Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2019-25016: Incomplete Cleanup (CWE-459)
value: In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue.
CWE description: The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
CVSS v3 base score: 8.8
Published: 2021-01-28T20:15Z
Repository: https://github.com/Duncaen/OpenDoas
Language: C
Files changed: doas.c
Commit date: 2021-01-28 20:40:32 +0100
Commit message: correctly reset path for rules without specific command

This is a fixup for commit 01c658f8c45cb92a343be5f32aa6da70b2032168
where the behaviour was changed to not inherit the PATH variable
by default.

Diff: diff --git a/doas.c b/doas.c
index a184650..d312b24 100644
--- a/doas.c
+++ b/doas.c
@@ -384,20 +384,23 @@ main(int argc, char **argv)
 	    rule->options & PERSIST);
 #endif
 
 #ifdef HAVE_LOGIN_CAP_H
 	if (setusercontext(NULL, targpw, target, LOGIN_SETGROUP |
+	    LOGIN_SETPATH |
 	    LOGIN_SETPRIORITY | LOGIN_SETRESOURCES | LOGIN_SETUMASK |
 	    LOGIN_SETUSER) != 0)
 		errx(1, "failed to set user context for target");
 #else
 	if (setresgid(targpw->pw_gid, targpw->pw_gid, targpw->pw_gid) != 0)
 		err(1, "setresgid");
 	if (initgroups(targpw->pw_name, targpw->pw_gid) != 0)
 		err(1, "initgroups");
 	if (setresuid(target, target, target) != 0)
 		err(1, "setresuid");
+	if (setenv("PATH", safepath, 1) == -1)
+		err(1, "failed to set PATH '%s'", safepath);
 #endif
 
 	if (getcwd(cwdpath, sizeof(cwdpath)) == NULL)
 		cwd = "(failed)";
 	else

Fixed code: 	    LOGIN_SETPATH |
	if (setenv("PATH", safepath, 1) == -1)
		err(1, "failed to set PATH '%s'", safepath);
CVE-2019-25016: Missing Initialization of Resource (CWE-909)
value: In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command. Rules that only allowed to authenticated user to execute specific commands were not affected by this issue.
CWE description: The product does not initialize a critical resource.
CVSS v3 base score: 8.8
Published: 2021-01-28T20:15Z
Repository: https://github.com/Duncaen/OpenDoas
Language: C
Files changed: doas.c
Commit date: 2021-01-28 20:40:32 +0100
Commit message: correctly reset path for rules without specific command

This is a fixup for commit 01c658f8c45cb92a343be5f32aa6da70b2032168
where the behaviour was changed to not inherit the PATH variable
by default.

Diff: diff --git a/doas.c b/doas.c
index a184650..d312b24 100644
--- a/doas.c
+++ b/doas.c
@@ -384,20 +384,23 @@ main(int argc, char **argv)
 	    rule->options & PERSIST);
 #endif
 
 #ifdef HAVE_LOGIN_CAP_H
 	if (setusercontext(NULL, targpw, target, LOGIN_SETGROUP |
+	    LOGIN_SETPATH |
 	    LOGIN_SETPRIORITY | LOGIN_SETRESOURCES | LOGIN_SETUMASK |
 	    LOGIN_SETUSER) != 0)
 		errx(1, "failed to set user context for target");
 #else
 	if (setresgid(targpw->pw_gid, targpw->pw_gid, targpw->pw_gid) != 0)
 		err(1, "setresgid");
 	if (initgroups(targpw->pw_name, targpw->pw_gid) != 0)
 		err(1, "initgroups");
 	if (setresuid(target, target, target) != 0)
 		err(1, "setresuid");
+	if (setenv("PATH", safepath, 1) == -1)
+		err(1, "failed to set PATH '%s'", safepath);
 #endif
 
 	if (getcwd(cwdpath, sizeof(cwdpath)) == NULL)
 		cwd = "(failed)";
 	else

Fixed code: 	    LOGIN_SETPATH |
	if (setenv("PATH", safepath, 1) == -1)
		err(1, "failed to set PATH '%s'", safepath);
CVE-2020-25613: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') (CWE-444)
value: An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.
CWE description: The product acts as an intermediary HTTP agent
         (such as a proxy or firewall) in the data flow between two
         entities such as a client and server, but it does not
         interpret malformed HTTP requests or responses in ways that
         are consistent with how the messages will be processed by
         those entities that are at the ultimate destination.
CVSS v3 base score: 7.5
Published: 2020-10-06T13:15Z
Repository: https://github.com/ruby/webrick
Language: Ruby
Files changed: lib/webrick/httprequest.rb
Commit date: 2020-09-29 13:15:58 +0900
Commit message: Make it more strict to interpret some headers

Some regexps were too tolerant.

Diff: diff --git a/lib/webrick/httprequest.rb b/lib/webrick/httprequest.rb
index 294bd91..d34eac7 100644
--- a/lib/webrick/httprequest.rb
+++ b/lib/webrick/httprequest.rb
@@ -225,13 +225,13 @@ module WEBrick
         @path_info = @path.dup
       rescue
         raise HTTPStatus::BadRequest, "bad URI `#{@unparsed_uri}'."
       end
 
-      if /close/io =~ self["connection"]
+      if /\Aclose\z/io =~ self["connection"]
         @keep_alive = false
-      elsif /keep-alive/io =~ self["connection"]
+      elsif /\Akeep-alive\z/io =~ self["connection"]
         @keep_alive = true
       elsif @http_version < "1.1"
         @keep_alive = false
       else
         @keep_alive = true
@@ -506,11 +506,11 @@ module WEBrick
 
     def read_body(socket, block)
       return unless socket
       if tc = self['transfer-encoding']
         case tc
-        when /chunked/io then read_chunked(socket, block)
+        when /\Achunked\z/io then read_chunked(socket, block)
         else raise HTTPStatus::NotImplemented, "Transfer-Encoding: #{tc}."
         end
       elsif self['content-length'] || @remaining_size
         @remaining_size ||= self['content-length'].to_i
         while @remaining_size > 0

Vulnerable code:       if /close/io =~ self["connection"]
      elsif /keep-alive/io =~ self["connection"]
        when /chunked/io then read_chunked(socket, block)
Fixed code:       if /\Aclose\z/io =~ self["connection"]
      elsif /\Akeep-alive\z/io =~ self["connection"]
        when /\Achunked\z/io then read_chunked(socket, block)
CVE-2011-3180: Other (NVD-CWE-Other)
value: kiwi before 4.98.08, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in the path of an overlay file, related to chown.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Published: 2014-04-16T18:37Z
Repository: https://github.com/openSUSE/kiwi
Language: Perl
Files changed: modules/KIWIRoot.pm
Commit date: 2011-10-21 16:43:56 +0200
Commit message: - fixed escaping of chown parameters (bnc #725706)

Diff: diff --git a/modules/KIWIRoot.pm b/modules/KIWIRoot.pm
index 2006910f..190d7c9b 100644
--- a/modules/KIWIRoot.pm
+++ b/modules/KIWIRoot.pm
@@ -928,11 +928,11 @@ sub fixupOverlayFilesOwnership {
 				);
 				$ok = 0; last;
 			}
 		}
 		next if ! $ok;
-		my $data = qxx ("chroot $root chown -c root:root \"$file\" 2>&1");
+		my $data = qxx ("chroot $root chown -c root:root '".$file."' 2>&1");
 		my $code = $? >> 8;
 		if ($code != 0) {
 			$kiwi -> warning (
 				"$prefix: Failed to fixup ownership of $root/$file: $data"
 			);

Vulnerable code: 		my $data = qxx ("chroot $root chown -c root:root \"$file\" 2>&1");
Fixed code: 		my $data = qxx ("chroot $root chown -c root:root '".$file."' 2>&1");
CVE-2023-22467: Inefficient Regular Expression Complexity (CWE-1333)
value: Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the 2.x branch prior to 2.5.2, and the 3.x branch on 3.2.1, Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks. This issue also appears in Moment as CVE-2022-31129. Versions 1.38.1, 2.5.2, and 3.2.1 contain patches for this issue. As a workaround, limit the length of the input.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2023-01-04T22:15Z
Repository: https://github.com/moment/luxon
Language: JavaScript
Files changed: src/impl/regexParser.js
Commit date: 2023-01-04 15:19:36 -0500
Commit message: fix rfc2822 regex

Diff: diff --git a/src/impl/regexParser.js b/src/impl/regexParser.js
index 20c9f81..ab09586 100644
--- a/src/impl/regexParser.js
+++ b/src/impl/regexParser.js
@@ -223,11 +223,11 @@ function extractRFC2822(match) {
 }
 
 function preprocessRFC2822(s) {
   // Remove comments and folding whitespace and replace multiple-spaces with a single space
   return s
-    .replace(/\([^)]*\)|[\n\t]/g, " ")
+    .replace(/\([^()]*\)|[\n\t]/g, " ")
     .replace(/(\s\s+)/g, " ")
     .trim();
 }
 
 // http date

Vulnerable code:     .replace(/\([^)]*\)|[\n\t]/g, " ")
Fixed code:     .replace(/\([^()]*\)|[\n\t]/g, " ")
CVE-2023-28114: Improper Handling of Insufficient Permissions or Privileges  (CWE-280)
value: `cilium-cli` is the command line interface to install, manage, and troubleshoot Kubernetes clusters running Cilium. Prior to version 0.13.2,`cilium-cli`, when used to configure cluster mesh functionality, can remove the enforcement of user permissions on the `etcd` store used to mirror local cluster information to remote clusters. Users who have set up cluster meshes using the Cilium Helm chart are not affected by this issue.

Due to an incorrect mount point specification, the settings specified by the `initContainer` that configures `etcd` users and their permissions are overwritten when using `cilium-cli` to configure a cluster mesh. An attacker who has already gained access to a valid key and certificate for an `etcd` cluster compromised in this manner could then modify state in that `etcd` cluster.

This issue is patched in `cilium-cli` 0.13.2. As a workaround, one may use Cilium's Helm charts to create their cluster.
CWE description: The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.
CVSS v3 base score: 4.1
Published: 2023-03-22T19:15Z
Repository: https://github.com/cilium/cilium-cli
Language: Go
Files changed: clustermesh/clustermesh.go
Commit date: 2023-03-16 11:20:12 +0100
Commit message: clustermesh: correctly mount the etcd data dir in the init container

This commit fixes an incorrect volume mount specification for the init
container of the clustermesh-apiserver deployment created through
'cilium clustermesh enable', that caused the operations performed in the
init container itself to be disregarded.

Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>

Diff: diff --git a/clustermesh/clustermesh.go b/clustermesh/clustermesh.go
index 628b67f0..3e774d26 100644
--- a/clustermesh/clustermesh.go
+++ b/clustermesh/clustermesh.go
@@ -318,11 +318,11 @@ func (k *K8sClusterMesh) generateDeployment(clustermeshApiserverArgs []string) *
 							ImagePullPolicy: corev1.PullIfNotPresent,
 							Env:             k.etcdEnvs(),
 							VolumeMounts: []corev1.VolumeMount{
 								{
 									Name:      "etcd-data-dir",
-									MountPath: "etcd-data-dir",
+									MountPath: "/var/run/etcd",
 								},
 							},
 						},
 					},
 					Volumes: []corev1.Volume{

Vulnerable code: 									MountPath: "etcd-data-dir",
Fixed code: 									MountPath: "/var/run/etcd",
CVE-2023-28114: Improper Handling of Exceptional Conditions (CWE-755)
value: `cilium-cli` is the command line interface to install, manage, and troubleshoot Kubernetes clusters running Cilium. Prior to version 0.13.2,`cilium-cli`, when used to configure cluster mesh functionality, can remove the enforcement of user permissions on the `etcd` store used to mirror local cluster information to remote clusters. Users who have set up cluster meshes using the Cilium Helm chart are not affected by this issue.

Due to an incorrect mount point specification, the settings specified by the `initContainer` that configures `etcd` users and their permissions are overwritten when using `cilium-cli` to configure a cluster mesh. An attacker who has already gained access to a valid key and certificate for an `etcd` cluster compromised in this manner could then modify state in that `etcd` cluster.

This issue is patched in `cilium-cli` 0.13.2. As a workaround, one may use Cilium's Helm charts to create their cluster.
CWE description: The product does not handle or incorrectly handles an exceptional condition.
CVSS v3 base score: 4.1
Published: 2023-03-22T19:15Z
Repository: https://github.com/cilium/cilium-cli
Language: Go
Files changed: clustermesh/clustermesh.go
Commit date: 2023-03-16 11:20:12 +0100
Commit message: clustermesh: correctly mount the etcd data dir in the init container

This commit fixes an incorrect volume mount specification for the init
container of the clustermesh-apiserver deployment created through
'cilium clustermesh enable', that caused the operations performed in the
init container itself to be disregarded.

Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>

Diff: diff --git a/clustermesh/clustermesh.go b/clustermesh/clustermesh.go
index 628b67f0..3e774d26 100644
--- a/clustermesh/clustermesh.go
+++ b/clustermesh/clustermesh.go
@@ -318,11 +318,11 @@ func (k *K8sClusterMesh) generateDeployment(clustermeshApiserverArgs []string) *
 							ImagePullPolicy: corev1.PullIfNotPresent,
 							Env:             k.etcdEnvs(),
 							VolumeMounts: []corev1.VolumeMount{
 								{
 									Name:      "etcd-data-dir",
-									MountPath: "etcd-data-dir",
+									MountPath: "/var/run/etcd",
 								},
 							},
 						},
 					},
 					Volumes: []corev1.Volume{

Vulnerable code: 									MountPath: "etcd-data-dir",
Fixed code: 									MountPath: "/var/run/etcd",
CVE-2023-40585: Missing Authentication for Critical Function (CWE-306)
value: ironic-image is a container image to run OpenStack Ironic as part of Metal³. Prior to version capm3-v1.4.3, if Ironic is not deployed with TLS and it does not have API and Conductor split into separate services, access to the API is not protected by any authentication. Ironic API is also listening in host network. In case the node is not behind a firewall, the API could be accessed by anyone via network without authentication. By default, Ironic API in Metal3 is protected by TLS and basic authentication, so this vulnerability requires operator to configure API without TLS for it to be vulnerable. TLS and authentication however should not be coupled as they are in versions prior to capm3-v1.4.3. A patch exists in versions capm3-v1.4.3 and newer. Some workarounds are available. Either configure TLS for Ironic API (`deploy.sh -t ...`, `IRONIC_TLS_SETUP=true`) or split Ironic API and Conductor via configuration change (old implementation, not recommended). With both workarounds, services are configured with httpd front-end, which has proper authentication configuration in place.
CWE description: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CVSS v3 base score: 7.5
Published: 2023-08-25T21:15Z
Repository: https://github.com/metal3-io/ironic-image
Language: Unknown
Commit date: 2023-08-25 14:04:48 +0300
Commit message: Merge pull request from GHSA-jwpr-9fwh-m4g7

Add missing authentication to runironic
CVE-2021-45932: Out-of-bounds Write (CWE-787)
value: wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow (4 bytes) in MqttDecode_Publish (called from MqttClient_DecodePacket and MqttClient_HandlePacket).
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2022-01-01T01:15Z
Repository: https://github.com/wolfSSL/wolfMQTT
Language: C
Files changed: src/mqtt_client.c
Commit date: 2021-09-21 11:46:53 -0500
Commit message: Fix wolfmqtt-fuzzer: Null-dereference WRITE in MqttProps_Free

Diff: diff --git a/src/mqtt_client.c b/src/mqtt_client.c
index d06fac6..d392cc5 100644
--- a/src/mqtt_client.c
+++ b/src/mqtt_client.c
@@ -904,12 +904,13 @@ wait_again:
             }
 
             /* Determine if we received data for this request */
             if ((wait_type == MQTT_PACKET_TYPE_ANY ||
                  wait_type == packet_type ||
-                 MqttIsPubRespPacket(packet_type) == MqttIsPubRespPacket(wait_type)) &&
-               (wait_packet_id == 0 || wait_packet_id == packet_id))
+                 (MqttIsPubRespPacket(packet_type) &&
+                  MqttIsPubRespPacket(wait_type))) &&
+                (wait_packet_id == 0 || wait_packet_id == packet_id))
             {
                 use_packet_obj = packet_obj;
                 waitMatchFound = 1;
             }
             else {

Vulnerable code:                  MqttIsPubRespPacket(packet_type) == MqttIsPubRespPacket(wait_type)) &&
               (wait_packet_id == 0 || wait_packet_id == packet_id))
Fixed code:                  (MqttIsPubRespPacket(packet_type) &&
                  MqttIsPubRespPacket(wait_type))) &&
                (wait_packet_id == 0 || wait_packet_id == packet_id))
CVE-2021-45933: Out-of-bounds Write (CWE-787)
value: wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow (8 bytes) in MqttDecode_Publish (called from MqttClient_DecodePacket and MqttClient_HandlePacket).
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2022-01-01T01:15Z
Repository: https://github.com/wolfSSL/wolfMQTT
Language: C
Files changed: src/mqtt_client.c
Commit date: 2021-09-21 11:46:53 -0500
Commit message: Fix wolfmqtt-fuzzer: Null-dereference WRITE in MqttProps_Free

Diff: diff --git a/src/mqtt_client.c b/src/mqtt_client.c
index d06fac6..d392cc5 100644
--- a/src/mqtt_client.c
+++ b/src/mqtt_client.c
@@ -904,12 +904,13 @@ wait_again:
             }
 
             /* Determine if we received data for this request */
             if ((wait_type == MQTT_PACKET_TYPE_ANY ||
                  wait_type == packet_type ||
-                 MqttIsPubRespPacket(packet_type) == MqttIsPubRespPacket(wait_type)) &&
-               (wait_packet_id == 0 || wait_packet_id == packet_id))
+                 (MqttIsPubRespPacket(packet_type) &&
+                  MqttIsPubRespPacket(wait_type))) &&
+                (wait_packet_id == 0 || wait_packet_id == packet_id))
             {
                 use_packet_obj = packet_obj;
                 waitMatchFound = 1;
             }
             else {

Vulnerable code:                  MqttIsPubRespPacket(packet_type) == MqttIsPubRespPacket(wait_type)) &&
               (wait_packet_id == 0 || wait_packet_id == packet_id))
Fixed code:                  (MqttIsPubRespPacket(packet_type) &&
                  MqttIsPubRespPacket(wait_type))) &&
                (wait_packet_id == 0 || wait_packet_id == packet_id))
CVE-2021-45934: Out-of-bounds Write (CWE-787)
value: wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow in MqttClient_DecodePacket (called from MqttClient_HandlePacket and MqttClient_WaitType).
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2022-01-01T01:15Z
Repository: https://github.com/wolfSSL/wolfMQTT
Language: C
Files changed: src/mqtt_client.c
Commit date: 2021-09-21 11:46:53 -0500
Commit message: Fix wolfmqtt-fuzzer: Null-dereference WRITE in MqttProps_Free

Diff: diff --git a/src/mqtt_client.c b/src/mqtt_client.c
index d06fac6..d392cc5 100644
--- a/src/mqtt_client.c
+++ b/src/mqtt_client.c
@@ -904,12 +904,13 @@ wait_again:
             }
 
             /* Determine if we received data for this request */
             if ((wait_type == MQTT_PACKET_TYPE_ANY ||
                  wait_type == packet_type ||
-                 MqttIsPubRespPacket(packet_type) == MqttIsPubRespPacket(wait_type)) &&
-               (wait_packet_id == 0 || wait_packet_id == packet_id))
+                 (MqttIsPubRespPacket(packet_type) &&
+                  MqttIsPubRespPacket(wait_type))) &&
+                (wait_packet_id == 0 || wait_packet_id == packet_id))
             {
                 use_packet_obj = packet_obj;
                 waitMatchFound = 1;
             }
             else {

Vulnerable code:                  MqttIsPubRespPacket(packet_type) == MqttIsPubRespPacket(wait_type)) &&
               (wait_packet_id == 0 || wait_packet_id == packet_id))
Fixed code:                  (MqttIsPubRespPacket(packet_type) &&
                  MqttIsPubRespPacket(wait_type))) &&
                (wait_packet_id == 0 || wait_packet_id == packet_id))
CVE-2021-45936: Out-of-bounds Write (CWE-787)
value: wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow in MqttDecode_Disconnect (called from MqttClient_DecodePacket and MqttClient_WaitType).
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2022-01-01T01:15Z
Repository: https://github.com/wolfSSL/wolfMQTT
Language: C
Files changed: src/mqtt_client.c
Commit date: 2021-09-21 11:46:53 -0500
Commit message: Fix wolfmqtt-fuzzer: Null-dereference WRITE in MqttProps_Free

Diff: diff --git a/src/mqtt_client.c b/src/mqtt_client.c
index d06fac6..d392cc5 100644
--- a/src/mqtt_client.c
+++ b/src/mqtt_client.c
@@ -904,12 +904,13 @@ wait_again:
             }
 
             /* Determine if we received data for this request */
             if ((wait_type == MQTT_PACKET_TYPE_ANY ||
                  wait_type == packet_type ||
-                 MqttIsPubRespPacket(packet_type) == MqttIsPubRespPacket(wait_type)) &&
-               (wait_packet_id == 0 || wait_packet_id == packet_id))
+                 (MqttIsPubRespPacket(packet_type) &&
+                  MqttIsPubRespPacket(wait_type))) &&
+                (wait_packet_id == 0 || wait_packet_id == packet_id))
             {
                 use_packet_obj = packet_obj;
                 waitMatchFound = 1;
             }
             else {

Vulnerable code:                  MqttIsPubRespPacket(packet_type) == MqttIsPubRespPacket(wait_type)) &&
               (wait_packet_id == 0 || wait_packet_id == packet_id))
Fixed code:                  (MqttIsPubRespPacket(packet_type) &&
                  MqttIsPubRespPacket(wait_type))) &&
                (wait_packet_id == 0 || wait_packet_id == packet_id))
CVE-2021-45937: Out-of-bounds Write (CWE-787)
value: wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow in MqttClient_DecodePacket (called from MqttClient_WaitType and MqttClient_Connect).
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2022-01-01T01:15Z
Repository: https://github.com/wolfSSL/wolfMQTT
Language: C
Files changed: src/mqtt_client.c
Commit date: 2021-09-21 11:46:53 -0500
Commit message: Fix wolfmqtt-fuzzer: Null-dereference WRITE in MqttProps_Free

Diff: diff --git a/src/mqtt_client.c b/src/mqtt_client.c
index d06fac6..d392cc5 100644
--- a/src/mqtt_client.c
+++ b/src/mqtt_client.c
@@ -904,12 +904,13 @@ wait_again:
             }
 
             /* Determine if we received data for this request */
             if ((wait_type == MQTT_PACKET_TYPE_ANY ||
                  wait_type == packet_type ||
-                 MqttIsPubRespPacket(packet_type) == MqttIsPubRespPacket(wait_type)) &&
-               (wait_packet_id == 0 || wait_packet_id == packet_id))
+                 (MqttIsPubRespPacket(packet_type) &&
+                  MqttIsPubRespPacket(wait_type))) &&
+                (wait_packet_id == 0 || wait_packet_id == packet_id))
             {
                 use_packet_obj = packet_obj;
                 waitMatchFound = 1;
             }
             else {

Vulnerable code:                  MqttIsPubRespPacket(packet_type) == MqttIsPubRespPacket(wait_type)) &&
               (wait_packet_id == 0 || wait_packet_id == packet_id))
Fixed code:                  (MqttIsPubRespPacket(packet_type) &&
                  MqttIsPubRespPacket(wait_type))) &&
                (wait_packet_id == 0 || wait_packet_id == packet_id))
CVE-2021-45938: Out-of-bounds Write (CWE-787)
value: wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow in MqttClient_DecodePacket (called from MqttClient_WaitType and MqttClient_Unsubscribe).
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2022-01-01T01:15Z
Repository: https://github.com/wolfSSL/wolfMQTT
Language: C
Files changed: src/mqtt_client.c
Commit date: 2021-09-21 11:46:53 -0500
Commit message: Fix wolfmqtt-fuzzer: Null-dereference WRITE in MqttProps_Free

Diff: diff --git a/src/mqtt_client.c b/src/mqtt_client.c
index d06fac6..d392cc5 100644
--- a/src/mqtt_client.c
+++ b/src/mqtt_client.c
@@ -904,12 +904,13 @@ wait_again:
             }
 
             /* Determine if we received data for this request */
             if ((wait_type == MQTT_PACKET_TYPE_ANY ||
                  wait_type == packet_type ||
-                 MqttIsPubRespPacket(packet_type) == MqttIsPubRespPacket(wait_type)) &&
-               (wait_packet_id == 0 || wait_packet_id == packet_id))
+                 (MqttIsPubRespPacket(packet_type) &&
+                  MqttIsPubRespPacket(wait_type))) &&
+                (wait_packet_id == 0 || wait_packet_id == packet_id))
             {
                 use_packet_obj = packet_obj;
                 waitMatchFound = 1;
             }
             else {

Vulnerable code:                  MqttIsPubRespPacket(packet_type) == MqttIsPubRespPacket(wait_type)) &&
               (wait_packet_id == 0 || wait_packet_id == packet_id))
Fixed code:                  (MqttIsPubRespPacket(packet_type) &&
                  MqttIsPubRespPacket(wait_type))) &&
                (wait_packet_id == 0 || wait_packet_id == packet_id))
CVE-2021-45939: Out-of-bounds Write (CWE-787)
value: wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow in MqttClient_DecodePacket (called from MqttClient_WaitType and MqttClient_Subscribe).
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2022-01-01T01:15Z
Repository: https://github.com/wolfSSL/wolfMQTT
Language: C
Files changed: src/mqtt_client.c
Commit date: 2021-09-21 11:46:53 -0500
Commit message: Fix wolfmqtt-fuzzer: Null-dereference WRITE in MqttProps_Free

Diff: diff --git a/src/mqtt_client.c b/src/mqtt_client.c
index d06fac6..d392cc5 100644
--- a/src/mqtt_client.c
+++ b/src/mqtt_client.c
@@ -904,12 +904,13 @@ wait_again:
             }
 
             /* Determine if we received data for this request */
             if ((wait_type == MQTT_PACKET_TYPE_ANY ||
                  wait_type == packet_type ||
-                 MqttIsPubRespPacket(packet_type) == MqttIsPubRespPacket(wait_type)) &&
-               (wait_packet_id == 0 || wait_packet_id == packet_id))
+                 (MqttIsPubRespPacket(packet_type) &&
+                  MqttIsPubRespPacket(wait_type))) &&
+                (wait_packet_id == 0 || wait_packet_id == packet_id))
             {
                 use_packet_obj = packet_obj;
                 waitMatchFound = 1;
             }
             else {

Vulnerable code:                  MqttIsPubRespPacket(packet_type) == MqttIsPubRespPacket(wait_type)) &&
               (wait_packet_id == 0 || wait_packet_id == packet_id))
Fixed code:                  (MqttIsPubRespPacket(packet_type) &&
                  MqttIsPubRespPacket(wait_type))) &&
                (wait_packet_id == 0 || wait_packet_id == packet_id))
CVE-2013-4451: Permissions, Privileges, and Access Controls (CWE-264)
value: gitolite commit fa06a34 through 3.5.3 might allow attackers to have unspecified impact via vectors involving world-writable permissions when creating (1) ~/.gitolite.rc, (2) ~/.gitolite, or (3) ~/repositories/gitolite-admin.git on fresh installs.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
CVSS v3 base score: 9.8
Published: 2018-09-21T17:29Z
Repository: https://github.com/sitaramc/gitolite
Language: Perl
Files changed: src/lib/Gitolite/Rc.pm
Commit date: 2013-10-21 07:38:15 +0530
Commit message: oops; fa06a34 had a nasty bug for fresh installs

thanks to Nathan Ferch for catching this.  See thread with subject line "World
writable files and directories" on the mailing list.

Diff: diff --git a/src/lib/Gitolite/Rc.pm b/src/lib/Gitolite/Rc.pm
index b327637..75ff21a 100644
--- a/src/lib/Gitolite/Rc.pm
+++ b/src/lib/Gitolite/Rc.pm
@@ -91,11 +91,11 @@ unshift @{ $rc{ACCESS_1} }, 'Writable::access_1';
 do $ENV{G3T_RC} if exists $ENV{G3T_RC} and -r $ENV{G3T_RC};
 
 # setup some perl/rc/env vars, plus umask
 # ----------------------------------------------------------------------
 
-umask $rc{UMASK};
+umask ( $rc{UMASK} || 0077 );
 
 unshift @INC, "$rc{LOCAL_CODE}/lib" if $rc{LOCAL_CODE};
 
 $ENV{PATH} = "$ENV{GL_BINDIR}:$ENV{PATH}" unless $ENV{PATH} =~ /^$ENV{GL_BINDIR}:/;
 

Vulnerable code: umask $rc{UMASK};
Fixed code: umask ( $rc{UMASK} || 0077 );
CVE-2024-40630: Insufficient Information (NVD-CWE-noinfo)
value: OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation via a format-agnostic API with a feature set, scalability, and robustness needed for feature film production. In affected versions there is a bug in the heif input functionality of OpenImageIO. Specifically, in `HeifInput::seek_subimage()`.  In the worst case, this can lead to an information disclosure vulnerability, particularly for programs that directly use the `ImageInput` APIs. This bug has been addressed in commit `0a2dcb4c` which is included in the 2.5.13.1 release. Users are advised to upgrade. There are no known workarounds for this issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-15T20:15Z
Repository: https://github.com/AcademySoftwareFoundation/OpenImageIO
Language: C++
Files changed: src/heif.imageio/heifinput.cpp
Commit date: 2024-07-15 09:30:17 -0400
Commit message: fix(heic): Correctly set imagespec size for heif images

Signed-off-by: Gerrard Tai <42868323+flyyee@users.noreply.github.com>

Diff: diff --git a/src/heif.imageio/heifinput.cpp b/src/heif.imageio/heifinput.cpp
index 436b9a51..8fae5d13 100644
--- a/src/heif.imageio/heifinput.cpp
+++ b/src/heif.imageio/heifinput.cpp
@@ -245,12 +245,13 @@ HeifInput::seek_subimage(int subimage, int miplevel)
         return false;
     }
 #endif
 
     int bits = m_himage.get_bits_per_pixel(heif_channel_interleaved);
-    m_spec = ImageSpec(m_ihandle.get_width(), m_ihandle.get_height(), bits / 8,
-                       TypeUInt8);
+    m_spec   = ImageSpec(m_himage.get_width(heif_channel_interleaved),
+                         m_himage.get_height(heif_channel_interleaved), bits / 8,
+                         TypeUInt8);
 
     m_spec.attribute("oiio:ColorSpace", "sRGB");
 
 #if LIBHEIF_HAVE_VERSION(1, 12, 0)
     // Libheif >= 1.12 added API call to find out if the image is associated

Vulnerable code:     m_spec = ImageSpec(m_ihandle.get_width(), m_ihandle.get_height(), bits / 8,
                       TypeUInt8);
Fixed code:     m_spec   = ImageSpec(m_himage.get_width(heif_channel_interleaved),
                         m_himage.get_height(heif_channel_interleaved), bits / 8,
                         TypeUInt8);
CVE-2021-32631: Authentication Bypass by Spoofing (CWE-290)
value: Common is a package of common modules that can be accessed by NIMBLE services. Common before commit number 3b96cb0293d3443b870351945f41d7d55cb34b53 did not properly verify the signature of JSON Web Tokens. This allows someone to forge a valid JWT. Being able to forge JWTs may lead to authentication bypasses. Commit number 3b96cb0293d3443b870351945f41d7d55cb34b53 contains a patch for the issue. As a workaround, one may use the parseClaimsJws method to correctly verify the signature of a JWT.
CWE description: This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
CVSS v3 base score: 6.5
Published: 2021-07-26T16:15Z
Repository: https://github.com/nimble-platform/common
Language: Java
Files changed: utility/src/main/java/eu/nimble/utility/validation/ValidationUtil.java
Commit date: 2021-07-26 14:22:37 +0300
Commit message: Use parseClaimsJws method instead of parseJws

Diff: diff --git a/utility/src/main/java/eu/nimble/utility/validation/ValidationUtil.java b/utility/src/main/java/eu/nimble/utility/validation/ValidationUtil.java
index b235dd3..4078ad9 100644
--- a/utility/src/main/java/eu/nimble/utility/validation/ValidationUtil.java
+++ b/utility/src/main/java/eu/nimble/utility/validation/ValidationUtil.java
@@ -34,11 +34,11 @@ public class ValidationUtil implements IValidationUtil {
     public Claims validateToken(String token) throws AuthenticationException {
         try {
             RsaKeyUtil rsaKeyUtil = new RsaKeyUtil();
             PublicKey publicKey = rsaKeyUtil.fromPemEncoded(keycloakPublicKey);
 
-            return Jwts.parser().setSigningKey(publicKey).parseJws(token.replace("Bearer ", "")).getBody();
+            return Jwts.parser().setSigningKey(publicKey).parseClaimsJws(token.replace("Bearer ", "")).getBody();
         } catch (Exception e){
             throw new AuthenticationException(String.format("Failed to check user authorization for token: %s", token), e);
         }
     }
 

Vulnerable code:             return Jwts.parser().setSigningKey(publicKey).parseJws(token.replace("Bearer ", "")).getBody();
Fixed code:             return Jwts.parser().setSigningKey(publicKey).parseClaimsJws(token.replace("Bearer ", "")).getBody();
CVE-2021-32631: Authentication Bypass by Spoofing (CWE-290)
value: Common is a package of common modules that can be accessed by NIMBLE services. Common before commit number 3b96cb0293d3443b870351945f41d7d55cb34b53 did not properly verify the signature of JSON Web Tokens. This allows someone to forge a valid JWT. Being able to forge JWTs may lead to authentication bypasses. Commit number 3b96cb0293d3443b870351945f41d7d55cb34b53 contains a patch for the issue. As a workaround, one may use the parseClaimsJws method to correctly verify the signature of a JWT.
CWE description: This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
CVSS v3 base score: 6.5
Published: 2021-07-26T16:15Z
Repository: https://github.com/nimble-platform/common
Language: Java
Files changed: utility/src/main/java/eu/nimble/utility/validation/ValidationUtil.java
Commit date: 2021-05-20 10:02:42 +0200
Commit message: Fixed JWT validation according to https://github.com/nimble-platform/common/security/advisories/GHSA-fjq8-896w-pv28

Diff: diff --git a/utility/src/main/java/eu/nimble/utility/validation/ValidationUtil.java b/utility/src/main/java/eu/nimble/utility/validation/ValidationUtil.java
index 60780c2..b235dd3 100644
--- a/utility/src/main/java/eu/nimble/utility/validation/ValidationUtil.java
+++ b/utility/src/main/java/eu/nimble/utility/validation/ValidationUtil.java
@@ -34,11 +34,11 @@ public class ValidationUtil implements IValidationUtil {
     public Claims validateToken(String token) throws AuthenticationException {
         try {
             RsaKeyUtil rsaKeyUtil = new RsaKeyUtil();
             PublicKey publicKey = rsaKeyUtil.fromPemEncoded(keycloakPublicKey);
 
-            return (Claims) Jwts.parser().setSigningKey(publicKey).parse(token.replace("Bearer ", "")).getBody();
+            return Jwts.parser().setSigningKey(publicKey).parseJws(token.replace("Bearer ", "")).getBody();
         } catch (Exception e){
             throw new AuthenticationException(String.format("Failed to check user authorization for token: %s", token), e);
         }
     }
 

Vulnerable code:             return (Claims) Jwts.parser().setSigningKey(publicKey).parse(token.replace("Bearer ", "")).getBody();
Fixed code:             return Jwts.parser().setSigningKey(publicKey).parseJws(token.replace("Bearer ", "")).getBody();
CVE-2021-32631: Authentication Bypass by Spoofing (CWE-290)
value: Common is a package of common modules that can be accessed by NIMBLE services. Common before commit number 3b96cb0293d3443b870351945f41d7d55cb34b53 did not properly verify the signature of JSON Web Tokens. This allows someone to forge a valid JWT. Being able to forge JWTs may lead to authentication bypasses. Commit number 3b96cb0293d3443b870351945f41d7d55cb34b53 contains a patch for the issue. As a workaround, one may use the parseClaimsJws method to correctly verify the signature of a JWT.
CWE description: This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
CVSS v3 base score: 6.5
Published: 2021-07-26T16:15Z
Repository: https://github.com/nimble-platform/common
Language: Unknown
Commit date: 2021-07-26 15:15:36 +0300
Commit message: Merge pull request #81 from nimble-platform/staging

Staging
CVE-2014-8567: Resource Management Errors (CWE-399)
value: The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data.
CWE description: Weaknesses in this category are related to improper management of system resources.
Published: 2014-11-14T15:59Z
Repository: https://github.com/UNINETT/mod_auth_mellon
Language: Other
Files changed: NEWS
Commit date: 2014-08-27 15:37:48 +0200
Commit message: Add NEWS-file for 0.9.0.

Diff: diff --git a/NEWS b/NEWS
index c303a8c..3b34248 100644
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,19 @@
+Version 0.9.0
+---------------------------------------------------------------------------
+
+* Set the AssertionConsumerServiceURL attribute in authentication
+  requests.
+
+* Bugfixes:
+
+  * Fix use of uninitialized data during logout.
+
+  * Fix session entry overflow leading to segmentation faults.
+
+  * Fix looking up sessions by NameID, which is used during logout.
+
 Version 0.8.0
 ---------------------------------------------------------------------------
 
 * Add support for receiving HTTP-Artifact identifiers as POST data.
 

Fixed code: Version 0.9.0
---------------------------------------------------------------------------

* Set the AssertionConsumerServiceURL attribute in authentication
  requests.

* Bugfixes:

  * Fix use of uninitialized data during logout.

  * Fix session entry overflow leading to segmentation faults.

  * Fix looking up sessions by NameID, which is used during logout.
CVE-2022-21646: Other (NVD-CWE-Other)
value: SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under the right hand branch of an `exclusion` or within an `intersection` operation will see `Lookup`/`LookupResources` return a resource as "accessible" if it is *not* accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion. In `v1.3.0`, the wildcard is ignored entirely in lookup's dispatch, resulting in the `banned` wildcard being ignored in the exclusion. Version 1.4.0 contains a patch for this issue. As a workaround, don't make use of wildcards on the right side of intersections or within exclusions.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 8.1
Published: 2022-01-11T22:15Z
Repository: https://github.com/authzed/spicedb
Language: Unknown
Commit date: 2022-01-11 14:39:23 -0500
Commit message: Merge pull request from GHSA-7p8f-8hjm-wm92

Fix handling of wildcards in lookup dispatch
CVE-2023-29193: Generation of Error Message Containing Sensitive Information (CWE-209)
value: SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. The `spicedb serve` command contains a flag named `--grpc-preshared-key` which is used to protect the gRPC API from being accessed by unauthorized requests. The values of this flag are to be considered sensitive, secret data. The `/debug/pprof/cmdline` endpoint served by the metrics service (defaulting running on port `9090`) reveals the command-line flags provided for debugging purposes. If a password is set via the `--grpc-preshared-key` then the key is revealed by this endpoint along with any other flags provided to the SpiceDB binary. This issue has been fixed in version 1.19.1.

### Impact

All deployments abiding by the recommended best practices for production usage are **NOT affected**:
- Authzed's SpiceDB Serverless
- Authzed's SpiceDB Dedicated
- SpiceDB Operator

Users configuring SpiceDB via environment variables are **NOT affected**.

Users **MAY be affected** if they expose their metrics port to an untrusted network and are configuring `--grpc-preshared-key` via command-line flag.

### Patches

TODO

### Workarounds

To workaround this issue you can do one of the following:

- Configure the preshared key via an environment variable (e.g. `SPICEDB_GRPC_PRESHARED_KEY=yoursecret spicedb serve`)
- Reconfigure the `--metrics-addr` flag to bind to a trusted network (e.g. `--metrics-addr=localhost:9090`)
- Disable the metrics service via the flag (e.g. `--metrics-enabled=false`)
- Adopt one of the recommended deployment models: [Authzed's managed services](https://authzed.com/pricing) or the [SpiceDB Operator](https://github.com/authzed/spicedb-operator)

### References

- [GitHub Security Advisory issued for SpiceDB](https://github.com/authzed/spicedb/security/advisories/GHSA-cjr9-mr35-7xh6)
- [Go issue #22085](https://github.com/golang/go/issues/22085) for documenting the risks of exposing pprof to the internet
- [Go issue #42834](https://github.com/golang/go/issues/42834) discusses preventing pprof registration to the default serve mux
- [semgrep rule go.lang.security.audit.net.pprof.pprof-debug-exposure](https://semgrep.dev/r?q=go.lang.security.audit.net.pprof) checks for a variation of this issue

### Credit

We'd like to thank Amit Laish, a security researcher at GE Vernova for responsibly disclosing this vulnerability.

CWE description: The product generates an error message that includes sensitive information about its environment, users, or associated data.
CVSS v3 base score: 7.5
Published: 2023-04-14T20:15Z
Repository: https://github.com/authzed/spicedb
Language: Unknown
Commit date: 2023-04-13 11:51:01 -0400
Commit message: Merge pull request from GHSA-cjr9-mr35-7xh6

pkg/cmd: disable cmdline profile
CVE-2023-46255: Insertion of Sensitive Information into Log File (CWE-532)
value: SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Prior to version 1.27.0-rc1, when the provided datastore URI is malformed (e.g. by having a password which contains `:`) the full URI (including the provided password) is printed, so that the password is shown in the logs. Version 1.27.0-rc1 patches this issue.
CWE description: Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
CVSS v3 base score: 6.5
Published: 2023-10-31T16:15Z
Repository: https://github.com/authzed/spicedb
Language: Unknown
Commit date: 2023-10-30 14:02:20 -0400
Commit message: Merge pull request from GHSA-jg7w-cxjv-98c2

Redact any passwords found in datastore config errors
CVE-2024-27101: Insufficient Information (NVD-CWE-noinfo)
value: SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Integer overflow in chunking helper causes dispatching to miss elements or panic.  Any SpiceDB cluster with any schema where a resource being checked has more than 65535 relationships for the same resource and subject type is affected by this problem.  The CheckPermission, BulkCheckPermission, and LookupSubjects API methods are affected. This vulnerability is fixed in 1.29.2.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-01T21:15Z
Repository: https://github.com/authzed/spicedb
Language: Unknown
Commit date: 2024-03-01 15:50:06 -0500
Commit message: Merge pull request from GHSA-h3m7-rqc4-7h9p

fix chunking integer overflow
CVE-2024-32001: Insufficient Information (NVD-CWE-noinfo)
value: SpiceDB is a graph database purpose-built for storing and evaluating access control data. Use of a relation of the form: `relation folder: folder | folder#parent` with an arrow such as `folder->view` can cause LookupSubjects to only return the subjects found under subjects for either `folder` or `folder#parent`. This bug only manifests if the same subject type is used multiple types in a relation, relationships exist for both subject types and an arrow is used over the relation. Any user making a negative authorization decision based on the results of a LookupSubjects request with version before v1.30.1 is affected. Version 1.30.1 contains a patch for the issue. As a workaround, avoid using LookupSubjects for negative authorization decisions and/or avoid using the broken schema.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-10T23:15Z
Repository: https://github.com/authzed/spicedb
Language: Unknown
Commit date: 2024-04-10 17:45:21 -0400
Commit message: Merge pull request from GHSA-j85q-46hg-36p2

Fix SubjectSetByType to properly *merge* mapped relations
CVE-2024-38361: Insufficient Information (NVD-CWE-noinfo)
value: Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Use of an exclusion under an arrow that has multiple resources may resolve to `NO_PERMISSION` when permission is expected. If the resource exists under *multiple* folders and the user has access to view more than a single folder, SpiceDB may report the user does not have access due to a failure in the exclusion dispatcher to request that *all* the folders in which the user is a member be returned. Permission is returned as `NO_PERMISSION` when `PERMISSION` is expected on the `CheckPermission` API. This issue has been addressed in version 1.33.1. All users are advised to upgrade. There are no known workarounds for this issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-06-20T23:15Z
Repository: https://github.com/authzed/spicedb
Language: Unknown
Commit date: 2024-06-20 11:33:19 -0400
Commit message: Merge pull request from GHSA-grjv-gjgr-66g2

Fix exclusion operation in Check dispatch to *always* request the full set of results for the first branch