openapi: 3.2.0
info:
  version: 1.0.0
  title: Eclipse Foundation Info CVE API
  description: Access information on the Eclipse Foundation, such as trademarks, councils, and board members.
  license:
    name: Eclipse Public License - 2.0
    url: https://www.eclipse.org/legal/epl-2.0/
  contact:
    url: https://gitlab.eclipse.org/eclipsefdn/it/api/eclipsefdn-info-api/-/issues
servers:
- url: https://api.eclipse.org/foundation/info
  description: Production endpoint for the Eclipse Foundation information
tags:
- name: CVE
paths:
  /cve:
    get:
      tags:
      - CVE
      summary: CVE List
      description: Fetches all public CVE data.
      operationId: CveList
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/cves'
        '500':
          description: Error while retrieving data
  /cve/{id}:
    parameters:
    - name: id
      in: path
      description: The id of the CVE to retrieve
      required: true
      schema:
        type: string
    get:
      tags:
      - CVE
      summary: CVE
      description: Returns a CVE entry that has a matching id
      operationId: Cve
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/cve'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Error while retrieving data
  /cve/rss.xml:
    get:
      tags:
      - CVE
      summary: CVE RSS feed
      description: Returns an RSS feed for the known and public vulnerabilities
      operationId: getCveRSSFeed
      responses:
        '200':
          description: Success
          content:
            application/xml:
              example: "<rdf:RDF\n    xmlns:rdf=\"http://www.w3.org/1999/02/22-rdf-syntax-ns#\"\n    xmlns=\"http://purl.org/rss/1.0/\"\n    xmlns:dc=\"http://purl.org/dc/elements/1.1/\">\n    <channel rdf:about=\"https://eclipse.org/security/known/rss.xml\">\n        <title>Eclipse Foundation Project CVE database</title>\n        <link>https://eclipse.org/security/known/rss.xml</link>\n        <description>Disclosed CVE records pertaining to Eclipse Foundation projects.</description>\n        <items>\n            <rdf:Seq>\n                <rdf:li />\n                <rdf:li />\n                <rdf:li />\n            </rdf:Seq>\n        </items>\n        <dc:creator>Eclipse Foundation WebDev</dc:creator>\n        <dc:date>2024-03-28T19:45:02Z</dc:date>\n        <dc:language>en-gb</dc:language>\n    </channel>\n    <item rdf:about=\"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7649\">\n        <title>CVE-2017-7649</title>\n        <link>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7649</link>\n        <description>The network enabled distribution of Kura before 2.1.0 takes control over the device's firewall setup but does not allow IPv6 firewall rules to be configured. Still the Equinox console port 5002 is left open, allowing to log into Kura without any user credentials over unencrypted telnet and executing commands using the Equinox \"exec\" command. As the process is running as \"root\" full control over the device can be acquired. IPv6 is also left in auto-configuration mode, accepting router advertisements automatically and assigns a MAC address based IPv6 address.</description>\n        <dc:date>2017-04-14T04:00:00Z</dc:date>\n    </item>\n    <item rdf:about=\"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7650\">\n        <title>CVE-2017-7650</title>\n        <link>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7650</link>\n        <description>In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '#' or '+'. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to. The same issue may be present in third party authentication/access control plugins for Mosquitto.</description>\n        <dc:date>2017-05-17T04:00:00Z</dc:date>\n    </item>\n    <item rdf:about=\"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7651\">\n        <title>CVE-2017-7651</title>\n        <link>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7651</link>\n        <description>In Eclipse Mosquitto 1.4.14, a user can shutdown the Mosquitto server simply by filling the RAM memory with a lot of connections with large payload. This can be done without authentications if occur in connection phase of MQTT protocol.</description>\n        <dc:date>2018-02-27T05:00:00Z</dc:date>\n    </item>\n</rdf:RDF>\n"
        '500':
          description: Error while retrieving data
components:
  schemas:
    cves:
      type: array
      items:
        $ref: '#/components/schemas/cve'
      example:
      - id: CVE-2020-12345
        date_published: '2020-03-17'
        project: eclipse.platform
        request_link: https://bugs.eclipse.org/bugs/show_bug.cgi?id=12345
        cve_pull_request: https://github.com/CVEProject/cvelist/pull/1111
        status: PUBLIC
        summary: This is the summary of the horrific security flaw that we fixed
        cvss: 9.9
      - id: CVE-2022-54321
        date_published: '2022-06-01'
        project: technology.dash
        request_link: https://bugs.eclipse.org/bugs/show_bug.cgi?id=54321
        cve_pull_request: ''
        status: PUBLIC
        summary: This is the summary of the minor vulnerablity
        cvss: 2
    cve:
      type: object
      additionalProperties: false
      required:
      - id
      - date_published
      - project
      - request_link
      - cve_pull_request
      - live_link
      - status
      properties:
        id:
          type: string
          description: CVE id containing year
        date_published:
          type: string
          description: The date of the report
        project:
          type: string
          description: The project where the vulerability exists
        request_link:
          type: string
          description: Link to the request where the vulnerability was tracked
        cve_pull_request:
          type: string
          description: Link to pull request that includes the vulnerability
        live_link:
          type: string
          description: Link to the cve.mitre.org page for the vulnerability
        status:
          type: string
          description: The current status of the vulerability (eg, PUBLIC, PRIVATE, CANCELED)
        summary:
          oneOf:
          - type: object
          - type: 'null'
          properties:
            content:
              type: string
              description: The summary of the vulnerablility pulled from the CVE details source
            source:
              type: string
              description: The URL of the pulled summary data
        cvss:
          oneOf:
          - type: number
          - type: 'null'
          description: The CVSS score pulled from the CVE details source
      example:
        id: CVE-2020-12345
        date_published: '2020-03-17'
        project: eclipse.platform
        request_link: https://bugs.eclipse.org/bugs/show_bug.cgi?id=12345
        cve_pull_request: https://github.com/CVEProject/cvelist/pull/1111
        status: PUBLIC
        summary: This is the summary of the horrific security flaw that we fixed
        cvss: 9.9
    Error:
      type: object
      additionalProperties: false
      required:
      - status_code
      - message
      properties:
        status_code:
          type: integer
          description: HTTP response code
        message:
          type: string
          description: Message containing error information
        url:
          type:
          - string
          - 'null'
          description: The URL
        friendly_message:
          type:
          - string
          - 'null'
          description: The optional client-friendly message for the error
      example:
        status_code: 404
        message: 'Unable to find public CVE with id: 999'
        url: null