Packages Vulnerabilities Osv List

a JSON object holding additional information about the vulnerability as defined by the database from which the record was obtained. The meaning of the values within the object is entirely defined by the database. In general, the canonical database for a particular ecosystem should record its information in ecosystem_specific, allowing other aggregator databases to put their own summaries in database_specific. For example, databases that add additional information such as computed CVSS scores for ecosystems that do not provide them could add that information here. Note that this is a single field with key “database_specific”, which itself contains a JSON object with unspecified fields.

A JSON object holding additional information about the vulnerability as defined by the ecosystem for which the record applies. The meaning of the values within the object is entirely defined by the ecosystem. For example, the Go ecosystem includes here information about the affected functions and which modules the packages were found in, along with severity in the Go project-specific severity scale. Note that this is a single field with key “ecosystem_specific”, which itself contains a JSON object with unspecified fields.

The affected object’s ranges field is a JSON array of objects describing the affected ranges of versions. In the range object, the type property is required. It specifies the type of version range being recorded and defines the interpretation of the events object’s introduced, fixed, and any type-specific fields. The ranges object’s events field is a JSON array of objects. Each object describes a single version that either introduces a vulnerability, fixes a vulnerability, describes the last known affected version, or sets an upper limit on the range being described.

array of objects

array of strings

The type of severity being described. The type indicates how the associated score should be interpreted. * `Ubuntu` - An "Ubuntu" severity type indicates that the associated score is a lowercased string representing the Ubuntu priority. If a severity has this type, the associated "score" will be one of "negligible", "low", "medium", "high", or "critical". See https://ubuntu.com/security/cves/about#priority for more information. * `CVSS_V2` - A "CVSS_V2" severity type indicates that the associated score is a CVSS vector string using a version of the Common Vulnerability Scoring System notation that is == 2.0 (e.g."AV:L/AC:M/Au:N/C:N/I:P/A:C"). * `CVSS_V3` - A "CVSS_V3" severity type indicates that the associated score is a CVSS vector string using a version of the Common Vulnerability Scoring System notation that is >= 3.0 and < 4.0 (e.g."CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N"). * `CVSS_V4` - A "CVSS_V4" severity type indicates that the associated score is a CVSS vector string using a version of the Common Vulnerability Scoring System notation that is >= 4.0 and < 5.0 (e.g. "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N").

The score of the vulnerability. This should be interpreted differently depending on the severity type.

A pre-calculated numerical score (added as a convenience by Cloudsmith) for CVSS severity types, based on the CVSS vector provided by OSV. For the UBUNTU severity type, this field is null.

Parsed CVSS components broken down by category for display. Only populated for CVSS severity types. Returns a dictionary with: version (CVSS version), vector (original vector string), severity_label (e.g., 'Critical', 'High', 'Medium', 'Low', 'None'), and groups (metrics organized by category).