grype (0.120.1+ds1-1) unstable; urgency=medium
 .
   * Initial release (Closes: #1061720)

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: grype
Upstream-Contact: Anchore, Inc. <dev@anchore.com>
Source: https://github.com/anchore/grype
Files-Excluded:
 test/integration/testdata/image-debian-match-coverage/java/example-java-app-maven-0.1.0.jar
 grype/presenter/sarif/testdata/sarif-schema-2.1.0.json
Comment: Files-Excluded removes a prebuilt Java archive shipped as an
 integration test fixture. It contains compiled joda-time classes with no
 corresponding source, and is only read by test/integration, which needs
 docker and a live vulnerability database and is not run at build time.
 It also removes the OASIS SARIF 2.1.0 schema, whose terms say it "may not be
 modified in any way". Debian ships it in sarif-oasis-schemas (non-free), and
 the test that reads it uses that copy when it is installed.
 Dependencies are not vendored: they are Debian golang-*-dev packages listed
 in Build-Depends, resolved by dh-go through the generated Go workspace.

Files: *
Copyright: 2020-2026 Anchore, Inc.
License: Apache-2.0
Comment:
 LICENSE is the Apache-2.0 text with its appendix left as the upstream
 boilerplate, "Copyright [yyyy] [name of copyright owner]", and none of
 grype's own files carries a notice. Upstream has since added a COPYRIGHT file
 reading "Copyright (c) Anchore, Inc." (commit 7c1f50808f, 2026-10-12,
 https://github.com/anchore/grype/pull/3791), which no release up to v0.120.1
 contains. The years run from the creation of github.com/anchore/grype
 (2020-05-26) to this release.

Files: debian/*
Copyright: 2024-2026 Juan Manuel Méndez Rey <juan.mendezr@proton.me>
License: Apache-2.0

Files: grype/pkg/testdata/syft-multiple-ecosystems.json
 test/cli/testdata/sbom-grype-source.json
Comment: SBOM test fixtures generated by syft. The GPL-2.0-only,
 LGPL-3.0-or-later and MIT strings are values of "license" fields describing
 the catalogued packages, not the licence of these files.
Copyright: 2020-2026 Anchore, Inc.
License: Apache-2.0

Files: grype/presenter/cyclonedx/testdata/bom-1.6.schema.json
 grype/presenter/cyclonedx/testdata/jsf-0.82.schema.json
 grype/presenter/cyclonedx/testdata/spdx.schema.json
Comment: Copies of the CycloneDX specification JSON schemas, used to
 validate grype's CycloneDX output. spdx.schema.json is CycloneDX's own list
 of SPDX license identifiers, not an SPDX file. The JSF schema implements the
 JSON Signature Format developed by Anders Rundgren; the schema file itself is
 part of the CycloneDX specification. The holder is the one the CycloneDX
 README states.
Copyright: OWASP Foundation
License: Apache-2.0

Files: grype/db/internal/provider/unmarshal/osvmodel/schema-v1.json
Comment: Byte for byte copy of validation/schema.json from
 https://github.com/ossf/osv-schema at v1.9.1. The holder is the one that
 project's own source headers use. vulnerability_generated.go, generated
 from it, holds only Go type definitions and stays under Files: *.
Copyright: 2021 OSV Schema Authors
License: Apache-2.0

Files: internal/file/tar_xz_decompressor.go
 internal/file/xz_decompressor.go
Comment: Adapted copies of decompress_xz.go and decompress_txz.go from
 https://github.com/hashicorp/go-getter at v2.2.3, as the files themselves
 state. MPL-2.0 applies per file, so these stay under it.
Copyright: 2017-2023 HashiCorp, Inc.
 2020-2026 Anchore, Inc.
License: MPL-2.0

Files: grype/version/fuzzy_constraint.go
Comment: fuzzyVersionComparison and its helpers are copied from
 cvefeed/nvd/smartvercmp.go of https://github.com/facebookincubator/nvdtools ,
 as the file states.
Copyright: Facebook, Inc. and its affiliates
 2020-2026 Anchore, Inc.
License: Apache-2.0

Files: grype/version/pacman_version.go
 grype/version/rpm_version.go
Comment: compareRpmVersions is copied from version.go of
 https://github.com/cavaliercoder/go-rpm , as rpm_version.go states;
 comparePacmanVersions is a copy of the same function.
Copyright: 2017 Ryan Armstrong
 2020-2026 Anchore, Inc.
License: Apache-2.0 and BSD-3-clause

Files: test/integration/testdata/image-portage-match-coverage/var/db/repos/gentoo/skel.ebuild
Comment: Copy of the Gentoo ebuild skeleton, used as a portage fixture.
Copyright: 1999-2022 Gentoo Authors
License: GPL-2

Files: test/integration/testdata/image-debian-match-coverage/javascript/pkg-json/package.json
Comment: Copy of the package.json of npm 6.14.6, used as an npm fixture.
Copyright: npm, Inc. and Contributors
License: Artistic-2.0

Files: test/integration/testdata/image-debian-match-coverage/python/dist-info/METADATA
Comment: Copy of the installed METADATA of Pygments 2.6.1, which embeds the
 Pygments README.
Copyright: 2006-2019 the Pygments team
 2006-2019 by the respective authors (see AUTHORS file)
License: BSD-2-clause

Files: test/integration/testdata/image-debian-match-coverage/ruby/specifications/bundler.gemspec
Comment: RubyGems stub specification of bundler 2.1.4, generated from the
 bundler gem's own metadata.
Copyright: 2010-2019 André Arko
 2009 Engine Yard
License: Expat

Files: grype/db/v5/build/transformers/nvd/testdata/*
 grype/db/v6/build/transformers/nvd/testdata/*
 grype/db/v6/diff/testdata/inputs/nvd/*
 grype/matcher/*/testdata/*/nvd/*
 internal/dbtest/testdata/shared/all/nvd/*
Comment: NVD CVE records (https://nvd.nist.gov). The CVE descriptions are
 MITRE's; the NIST additions (CPE configurations, NIST CVSS) are works of the
 US Government. Some records carry the Spanish translations that NVD
 publishes, for which no separate terms were found.
Copyright: 1999-2026 The MITRE Corporation
 National Institute of Standards and Technology (public domain)
License: cve-tou and public-domain

Files: grype/db/v5/build/transformers/github/testdata/*
 grype/db/v6/build/transformers/github/testdata/*
 grype/matcher/*/testdata/*/github/*
 grype/testdata/unaffected-db/github/*
 grype/db/processors/testdata/github.json
Comment: Records from the GitHub Advisory Database,
 https://github.com/github/advisory-database , licensed CC-BY-4.0 in its
 LICENSE.md.
Copyright: GitHub, Inc.
License: CC-BY-4.0

Files: grype/db/v6/build/transformers/osv/testdata/GO-*
 grype/matcher/golang/testdata/*/govulndb/*
 grype/db/processors/testdata/osv.json
Comment: Records from the Go vulnerability database,
 https://github.com/golang/vulndb , whose entries are CC-BY-4.0 per its
 README.
Copyright: The Go Authors
License: CC-BY-4.0

Files: grype/db/v6/build/transformers/osv/testdata/ALSA-*
 grype/matcher/rpm/testdata/alma8/alma/*
Comment: Records from https://github.com/AlmaLinux/osv-database (MIT).
Copyright: 2023 AlmaLinux OS
License: Expat

Files: grype/db/v6/build/transformers/osv/testdata/BIT-*
 grype/matcher/bitnami/testdata/bitnami/bitnami/*
Comment: Records from https://github.com/bitnami/vulndb (Apache-2.0).
Copyright: Bitnami (Broadcom Inc.)
License: Apache-2.0

Files: grype/db/v5/build/transformers/os/testdata/rhel-8*
 grype/db/v6/build/transformers/os/testdata/rhel-8*
 grype/db/v6/diff/testdata/inputs/rhel/*
 grype/matcher/rpm/testdata/*/rhel/*
 grype/testdata/unaffected-db/rhel/*
 grype/matcher/rpm/testdata/hummingbird/hummingbird/*
 grype/db/processors/testdata/csaf-vex.json
Comment: Records from Red Hat security data,
 https://access.redhat.com/security/data , licensed CC-BY-4.0 with attribution
 to Red Hat.
Copyright: Red Hat, Inc.
License: CC-BY-4.0

Files: grype/db/v6/diff/testdata/inputs/sles/*
 grype/matcher/rpm/testdata/sles15/sles/*
 grype/testdata/unaffected-db/sles/*
Comment: Records from the SUSE OVAL data,
 https://security-data.suse.com/oval/LICENSE (CC-BY-4.0).
Copyright: SUSE LLC
License: CC-BY-4.0

Files: grype/db/v5/build/transformers/os/testdata/azure-linux-3.json
 grype/db/v5/build/transformers/os/testdata/mariner-*
 grype/db/v6/build/transformers/os/testdata/azure-linux-3.json
 grype/db/v6/build/transformers/os/testdata/mariner-*
 grype/db/v6/diff/testdata/inputs/mariner/*
Comment: Records from https://github.com/microsoft/AzureLinuxVulnerabilityData
 (MIT).
Copyright: Microsoft Corporation
License: Expat

Files: grype/db/v6/build/transformers/kev/testdata/*
 grype/db/v6/diff/testdata/inputs/kev/*
 grype/db/processors/testdata/kev.json
Comment: Records from the CISA Known Exploited Vulnerabilities catalog,
 https://github.com/cisagov/kev-data (CC0-1.0).
Copyright: Cybersecurity and Infrastructure Security Agency
License: CC0-1.0

Files: grype/matcher/*/testdata/*/eol/*
 grype/db/processors/testdata/eol*
Comment: Records from https://endoflife.date (MIT).
Copyright: 2020 endoflife.date contributors
License: Expat

Files: grype/db/v5/build/transformers/os/testdata/debian-8*
 grype/db/v6/build/transformers/os/testdata/debian-8*
 grype/db/v6/diff/testdata/inputs/debian/*
 grype/matcher/dpkg/testdata/*/debian/*
 internal/dbtest/testdata/shared/all/debian/*
Comment: Records from the Debian security tracker,
 https://security-tracker.debian.org . Their descriptions are the MITRE CVE
 text; the tracker publishes no licence for the rest, which is package names
 and versions.
Copyright: 1999-2026 The MITRE Corporation
 Debian Security Team
License: cve-tou and advisory-data

Files: grype/db/v6/diff/testdata/inputs/ubuntu/*
 grype/matcher/dpkg/testdata/*/ubuntu/*
Comment: Records from the Ubuntu CVE tracker,
 https://git.launchpad.net/ubuntu-cve-tracker , which publishes no licence:
 package names, versions and empty or test-written descriptions.
Copyright: Canonical Ltd.
License: advisory-data

Files: grype/db/v5/build/transformers/os/testdata/alpine-*
 grype/db/v6/build/transformers/os/testdata/alpine-*
 grype/db/v6/diff/testdata/inputs/alpine/*
 grype/matcher/apk/testdata/*/alpine/*
Comment: Records from https://secdb.alpinelinux.org , which publishes no
 licence: package names, fixed versions and CVE ids.
Copyright: Alpine Linux Security Team
License: advisory-data

Files: grype/db/v5/build/transformers/os/testdata/ol-8*
 grype/db/v6/build/transformers/os/testdata/ol-8*
 grype/db/v6/diff/testdata/inputs/oracle/*
 grype/matcher/rpm/testdata/oracle/oracle/*
 grype/db/processors/testdata/oracle.json
Comment: Records from the Oracle Linux ELSA OVAL feed,
 https://linux.oracle.com/security/oval/ , which states no licence.
Copyright: Oracle Corporation
License: advisory-data

Files: grype/db/v5/build/transformers/os/testdata/amzn*
 grype/db/v5/build/transformers/os/testdata/amazon-*
 grype/db/v6/build/transformers/os/testdata/amzn*
 grype/db/v6/build/transformers/os/testdata/amazon-*
Comment: Records from the Amazon Linux Security Center,
 https://alas.aws.amazon.com : advisory ids and versions only.
Copyright: Amazon.com, Inc.
License: advisory-data

Files: grype/db/v5/build/transformers/os/testdata/photon-*
 grype/db/v6/diff/testdata/inputs/photon/*
Comment: Records from the Photon OS security advisories,
 https://github.com/vmware/photon/wiki : ids and versions only.
Copyright: Broadcom Inc. (VMware Photon OS)
License: advisory-data

Files: grype/db/v6/build/transformers/os/testdata/archlinux*
Comment: Records from https://security.archlinux.org : ids and versions only.
Copyright: Arch Linux Security Team
License: advisory-data

Files: grype/db/v6/build/transformers/os/testdata/fedora-*
Comment: Records from Fedora Bodhi, https://bodhi.fedoraproject.org : ids and
 versions only.
Copyright: Fedora Project
License: advisory-data

Files: grype/db/v6/diff/testdata/inputs/echo/*
Comment: Records from https://advisory.echohq.com : package names and CVE ids
 only.
Copyright: Echo
License: advisory-data

Files: grype/db/v6/build/transformers/osv/testdata/ROOT-*
 grype/matcher/*/testdata/rootio-*/rootio/*
Comment: Records from https://api.root.io/external/osv , which states no
 licence: a templated sentence, package names and versions. The ROOT-*.json
 files carry the MITRE CVE and GitHub text of the CVEs they patch.
Copyright: Root.io
License: advisory-data

Files: grype/db/v6/build/transformers/epss/testdata/*
 grype/db/v6/diff/testdata/inputs/epss/*
 grype/db/processors/testdata/epss.json
Comment: Scores from FIRST EPSS, https://www.first.org/epss/ , which names no
 licence for its data: CVE ids, scores and dates only.
Copyright: 2015-2026 Forum of Incident Response and Security Teams, Inc.
License: advisory-data

Files: grype/db/v5/build/transformers/msrc/testdata/*
 grype/db/v6/build/transformers/msrc/testdata/*
 grype/db/processors/testdata/msrc.json
Comment: Records from the Microsoft Security Response Center API: KB and
 product ids, scores and advisory titles.
Copyright: Microsoft Corporation
License: advisory-data

Files: grype/db/v6/diff/testdata/inputs/chainguard-libraries/*
 grype/matcher/*/testdata/*/chainguard-libraries/*
Comment: Records from the Chainguard Libraries OpenVEX feed,
 https://libraries.cgr.dev/openvex/v1/all.json , which states no licence:
 statuses, purls and aliases.
Copyright: Chainguard, Inc.
License: advisory-data

Files: grype/db/v6/diff/testdata/inputs/wolfi/*
 grype/matcher/apk/testdata/wolfi-rolling/wolfi/*
Comment: Records from the Wolfi security database,
 https://packages.wolfi.dev/os/security.json , published under CC BY-NC-ND 4.0
 with a "Chainguard License for Commercial Scanners"
 (https://github.com/wolfi-dev/advisories/blob/main/LICENSE): package names,
 fixed versions and CVE ids.
Copyright: Chainguard, Inc.
License: advisory-data

Files: grype/db/v6/diff/testdata/inputs/chainguard/*
 grype/matcher/apk/testdata/chainguard-rolling/chainguard/*
 grype/db/v6/build/transformers/osv/testdata/CGA-*
Comment: Records from the Chainguard security database and OSV feed, published
 under the same terms as Wolfi's
 (https://github.com/chainguard-dev/vulnerability-scanner-support/blob/main/docs/foundational_concepts.md):
 ids, aliases, versions and one-line titles. cga-n0f1-x000-0000.json is
 synthetic.
Copyright: Chainguard, Inc.
License: advisory-data

Files: grype/presenter/explain/testdata/*.json
 grype/presenter/explain/__snapshots__/*
Comment: grype output used as fixtures for the explain presenter. The
 vulnerability descriptions in them come from NVD (MITRE CVE text), Red Hat
 and the GitHub Advisory Database.
Copyright: 2020-2026 Anchore, Inc.
 1999-2026 The MITRE Corporation
 Red Hat, Inc.
 GitHub, Inc.
License: Apache-2.0 and cve-tou and CC-BY-4.0

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
     http://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the complete text of the Apache License, Version 2.0
 can be found in "/usr/share/common-licenses/Apache-2.0".

License: Artistic-2.0
 This program is free software; you can redistribute it and/or modify it
 under the terms of the Artistic License, Version 2.0.
 .
 On Debian systems, the complete text of the Artistic License, Version 2.0
 can be found in "/usr/share/common-licenses/Artistic-2.0".

License: BSD-2-clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
 met:
 .
 * Redistributions of source code must retain the above copyright
   notice, this list of conditions and the following disclaimer.
 .
 * Redistributions in binary form must reproduce the above copyright
   notice, this list of conditions and the following disclaimer in the
   documentation and/or other materials provided with the distribution.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

License: Expat
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 .
 The above copyright notice and this permission notice shall be included in
 all copies or substantial portions of the Software.
 .
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.

License: BSD-3-clause
 Redistribution and use in source and binary forms, with or without modification,
 are permitted provided that the following conditions are met:
 .
 1. Redistributions of source code must retain the above copyright notice, this
    list of conditions and the following disclaimer.
 .
 2. Redistributions in binary form must reproduce the above copyright notice,
    this list of conditions and the following disclaimer in the documentation
    and/or other materials provided with the distribution.
 .
 3. Neither the name of the copyright holder nor the names of its contributors
    may be used to endorse or promote products derived from this software without
    specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
 ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
 ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
 ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

License: GPL-2
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License version 2 as
 published by the Free Software Foundation.
 .
 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 .
 On Debian systems, the complete text of the GNU General Public License
 version 2 can be found in "/usr/share/common-licenses/GPL-2".

License: MPL-2.0
 This Source Code Form is subject to the terms of the Mozilla Public
 License, v. 2.0. If a copy of the MPL was not distributed with this
 file, You can obtain one at http://mozilla.org/MPL/2.0/.
 .
 On Debian systems, the complete text of the Mozilla Public License,
 version 2.0 can be found in "/usr/share/common-licenses/MPL-2.0".

License: advisory-data
 Vulnerability records copied from public advisory feeds, used as test input
 for grype's matchers and database builder. They hold facts about packages:
 identifiers, affected and fixed versions, scores and, for some feeds, a
 one-line title. Some feeds publish no licence, and Wolfi and Chainguard
 publish theirs under CC BY-NC-ND 4.0; each stanza names its feed and terms.
 The binary package does not ship them. They are kept in main on the fair
 use reasoning given on debian-legal for licence texts in a licence scanner,
 https://lists.debian.org/debian-legal/2026/10/msg00043.html , and for short
 snippets used as test input in syft,
 https://lists.debian.org/debian-legal/2026/11/msg00004.html .
 debian/README.source explains why the tests need them.

License: CC-BY-4.0
 This work is licensed under the Creative Commons Attribution 4.0
 International License.
 .
 On Debian systems, the complete text of the Creative Commons Attribution 4.0
 International License can be found in
 "/usr/share/common-licenses/CC-BY-4.0".

License: CC0-1.0
 To the extent possible under law, the authors have dedicated all copyright
 and related and neighboring rights to this work to the public domain
 worldwide.
 .
 On Debian systems, the complete text of the CC0 1.0 Universal Public Domain
 Dedication can be found in "/usr/share/common-licenses/CC0-1.0".

License: cve-tou
 CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive,
 no-charge, royalty-free, irrevocable copyright license to reproduce, prepare
 derivative works of, publicly display, publicly perform, sublicense, and
 distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for
 such purposes is authorized provided that you reproduce MITRE's copyright
 designation and this license in any such copy.
 .
 DISCLAIMERS
 .
 ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE
 PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE
 REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF
 TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
 INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
 MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

License: public-domain
 Works of the United States Government, such as the data NIST publishes in the
 National Vulnerability Database, are not subject to copyright protection in
 the United States (17 U.S.C. 105).