "spdxElementId": "SPDXRef-Package-mine3-", "relatedSpdxElement": "NOASSERTION", "relationshipType": "CONTAINS" } @@ -3554,8 +3554,8 @@ "filesAnalyzed": false }, { - "name": "author1/mine1", - "SPDXID": "SPDXRef-Package-author1-mine1-", + "name": "mine1", + "SPDXID": "SPDXRef-Package-mine1-", "versionInfo": "1.2.3", "supplier": "NOASSERTION", "downloadLocation": "NOASSERTION", @@ -3567,7 +3567,7 @@ { "referenceCategory": "PACKAGE-MANAGER", "referenceType": "purl", - "referenceLocator": "pkg:composer/author1%2Fmine1@1.2.3" + "referenceLocator": "pkg:composer/author1/mine1@1.2.3" } ] }, @@ -3590,8 +3590,8 @@ ] }, { - "name": "author3/mine3", - "SPDXID": "SPDXRef-Package-author3-mine3-", + "name": "mine3", + "SPDXID": "SPDXRef-Package-mine3-", "versionInfo": "0.4.1", "supplier": "NOASSERTION", "downloadLocation": "NOASSERTION", @@ -3603,7 +3603,7 @@ { "referenceCategory": "PACKAGE-MANAGER", "referenceType": "purl", - "referenceLocator": "pkg:composer/author3%2Fmine3@0.4.1" + "referenceLocator": "pkg:composer/author3/mine3@0.4.1" } ] } @@ -3616,11 +3616,11 @@ }, { "spdxElementId": "SPDXRef-Package-main-", - "relatedSpdxElement": "SPDXRef-Package-author1-mine1-", + "relatedSpdxElement": "SPDXRef-Package-mine1-", "relationshipType": "CONTAINS" }, { - "spdxElementId": "SPDXRef-Package-author1-mine1-", + "spdxElementId": "SPDXRef-Package-mine1-", "relatedSpdxElement": "NOASSERTION", "relationshipType": "CONTAINS" }, @@ -3636,11 +3636,11 @@ }, { "spdxElementId": "SPDXRef-Package-main-", - "relatedSpdxElement": "SPDXRef-Package-author3-mine3-", + "relatedSpdxElement": "SPDXRef-Package-mine3-", "relationshipType": "CONTAINS" }, { - "spdxElementId": "SPDXRef-Package-author3-mine3-", + "spdxElementId": "SPDXRef-Package-mine3-", "relatedSpdxElement": "NOASSERTION", "relationshipType": "CONTAINS" } diff --git a/internal/scalibrplugin/__snapshots__/resolve_test.snap b/internal/scalibrplugin/__snapshots__/resolve_test.snap index fe2f748353b..1974b5cbad4 100755 --- a/internal/scalibrplugin/__snapshots__/resolve_test.snap +++ b/internal/scalibrplugin/__snapshots__/resolve_test.snap @@ -37,6 +37,7 @@ os/apk os/chisel os/dpkg os/homebrew +os/rpm osv/osvscannerjson php/composerlock python/pdmlock @@ -76,6 +77,7 @@ os/apk os/chisel os/dpkg os/homebrew +os/rpm python/wheelegg rust/cargoauditable vex/os-duplicate/apk @@ -116,6 +118,7 @@ os/apk os/chisel os/dpkg os/homebrew +os/rpm python/wheelegg rust/cargoauditable vex/os-duplicate/apk @@ -145,6 +148,7 @@ os/apk os/chisel os/dpkg os/homebrew +os/rpm python/wheelegg rust/cargoauditable vex/os-duplicate/apk diff --git a/internal/scalibrplugin/presets.go b/internal/scalibrplugin/presets.go index 67c2b611603..1e05056bd40 100644 --- a/internal/scalibrplugin/presets.go +++ b/internal/scalibrplugin/presets.go @@ -52,6 +52,7 @@ import ( "github.com/google/osv-scalibr/extractor/filesystem/os/chisel" "github.com/google/osv-scalibr/extractor/filesystem/os/dpkg" "github.com/google/osv-scalibr/extractor/filesystem/os/homebrew" + "github.com/google/osv-scalibr/extractor/filesystem/os/rpm" "github.com/google/osv-scalibr/extractor/filesystem/sbom/cdx" "github.com/google/osv-scalibr/extractor/filesystem/sbom/spdx" "github.com/google/osv-scanner/v2/internal/scalibrextract/filesystem/vendored" @@ -166,6 +167,8 @@ var ExtractorPresets = map[string]extractors.InitMap{ chisel.Name: {chisel.New}, // Homebrew homebrew.Name: {homebrew.New}, + // RPM-based (AlmaLinux, RHEL, Rocky, CentOS, Fedora) + rpm.Name: {rpm.New}, }, } diff --git a/internal/scalibrplugin/resolve_test.go b/internal/scalibrplugin/resolve_test.go index 78e276e80b6..636b231a750 100644 --- a/internal/scalibrplugin/resolve_test.go +++ b/internal/scalibrplugin/resolve_test.go @@ -32,6 +32,7 @@ import ( "github.com/google/osv-scalibr/extractor/filesystem/os/chisel" "github.com/google/osv-scalibr/extractor/filesystem/os/dpkg" "github.com/google/osv-scalibr/extractor/filesystem/os/homebrew" + "github.com/google/osv-scalibr/extractor/filesystem/os/rpm" "github.com/google/osv-scalibr/extractor/filesystem/sbom/cdx" "github.com/google/osv-scalibr/extractor/filesystem/sbom/spdx" "github.com/google/osv-scanner/v2/internal/scalibrextract/filesystem/vendored" @@ -521,6 +522,7 @@ func TestResolve_Extractors(t *testing.T) { dpkg.Name, chisel.Name, homebrew.Name, + rpm.Name, gobinary.Name, nodemodules.Name, wheelegg.Name, @@ -543,6 +545,7 @@ func TestResolve_Extractors(t *testing.T) { dpkg.Name, chisel.Name, homebrew.Name, + rpm.Name, gobinary.Name, nodemodules.Name, wheelegg.Name, @@ -572,6 +575,7 @@ func TestResolve_Extractors(t *testing.T) { chisel.Name, gobinary.Name, homebrew.Name, + rpm.Name, nodemodules.Name, apkanno.Name, dpkganno.Name, @@ -593,6 +597,7 @@ func TestResolve_Extractors(t *testing.T) { dpkg.Name, chisel.Name, homebrew.Name, + rpm.Name, gitrepo.Name, gobinary.Name, nodemodules.Name,