Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-21354 State: PUBLISHED Published: 2021-03-08T19:05:32 Last Updated: 2024-08-03T18:09:15.871Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N) Vendors: mozilla Products: PollBot Problem Types: CWE-601 Description: Pollbot is open source software which "frees its human masters from the toilsome task of polling for the state of things during the Firefox release process." In Pollbot before version 1.4.4 there is an open redirection vulnerability in the path of "https://pollbot.services.mozilla.com/". An attacker can redirect anyone to malicious sites. To Reproduce type in this URL: "https://pollbot.services.mozilla.com//evil.com/". Affected versions will re
cious sites. To Reproduce type in this URL: "https://pollbot.services.mozilla.com//evil.com/". Affected versions will redirect to that website when you inject a payload like "//evil.com/". This is fixed in version 1.4.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mozilla/PollBot/security/advisories/GHSA-jhgx-wmq8-jc24 - https://bugzilla.mozilla.org/show_bug.cgi?id=1694684 - https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html - https://github.com/mozilla/PollBot/releases/tag/v1.4.4 - https://github.com/mozilla/PollBot/pull/333 - https://github.com/mozilla/PollBot/commit/6db74a4fcbff258c7cdf51a6ff0724fc10c4
s://github.com/mozilla/PollBot/pull/333 - https://github.com/mozilla/PollBot/commit/6db74a4fcbff258c7cdf51a6ff0724fc10c485e5
CVE ID: CVE-2021-21355 State: PUBLISHED Published: 2021-03-23T01:50:29 Last Updated: 2024-08-03T18:09:15.669Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) Vendors: TYPO3 Products: TYPO3.CMS Problem Types: CWE-434, CWE-552 Description: TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1, due to the lack of ensuring file extensions belong to configured allowed mime-types, attackers can upload arbitrary data with arbitrary file extensions - however, default _fileDenyPattern_ successfully blocked files like _.htaccess_ or _malicious.php_. Besides that, _UploadedFileReferenceConverter_ transforming upl
fully blocked files like _.htaccess_ or _malicious.php_. Besides that, _UploadedFileReferenceConverter_ transforming uploaded files into proper FileReference domain model objects handles possible file uploads for other extensions as well - given those extensions use the Extbase MVC framework, make use of FileReference items in their direct or inherited domain model definitions and did not implement their own type converter. In case this scenario applies, _UploadedFileReferenceConverter_ accepts any file mime-type and persists files in the default location. In any way, uploaded files are placed in the default location _/fileadmin/user_upload/_, in most scenarios keeping the submitted filename
ded files are placed in the default location _/fileadmin/user_upload/_, in most scenarios keeping the submitted filename - which allows attackers to directly reference files, or even correctly guess filenames used by other individuals, disclosing this information. No authentication is required to exploit this vulnerability. This is fixed in versions 8.7.40, 9.5.25, 10.4.14, 11.1.1. Additional Analyst Notes: - CVE Program Container: References: - https://packagist.org/packages/typo3/cms-form - https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-2r6j-862c-m2v2 - https://typo3.org/security/advisory/typo3-core-sa-2021-002
CVE ID: CVE-2021-21357 State: PUBLISHED Published: 2021-03-23T01:50:23 Last Updated: 2024-08-03T18:09:15.663Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H) Vendors: TYPO3 Products: TYPO3.CMS Problem Types: CWE-20, CWE-22, CWE-434 Description: TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1 due to improper input validation, attackers can by-pass restrictions of predefined options and submit arbitrary data in the Form Designer backend module of the Form Framework. In the default configuration of the Form Framework this allows attackers to explicitly allow arbitrary mime-types for file uploads - h
configuration of the Form Framework this allows attackers to explicitly allow arbitrary mime-types for file uploads - however, default _fileDenyPattern_ successfully blocked files like _.htaccess_ or _malicious.php_. Besides that, attackers can persist those files in any writable directory of the corresponding TYPO3 installation. A valid backend user account with access to the form module is needed to exploit this vulnerability. This is fixed in versions 8.7.40, 9.5.25, 10.4.14, 11.1.1. Additional Analyst Notes: - CVE Program Container: References: - https://packagist.org/packages/typo3/cms-form - https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-3vg7-jw9m-pc3f - https://typo3.org
packages/typo3/cms-form - https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-3vg7-jw9m-pc3f - https://typo3.org/security/advisory/typo3-core-sa-2021-003
CVE ID: CVE-2021-21358 State: PUBLISHED Published: 2021-03-23T01:50:16 Last Updated: 2024-08-03T18:09:15.902Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: TYPO3 Products: TYPO3.CMS Problem Types: CWE-79 Description: TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability. This is fixed in versions 10.4.14, 11.1.1. Additional Analyst Notes: - CVE Program Container: References: - https://gi
. This is fixed in versions 10.4.14, 11.1.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-x79j-wgqv-g8h2 - https://packagist.org/packages/typo3/cms-form - https://typo3.org/security/advisory/typo3-core-sa-2021-004
CVE ID: CVE-2021-21359 State: PUBLISHED Published: 2021-03-23T01:55:19 Last Updated: 2024-08-03T18:09:15.893Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: TYPO3 Products: TYPO3.CMS Problem Types: CWE-674, CWE-405 Description: TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.25, 10.4.14, 11.1.1 requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web
the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This is fixed in versions 9.5.25, 10.4.14, 11.1.1. Additional Analyst Notes: - CVE Program Container: References: - https://packagist.org/packages/typo3/cms-core - https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-4p9g-qgx9-397p - https://typo3.org/security/advisory/typo3-core-sa-2021-005
CVE ID: CVE-2021-21360 State: PUBLISHED Published: 2021-03-09T00:30:16 Last Updated: 2024-08-03T18:09:15.676Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: zopefoundation Products: Products.GenericSetup Problem Types: CWE-200 Description: Products.GenericSetup is a mini-framework for expressing the configured state of a Zope Site as a set of filesystem artifacts. In Products.GenericSetup before version 2.1.1 there is an information disclosure vulnerability - anonymous visitors may view log and snapshot files generated by the Generic Setup Tool. The problem has been fixed in version 2.1.1. Depending on how you have installed Products.GenericSetup, you shoul
Tool. The problem has been fixed in version 2.1.1. Depending on how you have installed Products.GenericSetup, you should change the buildout version pin to 2.1.1 and re-run the buildout, or if you used pip simply do pip install `"Products.GenericSetup>=2.1.1"`. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zopefoundation/Products.GenericSetup/security/advisories/GHSA-jff3-mwp3-f8cw - https://pypi.org/project/Products.GenericSetup/ - https://github.com/zopefoundation/Products.GenericSetup/commit/700319512b3615b3871a1f24e096cf66dc488c57 - http://www.openwall.com/lists/oss-security/2021/05/21/1 - http://www.openwall.com/lists/oss-security/2021/05/22/1
CVE ID: CVE-2021-21361 State: PUBLISHED Published: 2021-03-09T00:40:18 Last Updated: 2024-08-03T18:09:15.934Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: JLLeitschuh Products: security-research Problem Types: CWE-532 Description: The `com.bmuschko:gradle-vagrant-plugin` Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables. When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors. This is fixed in version 3.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JLLeitschuh/security-research
3.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-jpcm-4485-69p7 - https://github.com/bmuschko/gradle-vagrant-plugin/issues/19 - https://github.com/bmuschko/gradle-vagrant-plugin/pull/20 - https://github.com/bmuschko/gradle-vagrant-plugin/blob/292129f9343d00d391543fae06239e9b0f33db73/src/main/groovy/com/bmuschko/gradle/vagrant/process/GDKExternalProcessExecutor.groovy#L42-L44
CVE ID: CVE-2021-21362 State: PUBLISHED Published: 2021-03-08T18:40:34 Last Updated: 2024-08-03T18:09:15.715Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) Vendors: minio Products: minio Problem Types: CWE-285 Description: MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-04T00-53-13Z it is possible to bypass a readOnly policy by creating a temporary 'mc share upload' URL. Everyone is impacted who uses MinIO multi-users. This is fixed in version RELEASE.2021-03-04T00-53-13Z. As a workaround, one can disable uploads with `Content-Type: multipart/form-da
in version RELEASE.2021-03-04T00-53-13Z. As a workaround, one can disable uploads with `Content-Type: multipart/form-data` as mentioned in the S3 API RESTObjectPOST docs by using a proxy in front of MinIO. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/minio/minio/security/advisories/GHSA-hq5j-6r98-9m8v - https://github.com/minio/minio/pull/11682 - https://github.com/minio/minio/commit/039f59b552319fcc2f83631bb421a7d4b82bc482 - https://github.com/minio/minio/releases/tag/RELEASE.2021-03-04T00-53-13Z
CVE ID: CVE-2021-21363 State: PUBLISHED Published: 2021-03-11T03:05:23 Last Updated: 2024-08-03T18:09:16.080Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:N) Vendors: swagger-api Products: swagger-codegen Problem Types: CWE-379, CWE-378 Description: swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different languages by parsing your OpenAPI / Swagger definition. In swagger-codegen before version 2.4.19, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directo
s shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. This vulnerability is local privilege escalation because the contents of the `outputFolder` can be appended to by an attacker. As such, code written to this directory, when executed can be attacker controlled. For more details refer to the referenced GitHub Security Advisory. This vulnerability is fixed in version 2.4.19. Note this is a distinct vulnerability from CVE-2021-21364. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/swagger-api
ity from CVE-2021-21364. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/swagger-api/swagger-codegen/security/advisories/GHSA-pc22-3g76-gm6j - https://github.com/swagger-api/swagger-codegen/commit/987ea7a30b463cc239580d6ad166c707ae942a89
CVE ID: CVE-2021-21364 State: PUBLISHED Published: 2021-03-11T03:05:16 Last Updated: 2024-08-03T18:09:15.938Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: swagger-api Products: swagger-codegen Problem Types: CWE-200, CWE-378, CWE-732 Description: swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different languages by parsing your OpenAPI / Swagger definition. In swagger-codegen before version 2.4.19, on Unix-Like systems, the system temporary directory is shared between all local users. When files/directories are created, the default `umask` settings for the proces
ctory is shared between all local users. When files/directories are created, the default `umask` settings for the process are respected. As a result, by default, most processes/apis will create files/directories with the permissions `-rw-r--r--` and `drwxr-xr-x` respectively, unless an API that explicitly sets safe file permissions is used. Because this vulnerability impacts generated code, the generated code will remain vulnerable until fixed manually! This vulnerability is fixed in version 2.4.19. Note this is a distinct vulnerability from CVE-2021-21363. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/swagger-api/swagger-codegen/security/advisories/GHSA
st Notes: - CVE Program Container: References: - https://github.com/swagger-api/swagger-codegen/security/advisories/GHSA-hpv8-9rq5-hq7w - https://github.com/swagger-api/swagger-codegen/commit/35adbd552d5f99b3ff1e0e59da228becc85190f2
CVE ID: CVE-2021-21365 State: PUBLISHED Published: 2021-04-27T19:30:17 Last Updated: 2024-08-03T18:09:15.787Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: benjaminkott Products: bootstrap_package Problem Types: CWE-79 Description: Bootstrap Package is a theme for TYPO3. It has been discovered that rendering content in the website frontend is vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability. Users of the extension, who have overwritten the affected templates with custom code must manually apply the security fix. Update to version 7.1.2, 8.0.8, 9.1.4, 10.0.10 or 11.0.3 of the Bootstrap Package that fix
ually apply the security fix. Update to version 7.1.2, 8.0.8, 9.1.4, 10.0.10 or 11.0.3 of the Bootstrap Package that fix the problem described. Updated version are available from the TYPO3 extension manager, Packagist and at https://extensions.typo3.org/extension/download/bootstrap_package/. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/benjaminkott/bootstrap_package/security/advisories/GHSA-p48w-vf3c-rqjx - https://github.com/benjaminkott/bootstrap_package/commit/de3a568fc311d6712d9339643e51e8627c80530b - https://typo3.org/security/advisory/typo3-ext-sa-2021-007
CVE ID: CVE-2021-21366 State: PUBLISHED Published: 2021-03-12T00:00:00 Last Updated: 2024-08-03T18:09:16.000Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: xmldom Products: xmldom Problem Types: CWE-436, CWE-115 Description: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This is fixed in version 0.5.0. As a workaround downstream appli
during XML processing in some downstream applications. This is fixed in version 0.5.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xmldom/xmldom/security/advisories/GHSA-h6q6-9hqw-rwfv - https://www.npmjs.com/package/xmldom - https://github.com/xmldom/xmldom/releases/tag/0.5.0 - https://github.com/xmldom/xmldom/commit/d4201b9dfbf760049f457f9f08a3888d48835135 - https://lists.debian.org/debian-lts-announce/2023/01/msg00000.html
CVE ID: CVE-2021-21367 State: PUBLISHED Published: 2021-03-12T16:35:13 Last Updated: 2024-08-03T18:09:16.008Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L) Vendors: elementary Products: switchboard-plug-bluetooth Problem Types: CWE-863 Description: Switchboard Bluetooth Plug for elementary OS from version 2.3.0 and before version version 2.3.5 has an incorrect authorization vulnerability. When the Bluetooth plug is running (in discoverable mode), Bluetooth service requests and pairing requests are automatically accepted, allowing physically proximate attackers to pair with a device running an affected version of switchboard-plug-bluetooth without the active consent
ate attackers to pair with a device running an affected version of switchboard-plug-bluetooth without the active consent of the user. By default, elementary OS doesn't expose any services via Bluetooth that allow information to be extracted by paired Bluetooth devices. However, if such services (i.e. contact list sharing software) have been installed, it's possible that attackers have been able to extract data from such services without authorization. If no such services have been installed, attackers are only able to pair with a device running an affected version without authorization and then play audio out of the device or possibly present a HID device (keyboard, mouse, etc...) to control
uthorization and then play audio out of the device or possibly present a HID device (keyboard, mouse, etc...) to control the device. As such, users should check the list of trusted/paired devices and remove any that are not 100% confirmed to be genuine. This is fixed in version 2.3.5. To reduce the likelihood of this vulnerability on an unpatched version, only open the Bluetooth plug for short intervals when absolutely necessary and preferably not in crowded public areas. To mitigate the risk entirely with unpatched versions, do not open the Bluetooth plug within switchboard at all, and use a different method for pairing devices if necessary (e.g. `bluetoothctl` CLI). Additional Analyst Note
d at all, and use a different method for pairing devices if necessary (e.g. `bluetoothctl` CLI). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/elementary/switchboard-plug-bluetooth/security/advisories/GHSA-5p3g-j69g-w2mq - https://github.com/elementary/switchboard-plug-bluetooth/releases/tag/2.3.5 - https://github.com/elementary/switchboard-plug-bluetooth/commit/86500e645a907538abafe5225b67cc12c03e7645 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7TCGM4B45VLUJDCE5PHFYA5KBNHD4RA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AV7WKO5SZHTF3QEMX4WZ576H
ttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AV7WKO5SZHTF3QEMX4WZ576HRECIG6VQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWUPPVFG76PXQA3AHSGKYPRMVZ5AYHZI/
CVE ID: CVE-2021-21368 State: PUBLISHED Published: 2021-03-12T17:00:19 Last Updated: 2024-08-03T18:09:15.915Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:H) Vendors: mcollina Products: msgpack5 Problem Types: CWE-915 Description: msgpack5 is a msgpack v5 implementation for node.js and the browser. In msgpack5 before versions 3.6.1, 4.5.1, and 5.2.1 there is a "Prototype Poisoning" vulnerability. When msgpack5 decodes a map containing a key "__proto__", it assigns the decoded value to __proto__. Object.prototype.__proto__ is an accessor property for the receiver's prototype. If the value corresponding to the key __proto__ decodes to an object or null, msgpack5 sets t
the receiver's prototype. If the value corresponding to the key __proto__ decodes to an object or null, msgpack5 sets the decoded object's prototype to that value. An attacker who can submit crafted MessagePack data to a service can use this to produce values that appear to be of other types; may have unexpected prototype properties and methods (for example length, numeric properties, and push et al if __proto__'s value decodes to an Array); and/or may throw unexpected exceptions when used (for example if the __proto__ value decodes to a Map or Date). Other unexpected behavior might be produced for other types. There is no effect on the global prototype. This "prototype poisoning" is sort o
vior might be produced for other types. There is no effect on the global prototype. This "prototype poisoning" is sort of a very limited inversion of a prototype pollution attack. Only the decoded value's prototype is affected, and it can only be set to msgpack5 values (though if the victim makes use of custom codecs, anything could be a msgpack5 value). We have not found a way to escalate this to true prototype pollution (absent other bugs in the consumer's code). This has been fixed in msgpack5 version 3.6.1, 4.5.1, and 5.2.1. See the referenced GitHub Security Advisory for an example and more details. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mcol
or an example and more details. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mcollina/msgpack5/security/advisories/GHSA-gmjw-49p4-pcfm - https://www.npmjs.com/package/msgpack5 - https://github.com/mcollina/msgpack5/releases/tag/v3.6.1 - https://github.com/mcollina/msgpack5/releases/tag/v4.5.1 - https://github.com/mcollina/msgpack5/releases/tag/v5.2.1 - https://github.com/mcollina/msgpack5/commit/d4e6cb956ae51c8bb2828e71c7c1107c340cf1e8
CVE ID: CVE-2021-21369 State: PUBLISHED Published: 2021-03-09T18:10:18 Last Updated: 2024-08-03T18:09:15.981Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: hyperledger Products: besu Problem Types: CWE-400 Description: Hyperledger Besu is an open-source, MainNet compatible, Ethereum client written in Java. In Besu before version 1.5.1 there is a denial-of-service vulnerability involving the HTTP JSON-RPC API service. If username and password authentication is enabled for the HTTP JSON-RPC API service, then prior to making any requests to an API endpoint the requestor must use the login endpoint to obtain a JSON web token (JWT) using their credentials. A si
an API endpoint the requestor must use the login endpoint to obtain a JSON web token (JWT) using their credentials. A single user can readily overload the login endpoint with invalid requests (incorrect password). As the supplied password is checked for validity on the main vertx event loop and takes a relatively long time this can cause the processing of other valid requests to fail. A valid username is required for this vulnerability to be exposed. This has been fixed in version 1.5.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hyperledger/besu/security/advisories/GHSA-qgfj-mjpc-7w3q - https://github.com/hyperledger/besu/blob/master/CHANGELOG.md#151
erledger/besu/security/advisories/GHSA-qgfj-mjpc-7w3q - https://github.com/hyperledger/besu/blob/master/CHANGELOG.md#151 - https://github.com/hyperledger/besu/pull/1144 - https://github.com/hyperledger/besu/commit/06e35a58c07a30c0fbdc0aae45a3e8b06b53c022