Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2020-36364: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: An issue was discovered in Smartstore (aka SmartStoreNET) before 4.1.0. Administration/Controllers/ImportController.cs allows path traversal (for copy and delete actions) in the ImportController.Create method via a TempFileName field.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.1
Published: 2021-05-19T19:15Z
Repository: https://github.com/smartstore/SmartStoreNET
Language: C#
Files changed: src/Presentation/SmartStore.Web/Administration/Controllers/ImportController.cs
Commit date: 2020-10-13 11:07:23 +0200
Commit message: Resolves #2112 Path traversal vulnerability

Diff: diff --git a/src/Presentation/SmartStore.Web/Administration/Controllers/ImportController.cs b/src/Presentation/SmartStore.Web/Administration/Controllers/ImportController.cs
index 61bc922464..c749d82d2c 100644
--- a/src/Presentation/SmartStore.Web/Administration/Controllers/ImportController.cs
+++ b/src/Presentation/SmartStore.Web/Administration/Controllers/ImportController.cs
@@ -382,10 +382,15 @@ namespace SmartStore.Admin.Controllers
 
         [HttpPost]
         [Permission(Permissions.Configuration.Import.Create)]
         public ActionResult Create(ImportProfileModel model)
         {
+            if (PathHelper.HasInvalidFileNameChars(model.TempFileName))
+            {
+                return new HttpStatusCodeResult(HttpStatusCode.BadRequest, "Invalid file name.");
+            }
+
             var importFile = Path.Combine(FileSystemHelper.TempDirTenant(), model.TempFileName.EmptyNull());
 
             if (System.IO.File.Exists(importFile))
             {
                 var profile = _importProfileService.InsertImportProfile(model.TempFileName, model.Name, model.EntityType);

Fixed code:             if (PathHelper.HasInvalidFileNameChars(model.TempFileName))
            {
                return new HttpStatusCodeResult(HttpStatusCode.BadRequest, "Invalid file name.");
            }
CVE-2021-32607: Insufficient Information (NVD-CWE-noinfo)
value: An issue was discovered in Smartstore (aka SmartStoreNET) through 4.1.1. Views/PrivateMessages/View.cshtml does not call HtmlUtils.SanitizeHtml on a private message.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2021-05-12T15:15Z
Repository: https://github.com/smartstore/SmartStoreNET
Language: Other
Files changed: src/Presentation/SmartStore.Web/Views/PrivateMessages/View.cshtml
Commit date: 2021-05-10 19:14:02 +0200
Commit message: Fixed text issue in private messages of forum

Diff: diff --git a/src/Presentation/SmartStore.Web/Views/PrivateMessages/View.cshtml b/src/Presentation/SmartStore.Web/Views/PrivateMessages/View.cshtml
index d87dd93ae5..2425199937 100644
--- a/src/Presentation/SmartStore.Web/Views/PrivateMessages/View.cshtml
+++ b/src/Presentation/SmartStore.Web/Views/PrivateMessages/View.cshtml
@@ -1,7 +1,8 @@
 ﻿@model PrivateMessageModel
 @using SmartStore.Web.Models.PrivateMessages;
+@using SmartStore.Core.Html;
 @{
     Layout = "_Layout";
     Html.AddTitleParts(T("PageTitle.ViewPM").Text);
 }
 
@@ -26,11 +27,11 @@
         <div class="row mt-1 mb-3">
             <label class="col-sm-3">@T("PrivateMessages.View.Message")</label>
             <div class="col-sm-9">
                 <div class="card">
                     <div class="card-body" dir="auto">
-                        @Html.Raw(Model.Message)
+                        @Html.Raw(HtmlUtils.SanitizeHtml(Model.Message, true))
                     </div>
                 </div>
             </div>
         </div>
         <div class="row justify-content-end">

Vulnerable code:                         @Html.Raw(Model.Message)
Fixed code: @using SmartStore.Core.Html;
                        @Html.Raw(HtmlUtils.SanitizeHtml(Model.Message, true))
CVE-2023-45897: Out-of-bounds Read (CWE-125)
value: exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2023-10-28T21:15Z
Repository: https://github.com/exfatprogs/exfatprogs
Language: C
Files changed: fsck/fsck.c
Commit date: 2023-08-22 15:27:18 +0900
Commit message: fsck: fix out-of-bounds memory access

The size of utf16_name is ENTRY_NAME_MAX, we should pass
ENTRY_NAME_MAX to exfat_utf16_len(), not ENTRY_NAME_MAX*2.

exfat_utf16_enc() returns the length of the utf16-encoded
filename, it is not needed to call exfat_utf16_len().

Signed-off-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>

Diff: diff --git a/fsck/fsck.c b/fsck/fsck.c
index cd9ee9a..1924715 100644
--- a/fsck/fsck.c
+++ b/fsck/fsck.c
@@ -809,11 +809,11 @@ ask_again:
 	if (num) {
 		__le16 utf16_name[ENTRY_NAME_MAX];
 		char *rename = NULL;
 		__u16 hash;
 		struct exfat_dentry *stream_de;
-		int name_len, ret;
+		int ret;
 
 		switch (num) {
 		case 1:
 			rename = get_rename_from_user(iter);
 			break;
@@ -838,15 +838,15 @@ ask_again:
 		ret = exfat_utf16_enc(rename, utf16_name, sizeof(utf16_name));
 		free(rename);
 		if (ret < 0)
 			return ret;
 
+		ret >>= 1;
 		memcpy(dentry->name_unicode, utf16_name, ENTRY_NAME_MAX * 2);
-		name_len = exfat_utf16_len(utf16_name, ENTRY_NAME_MAX * 2);
-		hash = exfat_calc_name_hash(iter->exfat, utf16_name, (int)name_len);
+		hash = exfat_calc_name_hash(iter->exfat, utf16_name, ret);
 		exfat_de_iter_get_dirty(iter, 1, &stream_de);
-		stream_de->stream_name_len = (__u8)name_len;
+		stream_de->stream_name_len = (__u8)ret;
 		stream_de->stream_name_hash = cpu_to_le16(hash);
 	}
 
 	return 0;
 }

Vulnerable code: 		int name_len, ret;
		name_len = exfat_utf16_len(utf16_name, ENTRY_NAME_MAX * 2);
		hash = exfat_calc_name_hash(iter->exfat, utf16_name, (int)name_len);
		stream_de->stream_name_len = (__u8)name_len;
Fixed code: 		int ret;
		ret >>= 1;
		hash = exfat_calc_name_hash(iter->exfat, utf16_name, ret);
		stream_de->stream_name_len = (__u8)ret;
CVE-2023-45897: Out-of-bounds Read (CWE-125)
value: exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2023-10-28T21:15Z
Repository: https://github.com/exfatprogs/exfatprogs
Language: C
Files changed: exfat2img/exfat2img.c
Commit date: 2023-10-26 14:37:35 +0900
Commit message: exfat2img: fix out-of-bounds write in read_file_dentry_set

if SecondaryCount is greater than (2 + the max number
of File Name entries), writing to memory outside
the node->name could happen.

Reported-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>

Diff: diff --git a/exfat2img/exfat2img.c b/exfat2img/exfat2img.c
index be1f0f3..3f83588 100644
--- a/exfat2img/exfat2img.c
+++ b/exfat2img/exfat2img.c
@@ -317,11 +317,11 @@ static int read_file_dentry_set(struct exfat_de_iter *iter,
 	*new_node = NULL;
 	node = exfat_alloc_inode(le16_to_cpu(file_de->file_attr));
 	if (!node)
 		return -ENOMEM;
 
-	for (i = 2; i <= file_de->file_num_ext; i++) {
+	for (i = 2; i <= MIN(file_de->file_num_ext, 1 + MAX_NAME_DENTRIES); i++) {
 		ret = exfat_de_iter_get(iter, i, &dentry);
 		if (ret || dentry->type != EXFAT_NAME)
 			break;
 		memcpy(node->name +
 		       (i - 2) * ENTRY_NAME_MAX, dentry->name_unicode,

Vulnerable code: 	for (i = 2; i <= file_de->file_num_ext; i++) {
Fixed code: 	for (i = 2; i <= MIN(file_de->file_num_ext, 1 + MAX_NAME_DENTRIES); i++) {
CVE-2023-45897: Out-of-bounds Read (CWE-125)
value: exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2023-10-28T21:15Z
Repository: https://github.com/exfatprogs/exfatprogs
Language: C
Files changed: fsck/fsck.c, include/exfat_ondisk.h
Commit date: 2023-10-26 14:14:09 +0900
Commit message: fsck: fix out-of-bounds write in read_file_dentry_set

if SecondaryCount is greater than (2 + the max number
of File Name entries), writing to memory outside
the node->name could happen.

Reported-by: Maxim Suhanov <dfirblog@gmail.com>
Signed-off-by: Hyunchul Lee <hyc.lee@gmail.com>
Reviewed-by: Yuezhang Mo <Yuezhang.Mo@sony.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>

Diff: diff --git a/fsck/fsck.c b/fsck/fsck.c
index f529eea..77272aa 100644
--- a/fsck/fsck.c
+++ b/fsck/fsck.c
@@ -772,11 +772,11 @@ static int read_file_dentry_set(struct exfat_de_iter *iter,
 	*new_node = NULL;
 	node = exfat_alloc_inode(le16_to_cpu(file_de->file_attr));
 	if (!node)
 		return -ENOMEM;
 
-	for (i = 2; i <= file_de->file_num_ext; i++) {
+	for (i = 2; i <= MIN(file_de->file_num_ext, 1 + MAX_NAME_DENTRIES); i++) {
 		ret = exfat_de_iter_get(iter, i, &dentry);
 		if (ret || dentry->type != EXFAT_NAME) {
 			if (i > 2 && repair_file_ask(iter, NULL, ER_DE_NAME,
 						     "failed to get name dentry")) {
 				exfat_de_iter_get_dirty(iter, 0, &file_de);
diff --git a/include/exfat_ondisk.h b/include/exfat_ondisk.h
index b976e3d..42cdadf 100644
--- a/include/exfat_ondisk.h
+++ b/include/exfat_ondisk.h
@@ -38,10 +38,11 @@
 #define DENTRY_SIZE		32 /* directory entry size */
 #define DENTRY_SIZE_BITS	5
 /* exFAT allows 8388608(256MB) directory entries */
 #define MAX_EXFAT_DENTRIES	8388608
 #define MIN_FILE_DENTRIES	3
+#define MAX_NAME_DENTRIES	17
 
 /* dentry types */
 #define MSDOS_DELETED		0xE5	/* deleted mark */
 #define MSDOS_UNUSED		0x00	/* end of directory */
 

Vulnerable code: 	for (i = 2; i <= file_de->file_num_ext; i++) {
Fixed code: 	for (i = 2; i <= MIN(file_de->file_num_ext, 1 + MAX_NAME_DENTRIES); i++) {
#define MAX_NAME_DENTRIES	17
CVE-2024-37310: Insufficient Information (NVD-CWE-noinfo)
value: EVerest is an EV charging software stack. An integer overflow in the "v2g_incoming_v2gtp" function in the v2g_server.cpp implementation can allow a remote attacker to overflow the process' heap. This vulnerability is fixed in 2024.3.1 and 2024.6.0.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-10T20:15Z
Repository: https://github.com/EVerest/everest-core
Language: C++
Files changed: modules/EvseV2G/v2g_server.cpp
Commit date: 2024-06-05 13:01:31 +0200
Commit message: Fix EvseV2G: Prevent interger overflow after reading v2gtp message length (#706)

Signed-off-by: Sebastian Lukas <sebastian.lukas@pionix.de>
Diff: diff --git a/modules/EvseV2G/v2g_server.cpp b/modules/EvseV2G/v2g_server.cpp
index 3df6582..09905a6 100644
--- a/modules/EvseV2G/v2g_server.cpp
+++ b/modules/EvseV2G/v2g_server.cpp
@@ -23,10 +23,11 @@
 #include "log.hpp"
 #include "tools.hpp"
 #include "v2g_server.hpp"
 
 #define MAX_RES_TIME 98
+#define UINT32_MAX   0xFFFFFFFF
 
 static types::iso15118_charger::V2G_Message_ID get_V2G_Message_ID(enum V2gMsgTypeId v2g_msg,
                                                                   enum v2g_protocol selected_protocol, bool is_req) {
     switch (v2g_msg) {
     case V2G_SUPPORTED_APP_PROTOCOL_MSG:
@@ -160,12 +161,18 @@ static int v2g_incoming_v2gtp(struct v2g_connection* conn) {
     if (rv == -1) {
         dlog(DLOG_LEVEL_ERROR, "Invalid v2gtp header");
         return -1;
     }
 
+    if (conn->payload_len >= UINT32_MAX - V2GTP_HEADER_LENGTH) {
+        dlog(DLOG_LEVEL_ERROR, "Prevent integer overflow - payload too long: have %d, would need %u",
+             DEFAULT_BUFFER_SIZE, conn->payload_len);
+        return -1;
+    }
+
     if (conn->payload_len + V2GTP_HEADER_LENGTH > DEFAULT_BUFFER_SIZE) {
-        dlog(DLOG_LEVEL_ERROR, "payload too long: have %d, would need %d", DEFAULT_BUFFER_SIZE,
+        dlog(DLOG_LEVEL_ERROR, "payload too long: have %d, would need %u", DEFAULT_BUFFER_SIZE,
              conn->payload_len + V2GTP_HEADER_LENGTH);
 
         /* we have no way to flush/discard remaining unread data from the socket without reading it in chunks,
          * but this opens the chance to bind us in a "endless" read loop; so to protect us, simply close the connection
          */

Vulnerable code:         dlog(DLOG_LEVEL_ERROR, "payload too long: have %d, would need %d", DEFAULT_BUFFER_SIZE,
Fixed code: #define UINT32_MAX   0xFFFFFFFF
    if (conn->payload_len >= UINT32_MAX - V2GTP_HEADER_LENGTH) {
        dlog(DLOG_LEVEL_ERROR, "Prevent integer overflow - payload too long: have %d, would need %u",
             DEFAULT_BUFFER_SIZE, conn->payload_len);
        return -1;
    }

        dlog(DLOG_LEVEL_ERROR, "payload too long: have %d, would need %u", DEFAULT_BUFFER_SIZE,
CVE-2024-41130: Insufficient Information (NVD-CWE-noinfo)
value: llama.cpp provides LLM inference in C/C++. Prior to b3427, llama.cpp contains a null pointer dereference in gguf_init_from_file. This vulnerability is fixed in b3427.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-22T18:15Z
Repository: https://github.com/ggerganov/llama.cpp
Language: C++
Files changed: examples/gguf/gguf.cpp, ggml/src/ggml.c
Commit date: 2024-07-20 17:15:42 +0300
Commit message: gguf : handle null name during init (#8587)


Diff: diff --git a/examples/gguf/gguf.cpp b/examples/gguf/gguf.cpp
index 57514377..7498f85e 100644
--- a/examples/gguf/gguf.cpp
+++ b/examples/gguf/gguf.cpp
@@ -90,10 +90,15 @@ static bool gguf_ex_read_0(const std::string & fname) {
         /*.ctx      = */ NULL,
     };
 
     struct gguf_context * ctx = gguf_init_from_file(fname.c_str(), params);
 
+    if (!ctx) {
+        fprintf(stderr, "%s: failed to load '%s'\n", __func__, fname.c_str());
+        return false;
+    }
+
     printf("%s: version:      %d\n", __func__, gguf_get_version(ctx));
     printf("%s: alignment:   %zu\n", __func__, gguf_get_alignment(ctx));
     printf("%s: data offset: %zu\n", __func__, gguf_get_data_offset(ctx));
 
     // kv
diff --git a/ggml/src/ggml.c b/ggml/src/ggml.c
index 7a39c685..dbb3a3eb 100644
--- a/ggml/src/ggml.c
+++ b/ggml/src/ggml.c
@@ -21013,11 +21013,11 @@ struct gguf_context * gguf_init_from_file(const char * fname, struct gguf_init_p
 
             // TODO: return an error instead of crashing with GGML_ASSERT
             gguf_tensor_info_sanitize(info);
 
             // make sure there is no duplicated tensor names
-            for (uint64_t j = 0; j < i; ++j) {
+            for (uint64_t j = 0; j < i && ok; ++j) {
                 if (strcmp(info->name.data, ctx->infos[j].name.data) == 0) {
                     fprintf(stderr, "%s: duplicated tensor name %s\n", __func__, info->name.data);
                     ok = false;
                 }
             }

Vulnerable code:             for (uint64_t j = 0; j < i; ++j) {
Fixed code:     if (!ctx) {
        fprintf(stderr, "%s: failed to load '%s'\n", __func__, fname.c_str());
        return false;
    }

            for (uint64_t j = 0; j < i && ok; ++j) {
CVE-2016-6298: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack (MMA).
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 5.3
Published: 2016-09-01T23:59Z
Repository: https://github.com/latchset/jwcrypto
Language: Python
Files changed: jwcrypto/jwa.py
Commit date: 2016-08-31 15:38:09 -0400
Commit message: CVE-2016-6298: Million Messages Attack mitigation

RFC 3218 describes an oracle attack called Million Messages Attack
against RSA with PKCS1 v1.5 padding.

Depending on how JWEs are used a server may become an Oracle, and the
mitigation presecribed in RFC 3218 2.3.2 need to be implemented.

Many thanks to Dennis Detering for his responsible disclosure and help
verifying the mitigation approach.

Resolves #65
Signed-off-by: Simo Sorce <simo@redhat.com>
Closes #66

Diff: diff --git a/jwcrypto/jwa.py b/jwcrypto/jwa.py
index c61c46a..521890b 100644
--- a/jwcrypto/jwa.py
+++ b/jwcrypto/jwa.py
@@ -377,10 +377,27 @@ class _Rsa15(_RSA, JWAAlgorithm):
     algorithm_use = 'kex'
 
     def __init__(self):
         super(_Rsa15, self).__init__(padding.PKCS1v15())
 
+    def unwrap(self, key, bitsize, ek, headers):
+        self._check_key(key)
+        # Address MMA attack by implementing RFC 3218 - 2.3.2. Random Filling
+        # provides a random cek that will cause the decryption engine to
+        # run to the end, but will fail decryption later.
+
+        # always generate a random cek so we spend roughly the
+        # same time as in the exception side of the branch
+        cek = _randombits(bitsize)
+        try:
+            cek = super(_Rsa15, self).unwrap(key, bitsize, ek, headers)
+            # always raise so we always run through the exception handling
+            # code in all cases
+            raise Exception('Dummy')
+        except Exception:  # pylint: disable=broad-except
+            return cek
+
 
 class _RsaOaep(_RSA, JWAAlgorithm):
 
     name = 'RSA-OAEP'
     description = "RSAES OAEP using default parameters"

Fixed code:     def unwrap(self, key, bitsize, ek, headers):
        self._check_key(key)
        # Address MMA attack by implementing RFC 3218 - 2.3.2. Random Filling
        # provides a random cek that will cause the decryption engine to
        # run to the end, but will fail decryption later.

        # always generate a random cek so we spend roughly the
        # same time as in the exception side of the branch
        cek = _randombits(bitsize)
        try:
            cek = super(_Rsa15, self).unwrap(key, bitsize, ek, headers)
            # always raise so we always run through the exception handling
            # code in all cases
            raise Exception('Dummy')
        except Exception:  # pylint: disable=broad-except
            return cek
CVE-2022-1231: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: XSS via Embedded SVG in SVG Diagram Format in GitHub repository plantuml/plantuml prior to 1.2022.4. Stored XSS in the context of the diagram embedder. Depending on the actual context, this ranges from stealing secrets to account hijacking or even to code execution for example in desktop applications. Web based applications are the ones most affected. Since the SVG format allows clickable links in diagrams, it is commonly used in plugins for web based projects (like the Confluence plugin, etc. see https://plantuml.com/de/running).
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-04-15T15:15Z
Repository: https://github.com/plantuml/plantuml
Language: Java
Files changed: src/net/sourceforge/plantuml/ugraphic/UImageSvg.java
Commit date: 2022-04-07 19:07:38 +0200
Commit message: wip

Diff: diff --git a/src/net/sourceforge/plantuml/ugraphic/UImageSvg.java b/src/net/sourceforge/plantuml/ugraphic/UImageSvg.java
index 38012d11..206724d1 100644
--- a/src/net/sourceforge/plantuml/ugraphic/UImageSvg.java
+++ b/src/net/sourceforge/plantuml/ugraphic/UImageSvg.java
@@ -50,19 +50,19 @@ public class UImageSvg implements UShape {
 	public UImageSvg(String svg, double scale) {
 		this.svg = clean(Objects.requireNonNull(svg));
 		this.scale = scale;
 	}
 
-	private String clean(String svg) {
-		svg = svg.toLowerCase().replaceAll("\\s", "");
-		if (svg.contains("<script>"))
+	private String clean(final String svg) {
+		final String svg2 = svg.toLowerCase().replaceAll("\\s", "");
+		if (svg2.contains("<script>"))
 			return EMPTY_SVG;
-		if (svg.contains("</script>"))
+		if (svg2.contains("</script>"))
 			return EMPTY_SVG;
-		if (svg.contains("<foreignobject"))
+		if (svg2.contains("<foreignobject"))
 			return EMPTY_SVG;
-		if (svg.contains("</foreignobject>"))
+		if (svg2.contains("</foreignobject>"))
 			return EMPTY_SVG;
 		return svg;
 	}
 
 	public String getMD5Hex() {

Vulnerable code: 	private String clean(String svg) {
		svg = svg.toLowerCase().replaceAll("\\s", "");
		if (svg.contains("<script>"))
		if (svg.contains("</script>"))
		if (svg.contains("<foreignobject"))
		if (svg.contains("</foreignobject>"))
Fixed code: 	private String clean(final String svg) {
		final String svg2 = svg.toLowerCase().replaceAll("\\s", "");
		if (svg2.contains("<script>"))
		if (svg2.contains("</script>"))
		if (svg2.contains("<foreignobject"))
		if (svg2.contains("</foreignobject>"))
CVE-2014-125059: External Control of File Name or Path (CWE-73)
value: A vulnerability, which was classified as problematic, has been found in sternenseemann sternenblog. This issue affects the function blog_index of the file main.c. The manipulation of the argument post_path leads to file inclusion. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 0.1.0 is able to address this issue. The identifier of the patch is cf715d911d8ce17969a7926dea651e930c27e71a. It is recommended to upgrade the affected component. The identifier VDB-217613 was assigned to this vulnerability. NOTE: This case is rather theoretical and probably won't happen. Maybe only on obscure Web servers.
CWE description: The product allows user input to control or influence paths or file names that are used in filesystem operations.
CVSS v3 base score: 9.8
Published: 2023-01-07T13:15Z
Repository: https://github.com/sternenseemann/sternenblog
Language: C
Files changed: main.c
Commit date: 2014-08-15 13:50:19 +0200
Commit message: fixed LFI vulnerability

Diff: diff --git a/main.c b/main.c
index 78e0e7b..eab22ce 100644
--- a/main.c
+++ b/main.c
@@ -186,10 +186,18 @@ void blog_index(void) {
 
 	template_footer();
 }
 
 void blog_post(char post_path[]) {
+	if(strlen(post_path) != 0 || post_path[0] == '.'
+			|| strchr(post_path, '/') == NULL) {
+		send_header("Content-type", "text/plain");
+		terminate_headers();
+		printf("No, my dear h4xxx0r :)\nYou won\'t do that :p\n");
+		return;
+	}
+
 	if(file_exists(post_path) > 0) {
 		struct blogpost post = make_blogpost(post_path);
 
 		send_header("Content-type", "text/html");
 		terminate_headers();

Fixed code: 	if(strlen(post_path) != 0 || post_path[0] == '.'
			|| strchr(post_path, '/') == NULL) {
		send_header("Content-type", "text/plain");
		terminate_headers();
		printf("No, my dear h4xxx0r :)\nYou won\'t do that :p\n");
		return;
	}
CVE-2023-43805: Improper Authentication (CWE-287)
value: Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypass authentication for access to the job queue dashboard. Version 12.121.9 contains a fix for this issue. As a workaround, it may be possible to avoid this by blocking access using tools such as Cloudflare's WAF.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 7.5
Published: 2023-10-04T21:15Z
Repository: https://github.com/nexryai/nexkey
Language: TypeScript
Files changed: packages/backend/src/server/web/index.ts
Commit date: 2023-09-30 23:20:32 +0900
Commit message: BullBoardの認証をバイパスしてしまわないように

Diff: diff --git a/packages/backend/src/server/web/index.ts b/packages/backend/src/server/web/index.ts
index be95becb6..91ffb00a5 100644
--- a/packages/backend/src/server/web/index.ts
+++ b/packages/backend/src/server/web/index.ts
@@ -42,11 +42,13 @@ const app = new Koa();
 //#region Bull Dashboard
 const bullBoardPath = '/queue';
 
 // Authenticate
 app.use(async (ctx, next) => {
-	if (ctx.path === bullBoardPath || ctx.path.startsWith(bullBoardPath + '/')) {
+	// %71ueueとかでリクエストされたら困るため
+	const url = decodeURI(ctx.path);
+	if (url === bullBoardPath || url.startsWith(bullBoardPath + '/')) {
 		const token = ctx.cookies.get('token');
 		if (token == null) {
 			ctx.status = 401;
 			return;
 		}

Vulnerable code: 	if (ctx.path === bullBoardPath || ctx.path.startsWith(bullBoardPath + '/')) {
Fixed code: 	// %71ueueとかでリクエストされたら困るため
	const url = decodeURI(ctx.path);
	if (url === bullBoardPath || url.startsWith(bullBoardPath + '/')) {
CVE-2023-52077: Incorrect Authorization (CWE-863)
value: Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers. Prior to 12.23Q4.5, Nexkey allows external apps using tokens issued by administrators and moderators to call admin APIs.  This allows malicious third-party apps to perform operations such as updating server settings, as well as compromise object storage and email server credentials. This issue has been patched in 12.23Q4.5.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 9.8
Published: 2023-12-27T19:15Z
Repository: https://github.com/nexryai/nexkey
Language: Markdown
Files changed: CHANGELOG.md, packages/backend/src/server/api/call.ts
Commit date: 2023-12-27 08:05:05 +0900
Commit message: Security: Appは管理者/モデレータ権限を使えないように

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4bd2ce04e2..e6a8885371 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,8 +1,9 @@
 ## 12.23Q4.5
  - Security Hotfix: 管理者用APIのアクセス権限が適切に設定されていない問題を修正
  - fix: Filter featured collection
+ - Appは管理者/モデレータ権限を使えないように
  - 依存関係の更新
 
 ## 12.23Q4.4
  - Backend: deep-email-validatorをdevmehq/email-validator-jsで置き換えより高精度で捨てアド判定ができるように
  - Feat: arm64のDockerコンテナを利用可能に
diff --git a/packages/backend/src/server/api/call.ts b/packages/backend/src/server/api/call.ts
index a85d40643b..b2124f5a0a 100644
--- a/packages/backend/src/server/api/call.ts
+++ b/packages/backend/src/server/api/call.ts
@@ -91,10 +91,18 @@ export default async (endpoint: string, user: CacheableLocalUser | null | undefi
             code: "PERMISSION_DENIED",
             id: "1370e5b7-d4eb-4566-bb1d-7748ee6a1838",
         });
     }
 
+    if (token && ep.meta.requireAdmin) {
+        throw new ApiError(accessDenied, { reason: "Apps cannot use admin privileges." });
+    }
+
+    if (token && ep.meta.requireModerator) {
+        throw new ApiError(accessDenied, { reason: "Apps cannot use moderator privileges." });
+    }
+
     // Cast non JSON input
     if ((ep.meta.requireFile || ctx?.method === "GET") && ep.params.properties) {
         for (const k of Object.keys(ep.params.properties)) {
             const param = ep.params.properties![k];
             if (["boolean", "number", "integer"].includes(param.type ?? "") && typeof data[k] === "string") {

Fixed code:  - Appは管理者/モデレータ権限を使えないように
    if (token && ep.meta.requireAdmin) {
        throw new ApiError(accessDenied, { reason: "Apps cannot use admin privileges." });
    }

    if (token && ep.meta.requireModerator) {
        throw new ApiError(accessDenied, { reason: "Apps cannot use moderator privileges." });
    }
CVE-2021-41120: Authorization Bypass Through User-Controlled Key (CWE-639)
value: sylius/paypal-plugin is a paypal plugin for the Sylius development platform. In affected versions the URL to the payment page done after checkout was created with autoincremented payment id (/pay-with-paypal/{id}) and therefore it was easy to predict. The problem is that the Credit card form has prefilled "credit card holder" field with the Customer's first and last name and hence this can lead to personally identifiable information exposure. Additionally, the mentioned form did not require authentication. The problem has been patched in Sylius/PayPalPlugin 1.2.4 and 1.3.1. If users are unable to update they can override a sylius_paypal_plugin_pay_with_paypal_form route and change its URL parameters to (for example) {orderToken}/{paymentId}, then override the Sylius\PayPalPlugin\Controller\PayWithPayPalFormAction service, to operate on the payment taken from the repository by these 2 values. It would also require usage of custom repository method. Additionally, one could override the @SyliusPayPalPlugin/payWithPaypal.html.twig template, to add contingencies: ['SCA_ALWAYS'] line in hostedFields.submit(...) function call (line 421). It would then have to be handled in the function callback.
CWE description: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CVSS v3 base score: 7.5
Published: 2021-10-05T21:15Z
Repository: https://github.com/Sylius/PayPalPlugin
Language: Unknown
Commit date: 2021-10-05 21:45:14 +0200
Commit message: Merge pull request from GHSA-25fx-mxc2-76g7

Secure pay with PayPal form URL with order token + require 3D Secure
CVE-2018-3722: Insufficient Information (NVD-CWE-noinfo)
value: merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 8.8
Published: 2018-06-07T02:29Z
Repository: https://github.com/jonschlinkert/merge-deep
Language: JavaScript
Files changed: index.js
Commit date: 2018-02-07 11:43:20 -0500
Commit message: exclude __proto__

Diff: diff --git a/index.js b/index.js
index 11031ee..a7b8fc5 100644
--- a/index.js
+++ b/index.js
@@ -28,11 +28,11 @@ module.exports = function mergeDeep(orig, objects) {
   return target;
 };
 
 function merge(target, obj) {
   for (var key in obj) {
-    if (!hasOwn(obj, key)) {
+    if (key === '__proto__' || !hasOwn(obj, key)) {
       continue;
     }
 
     var oldVal = obj[key];
     var newVal = target[key];

Vulnerable code:     if (!hasOwn(obj, key)) {
Fixed code:     if (key === '__proto__' || !hasOwn(obj, key)) {
CVE-2021-26707: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks against applications using this library.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.8
Published: 2021-06-02T15:15Z
Repository: https://github.com/jonschlinkert/merge-deep
Language: JavaScript
Files changed: .travis.yml, index.js
Commit date: 2021-01-04 14:21:09 -0500
Commit message: add isValidKey function to ensure only valid keys are merged

Diff: diff --git a/.travis.yml b/.travis.yml
index b41bd9f..ea3ec10 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -15,6 +15,7 @@ node_js:
   - '0.12'
   - '0.10'
 matrix:
   fast_finish: true
   allow_failures:
+    - node_js: 'node'
     - node_js: '0.8'
diff --git a/index.js b/index.js
index 16b4690..08db87a 100644
--- a/index.js
+++ b/index.js
@@ -30,11 +30,11 @@ module.exports = function mergeDeep(orig, objects) {
   return target;
 };
 
 function merge(target, obj) {
   for (var key in obj) {
-    if (key === '__proto__' || !hasOwn(obj, key)) {
+    if (!isValidKey(key) || !hasOwn(obj, key)) {
       continue;
     }
 
     var oldVal = obj[key];
     var newVal = target[key];
@@ -55,5 +55,9 @@ function hasOwn(obj, key) {
 }
 
 function isObject(val) {
   return typeOf(val) === 'object' || typeOf(val) === 'function';
 }
+
+function isValidKey(key) {
+  return key !== '__proto__' && key !== 'constructor' && key !== 'prototype';
+}
\ No newline at end of file

Vulnerable code:     if (key === '__proto__' || !hasOwn(obj, key)) {
Fixed code:     - node_js: 'node'
    if (!isValidKey(key) || !hasOwn(obj, key)) {

function isValidKey(key) {
  return key !== '__proto__' && key !== 'constructor' && key !== 'prototype';
}
CVE-2024-23838: Server-Side Request Forgery (SSRF) (CWE-918)
value: TrueLayer.NET is the .Net client for TrueLayer.  The vulnerability could potentially allow a malicious actor to gain control over the destination URL of the HttpClient used in the API classes. For applications using the SDK, requests to unexpected resources on local networks or to the internet could be made which could lead to information disclosure. The issue can be mitigated by having strict egress rules limiting the destinations to which requests can be made, and applying strict validation to any user input passed to the `truelayer-dotnet` library. Versions of TrueLayer.Client `v1.6.0` and later are not affected.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 7.5
Published: 2024-01-30T17:15Z
Repository: https://github.com/TrueLayer/truelayer-dotnet
Language: Unknown
Commit date: 2024-01-22 16:55:08 +0000
Commit message: Merge pull request from GHSA-67m4-qxp3-j6hh

fix: validated that IDs in input are not valid URIs
CVE-2022-34299: Out-of-bounds Read (CWE-125)
value: There is a heap-based buffer over-read in libdwarf 0.4.0. This issue is related to dwarf_global_formref_b.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.1
Published: 2022-06-23T17:15Z
Repository: https://github.com/davea42/libdwarf-code
Language: C
Files changed: src/lib/libdwarf/dwarf_form.c
Commit date: 2022-06-15 14:46:01 -0700
Commit message: Fixes old bug(which could result in Denial of Service)
due to a missing check before reading the 8 bytes of a DW_FORM_ref_sig8.
DW202206-001
	modified:   src/lib/libdwarf/dwarf_form.c

Diff: diff --git a/src/lib/libdwarf/dwarf_form.c b/src/lib/libdwarf/dwarf_form.c
index 8e8e23090..fe4b013ef 100644
--- a/src/lib/libdwarf/dwarf_form.c
+++ b/src/lib/libdwarf/dwarf_form.c
@@ -603,11 +603,10 @@ find_sig8_target_as_global_offset(Dwarf_Attribute attr,
 {
     Dwarf_Die  targdie = 0;
     Dwarf_Bool targ_is_info = 0;
     Dwarf_Off  localoff = 0;
     int res = 0;
-
     targ_is_info = attr->ar_cu_context->cc_is_info;
     memcpy(sig8,attr->ar_debug_ptr,sizeof(*sig8));
     res = dwarf_find_die_given_sig8(attr->ar_dbg,
         sig8,&targdie,&targ_is_info,error);
     if (res != DW_DLV_OK) {
@@ -835,10 +834,17 @@ dwarf_global_formref_b(Dwarf_Attribute attr,
             .debug_info refers to .debug_types. */
         Dwarf_Sig8 sig8;
         Dwarf_Bool t_is_info = TRUE;
         Dwarf_Unsigned t_offset = 0;
 
+        if ((attr->ar_debug_ptr + sizeof(Dwarf_Sig8)) > section_end) {
+            _dwarf_error_string(dbg, error,
+                DW_DLE_REF_SIG8_NOT_HANDLED,
+                "DW_DLE_REF_SIG8_NOT_HANDLED: "
+                " Dwarf_Sig8 content runs off the end of its section");
+            return DW_DLV_ERROR;
+        }
         memcpy(&sig8,attr->ar_debug_ptr,sizeof(Dwarf_Sig8));
         res = find_sig8_target_as_global_offset(attr,
             &sig8,&t_is_info,&t_offset,error);
         if (res == DW_DLV_ERROR) {
             _dwarf_error_string(dbg, error,

Fixed code:         if ((attr->ar_debug_ptr + sizeof(Dwarf_Sig8)) > section_end) {
            _dwarf_error_string(dbg, error,
                DW_DLE_REF_SIG8_NOT_HANDLED,
                "DW_DLE_REF_SIG8_NOT_HANDLED: "
                " Dwarf_Sig8 content runs off the end of its section");
            return DW_DLV_ERROR;
        }
CVE-2022-39170: Double Free (CWE-415)
value: libdwarf 0.4.1 has a double free in _dwarf_exec_frame_instr in dwarf_frame.c.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 8.8
Published: 2022-09-02T03:15Z
Repository: https://github.com/davea42/libdwarf-code
Language: Other
Files changed: bugxml/data.txt
Commit date: 2022-08-27 09:49:37 -0700
Commit message: A new vulnerability: DW202208-001
	modified:   data.txt

Diff: diff --git a/bugxml/data.txt b/bugxml/data.txt
index 2609d751e..54bda4151 100644
--- a/bugxml/data.txt
+++ b/bugxml/data.txt
@@ -1,6 +1,31 @@
 
+
+
+id: DW202208-001
+cve:
+fuzzer: unspecified
+datereported: 2022-08-27
+reportedby: Han Zheng
+vulnerability: Double free in dwarfdump
+product: dwarfdump
+description: A carefully corrupted object file
+  would cause dwarfdump -vv -a 
+  to do a double free in handling an error condition.
+  That could cause a segmentation violation or other
+  major error, terminating the calling application and
+  resulting in Denial Of Service.
+datefixed: 
+references: regressiontests/hanzheng/fuzzedobject
+gitfixid: 
+tarrelease:
+endrec: DW202208-001
+
+
+
+
+
 id: DW202207-001
 cve:
 fuzzer: ossfuzz
 datereported: 2022-05-01
 reportedby: David Korczynski

Fixed code: 

id: DW202208-001
cve:
fuzzer: unspecified
datereported: 2022-08-27
reportedby: Han Zheng
vulnerability: Double free in dwarfdump
product: dwarfdump
description: A carefully corrupted object file
  would cause dwarfdump -vv -a 
  to do a double free in handling an error condition.
  That could cause a segmentation violation or other
  major error, terminating the calling application and
  resulting in Denial Of Service.
datefixed: 
references: regressiontests/hanzheng/fuzzedobject
gitfixid: 
tarrelease:
endrec: DW202208-001
CVE-2024-39896: Insufficient Information (NVD-CWE-noinfo)
value: Directus is a real-time API and App dashboard for managing SQL database content. When relying on SSO providers in combination with local authentication it can be possible to enumerate existing SSO users in the instance. This is possible because if an email address exists in Directus and belongs to a known SSO provider then it will throw a "helpful" error that the user belongs to another provider. This vulnerability is fixed in 10.13.0.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-08T18:15Z
Repository: https://github.com/directus/directus
Language: TypeScript
Files changed: api/src/services/authentication.ts
Commit date: 2024-06-24 14:51:07 -0400
Commit message: Merge pull request from GHSA-jgf4-vwc3-r46v

* naive fix for enumeration

* re-added explicit provider check

* Remove user suspended error as well

---------

Co-authored-by: Rijk van Zanten <rijkvanzanten@me.com>
Diff: diff --git a/api/src/services/authentication.ts b/api/src/services/authentication.ts
index 57bfa1c1454..56107840a5b 100644
--- a/api/src/services/authentication.ts
+++ b/api/src/services/authentication.ts
@@ -1,11 +1,10 @@
 import { Action } from '@directus/constants';
 import { useEnv } from '@directus/env';
 import {
 	InvalidCredentialsError,
 	InvalidOtpError,
-	InvalidProviderError,
 	ServiceUnavailableError,
 	UserSuspendedError,
 } from '@directus/errors';
 import type { Accountability, SchemaOverview } from '@directus/types';
 import jwt from 'jsonwebtoken';
@@ -123,23 +122,14 @@ export class AuthenticationService {
 					accountability: this.accountability,
 				},
 			);
 		};
 
-		if (user?.status !== 'active') {
+		if (user?.status !== 'active' || user?.provider !== providerName) {
 			emitStatus('fail');
-
-			if (user?.status === 'suspended') {
-				await stall(STALL_TIME, timeStart);
-				throw new UserSuspendedError();
-			} else {
-				await stall(STALL_TIME, timeStart);
-				throw new InvalidCredentialsError();
-			}
-		} else if (user.provider !== providerName) {
 			await stall(STALL_TIME, timeStart);
-			throw new InvalidProviderError();
+			throw new InvalidCredentialsError();
 		}
 
 		const settingsService = new SettingsService({
 			knex: this.knex,
 			schema: this.schema,

Vulnerable code: 	InvalidProviderError,
		if (user?.status !== 'active') {

			if (user?.status === 'suspended') {
				await stall(STALL_TIME, timeStart);
				throw new UserSuspendedError();
			} else {
				await stall(STALL_TIME, timeStart);
				throw new InvalidCredentialsError();
			}
		} else if (user.provider !== providerName) {
			throw new InvalidProviderError();
Fixed code: 		if (user?.status !== 'active' || user?.provider !== providerName) {
			throw new InvalidCredentialsError();
CVE-2023-46739: Observable Discrepancy (CWE-203)
value: CubeFS is an open-source cloud-native file storage system. A vulnerability was found during in the CubeFS master component in versions prior to 3.3.1 that could allow an untrusted attacker to steal user passwords by carrying out a timing attack. The root case of the vulnerability was that CubeFS used raw string comparison of passwords. The vulnerable part of CubeFS was the UserService of the master component. The UserService gets instantiated when starting the server of the master component. The issue has been patched in v3.3.1. For impacted users, there is no other way to mitigate the issue besides upgrading.
CWE description: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CVSS v3 base score: 5.9
Published: 2024-01-03T17:15Z
Repository: https://github.com/cubefs/cubefs
Language: Go
Files changed: master/gapi_user.go
Commit date: 2023-11-17 14:19:20 +0800
Commit message: enhance(gapi):Timing attack can leak user passwords

Signed-off-by: leonrayang <chl696@sina.com>

Diff: diff --git a/master/gapi_user.go b/master/gapi_user.go
index 751ebd1e5..80d897746 100644
--- a/master/gapi_user.go
+++ b/master/gapi_user.go
@@ -1,9 +1,11 @@
 package master
 
 import (
 	"context"
+	"crypto/sha256"
+	"encoding/hex"
 	"fmt"
 	"github.com/cubefs/cubefs/proto"
 	"github.com/cubefs/cubefs/util/log"
 	"github.com/samsarahq/thunder/graphql"
 	"github.com/samsarahq/thunder/graphql/schemabuilder"
@@ -345,12 +347,17 @@ func (s *UserService) validatePassword(ctx context.Context, args struct {
 
 	ak, err := s.user.getAKUser(ui.AccessKey)
 	if err != nil {
 		return nil, err
 	}
+	hashedPassword := sha256.Sum256([]byte(args.Password))
+	hashedPasswordStr := hex.EncodeToString(hashedPassword[:])
 
-	if ak.Password != args.Password {
+	hashedPassword_ := sha256.Sum256([]byte(ak.Password))
+	hashedPasswordStr_ := hex.EncodeToString(hashedPassword_[:])
+
+	if hashedPasswordStr != hashedPasswordStr_ {
 		log.LogWarnf("user:[%s] login pass word has err", args.UserID)
 		return nil, fmt.Errorf("user or password has err")
 	}
 	return ui, nil
 }

Vulnerable code: 	if ak.Password != args.Password {
Fixed code: 	"crypto/sha256"
	"encoding/hex"
	hashedPassword := sha256.Sum256([]byte(args.Password))
	hashedPasswordStr := hex.EncodeToString(hashedPassword[:])
	hashedPassword_ := sha256.Sum256([]byte(ak.Password))
	hashedPasswordStr_ := hex.EncodeToString(hashedPassword_[:])

	if hashedPasswordStr != hashedPasswordStr_ {
CVE-2023-46741: Insufficient Information (NVD-CWE-noinfo)
value: CubeFS is an open-source cloud-native file storage system. A vulnerability was found in CubeFS prior to version 3.3.1 that could allow users to read sensitive data from the logs which could allow them escalate privileges. CubeFS leaks configuration keys in plaintext format in the logs. These keys could allow anyone to carry out operations on blobs that they otherwise do not have permissions for. For example, an attacker that has succesfully retrieved a secret key from the logs can delete blogs from the blob store. The attacker can either be an internal user with limited privileges to read the log, or they can be an external user who has escalated privileges sufficiently to access the logs. The vulnerability has been patched in v3.3.1. There is no other mitigation than upgrading.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2024-01-03T17:15Z
Repository: https://github.com/cubefs/cubefs
Language: Go
Files changed: blobstore/access/server.go
Commit date: 2023-10-20 11:18:12 +0800
Commit message: fix(security): leaks magic secret key when starting blobstore access service

see more in cubefs advisories:
https://github.com/cubefs/cubefs/security/advisories/GHSA-8h2x-gr2c-c275

Signed-off-by: slasher <shenjie1@oppo.com>

Diff: diff --git a/blobstore/access/server.go b/blobstore/access/server.go
index 6e00bf6b1..4da37ebf7 100644
--- a/blobstore/access/server.go
+++ b/blobstore/access/server.go
@@ -76,12 +76,10 @@ func initTokenSecret(b []byte) {
 func initWithRegionMagic(regionMagic string) {
 	if regionMagic == "" {
 		log.Warn("no region magic setting, using default secret keys for checksum")
 		return
 	}
-
-	log.Info("using magic secret keys for checksum with:", regionMagic)
 	b := sha1.Sum([]byte(regionMagic))
 	initTokenSecret(b[:8])
 	initLocationSecret(b[:8])
 }
 

Vulnerable code: 
	log.Info("using magic secret keys for checksum with:", regionMagic)