Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
x users and groups to perform privilege separation inside the container are most directly impacted. This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in Moby (Docker Engine) 20.10.14. Running containers should be stopped, deleted, and recreated for the inheritable capabilities to be reset. This fix changes Moby (Docker Engine) behavior such that containers are started with a more typical Linux environment. As a workaround, the entry point of a container can be modified to use a utility like `capsh(1)` to drop inheritable capabilities prior to the primary p
of a container can be modified to use a utility like `capsh(1)` to drop inheritable capabilities prior to the primary process starting. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/moby/moby/security/advisories/GHSA-2mm7-x5h6-5pvq - https://github.com/moby/moby/commit/2bbc786e4c59761d722d2d1518cd0a32829bc07f - https://github.com/moby/moby/releases/tag/v20.10.14 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPOJUJZXGMIVKRS4QR75F6OIXNQ6LDBL/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PMQKCAPK2AR3DCYITJYMMNBEGQBGLCC/ - https://lists.fedoraproject.
list/package-announce%40lists.fedoraproject.org/message/6PMQKCAPK2AR3DCYITJYMMNBEGQBGLCC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5FQJ3MLFSEKQYCFPFZIKYGBXPZUJFVY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5AFKOQ5CE3CEIULWW4FLQKHFFU6FSYG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HIMAHZ6AUIKN7AX26KHZYBXVECIOVWBH/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQCVS7WBFSTKJFNX5PGDRARMTOFWV2O7/ - http://www.openwall.com/lists/oss-security/2022/05/12/1 - https://www.debian
message/HQCVS7WBFSTKJFNX5PGDRARMTOFWV2O7/ - http://www.openwall.com/lists/oss-security/2022/05/12/1 - https://www.debian.org/security/2022/dsa-5162 - https://security.gentoo.org/glsa/202401-31
CVE ID: CVE-2022-24770 State: PUBLISHED Published: 2022-03-17T20:30:19.000Z Last Updated: 2025-04-23T18:46:31.781Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: gradio-app Products: gradio Problem Types: CWE-1236 Description: `gradio` is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, `gradio` suffers from Improper Neutralization of Formula Elements in a CSV File. The `gradio` library has a flagging functionality which saves input/output data into a CSV file on the developer's computer. This can allow a user to save arbitrary text into the CSV file, such as commands. If a program like MS Excel ope
mputer. This can allow a user to save arbitrary text into the CSV file, such as commands. If a program like MS Excel opens such a file, then it automatically runs these commands, which could lead to arbitrary commands running on the user's computer. The problem has been patched as of `2.8.11`, which escapes the saved csv with single quotes. As a workaround, avoid opening csv files generated by `gradio` with Excel or similar spreadsheet programs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gradio-app/gradio/security/advisories/GHSA-f8xq-q7px-wg8c - https://github.com/gradio-app/gradio/pull/817 - https://github.com/gradio-app/gra
urity/advisories/GHSA-f8xq-q7px-wg8c - https://github.com/gradio-app/gradio/pull/817 - https://github.com/gradio-app/gradio/commit/80fea89117358ee105973453fdc402398ae20239
CVE ID: CVE-2022-24771 State: PUBLISHED Published: 2022-03-18T13:25:11.000Z Last Updated: 2025-04-23T18:46:25.686Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: digitalbazaar Products: forge Problem Types: CWE-347 Description: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in
e PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/digitalbazaar/forge/security/advisories/GHSA-cfm4-qjh2-4765 - https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1
CVE ID: CVE-2022-24772 State: PUBLISHED Published: 2022-03-18T13:30:20.000Z Last Updated: 2025-04-23T18:46:10.614Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: digitalbazaar Products: forge Problem Types: CWE-347 Description: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` versio
added to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1 - https://github.com/digitalbazaar/forge/commit/bb822c02df0b61211836472e29b9790cc541cdb2 - https://github.com/digitalbazaar/forge/security/advisories/GHSA-x4jg-mjrx-434g
CVE ID: CVE-2022-24773 State: PUBLISHED Published: 2022-03-18T13:30:14.000Z Last Updated: 2025-04-23T18:46:17.431Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: digitalbazaar Products: forge Problem Types: CWE-347 Description: Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check `DigestInfo` for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known w
tructures but a valid digest. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/digitalbazaar/forge/commit/3f0b49a0573ef1bb7af7f5673c0cfebf00424df1 - https://github.com/digitalbazaar/forge/security/advisories/GHSA-2r2c-g63r-vccr - https://github.com/digitalbazaar/forge/commit/bb822c02df0b61211836472e29b9790cc541cdb2
CVE ID: CVE-2022-24774 State: PUBLISHED Published: 2022-03-22T16:35:12.000Z Last Updated: 2025-04-23T18:44:55.626Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) Vendors: CycloneDX Products: cyclonedx-bom-repo-server Problem Types: CWE-20, CWE-35 Description: CycloneDX BOM Repository Server is a bill of materials (BOM) repository server for distributing CycloneDX BOMs. CycloneDX BOM Repository Server before version 2.0.1 has an improper input validation vulnerability leading to path traversal. A malicious user may potentially exploit this vulnerability to create arbitrary directories or a denial of service by deleting arbitrary directories. The vulnerability is resolv
ty to create arbitrary directories or a denial of service by deleting arbitrary directories. The vulnerability is resolved in version 2.0.1. The vulnerability is not exploitable with the default configuration with the post and delete methods disabled. This can be configured by modifying the `appsettings.json` file, or alternatively, setting the environment variables `ALLOWEDMETHODS__POST` and `ALLOWEDMETHODS__DELETE` to `false`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/CycloneDX/cyclonedx-bom-repo-server/security/advisories/GHSA-6c74-9588-wq9j - https://github.com/CycloneDX/cyclonedx-bom-repo-server/commit/001a3278b5572e52c0
curity/advisories/GHSA-6c74-9588-wq9j - https://github.com/CycloneDX/cyclonedx-bom-repo-server/commit/001a3278b5572e52c0ecac0bd1157bf2599502b7 - https://github.com/CycloneDX/cyclonedx-bom-repo-server/releases/tag/v2.0.1
CVE ID: CVE-2022-24775 State: PUBLISHED Published: 2022-03-21T19:00:17.000Z Last Updated: 2025-04-23T18:45:20.759Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: guzzle Products: psr7 Problem Types: CWE-20 Description: guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96 - h
ainer: - CISA ADP Vulnrichment: References: - https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96 - https://github.com/guzzle/psr7/pull/485/commits/e55afaa3fc138c89adf3b55a8ba20dc60d17f1f1 - https://github.com/guzzle/psr7/pull/486/commits/9a96d9db668b485361ed9de7b5bf1e54895df1dc - https://www.drupal.org/sa-core-2022-006
CVE ID: CVE-2022-24776 State: PUBLISHED Published: 2022-03-24T19:45:14.000Z Last Updated: 2025-04-23T18:44:03.621Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: dpgaspar Products: Flask-AppBuilder Problem Types: CWE-601 Description: Flask-AppBuilder is an application development framework, built on top of the Flask web framework. Flask-AppBuilder contains an open redirect vulnerability when using database authentication login page on versions below 3.4.5. This issue is fixed in version 3.4.5. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dpgaspar/Flask-
tional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-2ccw-7px8-vmpf - https://github.com/dpgaspar/Flask-AppBuilder/pull/1804 - https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v3.4.5
CVE ID: CVE-2022-24777 State: PUBLISHED Published: 2022-03-25T16:35:09.000Z Last Updated: 2025-04-23T18:43:40.348Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: grpc Products: grpc-swift Problem Types: CWE-617 Description: grpc-swift is the Swift language implementation of gRPC, a remote procedure call (RPC) framework. Prior to version 1.7.2, a grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This is due to incorrect logic when handling GOAWAY frames. The attack is low-effort: it takes very little resources to construct and send the required sequence of frames. The impact on availability is high as the server will cras
ources to construct and send the required sequence of frames. The impact on availability is high as the server will crash, dropping all in flight connections and requests. This issue is fixed in version 1.7.2. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/grpc/grpc-swift/security/advisories/GHSA-r6ww-5963-7r95 - https://github.com/grpc/grpc-swift/commit/858f977f2a51fca2292f384cf7a108dc2e73a3bd
CVE ID: CVE-2022-24778 State: PUBLISHED Published: 2022-03-25T17:20:11.000Z Last Updated: 2025-04-22T18:17:56.011Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: containerd Products: imgcrypt Problem Types: CWE-863 Description: The imgcrypt library provides API exensions for containerd to support encrypted container images and implements the ctd-decoder command line tool for use by containerd to decrypt encrypted container images. The imgcrypt function `CheckAuthorization` is supposed to check whether the current used is authorized to access an encrypted image and prevent the user from running an image that another user previously decrypted on the same system
an encrypted image and prevent the user from running an image that another user previously decrypted on the same system. In versions prior to 1.1.4, a failure occurs when an image with a ManifestList is used and the architecture of the local host is not the first one in the ManifestList. Only the first architecture in the list was tested, which may not have its layers available locally since it could not be run on the host architecture. Therefore, the verdict on unavailable layers was that the image could be run anticipating that image run failure would occur later due to the layers not being available. However, this verdict to allow the image to run enabled other architectures in the Manif
the layers not being available. However, this verdict to allow the image to run enabled other architectures in the ManifestList to run an image without providing keys if that image had previously been decrypted. A patch has been applied to imgcrypt 1.1.4. Workarounds may include usage of different namespaces for each remote user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/containerd/imgcrypt/security/advisories/GHSA-8v99-48m9-c8pm - https://github.com/containerd/imgcrypt/issues/69 - https://github.com/containerd/imgcrypt/commit/6fdd9818a4d8142107b7ecd767d839c9707700d9 - https://github.com/containerd/imgcrypt/releases/tag/v1.1.
erd/imgcrypt/commit/6fdd9818a4d8142107b7ecd767d839c9707700d9 - https://github.com/containerd/imgcrypt/releases/tag/v1.1.4 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZFTJR5CR5EOYDVOSBZEMLBHLJRTPJPUA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAHAAOOA3KZJC2I5WHCR3XVBJBNWTWUE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4SJUNSC7YZLA745EMKWK2GKEV57GE52K/
CVE ID: CVE-2022-24780 State: PUBLISHED Published: 2022-04-05T18:30:18.000Z Last Updated: 2025-04-22T18:17:20.019Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Combodo Products: iTop Problem Types: CWE-94 Description: Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG code to the server by forging specific http queries, and execute arbitrary code on the server using http server user privileges. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
urrently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Combodo/iTop/security/advisories/GHSA-v97m-wgxq-rh54 - https://github.com/Combodo/iTop/commit/93f273a28778e5da8e51096f021d2dc1adbf4ef3 - https://github.com/Combodo/iTop/commit/b6fac4b411b8d145fc30fa35c66b51243eafd06b - https://github.com/Combodo/iTop/commit/eb2a615bd28100442c7f6171707bb40884af2305 - https://markus-krell.de/itop-template-injection-inside-customer-portal/ - http://packetstormsecurity.com/files/167236/iTop-Remote-Command-Execution.html
CVE ID: CVE-2022-24781 State: PUBLISHED Published: 2022-03-24T20:25:10.000Z Last Updated: 2025-04-23T18:43:55.676Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) Vendors: math-geon Products: Geon Problem Types: CWE-384 Description: Geon is a board game based on solving questions about the Pythagorean Theorem. Malicious users can obtain the uuid from other users, spoof that uuid through the browser console and become co-owners of the target session. This issue is patched in version 1.1.0. No known workaround exists. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/math-geon/Geon/security/advisories/GHSA-4fv9-g
gram Container: - CISA ADP Vulnrichment: References: - https://github.com/math-geon/Geon/security/advisories/GHSA-4fv9-g2jh-j5xm - https://github.com/math-geon/Geon/commit/005456d752d5434b60026edbc83b2665b8557d19 - https://github.com/math-geon/Geon/releases/tag/v1.1.0
CVE ID: CVE-2022-24782 State: PUBLISHED Published: 2022-03-24T20:35:10.000Z Last Updated: 2025-04-23T18:43:48.121Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: discourse Products: discourse Problem Types: CWE-200 Description: Discourse is an open source discussion platform. Versions 2.8.2 and prior in the `stable` branch, 2.9.0.beta3 and prior in the `beta` branch, and 2.9.0.beta3 and prior in the `tests-passed` branch are vulnerable to a data leak. Users can request an export of their own activity. Sometimes, due to category settings, they may have category membership for a secure category. The name of this secure category is shown to the user in the exp
hey may have category membership for a secure category. The name of this secure category is shown to the user in the export. The same thing occurs when the user's post has been moved to a secure category. A patch for this issue is available in the `main` branch of Discourse's GitHub repository and is anticipated to be part of future releases. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-c3cq-w899-f343 - https://github.com/discourse/discourse/pull/16273 - https://github.com/discourse/discourse/commit/9d5737fd28374cc876c070f6c3a931a8071ec356
CVE ID: CVE-2022-24783 State: PUBLISHED Published: 2022-03-25T21:15:12.000Z Last Updated: 2025-04-23T18:43:31.886Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: denoland Products: deno Problem Types: CWE-269 Description: Deno is a runtime for JavaScript and TypeScript. The versions of Deno between release 1.18.0 and 1.20.2 (inclusive) are vulnerable to an attack where a malicious actor controlling the code executed in a Deno runtime could bypass all permission checks and execute arbitrary shell code. This vulnerability does not affect users of Deno Deploy. The vulnerability has been patched in Deno 1.20.3. There is no workaround. All users are recommended
ers of Deno Deploy. The vulnerability has been patched in Deno 1.20.3. There is no workaround. All users are recommended to upgrade to 1.20.3 immediately. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/denoland/deno/security/advisories/GHSA-838h-jqp6-cf2f
CVE ID: CVE-2022-24784 State: PUBLISHED Published: 2022-03-25T21:40:11.000Z Last Updated: 2025-04-23T18:43:26.208Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: statamic Products: cms Problem Types: CWE-200 Description: Statamic is a Laravel and Git powered CMS. Before versions 3.2.39 and 3.3.2, it is possible to confirm a single character of a user's password hash using a specially crafted regular expression filter in the users endpoint of the REST API. Multiple such requests can eventually uncover the entire hash. The hash is not present in the response, however the presence or absence of a result confirms if the character is in the right position. The API
n the response, however the presence or absence of a result confirms if the character is in the right position. The API has throttling enabled by default, making this a time intensive task. Both the REST API and the users endpoint need to be enabled, as they are disabled by default. The issue has been fixed in versions 3.2.39 and above, and 3.3.2 and above. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/statamic/cms/security/advisories/GHSA-qcgx-7p5f-hxvr - https://github.com/statamic/cms/issues/5604 - https://github.com/statamic/cms/pull/5568
CVE ID: CVE-2022-24785 State: PUBLISHED Published: 2022-04-04T00:00:00.000Z Last Updated: 2025-11-03T21:46:06.689Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: moment Products: moment Problem Types: CWE-22, CWE-27 Description: Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name
2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4 - https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5 - https://www.tenable.com/security/tns-2022-09 - https://security.netapp.com/advisory/ntap-20220513-0006/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q/ - https://lists.fedoraproject.org/archives/list/package-announc
oraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5/ - https://lists.debian.org/debian-lts-announce/2023/01/msg00035.html
CVE ID: CVE-2022-24786 State: PUBLISHED Published: 2022-04-06T00:00:00.000Z Last Updated: 2025-04-23T18:41:30.691Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: pjsip Products: pjproject Problem Types: CWE-125, CWE-787 Description: PJSIP is a free and open source multimedia communication library written in C. PJSIP versions 2.12 and prior do not parse incoming RTCP feedback RPSI (Reference Picture Selection Indication) packet, but any app that directly uses pjmedia_rtcp_fb_parse_rpsi() will be affected. A patch is available in the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds. Additional Analyst Note
er` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pjsip/pjproject/security/advisories/GHSA-vhxv-phmx-g52q - https://github.com/pjsip/pjproject/commit/11559e49e65bdf00922ad5ae28913ec6a198d508 - https://security.gentoo.org/glsa/202210-37 - https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html - https://www.debian.org/security/2022/dsa-5285
CVE ID: CVE-2022-24787 State: PUBLISHED Published: 2022-04-04T17:35:10.000Z Last Updated: 2025-04-23T18:41:56.894Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: vyperlang Products: vyper Problem Types: CWE-697 Description: Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting in the word-for-word comparisons giving incorrect results. Even without dirty nonzero bytes, two bytestrings can compare to equal if one ends with `"\x00"` because there is no comparison of the length. A patch is available and expected to be part of the 0.3.2 release. There are curren