whitelist vulneribilities

[ashwinidr23]

hello,
is it possible to whitelist vulnerabilities in stools ?

[vsoch]

Can you better explain what you mean? You could save the output to json and do whatever you like with it.

[ashwinidr23]

I mean, is there an option to ignore/allow few selected vulnerabilities? In some container scanners I have used (for Docker ) , there is a flag available which takes a file(yaml/json) with list of vulnerabilities as an argument and allow these vulnerabilities if encountered. This will be usefull for implementing in a CI/CD pipeline So I was wondering if there is an option available in stools as well. Thank you! Ashwini

[vsoch]

oh yeah that totally makes sense! How about we match the Docker file format for that, so you don't have to remake it. Can you point me to one?

[ashwinidr23]

Do you mean to a Docker container scanner which has this feature ? https://github.com/arminc/clair-scanner This page explains about the procedure and yaml file format with example I hope this helps! Best regards, Ashwini

…

________________________________ From: Vanessasaurus ***@***.***> Sent: Tuesday, November 23, 2021, 9:38 PM To: singularityhub/stools Cc: D R, Ashwini SBOBNG-PTIV/ZSH; Author Subject: Re: [singularityhub/stools] whitelist vulneribilities (Issue #13) Think Secure. This email is from an external source. oh yeah that totally makes sense! How about we match the Docker file format for that, so you don't have to remake it. Can you point me to one? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fsingularityhub%2Fstools%2Fissues%2F13%23issuecomment-976776229&data=04%7C01%7Cashwini.dr%40shell.com%7C4c6604925f624b90042f08d9ae9b74e4%7Cdb1e96a8a3da442a930b235cac24cd5c%7C0%7C0%7C637732804974327065%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=wp17%2BDD%2BMN%2FsrvyeEbPCxvvhkUWDt0N4%2Flp5dBX%2BCWI%3D&reserved=0>, or unsubscribe<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAQIOSUERS7DALL7FGPIUGSTUNO363ANCNFSM5ITJRPPQ&data=04%7C01%7Cashwini.dr%40shell.com%7C4c6604925f624b90042f08d9ae9b74e4%7Cdb1e96a8a3da442a930b235cac24cd5c%7C0%7C0%7C637732804974337061%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=4rTF%2Bf8K4f%2BcabG8O0c6bL0OR4ON%2BUN%2BZ1nyiuTqSlA%3D&reserved=0>. Triage notifications on the go with GitHub Mobile for iOS<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fapps.apple.com%2Fapp%2Fapple-store%2Fid1477376905%3Fct%3Dnotification-email%26mt%3D8%26pt%3D524675&data=04%7C01%7Cashwini.dr%40shell.com%7C4c6604925f624b90042f08d9ae9b74e4%7Cdb1e96a8a3da442a930b235cac24cd5c%7C0%7C0%7C637732804974347053%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=fghpBhidTDM%2FE2439r4SMuUMzZammM1mql%2BDGGYsKxU%3D&reserved=0> or Android<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fplay.google.com%2Fstore%2Fapps%2Fdetails%3Fid%3Dcom.github.android%26referrer%3Dutm_campaign%253Dnotification-email%2526utm_medium%253Demail%2526utm_source%253Dgithub&data=04%7C01%7Cashwini.dr%40shell.com%7C4c6604925f624b90042f08d9ae9b74e4%7Cdb1e96a8a3da442a930b235cac24cd5c%7C0%7C0%7C637732804974347053%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=52MC%2FYb%2B0PdAqJ39dRQeQQbjrwekDUkcVTQ533Vh%2BqM%3D&reserved=0>.

[vsoch]

yep that's perfect! I'll probably be adjusting the language so it's not whitelist but maybe allowlist? And I should be able to work on this soon.

[vsoch]

okey doke, here is a PR to test! #14

So I did matching for CVEs based on the upper level OS (e.g. ubuntu) and then the CVE name - I didn't use the content of the dict because I wasn't sure how it mapped! Do you want to test it out and let me know if you'd like changes, etc?

[ashwinidr23]

Thank you for the quick action on this! i cloned the latest changes and started docker-compose. The clair-scanner is exiting within few minutes. i have copied the logs here for your reference:

clair-scanner | {"Event":"could not determine a valid package from criterions","Level":"warning","Location":"oracle.go:352","Time":"2021-11-24 06:41:08.142465","criterions":"[{openssl is ksplice-based} {Oracle Linux arch is x86_64} {Oracle Linux 8 is installed}]"}
clair-scanner | {"Event":"could not determine a valid package from criterions","Level":"warning","Location":"oracle.go:352","Time":"2021-11-24 06:41:08.142478","criterions":"[{openssl-devel is ksplice-based} {Oracle Linux arch is x86_64} {Oracle Linux 8 is installed}]"}
clair-scanner | {"Event":"could not determine a valid package from criterions","Level":"warning","Location":"oracle.go:352","Time":"2021-11-24 06:41:08.142490","criterions":"[{openssl-libs is ksplice-based} {Oracle Linux arch is x86_64} {Oracle Linux 8 is installed}]"}
clair-scanner | {"Event":"could not determine a valid package from criterions","Level":"warning","Location":"oracle.go:352","Time":"2021-11-24 06:41:08.142505","criterions":"[{openssl-perl is ksplice-based} {Oracle Linux arch is x86_64} {Oracle Linux 8 is installed}]"}
clair-scanner | {"Event":"finished fetching","Level":"info","Location":"updater.go:253","Time":"2021-11-24 06:41:08.788603","updater name":"oracle"}
clair-scanner | {"Event":"Handled HTTP request","Level":"info","Location":"router.go:57","Time":"2021-11-24 06:43:01.153370","elapsed time":2681998,"method":"GET","remote addr":"127.0.0.1:50058","request uri":"/v1/namespaces","status":"200"}
clair-scanner | {"Event":"Handled HTTP request","Level":"info","Location":"router.go:57","Time":"2021-11-24 06:43:23.355409","elapsed time":5560431,"method":"POST","remote addr":"127.0.0.1:50066","request uri":"/v1/layers","status":"201"}
clair-scanner | {"Event":"Handled HTTP request","Level":"info","Location":"router.go:57","Time":"2021-11-24 06:43:23.370504","elapsed time":11169551,"method":"GET","remote addr":"127.0.0.1:50068","request uri":"/v1/layers/singularity-images_latest.sif?features=True\u0026vulnerabilities=True","status":"200"}
clair-scanner | panic: runtime error: slice bounds out of range
clair-scanner |
clair-scanner | goroutine 66 [running]:
clair-scanner | github.com/coreos/clair/ext/vulnsrc/rhel.toFeatureVersions(0xc420f05020, 0x2, 0xc4200a9078, 0x1, 0x1, 0xc4237cf110, 0x1, 0x1, 0x160, 0x83dc80, ...)
clair-scanner | /go/src/github.com/coreos/clair/ext/vulnsrc/rhel/rhel.go:292 +0xaf4
clair-scanner | github.com/coreos/clair/ext/vulnsrc/rhel.parseRHSA(0x7f3a6022b738, 0xc422c2da70, 0xc422c2da70, 0x7f3a6022b738, 0xc422c2da70, 0x88ae6e, 0x4)
clair-scanner | /go/src/github.com/coreos/clair/ext/vulnsrc/rhel/rhel.go:182 +0x1c7
clair-scanner | github.com/coreos/clair/ext/vulnsrc/rhel.(*updater).Update(0xafdf80, 0x8f02c0, 0xc4200ace80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
clair-scanner | /go/src/github.com/coreos/clair/ext/vulnsrc/rhel/rhel.go:145 +0x6f6
clair-scanner | github.com/coreos/clair.fetch.func1(0x8f02c0, 0xc4200ace80, 0xc4200a7bb8, 0xc4200826c0, 0x88b11e, 0x4, 0x8e86e0, 0xafdf80)
clair-scanner | /go/src/github.com/coreos/clair/updater.go:243 +0xa5
clair-scanner | created by github.com/coreos/clair.fetch
clair-scanner | /go/src/github.com/coreos/clair/updater.go:242 +0x19d
clair-scanner exited with code 2

also, i added the "RUN sed -i -e 's/http:/https:/' /etc/apk/repositories" line to Dockerfile as i was getting network connection aborted error during docker build. Addition of this line resolved the error for me.

[root@myvm stools]# docker build -t vanessa/stools-clair .
Sending build context to Docker daemon 37.58MB
Step 1/13 : FROM singularityware/singularity:v3.2.1-slim as base
---> 5288af72c4e3
Step 2/13 : FROM arminc/clair-local-scan:v2.0.8_0ed98e9ead65a51ba53f7cc53fa5e80c92169207 as clair
---> b0a03916f4ec
Step 3/13 : COPY --from=base /usr/local/singularity /usr/local/singularity
---> Using cache
---> f68c1bb478f0
Step 4/13 : RUN apk add --no-cache ca-certificates libseccomp squashfs-tools git
---> Running in d705e3e5573b
fetch http://dl-cdn.alpinelinux.org/alpine/v3.9/main/x86_64/APKINDEX.tar.gz
WARNING: Ignoring http://dl-cdn.alpinelinux.org/alpine/v3.9/main/x86_64/APKINDEX.tar.gz: network connection aborted
fetch http://dl-cdn.alpinelinux.org/alpine/v3.9/community/x86_64/APKINDEX.tar.gz
WARNING: Ignoring http://dl-cdn.alpinelinux.org/alpine/v3.9/community/x86_64/APKINDEX.tar.gz: network connection aborted
ERROR: unsatisfiable constraints:
libseccomp (missing):
required by: world[libseccomp]
squashfs-tools (missing):
required by: world[squashfs-tools]
The command '/bin/sh -c apk add --no-cache ca-certificates libseccomp squashfs-tools git' returned a non-zero code: 2

[vsoch]

@ashwinidr23 I just ran the build locally and had no issue with the network (and did not need the extra command) so I'm not able to reproduce your issue.

[ashwinidr23]

Hello @vsoch
apologies for the delay. I finally managed to get it running although I still see same warnings only it is not crashing now(I have found that it is a known issue with clair scanner. I Would appreciate any suggestions to fix it )

here is the logs:
clair-scanner | {"Event":"could not download mirror list","Level":"error","Location":"amzn.go:180","Time":"2021-12-27 14:55:31.126186","error":"Get http://repo.us-west-2.amazonaws.com/2018.03/updates/x86_64/mirror.list: read tcp 172.17.0.3:44756-\u003e52.218.244.154:80: read: connection reset by peer"}
clair-scanner | {"Event":"an error occured when fetching update","Level":"error","Location":"updater.go:246","Time":"2021-12-27 14:55:31.126310","error":"could not download requested resource","updater name":"amzn1"}
clair-scanner | {"Event":"could not decode RHEL's XML","Level":"error","Location":"rhel.go:158","Time":"2021-12-27 14:55:31.900180","error":"XML syntax error on line 1: invalid character entity \u0026SY\ufffd\ufffd˶ (no semicolon)"}
clair-scanner | {"Event":"an error occured when fetching update","Level":"error","Location":"updater.go:246","Time":"2021-12-27 14:55:31.900248","error":"updater/fetchers: could not parse","updater name":"rhel"}
clair-scanner | {"Event":"could not determine a valid package from criterions","Level":"warning","Location":"oracle.go:352"54.416992","criterions":"[{glibc-langpack-bs is ksplice-based} {Oracle Linux arch is x86_64} {Oracle Linux 8 is installed}]"}

I tested the allow list and I am able to approve selected vulnerabilities. Thank you very much for adding this :)

If I may suggest..
It would be useful to get a summary at the end of scan as to number of vulnerabilities present in a container and whether they are approved or not so it can be used in CI

Ex:
[clair-scanner]# ./clair-scanner_linux_386 --ip alpine:latest
2021/12/27 08:23:34 [INFO] ▶ Start clair-scanner
2021/12/27 08:23:34 [INFO] ▶ Server listening on port 9279
2021/12/27 08:23:34 [INFO] ▶ Analyzing 746e646689cefccc4b07923569a7d6585f9487482f59f80171f1bee5badbb
2021/12/27 08:23:34 [WARN] ▶ Image [alpine:latest] contains 4 total vulnerabilities
2021/12/27 08:23:34 [ERRO] ▶ Image [alpine:latest] contains 4 unapproved vulnerabilities
+------------+-------------------+--------------+-------------------------+-------------------------------------------------------------+
| STATUS | CVE SEVERITY | PACKAGE NAME | PACKAGE VERSION | CVE DESCRIPTION |
+------------+-------------------+--------------+-------------------------+-------------------------------------------------------------+
| Unapproved | Low CVE-2016-9841 | zlib | 1:1.2.8.dfsg-2ubuntu4.1 | inffast.c in zlib 1.2.8 might allow context-dependent |
| | | | | attackers to have unspecified impact by |
| | | | | leveraging improper pointer arithmetic. |
| | | | | http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-9841 |
+------------+-------------------+--------------+-------------------------+-------------------------------------------------------------+

And if there are no unapproved vulnerabilites ,

2021/12/27 09:20:37 [WARN] ▶ Image [alpine:latest] contains 4 total vulnerabilities
2021/12/27 09:20:37 [INFO] ▶ Image [alpine:latest] contains NO unapproved vulnerabilities

Thanks again!

[vsoch]

Awesome that it works! For interaction in CI, have you tried saving a report to programatically parse? E.g.,

stools/stools/clair/__init__.py

Line 60 in 0704228

parser.add_argument(

[ashwinidr23]

i did try using the report feature, but the json file does not have the status of whether the vulnerability is approved or not. for me, it looked easier to parse the output than the report for listing the vulnerabilities.

[vsoch]

Gotcha! I have work this week but I’ll make some time this weekend to test adding that extra summary ability at the end. I’m thinking it would make sense to add a flag for it in case the person running the tool doesn’t want it.

[ashwinidr23]

sure, Thank you!

[vsoch]

@ashwinidr23 I'll need your help to work on this - here is a data structure report that I've output, if you could please show me what you'd expect the output to be for this it would be greatly appreciated. Thanks!

{
    "Layer": {
        "Name": "singularity-images_latest.sif",
        "NamespaceName": "ubuntu:16.04",
        "IndexedByVersion": 3,
        "Features": [
            {
                "Name": "libusb",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "2:0.1.12-28",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "zlib",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "1:1.2.8.dfsg-2ubuntu4.1",
                "Vulnerabilities": [
                    {
                        "Name": "CVE-2016-9843",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-9843",
                        "Severity": "Low",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2017-05-23T04:29Z",
                                    "Score": 7.5,
                                    "Vectors": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 3.9,
                                    "ImpactScore": 5.9,
                                    "Score": 9.8,
                                    "Vectors": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
                                }
                            }
                        },
                        "FixedBy": "1:1.2.8.dfsg-2ubuntu4.3"
                    },
                    {
                        "Name": "CVE-2016-9842",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-9842",
                        "Severity": "Low",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2017-05-23T04:29Z",
                                    "Score": 6.8,
                                    "Vectors": "AV:N/AC:M/Au:N/C:P/I:P/A:P"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 2.8,
                                    "ImpactScore": 5.9,
                                    "Score": 8.8,
                                    "Vectors": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
                                }
                            }
                        },
                        "FixedBy": "1:1.2.8.dfsg-2ubuntu4.3"
                    },
                    {
                        "Name": "CVE-2016-9841",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-9841",
                        "Severity": "Low",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2017-05-23T04:29Z",
                                    "Score": 7.5,
                                    "Vectors": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 3.9,
                                    "ImpactScore": 5.9,
                                    "Score": 9.8,
                                    "Vectors": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
                                }
                            }
                        },
                        "FixedBy": "1:1.2.8.dfsg-2ubuntu4.3"
                    },
                    {
                        "Name": "CVE-2016-9840",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-9840",
                        "Severity": "Low",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2017-05-23T04:29Z",
                                    "Score": 6.8,
                                    "Vectors": "AV:N/AC:M/Au:N/C:P/I:P/A:P"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 2.8,
                                    "ImpactScore": 5.9,
                                    "Score": 8.8,
                                    "Vectors": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
                                }
                            }
                        },
                        "FixedBy": "1:1.2.8.dfsg-2ubuntu4.3"
                    }
                ],
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "apt",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "1.2.32",
                "Vulnerabilities": [
                    {
                        "Name": "CVE-2020-3810",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "Missing input validation in the ar/tar implementations of APT before version 2.1.2 could result in denial of service when processing specially crafted deb files.",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-3810",
                        "Severity": "Medium",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2020-05-15T14:15Z",
                                    "Score": 4.3,
                                    "Vectors": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 1.8,
                                    "ImpactScore": 3.6,
                                    "Score": 5.5,
                                    "Vectors": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
                                }
                            }
                        },
                        "FixedBy": "1.2.32ubuntu0.1"
                    },
                    {
                        "Name": "CVE-2020-27350",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc. This issue affects: apt 1.2.32ubuntu0 versions prior to 1.2.32ubuntu0.2; 1.6.12ubuntu0 versions prior to 1.6.12ubuntu0.2; 2.0.2ubuntu0 versions prior to 2.0.2ubuntu0.2; 2.1.10ubuntu0 versions prior to 2.1.10ubuntu0.1;",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-27350",
                        "Severity": "Medium",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2020-12-10T04:15Z",
                                    "Score": 4.6,
                                    "Vectors": "AV:L/AC:L/Au:N/C:P/I:P/A:P"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 1.5,
                                    "ImpactScore": 3.7,
                                    "Score": 5.7,
                                    "Vectors": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L"
                                }
                            }
                        },
                        "FixedBy": "1.2.32ubuntu0.2"
                    }
                ],
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "systemd",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "229-4ubuntu21.21",
                "Vulnerabilities": [
                    {
                        "Name": "CVE-2020-1712",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-1712",
                        "Severity": "Medium",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2020-03-31T17:15Z",
                                    "Score": 4.6,
                                    "Vectors": "AV:L/AC:L/Au:N/C:P/I:P/A:P"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 1.8,
                                    "ImpactScore": 5.9,
                                    "Score": 7.8,
                                    "Vectors": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
                                }
                            }
                        },
                        "FixedBy": "229-4ubuntu21.27"
                    },
                    {
                        "Name": "CVE-2019-20386",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur.",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-20386",
                        "Severity": "Low",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2020-01-21T06:15Z",
                                    "Score": 2.1,
                                    "Vectors": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 0.9,
                                    "ImpactScore": 1.4,
                                    "Score": 2.4,
                                    "Vectors": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
                                }
                            }
                        },
                        "FixedBy": "229-4ubuntu21.27"
                    },
                    {
                        "Name": "CVE-2018-16888",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable.",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-16888",
                        "Severity": "Low",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2019-01-14T22:29Z",
                                    "Score": 1.9,
                                    "Vectors": "AV:L/AC:M/Au:N/C:N/I:N/A:P"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 1,
                                    "ImpactScore": 3.6,
                                    "Score": 4.7,
                                    "Vectors": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
                                }
                            }
                        },
                        "FixedBy": "229-4ubuntu21.27"
                    }
                ],
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "sysvinit",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "2.88dsf-59.3ubuntu2",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "procps",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "2:3.3.10-4ubuntu2.4",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "glibc",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "2.23-0ubuntu11",
                "Vulnerabilities": [
                    {
                        "Name": "CVE-2017-18269",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "An SSE2-optimized memmove implementation for i386 in sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S in the GNU C Library (aka glibc or libc6) 2.21 through 2.27 does not correctly perform the overlapping memory check if the source memory range spans the middle of the address space, resulting in corrupt data being produced by the copy operation. This may disclose information to context-dependent attackers, or result in a denial of service, or, possibly, code execution.",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-18269",
                        "Severity": "Medium",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2018-05-18T16:29Z",
                                    "Score": 7.5,
                                    "Vectors": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 3.9,
                                    "ImpactScore": 5.9,
                                    "Score": 9.8,
                                    "Vectors": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
                                }
                            }
                        },
                        "FixedBy": "2.23-0ubuntu11.2"
                    },
                    {
                        "Name": "CVE-2018-11237",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper.",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-11237",
                        "Severity": "Medium",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2018-05-18T16:29Z",
                                    "Score": 4.6,
                                    "Vectors": "AV:L/AC:L/Au:N/C:P/I:P/A:P"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 1.8,
                                    "ImpactScore": 5.9,
                                    "Score": 7.8,
                                    "Vectors": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
                                }
                            }
                        },
                        "FixedBy": "2.23-0ubuntu11.2"
                    },
                    {
                        "Name": "CVE-2020-10029",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-10029",
                        "Severity": "Low",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2020-03-04T15:15Z",
                                    "Score": 2.1,
                                    "Vectors": "AV:L/AC:L/Au:N/C:N/I:N/A:P"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 1.8,
                                    "ImpactScore": 3.6,
                                    "Score": 5.5,
                                    "Vectors": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
                                }
                            }
                        },
                        "FixedBy": "2.23-0ubuntu11.2"
                    },
                    {
                        "Name": "CVE-2020-6096",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-6096",
                        "Severity": "Low",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2020-04-01T22:15Z",
                                    "Score": 6.8,
                                    "Vectors": "AV:N/AC:M/Au:N/C:P/I:P/A:P"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 2.2,
                                    "ImpactScore": 5.9,
                                    "Score": 8.1,
                                    "Vectors": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
                                }
                            }
                        },
                        "FixedBy": "2.23-0ubuntu11.3"
                    },
                    {
                        "Name": "CVE-2017-12133",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "Use-after-free vulnerability in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) before 2.26 allows remote attackers to have unspecified impact via vectors related to error path.",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-12133",
                        "Severity": "Low",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2017-09-07T13:29Z",
                                    "Score": 4.3,
                                    "Vectors": "AV:N/AC:M/Au:N/C:N/I:P/A:N"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 2.2,
                                    "ImpactScore": 3.6,
                                    "Score": 5.9,
                                    "Vectors": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
                                }
                            }
                        },
                        "FixedBy": "2.23-0ubuntu11.2"
                    },
                    {
                        "Name": "CVE-2020-1752",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-1752",
                        "Severity": "Low",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2020-04-30T17:15Z",
                                    "Score": 3.7,
                                    "Vectors": "AV:L/AC:H/Au:N/C:P/I:P/A:P"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 1,
                                    "ImpactScore": 5.9,
                                    "Score": 7,
                                    "Vectors": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
                                }
                            }
                        },
                        "FixedBy": "2.23-0ubuntu11.2"
                    },
                    {
                        "Name": "CVE-2020-1751",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Specifically, the backtrace function did not properly check the array bounds when storing the frame address, resulting in a denial of service or potential code execution. The highest threat from this vulnerability is to system availability.",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-1751",
                        "Severity": "Medium",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2020-04-17T19:15Z",
                                    "Score": 5.9,
                                    "Vectors": "AV:L/AC:M/Au:N/C:P/I:P/A:C"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 1,
                                    "ImpactScore": 5.9,
                                    "Score": 7,
                                    "Vectors": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
                                }
                            }
                        },
                        "FixedBy": "2.23-0ubuntu11.2"
                    },
                    {
                        "Name": "CVE-2019-9169",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-9169",
                        "Severity": "Low",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2019-02-26T02:29Z",
                                    "Score": 7.5,
                                    "Vectors": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 3.9,
                                    "ImpactScore": 5.9,
                                    "Score": 9.8,
                                    "Vectors": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
                                }
                            }
                        },
                        "FixedBy": "2.23-0ubuntu11.2"
                    },
                    {
                        "Name": "CVE-2018-6485",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption.",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-6485",
                        "Severity": "Medium",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2018-02-01T14:29Z",
                                    "Score": 7.5,
                                    "Vectors": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 3.9,
                                    "ImpactScore": 5.9,
                                    "Score": 9.8,
                                    "Vectors": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
                                }
                            }
                        },
                        "FixedBy": "2.23-0ubuntu11.2"
                    },
                    {
                        "Name": "CVE-2009-5155",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match.",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2009-5155",
                        "Severity": "Negligible",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2019-02-26T02:29Z",
                                    "Score": 5,
                                    "Vectors": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 3.9,
                                    "ImpactScore": 3.6,
                                    "Score": 7.5,
                                    "Vectors": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                                }
                            }
                        },
                        "FixedBy": "2.23-0ubuntu11.3"
                    },
                    {
                        "Name": "CVE-2018-11236",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-11236",
                        "Severity": "Medium",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2018-05-18T16:29Z",
                                    "Score": 7.5,
                                    "Vectors": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 3.9,
                                    "ImpactScore": 5.9,
                                    "Score": 9.8,
                                    "Vectors": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
                                }
                            }
                        },
                        "FixedBy": "2.23-0ubuntu11.2"
                    },
                    {
                        "Name": "CVE-2019-19126",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-19126",
                        "Severity": "Low",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2019-11-19T22:15Z",
                                    "Score": 2.1,
                                    "Vectors": "AV:L/AC:L/Au:N/C:P/I:N/A:N"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 1.8,
                                    "ImpactScore": 1.4,
                                    "Score": 3.3,
                                    "Vectors": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
                                }
                            }
                        },
                        "FixedBy": "2.23-0ubuntu11.2"
                    }
                ],
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "makedev",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "2.3.1-93ubuntu2~ubuntu16.04.1",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "util-linux",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "2.27.1-6ubuntu3.7",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "lvm2",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "2.02.133-1ubuntu10",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "shadow",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "1:4.2-3.1ubuntu5.4",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "pam",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "1.1.8-3.2ubuntu2.1",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "pcre3",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "2:8.38-3.1",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "findutils",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "4.6.0+git+20160126-2",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "apparmor",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "2.10.95-0ubuntu2.11",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "acl",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "2.2.52-3",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "debianutils",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "4.7",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "tar",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "1.28-2.1ubuntu0.1",
                "Vulnerabilities": [
                    {
                        "Name": "CVE-2018-20482",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root).",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-20482",
                        "Severity": "Low",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2018-12-26T18:29Z",
                                    "Score": 1.9,
                                    "Vectors": "AV:L/AC:M/Au:N/C:N/I:N/A:P"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 1,
                                    "ImpactScore": 3.6,
                                    "Score": 4.7,
                                    "Vectors": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
                                }
                            }
                        },
                        "FixedBy": "1.28-2.1ubuntu0.2"
                    },
                    {
                        "Name": "CVE-2019-9923",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-9923",
                        "Severity": "Low",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2019-03-22T08:29Z",
                                    "Score": 5,
                                    "Vectors": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 3.9,
                                    "ImpactScore": 3.6,
                                    "Score": 7.5,
                                    "Vectors": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                                }
                            }
                        },
                        "FixedBy": "1.28-2.1ubuntu0.2"
                    }
                ],
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "db5.3",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "5.3.28-11ubuntu0.2",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "attr",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "1:2.4.47-2",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "bash",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "4.3-14ubuntu1.3",
                "Vulnerabilities": [
                    {
                        "Name": "CVE-2019-9924",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-9924",
                        "Severity": "Low",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2019-03-22T08:29Z",
                                    "Score": 7.2,
                                    "Vectors": "AV:L/AC:L/Au:N/C:C/I:C/A:C"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 1.8,
                                    "ImpactScore": 5.9,
                                    "Score": 7.8,
                                    "Vectors": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
                                }
                            }
                        },
                        "FixedBy": "4.3-14ubuntu1.4"
                    }
                ],
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "e2fsprogs",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "1.42.13-1ubuntu1",
                "Vulnerabilities": [
                    {
                        "Name": "CVE-2019-5188",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-5188",
                        "Severity": "Medium",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2020-01-08T16:15Z",
                                    "Score": 4.6,
                                    "Vectors": "AV:L/AC:L/Au:N/C:P/I:P/A:P"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 0.8,
                                    "ImpactScore": 5.9,
                                    "Score": 6.7,
                                    "Vectors": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
                                }
                            }
                        },
                        "FixedBy": "1.42.13-1ubuntu1.2"
                    },
                    {
                        "Name": "CVE-2019-5094",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-5094",
                        "Severity": "Medium",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2019-09-24T22:15Z",
                                    "Score": 4.6,
                                    "Vectors": "AV:L/AC:L/Au:N/C:P/I:P/A:P"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 0.8,
                                    "ImpactScore": 5.9,
                                    "Score": 6.7,
                                    "Vectors": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
                                }
                            }
                        },
                        "FixedBy": "1.42.13-1ubuntu1.1"
                    }
                ],
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "sensible-utils",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "0.0.9ubuntu0.16.04.1",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "lsb",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "9.20160110ubuntu0.2",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "libcap2",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "1:2.24-12",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "bzip2",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "1.0.6-8",
                "Vulnerabilities": [
                    {
                        "Name": "CVE-2016-3189",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-3189",
                        "Severity": "Low",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2016-06-30T17:59Z",
                                    "Score": 4.3,
                                    "Vectors": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 2.8,
                                    "ImpactScore": 3.6,
                                    "Score": 6.5,
                                    "Vectors": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
                                }
                            }
                        },
                        "FixedBy": "1.0.6-8ubuntu0.1"
                    },
                    {
                        "Name": "CVE-2019-12900",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-12900",
                        "Severity": "Medium",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2019-06-19T23:15Z",
                                    "Score": 7.5,
                                    "Vectors": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 3.9,
                                    "ImpactScore": 5.9,
                                    "Score": 9.8,
                                    "Vectors": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
                                }
                            }
                        },
                        "FixedBy": "1.0.6-8ubuntu0.2"
                    }
                ],
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "adduser",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "3.113+nmu3ubuntu4",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "base-passwd",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "3.5.39",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "readline6",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "6.3-8ubuntu2",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "libselinux",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "2.4-3build2",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "kmod",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "22-1ubuntu5.2",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "libseccomp",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "2.4.1-0ubuntu0.16.04.2",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "libsepol",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "2.4-2",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "init-system-helpers",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "1.29ubuntu4",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "insserv",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "1.14.0-5ubuntu3",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "cryptsetup",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "2:1.6.6-5ubuntu2.1",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "ustr",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "1.0.4-5",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "cdebconf",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "0.198ubuntu1",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "gzip",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "1.6-4ubuntu1",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "sed",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "4.2.2-7",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "dash",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "0.5.8-2.1ubuntu2",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "gcc-5",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "5.4.0-6ubuntu1~16.04.11",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "mawk",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "1.3.3-17ubuntu2",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "lz4",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "0.0~r131-2ubuntu2",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "diffutils",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "1:3.3-3",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "coreutils",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "8.25-2ubuntu3~16.04",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "ubuntu-keyring",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "2012.05.19",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "grep",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "2.25-1~16.04.1",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "base-files",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "9.4ubuntu4.8",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "libgcrypt20",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "1.6.5-2ubuntu0.5",
                "Vulnerabilities": [
                    {
                        "Name": "CVE-2019-13627",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-13627",
                        "Severity": "Medium",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2019-09-25T15:15Z",
                                    "Score": 2.6,
                                    "Vectors": "AV:L/AC:H/Au:N/C:P/I:P/A:N"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 1,
                                    "ImpactScore": 5.2,
                                    "Score": 6.3,
                                    "Vectors": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
                                }
                            }
                        },
                        "FixedBy": "1.6.5-2ubuntu0.6"
                    }
                ],
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "hostname",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "3.16ubuntu2",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "libsemanage",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "2.3-1build3",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "gnupg",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "1.4.20-1ubuntu3.3",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "ncurses",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "6.0+20160213-1ubuntu1",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "perl",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "5.22.1-9ubuntu0.6",
                "Vulnerabilities": [
                    {
                        "Name": "CVE-2020-10543",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.  An application written in Perl would only be vulnerable to this flaw if it evaluates regular expressions supplied by the attacker. Evaluating regular expressions in this fashion is known to be dangerous since the regular expression engine does not protect against denial of service attacks in this usage scenario.  Additionally, the target system needs a sufficient amount of memory to allocate partial expansions of the nested quantifiers prior to the overflow occurring. This requirement is unlikely to be met on 64bit systems.]",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-10543",
                        "Severity": "Low",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2020-06-05T14:15Z",
                                    "Score": 6.4,
                                    "Vectors": "AV:N/AC:L/Au:N/C:N/I:P/A:P"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 3.9,
                                    "ImpactScore": 4.2,
                                    "Score": 8.2,
                                    "Vectors": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
                                }
                            }
                        },
                        "FixedBy": "5.22.1-9ubuntu0.9"
                    },
                    {
                        "Name": "CVE-2020-10878",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "Perl before 5.30.3 has an integer overflow related to mishandling of a \"PL_regkind[OP(n)] == NOTHING\" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.  An application written in Perl would only be vulnerable to this flaw if it evaluates regular expressions supplied by the attacker. Evaluating regular expressions in this fashion is known to be dangerous since the regular expression engine does not protect against denial of service attacks in this usage scenario.]",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-10878",
                        "Severity": "Low",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2020-06-05T14:15Z",
                                    "Score": 7.5,
                                    "Vectors": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 3.9,
                                    "ImpactScore": 4.7,
                                    "Score": 8.6,
                                    "Vectors": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"
                                }
                            }
                        },
                        "FixedBy": "5.22.1-9ubuntu0.9"
                    },
                    {
                        "Name": "CVE-2020-12723",
                        "NamespaceName": "ubuntu:16.04",
                        "Description": "regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.  An application written in Perl would only be vulnerable to this flaw if it evaluates regular expressions supplied by the attacker. Evaluating regular expressions in this fashion is known to be dangerous since the regular expression engine does not protect against denial of service attacks in this usage scenario.]",
                        "Link": "http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-12723",
                        "Severity": "Low",
                        "Metadata": {
                            "NVD": {
                                "CVSSv2": {
                                    "PublishedDateTime": "2020-06-05T15:15Z",
                                    "Score": 5,
                                    "Vectors": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
                                },
                                "CVSSv3": {
                                    "ExploitabilityScore": 3.9,
                                    "ImpactScore": 3.6,
                                    "Score": 7.5,
                                    "Vectors": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                                }
                            }
                        },
                        "FixedBy": "5.22.1-9ubuntu0.9"
                    }
                ],
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "libgpg-error",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "1.21-2ubuntu1",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "xz-utils",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "5.1.1alpha+20120614-2ubuntu2",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "gccgo-6",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "6.0.1-0ubuntu1",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "debconf",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "1.5.58ubuntu2",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "audit",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "1:2.4.5-1ubuntu2.1",
                "AddedBy": "singularity-images_latest.sif"
            },
            {
                "Name": "dpkg",
                "NamespaceName": "ubuntu:16.04",
                "VersionFormat": "dpkg",
                "Version": "1.18.4ubuntu1.5",
                "AddedBy": "singularity-images_latest.sif"
            }
        ]
    }
}