{"id":"CVE-2017-20166","aliases":["EUVD-2023-0331","GHSA-2xxx-fhc8-9qvq","GHSA-4r2f-6fm9-2qgh"],"status":"published","title":"Ecto missing `is_nil` requirement","description":"Ecto 2.2.0 lacks a certain protection mechanism associated with the interaction between is_nil and raise.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01316,"percentile":0.70946,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-754"],"published":"2022-04-12T19:42:45Z","modified":"2026-10-20T10:48:53Z","fixes":[{"ecosystem":"Hex","package":"ecto","fixed_in":["2.2.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Hex","package":"ecto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"last_affected":"2.2.0"},{"fixed":"2.2.1"}]}],"versions":["2.2.0"]},{"source":"osv","ecosystem":"Hex","package":"ecto","ranges":[{"type":"SEMVER","events":[{"introduced":"2.2.0"},{"fixed":"2.2.1"}]}],"versions":["2.2.0"]}],"products":[{"vendor":"ecto_project","product":"ecto"}],"references":[{"url":"https://github.com/advisories/GHSA-2xxx-fhc8-9qvq","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/elixir-ecto/ecto/pull/2125","tags":["x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://github.com/elixir-ecto/ecto/commit/db55b0cba6525c24ebddc88ef9ae0c1c00620250","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://groups.google.com/forum/#%21topic/elixir-ecto/0m4NPfg_MMU","tags":["x_transferred","web"]},{"url":"https://groups.google.com/forum/#!topic/elixir-ecto/0m4NPfg_MMU","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-20166","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4r2f-6fm9-2qgh"},{"url":"https://github.com/elixir-ecto/ecto","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2017-20166","description":"Ecto 2.2.0 lacks a certain protection mechanism associated with the interaction between is_nil and raise.","status":"published","published":"2023-01-10T00:00:00Z","modified":"2025-04-09T17:30:12.094Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T14:33:11.59359Z"}],"euvd":[{"id":"EUVD-2023-0331","description":"Ecto 2.2.0 lacks a certain protection mechanism associated with the interaction between is_nil and raise.","status":"published","published":"2023-01-10T00:00:00Z","modified":"2025-04-09T17:30:12Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:52:38.263259Z"}],"ghsa":[{"id":"GHSA-2xxx-fhc8-9qvq","title":"Ecto missing `is_nil` requirement","description":"Ecto will not raise on queries with non-explicit nil comparisons (ie if they aren't checked with `is_nil`).","status":"published","published":"2022-04-12T19:42:45Z","modified":"2026-01-22T20:39:00Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:39:19.525691Z"},{"id":"GHSA-4r2f-6fm9-2qgh","title":"Duplicate Advisory: Ecto lacks a protection mechanism","description":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-2xxx-fhc8-9qvq. This link is maintained to preserve external references.\n\n## Original Description\nEcto 2.2.0 lacks a certain protection mechanism associated with the interaction between `is_nil` and `raise`.","status":"withdrawn","published":"2023-01-10T06:30:25Z","modified":"2026-01-22T20:38:52Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:39:19.525691Z"}],"nvd":[{"id":"CVE-2017-20166","description":"Ecto 2.2.0 lacks a certain protection mechanism associated with the interaction between is_nil and raise.","status":"published","published":"2023-01-10T06:15:09.61Z","modified":"2026-06-17T01:15:18.917Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T14:04:21.492973Z"}],"osv":[{"id":"CVE-2017-20166","description":"Ecto 2.2.0 lacks a certain protection mechanism associated with the interaction between is_nil and raise.","status":"published","published":"2023-01-10T06:15:09.61Z","modified":"2026-10-20T10:48:53.896236879Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:05.486486Z"},{"id":"GHSA-2xxx-fhc8-9qvq","title":"Ecto missing `is_nil` requirement","description":"Ecto will not raise on queries with non-explicit nil comparisons (ie if they aren't checked with `is_nil`).","status":"published","published":"2022-04-12T19:42:45Z","modified":"2026-07-08T06:00:56.101837223Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:46:35.050232Z"},{"id":"GHSA-4r2f-6fm9-2qgh","title":"Duplicate Advisory: Ecto lacks a protection mechanism","description":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-2xxx-fhc8-9qvq. This link is maintained to preserve external references.\n\n## Original Description\nEcto 2.2.0 lacks a certain protection mechanism associated with the interaction between `is_nil` and `raise`.","status":"withdrawn","published":"2023-01-10T06:30:25Z","modified":"2026-09-10T03:49:56.638032084Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:46:37.528068Z"}]}}