changedOutput schema / oneOf
Previous value: -[
- {
- "additionalProperties": {},
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "affected_packages": {
- "additionalProperties": false,
- "properties": {
- "api_row_limit": {
- "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "returned": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Rows the API returned; null when the section was not read."
- }
- },
- "required": [
- "returned",
- "api_row_limit"
- ],
- "type": "object"
- },
- "exploits": {
- "additionalProperties": false,
- "properties": {
- "api_row_limit": {
- "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "returned": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Rows the API returned; null when the section was not read."
- }
- },
- "required": [
- "returned",
- "api_row_limit"
- ],
- "type": "object"
- },
- "fixed_versions": {
- "additionalProperties": false,
- "properties": {
- "api_row_limit": {
- "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "returned": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Rows the API returned; null when the section was not read."
- }
- },
- "required": [
- "returned",
- "api_row_limit"
- ],
- "type": "object"
- },
- "sections_failed": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The sections the API says it could not read (its failed_sections), left out of data; null when the answer does not say (an API older than failed_sections), so an empty list may be an unread section."
- },
- "sections_left_out": {
- "description": "The sections of the answer this tool does not relay.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "sections_relayed": {
- "description": "The sections of the answer relayed in data.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "timeline": {
- "additionalProperties": false,
- "properties": {
- "api_row_limit": {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "relayed": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The newest rows relayed in data.timeline."
- },
- "returned": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ]
- }
- },
- "required": [
- "returned",
- "relayed",
- "api_row_limit"
- ],
- "type": "object"
- }
- },
- "required": [
- "sections_relayed",
- "sections_failed",
- "sections_left_out",
- "exploits",
- "affected_packages",
- "fixed_versions",
- "timeline"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ],
- "description": "What the answer covers; null where the answer says nothing about it."
- },
- "data": {
- "additionalProperties": false,
- "properties": {
- "affected_packages": {
- "items": {
- "additionalProperties": {},
- "properties": {
- "dependents_count": {
- "type": [
- "number",
- "null"
- ]
- },
- "ecosystem": {
- "type": [
- "string",
- "null"
- ]
- },
- "fixed_branches": {
- "anyOf": [
- {
- "items": {
- "additionalProperties": {},
- "properties": {
- "advisory_id": {
- "description": "The OSV record that published the range (GHSA-…, PYSEC-…, CVE-…); null on a row loaded before it was stored.",
- "type": [
- "string",
- "null"
- ]
- },
- "fixed": {
- "description": "The range's fix: the first version past it. null where no fix is on record.",
- "type": [
- "string",
- "null"
- ]
- },
- "introduced": {
- "description": "The range's lower bound, inclusive; \"0\" is the first version.",
- "type": [
- "string",
- "null"
- ]
- },
- "last_affected": {
- "description": "The range's last affected version, inclusive, where no fix is on record; never a fix.",
- "type": [
- "string",
- "null"
- ]
- },
- "source": {
- "description": "The loader's label for that record (osv_bulk, osv); null on a row loaded before it was stored.",
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "fixed_branches lists each affected range of the package on record: introduced, and fixed (the range's fix) or last_affected (its last affected version, where no fix is on record), each null when absent, with advisory_id (the OSV record that published the range) and source (the loader's label for that record), both null on a row loaded before they were stored. Ranges with an advisory_id are in the order their record lists them (records in id order); ranges without one are oldest first. To pick the range for an installed version, compare in the ecosystem's version order (release numbers part by part, as numbers: 2.4 is below 2.13.0): the version is in a range when it is at or above introduced (\"0\" is the first version) and below fixed, or at or below last_affected; its fix is that range's fixed, or, while another range still holds that, the other range's fixed (none past a range without one); a version in no range is outside every range on record. fixed_branches is null where the package's ranges were never loaded, and [] where no version range is on record (the advisory gives none, only commit ranges, or more than are stored), which is not a finding that no fix exists: fixed_version can still name one. fixed_version is one range's fix, kept for compatibility (one per package: the range the loader kept, the advisory's last as a rule), not the fix for every affected range: for CVE-2021-44228, its advisory gives log4j-core three ranges, and fixed_version 2.12.2 is the fix for the one from 2.4, while the range holding 2.14.1 (from 2.13.0) is fixed in 2.15.0."
- },
- "fixed_version": {
- "description": "One range's fix, kept for compatibility; not the fix for every affected range: read fixed_branches.",
- "type": [
- "string",
- "null"
- ]
- },
- "package_name": {
- "type": [
- "string",
- "null"
- ]
- },
- "source": {
- "type": [
- "string",
- "null"
- ]
- },
- "version_range": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- "cve_id": {
- "type": "string"
- },
- "cwes": {
- "items": {
- "additionalProperties": {},
- "properties": {
- "cwe_id": {
- "type": [
- "string",
- "null"
- ]
- },
- "name": {
- "type": [
- "string",
- "null"
- ]
- },
- "source": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- "exploits": {
- "items": {
- "additionalProperties": {},
- "properties": {
- "description": {
- "type": [
- "string",
- "null"
- ]
- },
- "eg_first_seen_at": {
- "description": "When EchelonGraph first recorded the reference, as a UTC timestamp: a date of EchelonGraph's, not the source's.",
- "type": "string"
- },
- "first_seen_at": {
- "description": "Deprecated: the same value as source_published_at, null when that is.",
- "type": [
- "string",
- "null"
- ]
- },
- "kind": {
- "description": "metasploit, exploit_db, nuclei_template, github_poc or vendor_poc.",
- "type": [
- "string",
- "null"
- ]
- },
- "source_name": {
- "type": [
- "string",
- "null"
- ]
- },
- "source_published_at": {
- "description": "The source's own date for the reference (Exploit-DB's date_published, a GitHub proof-of-concept repository's created_at, or the first commit of a nuclei template or Metasploit module where EchelonGraph derived it from the source's git history); null where the source gives none, and EchelonGraph supplies no stand-in date.",
- "type": [
- "string",
- "null"
- ]
- },
- "source_url": {
- "type": [
- "string",
- "null"
- ]
- },
- "verified_status": {
- "description": "verified_status is the label stored with each reference: verified for a Metasploit module, for an Exploit-DB entry Exploit-DB marks verified, and for curated seed rows marked so; reported for a public artefact nothing has confirmed works (nuclei templates, GitHub proofs of concept, unverified Exploit-DB entries); unconfirmed where a curated row says so. It is a label from the source, not a guarantee that the exploit works against a given system.",
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- "exploits_by_kind": {
- "additionalProperties": {
- "type": "number"
- },
- "propertyNames": {
- "type": "string"
- },
- "type": "object"
- },
- "exploits_by_status": {
- "additionalProperties": {
- "type": "number"
- },
- "propertyNames": {
- "type": "string"
- },
- "type": "object"
- },
- "exploits_capped": {
- "description": "true: exploits lists fewer references than exploits_total.",
- "type": "boolean"
- },
- "exploits_total": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Every exploit reference on record for the CVE, not only those listed in exploits."
- },
- "fixed_versions": {
- "items": {
- "additionalProperties": {},
- "properties": {
- "ecosystem": {
- "type": [
- "string",
- "null"
- ]
- },
- "fixed_version": {
- "type": [
- "string",
- "null"
- ]
- },
- "package_name": {
- "type": [
- "string",
- "null"
- ]
- },
- "source": {
- "type": [
- "string",
- "null"
- ]
- },
- "vulnerable_range": {
- "type": [
- "string",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- "timeline": {
- "items": {
- "additionalProperties": {},
- "properties": {
- "enriched_at": {
- "type": [
- "string",
- "null"
- ]
- },
- "enrichment_kind": {
- "type": [
- "string",
- "null"
- ]
- },
- "fields_changed": {},
- "score_delta": {
- "type": [
- "number",
- "null"
- ]
- }
- },
- "type": "object"
- },
- "type": "array"
- },
- "timeline_count_30d": {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "timeline_count_7d": {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "timeline_total": {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- }
- },
- "required": [
- "cve_id"
- ],
- "type": "object"
- },
- "data_truncated": {
- "description": "false: data is the answer whole. true: the structured result would pass 30,000 characters of JSON with data whole, so data is cut (DATA CUT): the entries of some of its lists keep only some of their fields, or the lists only some of their entries, truncated gives each, and no string is shortened. The same call with full: true returns data whole.",
- "type": "boolean"
- },
- "freshness": {
- "description": "The producing radar's last completed check (last_run_at), where the API serves one.",
- "type": "null"
- },
- "measured_at": {
- "anyOf": [
- {
- "description": "An RFC 3339 instant.",
- "type": "string"
- },
- {
- "type": "null"
- }
- ],
- "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
- },
- "method": {
- "description": "How the numbers were produced.",
- "type": "string"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
- "enum": [
- "measured",
- "not_assessed"
- ],
- "type": "string"
- },
- "truncated": {
- "additionalProperties": {
- "additionalProperties": false,
- "properties": {
- "returned": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- },
- "thinned": {
- "const": true,
- "type": "boolean"
- },
- "total": {
- "maximum": 9007199254740991,
- "minimum": 0,
- "type": "integer"
- }
- },
- "required": [
- "total",
- "returned"
- ],
- "type": "object"
- },
- "description": "Present when data_truncated is true: each list of data that was cut, by its path in data (a dot between the names of an object and a list inside it), with total, its entries in the answer, returned, the entries data holds, and thinned, true when each of them keeps only some of its fields.",
- "propertyNames": {
- "type": "string"
- },
- "type": "object"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "data_truncated",
- "data"
- ],
- "type": "object"
- },
- {
- "additionalProperties": false,
- "properties": {
- "coverage": {
- "anyOf": [
- {
- "additionalProperties": false,
- "properties": {
- "affected_packages": {
- "additionalProperties": false,
- "properties": {
- "api_row_limit": {
- "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "returned": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Rows the API returned; null when the section was not read."
- }
- },
- "required": [
- "returned",
- "api_row_limit"
- ],
- "type": "object"
- },
- "exploits": {
- "additionalProperties": false,
- "properties": {
- "api_row_limit": {
- "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "returned": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Rows the API returned; null when the section was not read."
- }
- },
- "required": [
- "returned",
- "api_row_limit"
- ],
- "type": "object"
- },
- "fixed_versions": {
- "additionalProperties": false,
- "properties": {
- "api_row_limit": {
- "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "returned": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "Rows the API returned; null when the section was not read."
- }
- },
- "required": [
- "returned",
- "api_row_limit"
- ],
- "type": "object"
- },
- "sections_failed": {
- "anyOf": [
- {
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- {
- "type": "null"
- }
- ],
- "description": "The sections the API says it could not read (its failed_sections), left out of data; null when the answer does not say (an API older than failed_sections), so an empty list may be an unread section."
- },
- "sections_left_out": {
- "description": "The sections of the answer this tool does not relay.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "sections_relayed": {
- "description": "The sections of the answer relayed in data.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "timeline": {
- "additionalProperties": false,
- "properties": {
- "api_row_limit": {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- "relayed": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The newest rows relayed in data.timeline."
- },
- "returned": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ]
- }
- },
- "required": [
- "returned",
- "relayed",
- "api_row_limit"
- ],
- "type": "object"
- }
- },
- "required": [
- "sections_relayed",
- "sections_failed",
- "sections_left_out",
- "exploits",
- "affected_packages",
- "fixed_versions",
- "timeline"
- ],
- "type": "object"
- },
- {
- "type": "null"
- }
- ]
- },
- "error": {
- "additionalProperties": false,
- "properties": {
- "kind": {
- "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
- "enum": [
- "network",
- "timeout",
- "http",
- "not_json",
- "not_object",
- "invalid_input",
- "internal",
- "unexpected_shape",
- "radars"
- ],
- "type": "string"
- },
- "message": {
- "description": "The cause: the API's own message, or what went wrong.",
- "type": "string"
- },
- "path": {
- "description": "The API path requested, when a request was made.",
- "type": [
- "string",
- "null"
- ]
- },
- "status": {
- "anyOf": [
- {
- "maximum": 9007199254740991,
- "minimum": -9007199254740991,
- "type": "integer"
- },
- {
- "type": "null"
- }
- ],
- "description": "The HTTP status, when the API answered one."
- }
- },
- "required": [
- "kind",
- "path",
- "status",
- "message"
- ],
- "type": "object"
- },
- "freshness": {
- "type": "null"
- },
- "measured_at": {
- "type": "null"
- },
- "method": {
- "type": "null"
- },
- "notes": {
- "description": "Caveats, one sentence each.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "state": {
- "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
- "enum": [
- "failed",
- "invalid_input"
- ],
- "type": "string"
- }
- },
- "required": [
- "state",
- "measured_at",
- "method",
- "coverage",
- "freshness",
- "notes",
- "error"
- ],
- "type": "object"
- }
-]New value: +[
+ {
+ "additionalProperties": {},
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "properties": {
+ "affected_packages": {
+ "additionalProperties": {},
+ "properties": {
+ "api_row_limit": {
+ "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "returned": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Rows the API returned; null when the section was not read."
+ }
+ },
+ "required": [
+ "returned",
+ "api_row_limit"
+ ],
+ "type": "object"
+ },
+ "exploits": {
+ "additionalProperties": {},
+ "properties": {
+ "api_row_limit": {
+ "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "returned": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Rows the API returned; null when the section was not read."
+ }
+ },
+ "required": [
+ "returned",
+ "api_row_limit"
+ ],
+ "type": "object"
+ },
+ "fixed_versions": {
+ "additionalProperties": {},
+ "properties": {
+ "api_row_limit": {
+ "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "returned": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Rows the API returned; null when the section was not read."
+ }
+ },
+ "required": [
+ "returned",
+ "api_row_limit"
+ ],
+ "type": "object"
+ },
+ "sections_failed": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The sections the API says it could not read (its failed_sections), left out of data; null when the answer does not say (an API older than failed_sections), so an empty list may be an unread section."
+ },
+ "sections_left_out": {
+ "description": "The sections of the answer this tool does not relay.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "sections_relayed": {
+ "description": "The sections of the answer relayed in data.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "timeline": {
+ "additionalProperties": {},
+ "properties": {
+ "api_row_limit": {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "relayed": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The newest rows relayed in data.timeline."
+ },
+ "returned": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "returned",
+ "relayed",
+ "api_row_limit"
+ ],
+ "type": "object"
+ }
+ },
+ "required": [
+ "sections_relayed",
+ "sections_failed",
+ "sections_left_out",
+ "exploits",
+ "affected_packages",
+ "fixed_versions",
+ "timeline"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "What the answer covers; null where the answer says nothing about it."
+ },
+ "data": {
+ "additionalProperties": {},
+ "properties": {
+ "affected_packages": {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "dependents_count": {
+ "type": [
+ "number",
+ "null"
+ ]
+ },
+ "ecosystem": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "fixed_branches": {
+ "anyOf": [
+ {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "advisory_id": {
+ "description": "The OSV record that published the range (GHSA-…, PYSEC-…, CVE-…); null on a row loaded before it was stored.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "fixed": {
+ "description": "The range's fix: the first version past it. null where no fix is on record.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "introduced": {
+ "description": "The range's lower bound, inclusive; \"0\" is the first version.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "last_affected": {
+ "description": "The range's last affected version, inclusive, where no fix is on record; never a fix.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "source": {
+ "description": "The loader's label for that record (osv_bulk, osv); null on a row loaded before it was stored.",
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "fixed_branches lists each affected range of the package on record: introduced, and fixed (the range's fix) or last_affected (its last affected version, where no fix is on record), each null when absent, with advisory_id (the OSV record that published the range) and source (the loader's label for that record), both null on a row loaded before they were stored. Ranges with an advisory_id are in the order their record lists them (records in id order); ranges without one are oldest first. To pick the range for an installed version, compare in the ecosystem's version order (release numbers part by part, as numbers: 2.4 is below 2.13.0): the version is in a range when it is at or above introduced (\"0\" is the first version) and below fixed, or at or below last_affected; its fix is that range's fixed, or, while another range still holds that, the other range's fixed (none past a range without one); a version in no range is outside every range on record. fixed_branches is null where the package's ranges were never loaded, and [] where no version range is on record (the advisory gives none, only commit ranges, or more than are stored), which is not a finding that no fix exists: fixed_version can still name one. fixed_version is one range's fix, kept for compatibility (one per package: the range the loader kept, the advisory's last as a rule), not the fix for every affected range: for CVE-2021-44228, its advisory gives log4j-core three ranges, and fixed_version 2.12.2 is the fix for the one from 2.4, while the range holding 2.14.1 (from 2.13.0) is fixed in 2.15.0."
+ },
+ "fixed_version": {
+ "description": "One range's fix, kept for compatibility; not the fix for every affected range: read fixed_branches.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "package_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "source": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "version_range": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "cve_id": {
+ "type": "string"
+ },
+ "cwes": {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "cwe_id": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "source": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "exploits": {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "description": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "eg_first_seen_at": {
+ "description": "When EchelonGraph first recorded the reference, as a UTC timestamp: a date of EchelonGraph's, not the source's.",
+ "type": "string"
+ },
+ "first_seen_at": {
+ "description": "Deprecated: the same value as source_published_at, null when that is.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "kind": {
+ "description": "Exploit code: metasploit, exploit_db, github_poc or vendor_poc. A detection check, which checks whether a system is affected and is not necessarily exploit code: nuclei_template (a Nuclei detection template) or github_checker (a GitHub repository named or described as a checker or scanner). A kind not named here is one this server does not classify: the note counts it as neither.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "source_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "source_published_at": {
+ "description": "The source's own date for the reference (Exploit-DB's date_published, a GitHub proof-of-concept repository's created_at, or the first commit of a nuclei template or Metasploit module where EchelonGraph derived it from the source's git history); null where the source gives none, and EchelonGraph supplies no stand-in date.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "source_url": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "verified_status": {
+ "description": "verified_status is the label stored with each reference: verified for a Metasploit module, for an Exploit-DB entry Exploit-DB marks verified, and for curated seed rows marked so; reported for a public artefact nothing has confirmed works (nuclei templates, GitHub proofs of concept and checker repositories, unverified Exploit-DB entries); unconfirmed where a curated row says so. It is a label from the source, not a guarantee that the exploit works against a given system.",
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "exploits_by_kind": {
+ "additionalProperties": {
+ "type": "number"
+ },
+ "description": "Every reference on record counted by kind (the values of each exploit's kind), past the 10 listed; the counts under nuclei_template and github_checker are detection checks, not exploit code, those under metasploit, exploit_db, github_poc and vendor_poc are exploit code, and those under any other kind are of a kind this server does not classify, counted as neither.",
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ },
+ "exploits_by_status": {
+ "additionalProperties": {
+ "type": "number"
+ },
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ },
+ "exploits_capped": {
+ "description": "true: exploits lists fewer references than exploits_total.",
+ "type": "boolean"
+ },
+ "exploits_total": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Every exploit reference on record for the CVE, not only those listed in exploits."
+ },
+ "fixed_versions": {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "ecosystem": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "fixed_version": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "package_name": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "source": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "vulnerable_range": {
+ "type": [
+ "string",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "timeline": {
+ "items": {
+ "additionalProperties": {},
+ "properties": {
+ "enriched_at": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "enrichment_kind": {
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "fields_changed": {},
+ "score_delta": {
+ "type": [
+ "number",
+ "null"
+ ]
+ }
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "timeline_count_30d": {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "timeline_count_7d": {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "timeline_total": {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "cve_id"
+ ],
+ "type": "object"
+ },
+ "data_truncated": {
+ "description": "false: data is the answer whole. true: the structured result would pass 30,000 characters of JSON with data whole, so data is cut (DATA CUT): the entries of some of its lists keep only some of their fields, or the lists only some of their entries, truncated gives each, and no string is shortened. The same call with full: true returns data whole.",
+ "type": "boolean"
+ },
+ "freshness": {
+ "anyOf": [
+ {
+ "additionalProperties": {},
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The producing radar's last completed check (last_run_at), where the API serves one."
+ },
+ "measured_at": {
+ "anyOf": [
+ {
+ "description": "An RFC 3339 instant.",
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "When the underlying observation was made, as the API states it; null when the answer does not say or holds no observation."
+ },
+ "method": {
+ "description": "How the numbers were produced.",
+ "type": "string"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "measured: a measurement of what was asked; an exposure count is measured only with measured_at and method. not_assessed: the answer holds no dated measurement of what was asked, so no count in it is presented as one; it can still relay a count, as what the source holds on record, undated, and its notes (and exposure_state, where the result carries it) say what each count is.",
+ "enum": [
+ "measured",
+ "not_assessed"
+ ],
+ "type": "string"
+ },
+ "truncated": {
+ "additionalProperties": {
+ "additionalProperties": {},
+ "properties": {
+ "returned": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ },
+ "thinned": {
+ "const": true,
+ "type": "boolean"
+ },
+ "total": {
+ "maximum": 9007199254740991,
+ "minimum": 0,
+ "type": "integer"
+ }
+ },
+ "required": [
+ "total",
+ "returned"
+ ],
+ "type": "object"
+ },
+ "description": "Present when data_truncated is true: each list of data that was cut, by its path in data (a dot between the names of an object and a list inside it), with total, its entries in the answer, returned, the entries data holds, and thinned, true when each of them keeps only some of its fields.",
+ "propertyNames": {
+ "type": "string"
+ },
+ "type": "object"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "data_truncated",
+ "data"
+ ],
+ "type": "object"
+ },
+ {
+ "additionalProperties": false,
+ "properties": {
+ "coverage": {
+ "anyOf": [
+ {
+ "additionalProperties": false,
+ "properties": {
+ "affected_packages": {
+ "additionalProperties": false,
+ "properties": {
+ "api_row_limit": {
+ "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "returned": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Rows the API returned; null when the section was not read."
+ }
+ },
+ "required": [
+ "returned",
+ "api_row_limit"
+ ],
+ "type": "object"
+ },
+ "exploits": {
+ "additionalProperties": false,
+ "properties": {
+ "api_row_limit": {
+ "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "returned": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Rows the API returned; null when the section was not read."
+ }
+ },
+ "required": [
+ "returned",
+ "api_row_limit"
+ ],
+ "type": "object"
+ },
+ "fixed_versions": {
+ "additionalProperties": false,
+ "properties": {
+ "api_row_limit": {
+ "description": "The most rows the API returns for this list per CVE: a list this long may be cut.",
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "returned": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "Rows the API returned; null when the section was not read."
+ }
+ },
+ "required": [
+ "returned",
+ "api_row_limit"
+ ],
+ "type": "object"
+ },
+ "sections_failed": {
+ "anyOf": [
+ {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The sections the API says it could not read (its failed_sections), left out of data; null when the answer does not say (an API older than failed_sections), so an empty list may be an unread section."
+ },
+ "sections_left_out": {
+ "description": "The sections of the answer this tool does not relay.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "sections_relayed": {
+ "description": "The sections of the answer relayed in data.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "timeline": {
+ "additionalProperties": false,
+ "properties": {
+ "api_row_limit": {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ "relayed": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The newest rows relayed in data.timeline."
+ },
+ "returned": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ }
+ },
+ "required": [
+ "returned",
+ "relayed",
+ "api_row_limit"
+ ],
+ "type": "object"
+ }
+ },
+ "required": [
+ "sections_relayed",
+ "sections_failed",
+ "sections_left_out",
+ "exploits",
+ "affected_packages",
+ "fixed_versions",
+ "timeline"
+ ],
+ "type": "object"
+ },
+ {
+ "type": "null"
+ }
+ ]
+ },
+ "error": {
+ "additionalProperties": false,
+ "properties": {
+ "kind": {
+ "description": "What failed: the request (network, timeout), the answer (http, not_json, not_object, unexpected_shape), the input, or this server.",
+ "enum": [
+ "network",
+ "timeout",
+ "http",
+ "not_json",
+ "not_object",
+ "invalid_input",
+ "internal",
+ "unexpected_shape",
+ "radars"
+ ],
+ "type": "string"
+ },
+ "message": {
+ "description": "The cause: the API's own message, or what went wrong.",
+ "type": "string"
+ },
+ "path": {
+ "description": "The API path requested, when a request was made.",
+ "type": [
+ "string",
+ "null"
+ ]
+ },
+ "status": {
+ "anyOf": [
+ {
+ "maximum": 9007199254740991,
+ "minimum": -9007199254740991,
+ "type": "integer"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "description": "The HTTP status, when the API answered one."
+ }
+ },
+ "required": [
+ "kind",
+ "path",
+ "status",
+ "message"
+ ],
+ "type": "object"
+ },
+ "freshness": {
+ "type": "null"
+ },
+ "measured_at": {
+ "type": "null"
+ },
+ "method": {
+ "type": "null"
+ },
+ "notes": {
+ "description": "Caveats, one sentence each.",
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ },
+ "state": {
+ "description": "failed: the lookup did not complete. invalid_input: the input was refused, so nothing was looked up. Neither is a finding.",
+ "enum": [
+ "failed",
+ "invalid_input"
+ ],
+ "type": "string"
+ }
+ },
+ "required": [
+ "state",
+ "measured_at",
+ "method",
+ "coverage",
+ "freshness",
+ "notes",
+ "error"
+ ],
+ "type": "object"
+ }
+]