Single advisory in detail

Extraits de code

curl "https://api.oanor.com/osv-api/v1/vulnerability" \
  -H "x-oanor-key: oanor_test_..."

await fetch("https://api.oanor.com/osv-api/v1/vulnerability", {
  headers: { "x-oanor-key": "oanor_test_..." }
});

$ch = curl_init("https://api.oanor.com/osv-api/v1/vulnerability");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["x-oanor-key: oanor_test_..."]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$out = curl_exec($ch);

import requests
requests.get(
    "https://api.oanor.com/osv-api/v1/vulnerability",
    headers={"x-oanor-key": "oanor_test_..."}
)

Exemple de réponse

Une réponse réelle de ce endpoint, capturée lors du dernier contrôle de santé.

{
    "data": {
        "vulnerability": {
            "id": "GHSA-462w-v97r-4m45",
            "aliases": [
                "CVE-2019-10906",
                "PYSEC-2019-217"
            ],
            "cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "cvss_v4": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
            "cwe_ids": [
                "CWE-693"
            ],
            "details": "In Pallets Jinja before 2.10.1, `str.format_map` allows a sandbox escape. The sandbox is used to restrict what code can be evaluated when rendering untrusted, user-provided templates. Due to the way string formatting works in Python, the `str.format_map` method could be used to escape the sandbox. This issue was previously addressed for the `str.format` method in Jinja 2.8.1, which discusses the issue in detail. However, the less-common `str.format_map` method was overlooked. This release applies the same sandboxing to both methods. If you cannot upgrade Jinja, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.",
            "osv_url": "https://osv.dev/vulnerability/GHSA-462w-v97r-4m45",
            "summary": "Jinja2 sandbox escape via string formatting",
            "affected": [
                {
                    "name": "jinja2",
                    "ecosystem": "PyPI"
                }
            ],
            "modified": "2024-09-24T21:03:59.802687Z",
            "severity": "HIGH",
            "published": "2019-04-10T14:30:24Z",
            "withdrawn": null,
            "references": [
                {
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10906",
                    "type": "ADVISORY"
                },
                {
                    "url": "https://usn.ubuntu.com/4011-2",
                    "type": "WEB"
                },
                {
                    "url": "https://usn.ubuntu.com/4011-1",
                    "type": "WEB"
                },
                {
                    "url": "https://palletsprojects.com/blog/jinja-2-10-1-released",
                    "type": "WEB"
                },
                {
                    "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/TS7IVZAJBWOHNRDMFJDIZVFCMRP6YIUQ",
                    "type": "WEB"
                },
                {
                    "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/QCDYIS254EJMBNWOG4S5QY6AOTOR4TZU",
                    "type": "WEB"
                },
                {
                    "url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/DSW3QZMFVVR7YE3UT4YRQA272TYAL5AF",
                    "type": "WEB"
                },
                {
                    "url": "https://lists.apache.org/thread.html/f0c4a03418bcfe70c539
…