|
3 | 3 | methods: ["POST"] |
4 | 4 | responses: |
5 | 5 | - status_code: 200 |
6 | | - body: | |
7 | | - {"findings":[{"awsAccountId":"123456789","description":"Findins message","findingArn":"arn:aws:s3:::sample","firstObservedAt":"1.663703546405E9","inspectorScore":1.2,"inspectorScoreDetails":{"adjustedCvss":{"adjustments":[{"metric":"Base","reason":"use Base metric"}],"cvssSource":"scope1","score":8.9,"scoreSource":"scope2","scoringVector":"Attack Vector","version":"v3.1"}},"lastObservedAt":"1.663703546405E9","networkReachabilityDetails":{"networkPath":{"steps":[{"componentId":"02ce3860-3126-42af-8ac7-c2a661134129","componentType":"type"}]},"openPortRange":{"begin":1234,"end":4567},"protocol":"TCP"},"packageVulnerabilityDetails":{"cvss":[{"baseScore":1.1,"scoringVector":"Attack Vector","source":"scope3","version":"v3.1"}],"referenceUrls":["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6111"],"relatedVulnerabilities":["security"],"source":"example","sourceUrl":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6111","vendorCreatedAt":"1.663703546405E9","vendorSeverity":"basic","vendorUpdatedAt":"1.663703546405E9","vulnerabilityId":"123456789","vulnerablePackages":[{"arch":"arch","epoch":123,"filePath":"/example","fixedInVersion":"3","name":"example","packageManager":"BUNDLER","release":"release","sourceLayerHash":"50d858e0985ecc7f60418aaf0cc5ab587f42c2570a884095a9e8ccacd0f6545c","version":"2.0"}]},"remediation":{"recommendation":{"text":"example","Url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6111"}},"resources":[{"details":{"awsEc2Instance":{"iamInstanceProfileArn":"arn:aws:s3:::iam","imageId":"123456789","ipV4Addresses":["89.160.20.128","81.2.69.192"],"ipV6Addresses":["2a02:cf40::"],"keyName":"sample","launchedAt":"1.663703546405E9","platform":"EC2","subnetId":"123456","type":"Instance","vpcId":"3265875"},"awsEcrContainerImage":{"architecture":"arch","author":"example","imageHash":"50d858e0985ecc7f60418aaf0cc5ab587f42c2570a884095a9e8ccacd0f6545d","imageTags":["sample"],"platform":"ECR","pushedAt":"1.663703546405E9","registry":"ecr registry","repositoryName":"sample"}},"id":"12345678","partition":"partition","region":"us-east-1","tags":{"string1":"string1","string2":"string2"},"type":"AWS_EC2_INSTANCE"}],"severity":"INFORMATIONAL","status":"ACTIVE","title":"sample findings","type":"NETWORK_REACHABILITY","updatedAt":"1.663703546405E9"}]} |
| 6 | + body: |- |
| 7 | + {{ minify_json ` |
| 8 | + { |
| 9 | + "findings": [ |
| 10 | + { |
| 11 | + "awsAccountId": "123456789012", |
| 12 | + "description": "The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).", |
| 13 | + "epss": { |
| 14 | + "score": 0.00024 |
| 15 | + }, |
| 16 | + "exploitAvailable": "NO", |
| 17 | + "findingArn": "arn:aws:inspector2:us-east-2:123456789012:finding/fb6294abcdef0123456789abcdef8123", |
| 18 | + "firstObservedAt": 1748539687.919, |
| 19 | + "fixAvailable": "YES", |
| 20 | + "inspectorScore": 6.5, |
| 21 | + "inspectorScoreDetails": { |
| 22 | + "adjustedCvss": { |
| 23 | + "adjustments": [], |
| 24 | + "cvssSource": "NVD", |
| 25 | + "score": 6.5, |
| 26 | + "scoreSource": "NVD", |
| 27 | + "scoringVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L", |
| 28 | + "version": "3.1" |
| 29 | + } |
| 30 | + }, |
| 31 | + "lastObservedAt": 1749165796.162, |
| 32 | + "packageVulnerabilityDetails": { |
| 33 | + "cvss": [ |
| 34 | + { |
| 35 | + "baseScore": 6.5, |
| 36 | + "scoringVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L", |
| 37 | + "source": "NVD", |
| 38 | + "version": "3.1" |
| 39 | + }, |
| 40 | + { |
| 41 | + "baseScore": 6.5, |
| 42 | + "scoringVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L", |
| 43 | + "source": "NVD", |
| 44 | + "version": "3.1" |
| 45 | + } |
| 46 | + ], |
| 47 | + "referenceUrls": [ |
| 48 | + "https://groups.google.com/g/golang-announce/c/ezSKR9vqbqA", |
| 49 | + "https://nvd.nist.gov/vuln/detail/CVE-2025-22872", |
| 50 | + "https://alas.aws.amazon.com/AL2023/ALAS-2025-981.html", |
| 51 | + "https://alas.aws.amazon.com/AL2/ALASDOCKER-2025-064.html", |
| 52 | + "https://alas.aws.amazon.com/AL2023/ALAS-2025-980.html", |
| 53 | + "https://alas.aws.amazon.com/AL2/ALASDOCKER-2025-063.html", |
| 54 | + "https://alas.aws.amazon.com/AL2023/ALAS-2025-979.html", |
| 55 | + "https://alas.aws.amazon.com/cve/json/v1/CVE-2025-22872.json", |
| 56 | + "https://alas.aws.amazon.com/AL2/ALAS-2025-2863.html", |
| 57 | + "https://alas.aws.amazon.com/cve/json/v1/CVE-2025-22872.json" |
| 58 | + ], |
| 59 | + "relatedVulnerabilities": [], |
| 60 | + "source": "NVD", |
| 61 | + "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2025-22872", |
| 62 | + "vendorCreatedAt": 1744827364, |
| 63 | + "vendorSeverity": "MEDIUM", |
| 64 | + "vendorUpdatedAt": 1747437319, |
| 65 | + "vulnerabilityId": "CVE-2025-22872", |
| 66 | + "vulnerablePackages": [ |
| 67 | + { |
| 68 | + "epoch": 0, |
| 69 | + "filePath": "vol-0e47545061282cd35:/p1:opt/cni/bin/aws-cni", |
| 70 | + "fixedInVersion": "0.38.0", |
| 71 | + "name": "golang.org/x/net", |
| 72 | + "packageManager": "GOBINARY", |
| 73 | + "version": "v0.1.0" |
| 74 | + }, |
| 75 | + { |
| 76 | + "epoch": 0, |
| 77 | + "filePath": "vol-0e47545061282cd35:/p1:etc/eks/image-credential-provider/ecr-credential-provider", |
| 78 | + "fixedInVersion": "0.38.0", |
| 79 | + "name": "golang.org/x/net", |
| 80 | + "packageManager": "GOBINARY", |
| 81 | + "version": "v0.30.0" |
| 82 | + }, |
| 83 | + { |
| 84 | + "epoch": 0, |
| 85 | + "filePath": "vol-0e47545061282cd35:/p1:opt/cni/bin/dhcp", |
| 86 | + "fixedInVersion": "0.38.0", |
| 87 | + "name": "golang.org/x/net", |
| 88 | + "packageManager": "GOBINARY", |
| 89 | + "version": "v0.30.0" |
| 90 | + }, |
| 91 | + { |
| 92 | + "epoch": 0, |
| 93 | + "filePath": "vol-0e47545061282cd35:/p1:usr/bin/aws-iam-authenticator", |
| 94 | + "fixedInVersion": "0.38.0", |
| 95 | + "name": "golang.org/x/net", |
| 96 | + "packageManager": "GOBINARY", |
| 97 | + "version": "v0.30.0" |
| 98 | + }, |
| 99 | + { |
| 100 | + "epoch": 0, |
| 101 | + "filePath": "vol-0e47545061282cd35:/p1:usr/bin/kubelet", |
| 102 | + "fixedInVersion": "0.38.0", |
| 103 | + "name": "golang.org/x/net", |
| 104 | + "packageManager": "GOBINARY", |
| 105 | + "version": "v0.30.0" |
| 106 | + }, |
| 107 | + { |
| 108 | + "arch": "X86_64", |
| 109 | + "epoch": 0, |
| 110 | + "fixedInVersion": "0:2.0.5-1.amzn2.0.1", |
| 111 | + "name": "nerdctl", |
| 112 | + "packageManager": "OS", |
| 113 | + "release": "1.amzn2.0.1", |
| 114 | + "remediation": "yum update nerdctl", |
| 115 | + "version": "2.0.4" |
| 116 | + } |
| 117 | + ] |
| 118 | + }, |
| 119 | + "remediation": { |
| 120 | + "recommendation": { |
| 121 | + "text": "None Provided" |
| 122 | + } |
| 123 | + }, |
| 124 | + "resources": [ |
| 125 | + { |
| 126 | + "details": { |
| 127 | + "awsEc2Instance": { |
| 128 | + "iamInstanceProfileArn": "arn:aws:iam::123456789012:instance-profile/eks-0012345a-1234-5678-1234-6c1abcdef012", |
| 129 | + "imageId": "ami-0e0f0123456789abd", |
| 130 | + "ipV4Addresses": [ |
| 131 | + "10.90.1.245", |
| 132 | + "10.90.1.45", |
| 133 | + "10.90.1.168", |
| 134 | + "10.90.1.157", |
| 135 | + "1.128.0.1", |
| 136 | + "10.90.1.103", |
| 137 | + "10.90.1.197", |
| 138 | + "10.90.1.220", |
| 139 | + "10.90.1.86", |
| 140 | + "10.90.1.29", |
| 141 | + "10.90.1.18", |
| 142 | + "10.90.1.181", |
| 143 | + "10.90.1.161", |
| 144 | + "10.90.1.229", |
| 145 | + "10.90.1.108", |
| 146 | + "10.90.1.219", |
| 147 | + "10.90.1.9", |
| 148 | + "10.90.1.106", |
| 149 | + "10.90.1.206" |
| 150 | + ], |
| 151 | + "ipV6Addresses": [], |
| 152 | + "launchedAt": 1748534768, |
| 153 | + "platform": "AMAZON_LINUX_2", |
| 154 | + "subnetId": "subnet-0ababcdefabcdef8b", |
| 155 | + "type": "t3.medium", |
| 156 | + "vpcId": "vpc-04ab0123456789123" |
| 157 | + } |
| 158 | + }, |
| 159 | + "id": "i-0fabcdefabcdef50b", |
| 160 | + "partition": "aws", |
| 161 | + "region": "us-east-2", |
| 162 | + "tags": { |
| 163 | + "aws:autoscaling:groupName": "eks-sei_demo_prod_linux-00c12345-abcd-1234-5678-601234567896", |
| 164 | + "aws:ec2launchtemplate:version": "6", |
| 165 | + "aws:eks:cluster-name": "sei_demo_prod", |
| 166 | + "eks:cluster-name": "sei_demo_prod", |
| 167 | + "eks:nodegroup-name": "sei_demo_prod_linux", |
| 168 | + "k8s.io/cluster-autoscaler/enabled": "true", |
| 169 | + "k8s.io/cluster-autoscaler/sei_demo_prod": "owned", |
| 170 | + "kubernetes.io/cluster/sei_demo_prod": "owned" |
| 171 | + }, |
| 172 | + "type": "AWS_EC2_INSTANCE" |
| 173 | + } |
| 174 | + ], |
| 175 | + "severity": "MEDIUM", |
| 176 | + "status": "ACTIVE", |
| 177 | + "title": "CVE-2025-22872 - golang.org/x/net, golang.org/x/net and 4 more", |
| 178 | + "type": "PACKAGE_VULNERABILITY", |
| 179 | + "updatedAt": 1749165796.162 |
| 180 | + } |
| 181 | + ] |
| 182 | + } |
| 183 | + `}} |
0 commit comments