Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2021-3836: Improper Restriction of XML External Entity Reference (CWE-611)
value: dbeaver is vulnerable to Improper Restriction of XML External Entity Reference
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 5.5
Published: 2021-12-14T16:15Z
Repository: https://github.com/dbeaver/dbeaver
Language: Java
Files changed: bundles/org.jkiss.utils/src/org/jkiss/utils/xml/XMLUtils.java
Commit date: 2021-10-04 13:13:02 +0300
Commit message: dbeaver/dbeaver-ee#1166 prevent XXE

Diff: diff --git a/bundles/org.jkiss.utils/src/org/jkiss/utils/xml/XMLUtils.java b/bundles/org.jkiss.utils/src/org/jkiss/utils/xml/XMLUtils.java
index 51754aa541..c035633d7b 100644
--- a/bundles/org.jkiss.utils/src/org/jkiss/utils/xml/XMLUtils.java
+++ b/bundles/org.jkiss.utils/src/org/jkiss/utils/xml/XMLUtils.java
@@ -15,10 +15,11 @@
  * limitations under the License.
  */
 
 package org.jkiss.utils.xml;
 
+import javax.xml.XMLConstants;
 import org.jkiss.code.NotNull;
 import org.jkiss.code.Nullable;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 import org.xml.sax.InputSource;
@@ -60,10 +61,11 @@ public class XMLUtils {
 
     public static Document parseDocument(InputSource source) throws XMLException {
         try {
             DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
             DocumentBuilder xmlBuilder = dbf.newDocumentBuilder();
+            dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
             return xmlBuilder.parse(source);
         } catch (Exception er) {
             throw new XMLException("Error parsing XML document", er);
         }
     }

Fixed code: import javax.xml.XMLConstants;
            dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
CVE-2021-41167: Allocation of Resources Without Limits or Throttling (CWE-770)
value: modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they don't. Any code calling these functions will be written thinking they would limit the concurrency but they won't. This could lead to potential security issues in other projects. The problem has been patched in 1.0.4. There is no workaround.
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 7.5
Published: 2021-10-20T19:15Z
Repository: https://github.com/nicolas-van/modern-async
Language: Other
Files changed: src/forEachLimit.mjs
Commit date: 2021-10-19 23:22:02 +0200
Commit message: Fix #5

Diff: diff --git a/src/forEachLimit.mjs b/src/forEachLimit.mjs
index 08841a7..e6c44fe 100644
--- a/src/forEachLimit.mjs
+++ b/src/forEachLimit.mjs
@@ -33,10 +33,10 @@ import mapLimit from './mapLimit.mjs'
  *   // the concurrency limit and the internal scheduling order)
  * })
  */
 async function forEachLimit (iterable, iteratee, concurrency) {
   await mapLimit(iterable, async (v, i, t) => {
-    iteratee(v, i, t)
+    await iteratee(v, i, t)
   }, concurrency)
 }
 
 export default forEachLimit

Vulnerable code:     iteratee(v, i, t)
Fixed code:     await iteratee(v, i, t)
CVE-2023-37280: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Pimcore Admin Classic Bundle provides a Backend UI for Pimcore based on the ExtJS framework. An admin who has not setup two factor authentication before is vulnerable for this attack, without need for any form of privilege, causing the application to execute arbitrary scripts/HTML content. This vulnerability has been patched in version 1.0.3.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-07-11T19:15Z
Repository: https://github.com/pimcore/admin-ui-classic-bundle
Language: Other
Files changed: templates/admin/login/two_factor_setup.html.twig
Commit date: 2023-07-06 16:46:13 +0200
Commit message: Fix xss in admin login 2fa setup page (#147)

* Fix xss in admin login 2fa setup page

* Remove raw from the twig as the error message shouldn't have html
Diff: diff --git a/templates/admin/login/two_factor_setup.html.twig b/templates/admin/login/two_factor_setup.html.twig
index c3c92ccbe..bf2b87280 100644
--- a/templates/admin/login/two_factor_setup.html.twig
+++ b/templates/admin/login/two_factor_setup.html.twig
@@ -1,11 +1,11 @@
 {% extends '@PimcoreAdmin/admin/login/layout.html.twig' %}
 
 {% block content %}
     {% if error is defined %}
         <div class="text error">
-            {{ error|trans([],'admin')|raw }}
+            {{ error|trans([],'admin') }}
         </div>
     {% else %}
         <div class="text info">
             {{ 'Enter your verification code'|trans([],'admin') }}
         </div>

Vulnerable code:             {{ error|trans([],'admin')|raw }}
Fixed code:             {{ error|trans([],'admin') }}
CVE-2023-49075: Use of Single-factor Authentication (CWE-308)
value: The Admin Classic Bundle provides a Backend UI for Pimcore. `AdminBundle\Security\PimcoreUserTwoFactorCondition` introduced in v11 disable the two factor authentication for all non-admin security firewalls. An authenticated user can access the system without having to provide the two factor credentials. This issue has been patched in version 1.2.2.


CWE description: The use of single-factor authentication can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme.
CVSS v3 base score: 7.2
Published: 2023-11-28T05:15Z
Repository: https://github.com/pimcore/admin-ui-classic-bundle
Language: PHP
Files changed: src/Security/PimcoreUserTwoFactorCondition.php
Commit date: 2023-11-10 12:51:20 +0100
Commit message: Fix 2FA authentication for firewalls other than admin (#345)


Diff: diff --git a/src/Security/PimcoreUserTwoFactorCondition.php b/src/Security/PimcoreUserTwoFactorCondition.php
index c74cac25de..81ea7a3cac 100644
--- a/src/Security/PimcoreUserTwoFactorCondition.php
+++ b/src/Security/PimcoreUserTwoFactorCondition.php
@@ -25,12 +25,13 @@ use Scheb\TwoFactorBundle\Security\TwoFactor\Condition\TwoFactorConditionInterfa
  */
 class PimcoreUserTwoFactorCondition implements TwoFactorConditionInterface
 {
     public function shouldPerformTwoFactorAuthentication(AuthenticationContextInterface $context): bool
     {
+        //return true for performing two factor for firewalls other than admin
         if ($context->getFirewallName() !== 'pimcore_admin') {
-            return false;
+            return true;
         }
 
         $user = $context->getUser();
 
         if (!$user instanceof User) {

Vulnerable code:             return false;
Fixed code:         //return true for performing two factor for firewalls other than admin
            return true;
CVE-2023-5844: Improper Authentication (CWE-287)
value: Unverified Password Change in GitHub repository pimcore/admin-ui-classic-bundle prior to 1.2.0.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 7.2
Published: 2023-10-30T11:15Z
Repository: https://github.com/pimcore/admin-ui-classic-bundle
Language: PHP
Files changed: CHANGELOG.md, src/Controller/Admin/UserController.php
Commit date: 2023-09-26 09:37:41 +0200
Commit message: [Improvement]: Check if new password is NOT the same as the old one when resetting (#285)

* add check that new passoword is different than old one

* refactor empty old password check

* add CHANGELOG

* Update CHANGELOG.md

---------

Co-authored-by: Divesh Pahuja <divesh.pahuja@pimcore.com>
Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 01dc897135..f1cf8433e4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,7 +1,8 @@
 #### v1.2.0
  - DataObject used to automatically reload version after save, but now it's triggered only on successfull save. The reload can be forced by setting `forceReloadVersionsAfterSave` to `true` in a `postSaveObject` event listener.
+ - [User -> Settings] When resetting password, setting the new password same as the old one would throw an error.
 
 #### v1.1.0
  - `Pimcore\Bundle\AdminBundle\Service\ElementService` is marked as internal.
  - Deprecated `DocumentTreeConfigTrait`
  - Added `pimcore.events.prepareAffectedNodes` js event to extend node refresh on tree update. It can be used to 
diff --git a/src/Controller/Admin/UserController.php b/src/Controller/Admin/UserController.php
index 4a1b242b32..146ad85192 100644
--- a/src/Controller/Admin/UserController.php
+++ b/src/Controller/Admin/UserController.php
@@ -587,10 +587,15 @@ class UserController extends AdminAbstractController implements KernelController
                     if (strlen($values['new_password']) < 10) {
                         throw new \Exception('Passwords have to be at least 10 characters long');
                     }
 
                     if ($oldPasswordCheck && $values['new_password'] == $values['retype_password']) {
+
+                        if (Tool\Authentication::verifyPassword($user, $values['new_password'])) {
+                            throw new \Exception('The new password cannot be the same as the old one');
+                        }
+
                         $values['password'] = Tool\Authentication::getPasswordHash($user->getName(), $values['new_password']);
                     } else {
                         if (!$oldPasswordCheck) {
                             return $this->adminJson(['success' => false, 'message' => 'incorrect_password']);
                         }

Fixed code:  - [User -> Settings] When resetting password, setting the new password same as the old one would throw an error.

                        if (Tool\Authentication::verifyPassword($user, $values['new_password'])) {
                            throw new \Exception('The new password cannot be the same as the old one');
                        }
CVE-2024-24822: Missing Authorization (CWE-862)
value: Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Prior to version 1.3.3, an attacker can create, delete etc. tags without having the permission to do so. A fix is available in version 1.3.3. As a workaround, one may apply the patch manually.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 9.1
Published: 2024-02-07T18:15Z
Repository: https://github.com/pimcore/admin-ui-classic-bundle
Language: PHP
Files changed: src/Controller/Admin/TagsController.php
Commit date: 2024-02-07 10:31:46 +0100
Commit message: Fix: Tag access rights (#412)


Diff: diff --git a/src/Controller/Admin/TagsController.php b/src/Controller/Admin/TagsController.php
index 119270ea9b..7bde330ab0 100644
--- a/src/Controller/Admin/TagsController.php
+++ b/src/Controller/Admin/TagsController.php
@@ -39,10 +39,12 @@ class TagsController extends AdminAbstractController
      *
      * @return JsonResponse
      */
     public function addAction(Request $request): JsonResponse
     {
+        $this->checkPermission('tags_configuration');
+
         try {
             $tag = new Tag();
             $tag->setName(strip_tags($request->get('text', '')));
             $tag->setParentId((int)$request->get('parentId'));
             $tag->save();
@@ -62,10 +64,12 @@ class TagsController extends AdminAbstractController
      *
      * @throws \Exception
      */
     public function deleteAction(Request $request): JsonResponse
     {
+        $this->checkPermission('tags_configuration');
+
         $tag = Tag::getById((int) $request->get('id'));
         if ($tag) {
             $tag->delete();
 
             return $this->adminJson(['success' => true]);
@@ -83,10 +87,12 @@ class TagsController extends AdminAbstractController
      *
      * @throws \Exception
      */
     public function updateAction(Request $request): JsonResponse
     {
+        $this->checkPermission('tags_configuration');
+
         $tag = Tag::getById((int) $request->get('id'));
         if ($tag) {
             $parentId = $request->get('parentId');
             if ($parentId || $parentId === '0') {
                 $tag->setParentId((int)$parentId);

Fixed code:         $this->checkPermission('tags_configuration');

        $this->checkPermission('tags_configuration');

        $this->checkPermission('tags_configuration');
CVE-2021-27815: NULL Pointer Dereference (CWE-476)
value: NULL Pointer Deference in the exif command line tool, when printing out XML formatted EXIF data, in exif v0.6.22 and earlier allows attackers to cause a Denial of Service (DoS) by uploading a malicious JPEG file, causing the application to crash.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2021-04-14T14:15Z
Repository: https://github.com/libexif/exif
Language: C
Files changed: exif/actions.c
Commit date: 2021-02-25 09:45:36 +0100
Commit message: actually return empty stringand not 'em,pty string' as expected

Diff: diff --git a/exif/actions.c b/exif/actions.c
index 123c064..4fade01 100644
--- a/exif/actions.c
+++ b/exif/actions.c
@@ -659,11 +659,11 @@ escape_xml(const char *text)
 	static char *escaped;
 	static size_t escaped_size;
 	char *out;
 	size_t len;
 
-	if (!strlen(text)) return "empty string";
+	if (!strlen(text)) return "";
 
 	for (out=escaped, len=0; *text; ++len, ++out, ++text) {
 		/* Make sure there's plenty of room for a quoted character */
 		if ((len + 8) > escaped_size) {
 			char *bigger_escaped;

Vulnerable code: 	if (!strlen(text)) return "empty string";
Fixed code: 	if (!strlen(text)) return "";
CVE-2021-27815: NULL Pointer Dereference (CWE-476)
value: NULL Pointer Deference in the exif command line tool, when printing out XML formatted EXIF data, in exif v0.6.22 and earlier allows attackers to cause a Denial of Service (DoS) by uploading a malicious JPEG file, causing the application to crash.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2021-04-14T14:15Z
Repository: https://github.com/libexif/exif
Language: C
Files changed: exif/actions.c
Commit date: 2021-02-25 08:31:53 +0100
Commit message: added empty strign check, which would lead to NULL ptr deref/crash in exif XML display. fixes https://github.com/libexif/exif/issues/4

Diff: diff --git a/exif/actions.c b/exif/actions.c
index ed245df..123c064 100644
--- a/exif/actions.c
+++ b/exif/actions.c
@@ -659,10 +659,12 @@ escape_xml(const char *text)
 	static char *escaped;
 	static size_t escaped_size;
 	char *out;
 	size_t len;
 
+	if (!strlen(text)) return "empty string";
+
 	for (out=escaped, len=0; *text; ++len, ++out, ++text) {
 		/* Make sure there's plenty of room for a quoted character */
 		if ((len + 8) > escaped_size) {
 			char *bigger_escaped;
 			escaped_size += 128;

Fixed code: 	if (!strlen(text)) return "empty string";
CVE-2022-0355: Improper Removal of Sensitive Information Before Storage or Transfer (CWE-212)
value: Improper Removal of Sensitive Information Before Storage or Transfer in NPM simple-get prior to 4.0.1.


CWE description: The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
CVSS v3 base score: 7.5
Published: 2022-01-26T04:15Z
Repository: https://github.com/feross/simple-get
Language: Unknown
Commit date: 2022-01-24 19:23:27 -0800
Commit message: Merge pull request #73 from ranjit-git/master
CVE-2018-11363: Out-of-bounds Read (CWE-125)
value: jpeg_size in pdfgen.c in PDFGen before 2018-04-09 has a heap-based buffer over-read.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2018-05-22T04:29Z
Repository: https://github.com/AndreRenaud/PDFGen
Language: C
Files changed: pdfgen.c
Commit date: 2018-04-10 09:21:34 +1200
Commit message: jpeg: Fix another possible buffer overrun

Found via the clang libfuzzer

Diff: diff --git a/pdfgen.c b/pdfgen.c
index 4ae05df..90ce287 100644
--- a/pdfgen.c
+++ b/pdfgen.c
@@ -2034,11 +2034,12 @@ static int jpeg_size(unsigned char* data, unsigned int data_size,
                     *height = data[i+5]*256 + data[i+6];
                     *width = data[i+7]*256 + data[i+8];
                     return 0;
                 }
                 i+=2;
-                block_length = data[i] * 256 + data[i+1];
+                if (i + 1 < data_size)
+                    block_length = data[i] * 256 + data[i+1];
             }
         }
     }
 
     return -1;

Vulnerable code:                 block_length = data[i] * 256 + data[i+1];
Fixed code:                 if (i + 1 < data_size)
                    block_length = data[i] * 256 + data[i+1];
CVE-2021-4293: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in gnuboard youngcart5 up to 5.4.5.1. Affected is an unknown function of the file adm/menu_list_update.php. The manipulation of the argument me_link leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 5.4.5.2 is able to address this issue. The name of the patch is 70daa537adfa47b87af12d85f1e698fff01785ff. It is recommended to upgrade the affected component. VDB-216954 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-28T09:15Z
Repository: https://github.com/gnuboard/youngcart5
Language: PHP
Files changed: adm/menu_list_update.php
Commit date: 2021-03-16 15:17:26 +0900
Commit message: [KVE-2020-1616]그누보드 메인화면 XSS 취약점 수정

Diff: diff --git a/adm/menu_list_update.php b/adm/menu_list_update.php
index 9a3ecd4..f62ab47 100644
--- a/adm/menu_list_update.php
+++ b/adm/menu_list_update.php
@@ -19,11 +19,15 @@ $count = count($_POST['code']);
 
 for ($i=0; $i<$count; $i++)
 {
     $_POST = array_map_deep('trim', $_POST);
     
-    $_POST['me_link'][$i] = is_array($_POST['me_link']) ? clean_xss_tags(clean_xss_attributes($_POST['me_link'][$i], 1)) : '';
+    if(preg_match('/^javascript/i', preg_replace('/[ ]{1,}|[\t]/', '', $_POST['me_link'][$i]))){
+        $_POST['me_link'][$i] = G5_URL;
+    }
+
+    $_POST['me_link'][$i] = is_array($_POST['me_link']) ? clean_xss_tags(clean_xss_attributes(preg_replace('/[ ]{2,}|[\t]/', '', $_POST['me_link'][$i]), 1)) : '';
 
     $code    = is_array($_POST['code']) ? strip_tags($_POST['code'][$i]) : '';
     $me_name = is_array($_POST['me_name']) ? strip_tags($_POST['me_name'][$i]) : '';
     $me_link = (preg_match('/^javascript/i', $_POST['me_link'][$i]) || preg_match('/script:/i', $_POST['me_link'][$i])) ? G5_URL : strip_tags(clean_xss_attributes($_POST['me_link'][$i]));
     

Vulnerable code:     $_POST['me_link'][$i] = is_array($_POST['me_link']) ? clean_xss_tags(clean_xss_attributes($_POST['me_link'][$i], 1)) : '';
Fixed code:     if(preg_match('/^javascript/i', preg_replace('/[ ]{1,}|[\t]/', '', $_POST['me_link'][$i]))){
        $_POST['me_link'][$i] = G5_URL;
    }

    $_POST['me_link'][$i] = is_array($_POST['me_link']) ? clean_xss_tags(clean_xss_attributes(preg_replace('/[ ]{2,}|[\t]/', '', $_POST['me_link'][$i]), 1)) : '';
CVE-2010-4264: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: It was found in vanilla forums before 2.0.10 a cross-site scripting vulnerability where a filename could contain arbitrary code to execute on the client side.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-06-22T14:15Z
Repository: https://github.com/vanilla/vanilla
Language: PHP
Files changed: applications/dashboard/controllers/class.entrycontroller.php, library/core/class.dispatcher.php
Commit date: 2010-09-27 11:22:20 -0400
Commit message: Fixed XSS vulnerability where filename could contain abitrary code to execute on the client side.

Diff: diff --git a/applications/dashboard/controllers/class.entrycontroller.php b/applications/dashboard/controllers/class.entrycontroller.php
index 20e30750..ad3ee937 100755
--- a/applications/dashboard/controllers/class.entrycontroller.php
+++ b/applications/dashboard/controllers/class.entrycontroller.php
@@ -277,11 +277,11 @@ class EntryController extends Gdn_Controller {
                   $SerializedCookiePayload = Gdn_Format::Serialize($CookiePayload);
                   $Authenticator->Remember($UserInfo['ConsumerKey'], $SerializedCookiePayload);
                   
                   // This resets vanilla's internal "where am I" to the homepage. Needed.
                   Gdn::Request()->WithRoute('DefaultController');
-                  $this->SelfUrl = Gdn::Request()->Path();
+                  $this->SelfUrl = Url('');//Gdn::Request()->Path();
                   
                   $this->View = 'syncfailed';
                   $this->ProviderSite = $Authenticator->GetProviderUrl();
                   $this->Render();
                }
diff --git a/library/core/class.dispatcher.php b/library/core/class.dispatcher.php
index 3b7ca684..0d24d254 100644
--- a/library/core/class.dispatcher.php
+++ b/library/core/class.dispatcher.php
@@ -357,11 +357,11 @@ class Gdn_Dispatcher extends Gdn_Pluggable {
       $this->_ApplicationFolder = '';
       $this->_ControllerFolder = '';
       $this->_ControllerName = '';
       $this->_ControllerMethod = 'index';
       $this->_ControllerMethodArgs = array();
-      $this->Request = $Request->Path();
+      $this->Request = Url('');//$Request->Path();
 
       $PathAndQuery = $Request->PathAndQuery();
       $MatchRoute = Gdn::Router()->MatchRoute($PathAndQuery);
 
       // We have a route. Take action.

Vulnerable code:                   $this->SelfUrl = Gdn::Request()->Path();
      $this->Request = $Request->Path();
Fixed code:                   $this->SelfUrl = Url('');//Gdn::Request()->Path();
      $this->Request = Url('');//$Request->Path();
CVE-2020-26208: Out-of-bounds Write (CWE-787)
value: JHEAD is a simple command line tool for displaying and some manipulation of EXIF header data embedded in Jpeg images from digital cameras. In affected versions there is a heap-buffer-overflow on jhead-3.04/jpgfile.c:285 ReadJpegSections. Crafted jpeg images can be provided to the user resulting in a program crash or potentially incorrect exif information retrieval. Users are advised to upgrade. There is no known workaround for this issue.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 6.1
Published: 2022-02-02T12:15Z
Repository: https://github.com/F-ZhaoYang/jhead
Language: C
Files changed: jpgfile.c
Commit date: 2020-10-23 10:17:20 -0300
Commit message: Just allocate 20 bytes extra at the end of a section. Otherwise, we end
up with a whole lot of little checks for structures that the file says
are there but are unexpectedly cut off in fuzz tests

Diff: diff --git a/jpgfile.c b/jpgfile.c
index 45d97dc..a8174c1 100644
--- a/jpgfile.c
+++ b/jpgfile.c
@@ -167,11 +167,14 @@ int ReadJpegSections (FILE * infile, ReadMode_t ReadMode)
             ErrFatal("invalid marker");
         }
 
         Sections[SectionsRead].Size = itemlen;
 
-        Data = (uchar *)malloc(itemlen);
+        // Allocate an extra 20 bytes more than needed, because sometimes when reading structures,
+        // if the section erroneously ends before short structures that should be there, that can trip
+        // memory checkers in combination with fuzzers.
+        Data = (uchar *)malloc(itemlen+20);
         if (Data == NULL){
             ErrFatal("Could not allocate memory");
         }
         Sections[SectionsRead].Data = Data;
 
@@ -474,11 +477,11 @@ int ReplaceThumbnail(const char * ThumbFileName)
     }else{
         if (ImageInfo.ThumbnailSize == 0){
              return FALSE;
         }
 
-        ThumbLen = 0;
+        ThumbLen = 0;
         ThumbnailFile = NULL;
     }
 
     ExifSection = FindSection(M_EXIF);
 

Vulnerable code:         Data = (uchar *)malloc(itemlen);
        ThumbLen = 0;
Fixed code:         // Allocate an extra 20 bytes more than needed, because sometimes when reading structures,
        // if the section erroneously ends before short structures that should be there, that can trip
        // memory checkers in combination with fuzzers.
        Data = (uchar *)malloc(itemlen+20);
        ThumbLen = 0;
CVE-2018-15120: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted text with invalid Unicode sequences.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 6.5
Published: 2018-08-24T19:29Z
Repository: https://github.com/GNOME/pango
Language: C
Files changed: pango/pango-emoji.c
Commit date: 2018-08-17 22:33:41 -0400
Commit message: Prevent an assertion with invalid Unicode sequences

Invalid Unicode sequences, such as 0x2665 0xfe0e 0xfe0f,
can trick the Emoji iter code into returning an empty
segment, which then triggers an assertion in the itemizer.

Prevent this by ensuring that we make progress.

This issue was reported by Jeffrey M.

Diff: diff --git a/pango/pango-emoji.c b/pango/pango-emoji.c
index 0e332dff..29472452 100644
--- a/pango/pango-emoji.c
+++ b/pango/pango-emoji.c
@@ -251,10 +251,16 @@ _pango_emoji_iter_next (PangoEmojiIter *iter)
     if (iter->is_emoji == (gboolean) 2)
       iter->is_emoji = !PANGO_EMOJI_TYPE_IS_EMOJI (current_emoji_type);
     if (iter->is_emoji == PANGO_EMOJI_TYPE_IS_EMOJI (current_emoji_type))
     {
       iter->is_emoji = !PANGO_EMOJI_TYPE_IS_EMOJI (current_emoji_type);
+
+      /* Make sure we make progress.  Weird sequences, like a VC15 followed
+       * by VC16, can trick us into stalling otherwise. */
+      if (iter->start == iter->end)
+        iter->end = g_utf8_next_char (iter->end);
+
       return TRUE;
     }
   }
 
   iter->is_emoji = PANGO_EMOJI_TYPE_IS_EMOJI (current_emoji_type);

Fixed code: 
      /* Make sure we make progress.  Weird sequences, like a VC15 followed
       * by VC16, can trick us into stalling otherwise. */
      if (iter->start == iter->end)
        iter->end = g_utf8_next_char (iter->end);
CVE-2021-32637: Improper Authentication (CWE-287)
value: Authelia is a a single sign-on multi-factor portal for web apps. This affects uses who are using nginx ngx_http_auth_request_module with Authelia, it allows a malicious individual who crafts a malformed HTTP request to bypass the authentication mechanism. It additionally could theoretically affect other proxy servers, but all of the ones we officially support except nginx do not allow malformed URI paths. The problem is rectified entirely in v4.29.3. As this patch is relatively straightforward we can back port this to any version upon request. Alternatively we are supplying a git patch to 4.25.1 which should be relatively straightforward to apply to any version, the git patches for specific versions can be found in the references. The most relevant workaround is upgrading. You can also add a block which fails requests that contains a malformed URI in the internal location block.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 10
Published: 2021-05-28T17:15Z
Repository: https://github.com/authelia/authelia
Language: Go
Files changed: internal/handlers/handler_verify.go
Commit date: 2021-05-21 14:03:44 +0200
Commit message: fix(handlers): align response status codes for the verify endpoint (#2016)

This aligns all response status codes on the /api/verify endpoint when an error occurs, making it impossible to determine the actual reason for the failure.
Diff: diff --git a/internal/handlers/handler_verify.go b/internal/handlers/handler_verify.go
index 0b08059a..331eece1 100644
--- a/internal/handlers/handler_verify.go
+++ b/internal/handlers/handler_verify.go
@@ -426,11 +426,13 @@ func VerifyGet(cfg schema.AuthenticationBackendConfiguration) middlewares.Reques
 	return func(ctx *middlewares.AutheliaCtx) {
 		ctx.Logger.Tracef("Headers=%s", ctx.Request.Header.String())
 		targetURL, err := ctx.GetOriginalURL()
 
 		if err != nil {
-			ctx.Error(fmt.Errorf("Unable to parse target URL: %s", err), operationFailedMessage)
+			ctx.Logger.Error(fmt.Errorf("Unable to parse target URL: %s", err))
+			ctx.ReplyUnauthorized()
+
 			return
 		}
 
 		if !isSchemeHTTPS(targetURL) && !isSchemeWSS(targetURL) {
 			ctx.Logger.Error(fmt.Errorf("Scheme of target URL %s must be secure since cookies are "+

Vulnerable code: 			ctx.Error(fmt.Errorf("Unable to parse target URL: %s", err), operationFailedMessage)
Fixed code: 			ctx.Logger.Error(fmt.Errorf("Unable to parse target URL: %s", err))
			ctx.ReplyUnauthorized()
CVE-2021-45379: Improper Authentication (CWE-287)
value: Glewlwyd 2.0.0, fixed in 2.6.1 is affected by an incorrect access control vulnerability. One user can attempt to log in as another user without its password.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 8.8
Published: 2021-12-30T18:15Z
Repository: https://github.com/babelouest/glewlwyd
Language: C
Files changed: src/webservice.c
Commit date: 2021-12-15 09:49:03 -0500
Commit message: Fix update session when auth fail

Diff: diff --git a/src/webservice.c b/src/webservice.c
index 15ab937b..58e0a3ab 100644
--- a/src/webservice.c
+++ b/src/webservice.c
@@ -276,14 +276,10 @@ int callback_glewlwyd_user_auth (const struct _u_request * request, struct _u_re
             glewlwyd_metrics_increment_counter_va(config, GLWD_METRICS_AUTH_USER_VALID_SCHEME, 1, "scheme_type", "password", NULL);
           } else {
             if (check_result_value(j_result, G_ERROR_UNAUTHORIZED)) {
               y_log_message(Y_LOG_LEVEL_WARNING, "Security - Authorization invalid for username %s at IP Address %s", json_string_value(json_object_get(j_param, "username")), ip_source);
             }
-            if ((session_uid = get_session_id(config, request)) != NULL && user_session_update(config, session_uid, u_map_get_case(request->map_header, "user-agent"), issued_for, json_string_value(json_object_get(j_param, "username")), NULL, 1) != G_OK) {
-              y_log_message(Y_LOG_LEVEL_ERROR, "callback_glewlwyd_user_auth - Error user_session_update (2)");
-            }
-            o_free(session_uid);
             response->status = 401;
             glewlwyd_metrics_increment_counter_va(config, GLWD_METRICS_AUTH_USER_INVALID, 1, NULL);
             glewlwyd_metrics_increment_counter_va(config, GLWD_METRICS_AUTH_USER_INVALID_SCHEME, 1, "scheme_type", "password", NULL);
           }
           json_decref(j_result);

Vulnerable code:             if ((session_uid = get_session_id(config, request)) != NULL && user_session_update(config, session_uid, u_map_get_case(request->map_header, "user-agent"), issued_for, json_string_value(json_object_get(j_param, "username")), NULL, 1) != G_OK) {
              y_log_message(Y_LOG_LEVEL_ERROR, "callback_glewlwyd_user_auth - Error user_session_update (2)");
            }
            o_free(session_uid);
CVE-2023-49208: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: scheme/webauthn.c in Glewlwyd SSO server before 2.7.6 has a possible buffer overflow during FIDO2 credentials validation in webauthn registration.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 9.8
Published: 2023-11-23T18:15Z
Repository: https://github.com/babelouest/glewlwyd
Language: C
Files changed: src/scheme/webauthn.c
Commit date: 2023-11-15 14:33:43 -0500
Commit message: Check key length before parsing it in FIDO2 attestation registration

Diff: diff --git a/src/scheme/webauthn.c b/src/scheme/webauthn.c
index 92cf0455d..3a180483f 100644
--- a/src/scheme/webauthn.c
+++ b/src/scheme/webauthn.c
@@ -2297,17 +2297,17 @@ static json_t * register_new_attestation(struct config_module * config, json_t *
         }
 
         for (i=0; i<cbor_map_size(cbor_cose); i++) {
           cbor_key = cbor_map_handle(cbor_cose)[i].key;
           cbor_value = cbor_map_handle(cbor_cose)[i].value;
-          if (cbor_isa_negint(cbor_key) && cbor_get_int(cbor_key) == 1 && cbor_isa_bytestring(cbor_value)) {
+          if (cbor_isa_negint(cbor_key) && cbor_get_int(cbor_key) == 1 && cbor_isa_bytestring(cbor_value) && cbor_bytestring_length(cbor_value) <= 256) {
             has_x = 1;
             memcpy(cert_x, cbor_bytestring_handle(cbor_value), cbor_bytestring_length(cbor_value));
             cert_x_len = cbor_bytestring_length(cbor_value);
             g_x.data = cert_x;
             g_x.size = (unsigned int)cbor_bytestring_length(cbor_value);
-          } else if (cbor_isa_negint(cbor_key) && cbor_get_int(cbor_key) == 2 && cbor_isa_bytestring(cbor_value)) {
+          } else if (cbor_isa_negint(cbor_key) && cbor_get_int(cbor_key) == 2 && cbor_isa_bytestring(cbor_value) && cbor_bytestring_length(cbor_value) <= 256) {
             has_y = 1;
             memcpy(cert_y, cbor_bytestring_handle(cbor_value), cbor_bytestring_length(cbor_value));
             cert_y_len = cbor_bytestring_length(cbor_value);
             g_y.data = cert_y;
             g_y.size = (unsigned int)cbor_bytestring_length(cbor_value);

Vulnerable code:           if (cbor_isa_negint(cbor_key) && cbor_get_int(cbor_key) == 1 && cbor_isa_bytestring(cbor_value)) {
          } else if (cbor_isa_negint(cbor_key) && cbor_get_int(cbor_key) == 2 && cbor_isa_bytestring(cbor_value)) {
Fixed code:           if (cbor_isa_negint(cbor_key) && cbor_get_int(cbor_key) == 1 && cbor_isa_bytestring(cbor_value) && cbor_bytestring_length(cbor_value) <= 256) {
          } else if (cbor_isa_negint(cbor_key) && cbor_get_int(cbor_key) == 2 && cbor_isa_bytestring(cbor_value) && cbor_bytestring_length(cbor_value) <= 256) {
CVE-2020-4043: Deserialization of Untrusted Data (CWE-502)
value: phpMussel from versions 1.0.0 and less than 1.6.0 has an unserialization vulnerability in PHP's phar wrapper. Uploading a specially crafted file to an affected version allows arbitrary code execution (discovered, tested, and confirmed by myself), so the risk factor should be regarded as very high. Newer phpMussel versions don't use PHP's phar wrapper, and are therefore unaffected. This has been fixed in version 1.6.0.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9.8
Published: 2020-06-10T20:15Z
Repository: https://github.com/phpMussel/phpMussel
Language: Unknown
Commit date: 2018-10-17 20:40:11 +0800
Commit message: Merge pull request #173 from phpMussel/archive-overhaul

Archive overhaul.
CVE-2023-37268: Improper Authentication (CWE-287)
value: Warpgate is an SSH, HTTPS and MySQL bastion host for Linux that doesn't need special client apps. When logging in as a user with SSO enabled an attacker may authenticate as an other user. Any user account which does not have a second factor enabled could be compromised. This issue has been addressed in commit `8173f6512a` and in releases starting with version 0.7.3. Users are advised to upgrade. Users unable to upgrade should require their users to use a second factor in authentication.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 8.8
Published: 2023-07-14T22:15Z
Repository: https://github.com/warp-tech/warpgate
Language: Rust
Files changed: warpgate-protocol-http/src/api/sso_provider_list.rs
Commit date: 2023-07-07 20:41:00 +0200
Commit message: fixed GHSA-868r-97g5-r9g4 - insufficient authentication for SSO users

Diff: diff --git a/warpgate-protocol-http/src/api/sso_provider_list.rs b/warpgate-protocol-http/src/api/sso_provider_list.rs
index 74b86a4..ce82fa2 100644
--- a/warpgate-protocol-http/src/api/sso_provider_list.rs
+++ b/warpgate-protocol-http/src/api/sso_provider_list.rs
@@ -191,10 +191,16 @@ impl Api {
             get_auth_state_for_request(&username, session, &mut auth_state_store).await?;
 
         let mut state = state_arc.lock().await;
         let mut cp = services.config_provider.lock().await;
 
+        if state.username() != username {
+            return Ok(Err(format!(
+                "Incorrect account for SSO authentication ({username})"
+            )));
+        }
+
         if cp.validate_credential(&username, &cred).await? {
             state.add_valid_credential(cred);
         }
 
         if let AuthResult::Accepted { username } = state.verify() {

Fixed code:         if state.username() != username {
            return Ok(Err(format!(
                "Incorrect account for SSO authentication ({username})"
            )));
        }
CVE-2021-4252: Improper Neutralization (CWE-707)
value: A vulnerability, which was classified as problematic, has been found in WP-Ban. This issue affects the function toggle_checkbox of the file ban-options.php. The manipulation of the argument $_SERVER["HTTP_USER_AGENT"] leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 13e0b1e922f3aaa3f8fcb1dd6d50200dd693fd76. It is recommended to apply a patch to fix this issue. The identifier VDB-216209 was assigned to this vulnerability.
CWE description: The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
CVSS v3 base score: 6.1
Published: 2022-12-18T22:15Z
Repository: https://github.com/lesterchan/wp-ban
Language: Unknown
Commit date: 2021-11-25 11:18:54 +0800
Commit message: Merge pull request #11 from jsgm/master

Fixed Self-XSS for unescaped User-Agent
CVE-2023-0247: Uncontrolled Search Path Element (CWE-427)
value: Uncontrolled Search Path Element in GitHub repository bits-and-blooms/bloom prior to 3.3.1.
CWE description: The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
CVSS v3 base score: 7.8
Published: 2023-01-12T17:15Z
Repository: https://github.com/bits-and-blooms/bloom
Language: Other
Files changed: go.mod, go.sum
Commit date: 2022-09-07 15:29:11 -0400
Commit message: Updating go.mod/go.sum

Diff: diff --git a/go.mod b/go.mod
index 4726744..91b237d 100644
--- a/go.mod
+++ b/go.mod
@@ -1,8 +1,8 @@
 module github.com/bits-and-blooms/bloom/v3
 
 go 1.14
 
 require (
-	github.com/bits-and-blooms/bitset v1.2.0
+	github.com/bits-and-blooms/bitset v1.3.1
 	github.com/twmb/murmur3 v1.1.6
 )
diff --git a/go.sum b/go.sum
index 6a3a508..0b2d3fe 100644
--- a/go.sum
+++ b/go.sum
@@ -1,4 +1,4 @@
-github.com/bits-and-blooms/bitset v1.2.0 h1:Kn4yilvwNtMACtf1eYDlG8H77R07mZSPbMjLyS07ChA=
-github.com/bits-and-blooms/bitset v1.2.0/go.mod h1:gIdJ4wp64HaoK2YrL1Q5/N7Y16edYb8uY+O0FJTyyDA=
+github.com/bits-and-blooms/bitset v1.3.1 h1:y+qrlmq3XsWi+xZqSaueaE8ry8Y127iMxlMfqcK8p0g=
+github.com/bits-and-blooms/bitset v1.3.1/go.mod h1:gIdJ4wp64HaoK2YrL1Q5/N7Y16edYb8uY+O0FJTyyDA=
 github.com/twmb/murmur3 v1.1.6 h1:mqrRot1BRxm+Yct+vavLMou2/iJt0tNVTTC0QoIjaZg=
 github.com/twmb/murmur3 v1.1.6/go.mod h1:Qq/R7NUyOfr65zD+6Q5IHKsJLwP7exErjN6lyyq3OSQ=

Vulnerable code: 	github.com/bits-and-blooms/bitset v1.2.0
github.com/bits-and-blooms/bitset v1.2.0 h1:Kn4yilvwNtMACtf1eYDlG8H77R07mZSPbMjLyS07ChA=
github.com/bits-and-blooms/bitset v1.2.0/go.mod h1:gIdJ4wp64HaoK2YrL1Q5/N7Y16edYb8uY+O0FJTyyDA=
Fixed code: 	github.com/bits-and-blooms/bitset v1.3.1
github.com/bits-and-blooms/bitset v1.3.1 h1:y+qrlmq3XsWi+xZqSaueaE8ry8Y127iMxlMfqcK8p0g=
github.com/bits-and-blooms/bitset v1.3.1/go.mod h1:gIdJ4wp64HaoK2YrL1Q5/N7Y16edYb8uY+O0FJTyyDA=
CVE-2021-41560: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUtility.php.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 9.8
Published: 2021-12-15T07:15Z
Repository: https://github.com/opencats/OpenCATS
Language: PHP
Files changed: lib/FileUtility.php
Commit date: 2021-11-10 09:10:49 +0000
Commit message: Fixed critical upload vulnerability (#552)

Co-authored-by: Nicholas Ferreira <nickguitar.dll@hotmail.com>
Diff: diff --git a/lib/FileUtility.php b/lib/FileUtility.php
index 7bfe976..8546fd3 100755
--- a/lib/FileUtility.php
+++ b/lib/FileUtility.php
@@ -182,15 +182,21 @@ class FileUtility
             }
         }
 
         /* Is the file extension safe? */
         $fileExtension = self::getFileExtension($filename);
-        if (in_array($fileExtension, $GLOBALS['badFileExtensions']))
+        
+        /* Use a whitelist instead of a blacklist to prevent possible bypasses */
+        if (!preg_match("/(?i)\.(pdf|docx?|rtf|odt?g?|txt|wpd|jpe?g|png|csv|xlsx?|ppt|msg|heic|tiff?|html?|bmp|wps|xps)$/i", $fileExtension))
+        {
+            $filename .= ".txt";
+        }
+/*        if (in_array($fileExtension, $GLOBALS['badFileExtensions']))
         {
             $filename .= '.txt';
         }
-
+*/
         return $filename;
     }
 
     /**
      * Returns a unused filename in CATS_TEMP_DIR.
@@ -561,11 +567,11 @@ class FileUtility
             }
 
             if (!eval(Hooks::get('FILE_UTILITY_SPACE_CHECK'))) return;
 
             $uploadPath = FileUtility::getUploadPath($siteID, $subDirectory);
-            $newFileName = $_FILES[$id]['name'];
+            $newFileName = FileUtility::makeSafeFilename($_FILES[$id]['name']);
 
             // Could just while(file_exists) it, but I'm paranoid of infinate loops
             // Shouldn't have 1000 files of the same name anyway
             for ($i = 0; @file_exists($uploadPath . '/' . $newFileName) && $i < 1000; $i++)
             {

Vulnerable code:         if (in_array($fileExtension, $GLOBALS['badFileExtensions']))

            $newFileName = $_FILES[$id]['name'];
Fixed code:         
        /* Use a whitelist instead of a blacklist to prevent possible bypasses */
        if (!preg_match("/(?i)\.(pdf|docx?|rtf|odt?g?|txt|wpd|jpe?g|png|csv|xlsx?|ppt|msg|heic|tiff?|html?|bmp|wps|xps)$/i", $fileExtension))
        {
            $filename .= ".txt";
        }
/*        if (in_array($fileExtension, $GLOBALS['badFileExtensions']))
*/
            $newFileName = FileUtility::makeSafeFilename($_FILES[$id]['name']);
CVE-2024-22194: Insertion of Sensitive Information Into Debugging Code (CWE-215)
value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
CWE description: The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
CVSS v3 base score: 2.8
Published: 2024-01-11T03:15Z
Repository: https://github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID
Language: Python
Files changed: cdo_local_uuid/__init__.py
Commit date: 2023-12-14 00:04:07 -0500
Commit message: Merge pull request #3 from Cyber-Domain-Ontology/fix_command_in_top_srcdir_case


Diff: diff --cc cdo_local_uuid/__init__.py
index b951440,9ef7abd..6f42b31
--- a/cdo_local_uuid/__init__.py
+++ b/cdo_local_uuid/__init__.py
@@@ -43,25 -57,20 +57,27 @@@ def configure() -> None
      """
      This function is part of setting up _demo_uuid() to generate non-random UUIDs.  See _demo_uuid() documentation for further setup notes.
      """
      global DEMO_UUID_BASE
  
+     # _logger.debug("sys.argv = %r.", sys.argv)
+ 
      if os.getenv("DEMO_UUID_REQUESTING_NONRANDOM") == "NONRANDOM_REQUESTED":
          warnings.warn(
 -            "Environment variable DEMO_UUID_REQUESTING_NONRANDOM is deprecated.  See case_utils.local_uuid._demo_uuid for usage notes on its replacement, CASE_DEMO_NONRANDOM_UUID_BASE.  Proceeding with random UUIDs.",
 +            "Environment variable DEMO_UUID_REQUESTING_NONRANDOM is deprecated.  See cdo_local_uuid._demo_uuid for usage notes on its replacement, CDO_DEMO_NONRANDOM_UUID_BASE.  Proceeding with random UUIDs.",
              FutureWarning,
          )
          return
  
 -    env_base_dir_name = os.getenv("CASE_DEMO_NONRANDOM_UUID_BASE")
 +    if os.getenv("CASE_DEMO_NONRANDOM_UUID_BASE") is not None:
 +        warnings.warn(
 +            "Environment variable CASE_DEMO_NONRANDOM_UUID_BASE is deprecated.  Its replacement variable is CDO_DEMO_NONRANDOM_UUID_BASE.  Proceeding with random UUIDs.",
 +            FutureWarning,
 +        )
 +        return
 +
 +    env_base_dir_name = os.getenv("CDO_DEMO_NONRANDOM_UUID_BASE")
      if env_base_dir_name is None:
          return
  
      base_dir_original_path = pathlib.Path(env_base_dir_name)
      if not base_dir_original_path.exists():

Fixed code:      # _logger.debug("sys.argv = %r.", sys.argv)