{
  "schemaVersion": 1,
  "project": "Service inventory and CVE review",
  "dataMode": "Synthetic Nmap XML fixture",
  "catalogReviewedOn": "2026-10-13",
  "catalogSize": 2,
  "scope": "Two curated upstream advisories. No complete CVE coverage is implied.",
  "notice": "Banner matches are candidates for review. Package backports and configuration can change applicability.",
  "services": [
    {
      "id": "192.0.2.10/tcp/80",
      "address": "192.0.2.10",
      "hostname": "web.example.test",
      "port": 80,
      "protocol": "tcp",
      "service": "http",
      "product": "Apache httpd",
      "version": "2.4.49",
      "extraInfo": "",
      "method": "probed",
      "cpes": [
        "cpe:/a:apache:http_server:2.4.49"
      ],
      "status": "potential"
    },
    {
      "id": "192.0.2.20/tcp/22",
      "address": "192.0.2.20",
      "hostname": "admin.example.test",
      "port": 22,
      "protocol": "tcp",
      "service": "ssh",
      "product": "OpenSSH",
      "version": "9.2p1",
      "extraInfo": "Linux, package patch level unknown",
      "method": "probed",
      "cpes": [
        "cpe:/a:openbsd:openssh:9.2:p1"
      ],
      "status": "potential"
    },
    {
      "id": "192.0.2.30/tcp/22",
      "address": "192.0.2.30",
      "hostname": "updated.example.test",
      "port": 22,
      "protocol": "tcp",
      "service": "ssh",
      "product": "OpenSSH",
      "version": "9.8p1",
      "extraInfo": "",
      "method": "probed",
      "cpes": [
        "cpe:/a:openbsd:openssh:9.8:p1"
      ],
      "status": "no-catalog-match"
    }
  ],
  "findings": [
    {
      "id": "192.0.2.10/tcp/80:CVE-2021-41773",
      "serviceId": "192.0.2.10/tcp/80",
      "cve": "CVE-2021-41773",
      "status": "potential",
      "title": "Apache HTTP Server path traversal",
      "affected": "Apache HTTP Server 2.4.49",
      "evidence": "Apache httpd 2.4.49 on tcp/80",
      "basis": "Product CPE and upstream banner version",
      "conditions": "Exposure depends on the Alias configuration and filesystem access rules. CGI changes the possible impact.",
      "remediation": "Check the package advisory and install a supported patched release. Apache 2.4.50's fix was incomplete, tracked as CVE-2021-42013. Apache 2.4.51 addressed that follow-up issue.",
      "verification": "Confirm the installed package build and review Alias access rules before closing this finding.",
      "firstFix": "2.4.50",
      "references": [
        {
          "label": "Apache advisory",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-41773"
        },
        {
          "label": "NVD record",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41773"
        },
        {
          "label": "Incomplete fix",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-42013"
        }
      ]
    },
    {
      "id": "192.0.2.20/tcp/22:CVE-2024-6387",
      "serviceId": "192.0.2.20/tcp/22",
      "cve": "CVE-2024-6387",
      "status": "potential",
      "title": "OpenSSH sshd signal-handler race",
      "affected": "Portable OpenSSH 8.5p1 through 9.7p1",
      "evidence": "OpenSSH 9.2p1 on tcp/22",
      "basis": "Product CPE and upstream banner version",
      "conditions": "This rule covers the Portable OpenSSH regression. OpenBSD is excluded. The remote banner does not establish platform details or downstream patch status.",
      "remediation": "Install the operating-system vendor's patched package. The upstream fix shipped in OpenSSH 9.8p1. Retest after restarting sshd.",
      "verification": "Check the distribution security advisory against the full installed package version, including any backported fix.",
      "firstFix": "9.8p1",
      "references": [
        {
          "label": "OpenSSH release notes",
          "url": "https://www.openssh.org/txt/release-9.8"
        },
        {
          "label": "NVD record",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6387"
        }
      ]
    }
  ],
  "summary": {
    "hosts": 3,
    "openServices": 3,
    "potentialMatches": 2,
    "manualReview": 0,
    "noCatalogMatch": 1
  },
  "workflow": [
    "Read Nmap XML",
    "Match upstream versions",
    "Review package evidence",
    "Generate remediation report"
  ]
}