[
  {
    "advisoryKey": "GHSA-77vh-xpmg-72qh",
    "affectedPackages": [
      {
        "identifier": "pkg:golang/github.com/opencontainers/image-spec",
        "platform": "Go",
        "provenance": [
          {
            "fieldMask": [],
            "kind": "affected",
            "recordedAt": "2025-10-09T20:52:03.9319037+00:00",
            "source": "osv",
            "value": "pkg:golang/github.com/opencontainers/image-spec"
          }
        ],
        "statuses": [],
        "type": "semver",
        "versionRanges": [
          {
            "fixedVersion": "1.0.2",
            "introducedVersion": "0",
            "lastAffectedVersion": null,
            "primitives": {
              "evr": null,
              "hasVendorExtensions": false,
              "nevra": null,
              "semVer": {
                "constraintExpression": null,
                "fixed": "1.0.2",
                "fixedInclusive": false,
                "introduced": "0",
                "introducedInclusive": true,
                "lastAffected": null,
                "lastAffectedInclusive": true
              },
              "vendorExtensions": null
            },
            "provenance": {
              "fieldMask": [],
              "kind": "range",
              "recordedAt": "2025-10-09T20:52:03.9319037+00:00",
              "source": "osv",
              "value": "pkg:golang/github.com/opencontainers/image-spec"
            },
            "rangeExpression": null,
            "rangeKind": "semver"
          }
        ]
      }
    ],
    "aliases": [
      "CGA-j36r-723f-8c29",
      "GHSA-77vh-xpmg-72qh"
    ],
    "cvssMetrics": [
      {
        "baseScore": 3,
        "baseSeverity": "low",
        "provenance": {
          "fieldMask": [],
          "kind": "cvss",
          "recordedAt": "2025-10-09T20:52:03.9319037+00:00",
          "source": "osv",
          "value": "CVSS_V3"
        },
        "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N",
        "version": "3.1"
      }
    ],
    "exploitKnown": false,
    "language": "en",
    "modified": "2021-11-24T19:43:35+00:00",
    "provenance": [
      {
        "fieldMask": [],
        "kind": "document",
        "recordedAt": "2021-11-18T16:02:41+00:00",
        "source": "osv",
        "value": "https://osv.dev/vulnerability/GHSA-77vh-xpmg-72qh"
      },
      {
        "fieldMask": [],
        "kind": "mapping",
        "recordedAt": "2025-10-09T20:52:03.9319037+00:00",
        "source": "osv",
        "value": "GHSA-77vh-xpmg-72qh"
      }
    ],
    "published": "2021-11-18T16:02:41+00:00",
    "references": [
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9319037+00:00",
          "source": "osv",
          "value": "https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9319037+00:00",
          "source": "osv",
          "value": "https://github.com/opencontainers/image-spec"
        },
        "sourceTag": "PACKAGE",
        "summary": null,
        "url": "https://github.com/opencontainers/image-spec"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9319037+00:00",
          "source": "osv",
          "value": "https://github.com/opencontainers/image-spec/commit/693428a734f5bab1a84bd2f990d92ef1111cd60c"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://github.com/opencontainers/image-spec/commit/693428a734f5bab1a84bd2f990d92ef1111cd60c"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9319037+00:00",
          "source": "osv",
          "value": "https://github.com/opencontainers/image-spec/releases/tag/v1.0.2"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://github.com/opencontainers/image-spec/releases/tag/v1.0.2"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9319037+00:00",
          "source": "osv",
          "value": "https://github.com/opencontainers/image-spec/security/advisories/GHSA-77vh-xpmg-72qh"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://github.com/opencontainers/image-spec/security/advisories/GHSA-77vh-xpmg-72qh"
      }
    ],
    "severity": "low",
    "summary": "### Impact In the OCI Image Specification version 1.0.1 and prior, manifest and index documents are not self-describing and documents with a single digest could be interpreted as either a manifest or an index. ### Patches The Image Specification will be updated to recommend that both manifest and index documents contain a `mediaType` field to identify the type of document. Release [v1.0.2](https://github.com/opencontainers/image-spec/releases/tag/v1.0.2) includes these updates. ### Workarounds Software attempting to deserialize an ambiguous document may reject the document if it contains both “manifests” and “layers” fields or “manifests” and “config” fields. ### References https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m ### For more information If you have any questions or comments about this advisory: * Open an issue in https://github.com/opencontainers/image-spec * Email us at [security@opencontainers.org](mailto:security@opencontainers.org) * https://github.com/opencontainers/image-spec/commits/v1.0.2",
    "title": "Clarify `mediaType` handling"
  },
  {
    "advisoryKey": "GHSA-7rjr-3q55-vv33",
    "affectedPackages": [
      {
        "identifier": "pkg:maven/org.apache.logging.log4j/log4j-core",
        "platform": "Maven",
        "provenance": [
          {
            "fieldMask": [],
            "kind": "affected",
            "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
            "source": "osv",
            "value": "pkg:maven/org.apache.logging.log4j/log4j-core"
          }
        ],
        "statuses": [],
        "type": "semver",
        "versionRanges": [
          {
            "fixedVersion": "2.16.0",
            "introducedVersion": "2.13.0",
            "lastAffectedVersion": null,
            "primitives": {
              "evr": null,
              "hasVendorExtensions": false,
              "nevra": null,
              "semVer": {
                "constraintExpression": null,
                "fixed": "2.16.0",
                "fixedInclusive": false,
                "introduced": "2.13.0",
                "introducedInclusive": true,
                "lastAffected": null,
                "lastAffectedInclusive": true
              },
              "vendorExtensions": null
            },
            "provenance": {
              "fieldMask": [],
              "kind": "range",
              "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
              "source": "osv",
              "value": "pkg:maven/org.apache.logging.log4j/log4j-core"
            },
            "rangeExpression": null,
            "rangeKind": "semver"
          }
        ]
      },
      {
        "identifier": "pkg:maven/org.apache.logging.log4j/log4j-core",
        "platform": "Maven",
        "provenance": [
          {
            "fieldMask": [],
            "kind": "affected",
            "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
            "source": "osv",
            "value": "pkg:maven/org.apache.logging.log4j/log4j-core"
          }
        ],
        "statuses": [],
        "type": "semver",
        "versionRanges": [
          {
            "fixedVersion": "2.12.2",
            "introducedVersion": "0",
            "lastAffectedVersion": null,
            "primitives": {
              "evr": null,
              "hasVendorExtensions": false,
              "nevra": null,
              "semVer": {
                "constraintExpression": null,
                "fixed": "2.12.2",
                "fixedInclusive": false,
                "introduced": "0",
                "introducedInclusive": true,
                "lastAffected": null,
                "lastAffectedInclusive": true
              },
              "vendorExtensions": null
            },
            "provenance": {
              "fieldMask": [],
              "kind": "range",
              "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
              "source": "osv",
              "value": "pkg:maven/org.apache.logging.log4j/log4j-core"
            },
            "rangeExpression": null,
            "rangeKind": "semver"
          }
        ]
      },
      {
        "identifier": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2",
        "platform": "Maven",
        "provenance": [
          {
            "fieldMask": [],
            "kind": "affected",
            "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
            "source": "osv",
            "value": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2"
          }
        ],
        "statuses": [],
        "type": "semver",
        "versionRanges": [
          {
            "fixedVersion": "1.9.2",
            "introducedVersion": "1.8.0",
            "lastAffectedVersion": null,
            "primitives": {
              "evr": null,
              "hasVendorExtensions": false,
              "nevra": null,
              "semVer": {
                "constraintExpression": null,
                "fixed": "1.9.2",
                "fixedInclusive": false,
                "introduced": "1.8.0",
                "introducedInclusive": true,
                "lastAffected": null,
                "lastAffectedInclusive": true
              },
              "vendorExtensions": null
            },
            "provenance": {
              "fieldMask": [],
              "kind": "range",
              "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
              "source": "osv",
              "value": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2"
            },
            "rangeExpression": null,
            "rangeKind": "semver"
          }
        ]
      },
      {
        "identifier": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2",
        "platform": "Maven",
        "provenance": [
          {
            "fieldMask": [],
            "kind": "affected",
            "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
            "source": "osv",
            "value": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2"
          }
        ],
        "statuses": [],
        "type": "semver",
        "versionRanges": [
          {
            "fixedVersion": "1.10.8",
            "introducedVersion": "1.10.0",
            "lastAffectedVersion": null,
            "primitives": {
              "evr": null,
              "hasVendorExtensions": false,
              "nevra": null,
              "semVer": {
                "constraintExpression": null,
                "fixed": "1.10.8",
                "fixedInclusive": false,
                "introduced": "1.10.0",
                "introducedInclusive": true,
                "lastAffected": null,
                "lastAffectedInclusive": true
              },
              "vendorExtensions": null
            },
            "provenance": {
              "fieldMask": [],
              "kind": "range",
              "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
              "source": "osv",
              "value": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2"
            },
            "rangeExpression": null,
            "rangeKind": "semver"
          }
        ]
      },
      {
        "identifier": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2",
        "platform": "Maven",
        "provenance": [
          {
            "fieldMask": [],
            "kind": "affected",
            "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
            "source": "osv",
            "value": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2"
          }
        ],
        "statuses": [],
        "type": "semver",
        "versionRanges": [
          {
            "fixedVersion": "1.11.11",
            "introducedVersion": "1.11.0",
            "lastAffectedVersion": null,
            "primitives": {
              "evr": null,
              "hasVendorExtensions": false,
              "nevra": null,
              "semVer": {
                "constraintExpression": null,
                "fixed": "1.11.11",
                "fixedInclusive": false,
                "introduced": "1.11.0",
                "introducedInclusive": true,
                "lastAffected": null,
                "lastAffectedInclusive": true
              },
              "vendorExtensions": null
            },
            "provenance": {
              "fieldMask": [],
              "kind": "range",
              "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
              "source": "osv",
              "value": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2"
            },
            "rangeExpression": null,
            "rangeKind": "semver"
          }
        ]
      },
      {
        "identifier": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2",
        "platform": "Maven",
        "provenance": [
          {
            "fieldMask": [],
            "kind": "affected",
            "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
            "source": "osv",
            "value": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2"
          }
        ],
        "statuses": [],
        "type": "semver",
        "versionRanges": [
          {
            "fixedVersion": "2.0.12",
            "introducedVersion": "2.0.0",
            "lastAffectedVersion": null,
            "primitives": {
              "evr": null,
              "hasVendorExtensions": false,
              "nevra": null,
              "semVer": {
                "constraintExpression": null,
                "fixed": "2.0.12",
                "fixedInclusive": false,
                "introduced": "2.0.0",
                "introducedInclusive": true,
                "lastAffected": null,
                "lastAffectedInclusive": true
              },
              "vendorExtensions": null
            },
            "provenance": {
              "fieldMask": [],
              "kind": "range",
              "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
              "source": "osv",
              "value": "pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2"
            },
            "rangeExpression": null,
            "rangeKind": "semver"
          }
        ]
      }
    ],
    "aliases": [
      "CVE-2021-45046",
      "GHSA-7rjr-3q55-vv33"
    ],
    "cvssMetrics": [
      {
        "baseScore": 9,
        "baseSeverity": "critical",
        "provenance": {
          "fieldMask": [],
          "kind": "cvss",
          "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
          "source": "osv",
          "value": "CVSS_V3"
        },
        "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
        "version": "3.1"
      }
    ],
    "exploitKnown": false,
    "language": "en",
    "modified": "2025-05-09T13:13:16.169374+00:00",
    "provenance": [
      {
        "fieldMask": [],
        "kind": "document",
        "recordedAt": "2021-12-14T18:01:28+00:00",
        "source": "osv",
        "value": "https://osv.dev/vulnerability/GHSA-7rjr-3q55-vv33"
      },
      {
        "fieldMask": [],
        "kind": "mapping",
        "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
        "source": "osv",
        "value": "GHSA-7rjr-3q55-vv33"
      }
    ],
    "published": "2021-12-14T18:01:28+00:00",
    "references": [
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
          "source": "osv",
          "value": "http://www.openwall.com/lists/oss-security/2021/12/14/4"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "http://www.openwall.com/lists/oss-security/2021/12/14/4"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
          "source": "osv",
          "value": "http://www.openwall.com/lists/oss-security/2021/12/15/3"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "http://www.openwall.com/lists/oss-security/2021/12/15/3"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
          "source": "osv",
          "value": "http://www.openwall.com/lists/oss-security/2021/12/18/1"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "http://www.openwall.com/lists/oss-security/2021/12/18/1"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
          "source": "osv",
          "value": "https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
          "source": "osv",
          "value": "https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
          "source": "osv",
          "value": "https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
          "source": "osv",
          "value": "https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf"
      },
      {
        "kind": "advisory",
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
          "source": "osv",
          "value": "https://github.com/advisories/GHSA-jfh8-c2jp-5v3q"
        },
        "sourceTag": "ADVISORY",
        "summary": null,
        "url": "https://github.com/advisories/GHSA-jfh8-c2jp-5v3q"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
          "source": "osv",
          "value": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
          "source": "osv",
          "value": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
          "source": "osv",
          "value": "https://logging.apache.org/log4j/2.x/security.html"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://logging.apache.org/log4j/2.x/security.html"
      },
      {
        "kind": "advisory",
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
          "source": "osv",
          "value": "https://nvd.nist.gov/vuln/detail/CVE-2021-45046"
        },
        "sourceTag": "ADVISORY",
        "summary": null,
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45046"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
          "source": "osv",
          "value": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
          "source": "osv",
          "value": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
          "source": "osv",
          "value": "https://security.gentoo.org/glsa/202310-16"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://security.gentoo.org/glsa/202310-16"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
          "source": "osv",
          "value": "https://www.cve.org/CVERecord?id=CVE-2021-44228"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://www.cve.org/CVERecord?id=CVE-2021-44228"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
          "source": "osv",
          "value": "https://www.debian.org/security/2021/dsa-5022"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://www.debian.org/security/2021/dsa-5022"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
          "source": "osv",
          "value": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
          "source": "osv",
          "value": "https://www.kb.cert.org/vuls/id/930724"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://www.kb.cert.org/vuls/id/930724"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
          "source": "osv",
          "value": "https://www.openwall.com/lists/oss-security/2021/12/14/4"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://www.openwall.com/lists/oss-security/2021/12/14/4"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
          "source": "osv",
          "value": "https://www.oracle.com/security-alerts/alert-cve-2021-44228.html"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://www.oracle.com/security-alerts/alert-cve-2021-44228.html"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
          "source": "osv",
          "value": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
          "source": "osv",
          "value": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9393878+00:00",
          "source": "osv",
          "value": "https://www.oracle.com/security-alerts/cpujul2022.html"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
      }
    ],
    "severity": "critical",
    "summary": "# Impact The fix to address [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allow attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a remote code execution (RCE) attack. ## Affected packages Only the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use. # Mitigation Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default. This issue can be mitigated in prior releases (< 2.16.0) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). Log4j 2.15.0 restricts JNDI LDAP lookups to localhost by default. Note that previous mitigations involving configuration such as to set the system property `log4j2.formatMsgNoLookups` to `true` do NOT mitigate this specific vulnerability.",
    "title": "Incomplete fix for Apache Log4j vulnerability"
  },
  {
    "advisoryKey": "GHSA-cjjf-27cc-pvmv",
    "affectedPackages": [
      {
        "identifier": "pkg:pypi/pyload-ng",
        "platform": "PyPI",
        "provenance": [
          {
            "fieldMask": [],
            "kind": "affected",
            "recordedAt": "2025-10-09T20:52:03.9260555+00:00",
            "source": "osv",
            "value": "pkg:pypi/pyload-ng"
          }
        ],
        "statuses": [],
        "type": "semver",
        "versionRanges": [
          {
            "fixedVersion": "0.5.0b3.dev91",
            "introducedVersion": "0",
            "lastAffectedVersion": null,
            "primitives": {
              "evr": null,
              "hasVendorExtensions": false,
              "nevra": null,
              "semVer": {
                "constraintExpression": null,
                "fixed": "0.5.0b3.dev91",
                "fixedInclusive": false,
                "introduced": "0",
                "introducedInclusive": true,
                "lastAffected": null,
                "lastAffectedInclusive": true
              },
              "vendorExtensions": null
            },
            "provenance": {
              "fieldMask": [],
              "kind": "range",
              "recordedAt": "2025-10-09T20:52:03.9260555+00:00",
              "source": "osv",
              "value": "pkg:pypi/pyload-ng"
            },
            "rangeExpression": null,
            "rangeKind": "semver"
          }
        ]
      }
    ],
    "aliases": [
      "CVE-2025-61773",
      "GHSA-cjjf-27cc-pvmv"
    ],
    "cvssMetrics": [
      {
        "baseScore": 8.1,
        "baseSeverity": "high",
        "provenance": {
          "fieldMask": [],
          "kind": "cvss",
          "recordedAt": "2025-10-09T20:52:03.9260555+00:00",
          "source": "osv",
          "value": "CVSS_V3"
        },
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
        "version": "3.1"
      }
    ],
    "exploitKnown": false,
    "language": "en",
    "modified": "2025-10-09T15:59:13.250015+00:00",
    "provenance": [
      {
        "fieldMask": [],
        "kind": "document",
        "recordedAt": "2025-10-09T15:19:48+00:00",
        "source": "osv",
        "value": "https://osv.dev/vulnerability/GHSA-cjjf-27cc-pvmv"
      },
      {
        "fieldMask": [],
        "kind": "mapping",
        "recordedAt": "2025-10-09T20:52:03.9260555+00:00",
        "source": "osv",
        "value": "GHSA-cjjf-27cc-pvmv"
      }
    ],
    "published": "2025-10-09T15:19:48+00:00",
    "references": [
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9260555+00:00",
          "source": "osv",
          "value": "https://github.com/pyload/pyload"
        },
        "sourceTag": "PACKAGE",
        "summary": null,
        "url": "https://github.com/pyload/pyload"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9260555+00:00",
          "source": "osv",
          "value": "https://github.com/pyload/pyload/commit/5823327d0b797161c7195a1f660266d30a69f0ca"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://github.com/pyload/pyload/commit/5823327d0b797161c7195a1f660266d30a69f0ca"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9260555+00:00",
          "source": "osv",
          "value": "https://github.com/pyload/pyload/pull/4624"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://github.com/pyload/pyload/pull/4624"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.9260555+00:00",
          "source": "osv",
          "value": "https://github.com/pyload/pyload/security/advisories/GHSA-cjjf-27cc-pvmv"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://github.com/pyload/pyload/security/advisories/GHSA-cjjf-27cc-pvmv"
      }
    ],
    "severity": "high",
    "summary": "### Summary pyLoad web interface contained insufficient input validation in both the Captcha script endpoint and the Click'N'Load (CNL) Blueprint. This flaw allowed untrusted user input to be processed unsafely, which could be exploited by an attacker to inject arbitrary content into the web UI or manipulate request handling. The vulnerability could lead to client-side code execution (XSS) or other unintended behaviors when a malicious payload is submitted. user-supplied parameters from HTTP requests were not adequately validated or sanitized before being passed into the application logic and response generation. This allowed crafted input to alter the expected execution flow. CNL (Click'N'Load) blueprint exposed unsafe handling of untrusted parameters in HTTP requests. The application did not consistently enforce input validation or encoding, making it possible for an attacker to craft malicious requests. ### PoC 1. Run a vulnerable version of pyLoad prior to commit [`f9d27f2`](https://github.com/pyload/pyload/pull/4624). 2. Start the web UI and access the Captcha or CNL endpoints. 3. Submit a crafted request containing malicious JavaScript payloads in unvalidated parameters (`/flash/addcrypted2?jk=function(){alert(1)}&crypted=12345`). 4. Observe that the payload is reflected and executed in the client’s browser, demonstrating cross-site scripting (XSS). Example request: ```http GET /flash/addcrypted2?jk=function(){alert(1)}&crypted=12345 HTTP/1.1 Host: 127.0.0.1:8000 Content-Type: application/x-www-form-urlencoded Content-Length: 107 ``` ### Impact Exploiting this vulnerability allows an attacker to inject and execute arbitrary JavaScript within the browser session of a user accessing the pyLoad Web UI. In practice, this means an attacker could impersonate an administrator, steal authentication cookies or tokens, and perform unauthorized actions on behalf of the victim. Because the affected endpoints are part of the core interface, a successful attack undermines the trust and security of the entire application, potentially leading to a full compromise of the management interface and the data it controls. The impact is particularly severe in cases where the Web UI is exposed over a network without additional access restrictions, as it enables remote attackers to directly target users with crafted links or requests that trigger the vulnerability.",
    "title": "pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters"
  },
  {
    "advisoryKey": "GHSA-wv4w-6qv2-qqfg",
    "affectedPackages": [
      {
        "identifier": "pkg:pypi/social-auth-app-django",
        "platform": "PyPI",
        "provenance": [
          {
            "fieldMask": [],
            "kind": "affected",
            "recordedAt": "2025-10-09T20:52:03.8947884+00:00",
            "source": "osv",
            "value": "pkg:pypi/social-auth-app-django"
          }
        ],
        "statuses": [],
        "type": "semver",
        "versionRanges": [
          {
            "fixedVersion": "5.6.0",
            "introducedVersion": "0",
            "lastAffectedVersion": null,
            "primitives": {
              "evr": null,
              "hasVendorExtensions": false,
              "nevra": null,
              "semVer": {
                "constraintExpression": null,
                "fixed": "5.6.0",
                "fixedInclusive": false,
                "introduced": "0",
                "introducedInclusive": true,
                "lastAffected": null,
                "lastAffectedInclusive": true
              },
              "vendorExtensions": null
            },
            "provenance": {
              "fieldMask": [],
              "kind": "range",
              "recordedAt": "2025-10-09T20:52:03.8947884+00:00",
              "source": "osv",
              "value": "pkg:pypi/social-auth-app-django"
            },
            "rangeExpression": null,
            "rangeKind": "semver"
          }
        ]
      }
    ],
    "aliases": [
      "CVE-2025-61783",
      "GHSA-wv4w-6qv2-qqfg"
    ],
    "cvssMetrics": [],
    "exploitKnown": false,
    "language": "en",
    "modified": "2025-10-09T17:57:29.916841+00:00",
    "provenance": [
      {
        "fieldMask": [],
        "kind": "document",
        "recordedAt": "2025-10-09T17:08:05+00:00",
        "source": "osv",
        "value": "https://osv.dev/vulnerability/GHSA-wv4w-6qv2-qqfg"
      },
      {
        "fieldMask": [],
        "kind": "mapping",
        "recordedAt": "2025-10-09T20:52:03.8947884+00:00",
        "source": "osv",
        "value": "GHSA-wv4w-6qv2-qqfg"
      }
    ],
    "published": "2025-10-09T17:08:05+00:00",
    "references": [
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.8947884+00:00",
          "source": "osv",
          "value": "https://github.com/python-social-auth/social-app-django"
        },
        "sourceTag": "PACKAGE",
        "summary": null,
        "url": "https://github.com/python-social-auth/social-app-django"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.8947884+00:00",
          "source": "osv",
          "value": "https://github.com/python-social-auth/social-app-django/commit/10c80e2ebabeccd4e9c84ad0e16e1db74148ed4c"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://github.com/python-social-auth/social-app-django/commit/10c80e2ebabeccd4e9c84ad0e16e1db74148ed4c"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.8947884+00:00",
          "source": "osv",
          "value": "https://github.com/python-social-auth/social-app-django/issues/220"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://github.com/python-social-auth/social-app-django/issues/220"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.8947884+00:00",
          "source": "osv",
          "value": "https://github.com/python-social-auth/social-app-django/issues/231"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://github.com/python-social-auth/social-app-django/issues/231"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.8947884+00:00",
          "source": "osv",
          "value": "https://github.com/python-social-auth/social-app-django/issues/634"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://github.com/python-social-auth/social-app-django/issues/634"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.8947884+00:00",
          "source": "osv",
          "value": "https://github.com/python-social-auth/social-app-django/pull/803"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://github.com/python-social-auth/social-app-django/pull/803"
      },
      {
        "kind": null,
        "provenance": {
          "fieldMask": [],
          "kind": "reference",
          "recordedAt": "2025-10-09T20:52:03.8947884+00:00",
          "source": "osv",
          "value": "https://github.com/python-social-auth/social-app-django/security/advisories/GHSA-wv4w-6qv2-qqfg"
        },
        "sourceTag": "WEB",
        "summary": null,
        "url": "https://github.com/python-social-auth/social-app-django/security/advisories/GHSA-wv4w-6qv2-qqfg"
      }
    ],
    "severity": "medium",
    "summary": "### Impact Upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn't require unique e-mail addresses. ### Patches * https://github.com/python-social-auth/social-app-django/pull/803 ### Workarounds Review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.",
    "title": "Python Social Auth - Django has unsafe account association"
  }
]