Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2023-50255: Relative Path Traversal (CWE-23)
value: Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.

CWE description: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
CVSS v3 base score: 7.8
Published: 2023-12-27T17:15Z
Repository: https://github.com/linuxdeepin/deepin-compressor
Language: C++
Files changed: 3rdparty/libzipplugin/libzipplugin.cpp
Commit date: 2023-12-12 05:25:17 +0000
Commit message: fix: Zip Path Traversal

Zip Path Traversal

Bug: https://pms.uniontech.com/bug-view-232873.html

Log: Zip Path Traversal

Diff: diff --git a/3rdparty/libzipplugin/libzipplugin.cpp b/3rdparty/libzipplugin/libzipplugin.cpp
index c872778c..3c64fd6a 100644
--- a/3rdparty/libzipplugin/libzipplugin.cpp
+++ b/3rdparty/libzipplugin/libzipplugin.cpp
@@ -759,10 +759,15 @@ ErrorType LibzipPlugin::extractEntry(zip_t *archive, zip_int64_t index, const Ex
     if (zip_stat_index(archive, zip_uint64_t(index), ZIP_FL_ENC_RAW, &statBuffer) != 0) {
         return ET_FileReadError;
     }
 
     strFileName = m_common->trans2uft8(statBuffer.name, m_mapFileCode[index]);    // 解压文件名（压缩包中）
+    //fix 232873
+    if(strFileName.indexOf("../") != -1) {
+        qInfo() << "skipped ../ path component(s) in " << strFileName;
+        strFileName = strFileName.replace("../", "");
+    }
     if(strFileName.contains(QLatin1Char('\\')))
         strFileName = strFileName.replace(QLatin1Char('\\'), QDir::separator());
     QString strOriginName = strFileName;
 
     // 针对文件夹名称过长的情况，直接提示解压失败，文件夹名称过长

Fixed code:     //fix 232873
    if(strFileName.indexOf("../") != -1) {
        qInfo() << "skipped ../ path component(s) in " << strFileName;
        strFileName = strFileName.replace("../", "");
    }
CVE-2023-50255: Path Traversal: '/dir/../filename' (CWE-26)
value: Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.

CWE description: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "/dir/../filename" sequences that can resolve to a location that is outside of that directory.
CVSS v3 base score: 7.8
Published: 2023-12-27T17:15Z
Repository: https://github.com/linuxdeepin/deepin-compressor
Language: C++
Files changed: 3rdparty/libzipplugin/libzipplugin.cpp
Commit date: 2023-12-12 05:25:17 +0000
Commit message: fix: Zip Path Traversal

Zip Path Traversal

Bug: https://pms.uniontech.com/bug-view-232873.html

Log: Zip Path Traversal

Diff: diff --git a/3rdparty/libzipplugin/libzipplugin.cpp b/3rdparty/libzipplugin/libzipplugin.cpp
index c872778c..3c64fd6a 100644
--- a/3rdparty/libzipplugin/libzipplugin.cpp
+++ b/3rdparty/libzipplugin/libzipplugin.cpp
@@ -759,10 +759,15 @@ ErrorType LibzipPlugin::extractEntry(zip_t *archive, zip_int64_t index, const Ex
     if (zip_stat_index(archive, zip_uint64_t(index), ZIP_FL_ENC_RAW, &statBuffer) != 0) {
         return ET_FileReadError;
     }
 
     strFileName = m_common->trans2uft8(statBuffer.name, m_mapFileCode[index]);    // 解压文件名（压缩包中）
+    //fix 232873
+    if(strFileName.indexOf("../") != -1) {
+        qInfo() << "skipped ../ path component(s) in " << strFileName;
+        strFileName = strFileName.replace("../", "");
+    }
     if(strFileName.contains(QLatin1Char('\\')))
         strFileName = strFileName.replace(QLatin1Char('\\'), QDir::separator());
     QString strOriginName = strFileName;
 
     // 针对文件夹名称过长的情况，直接提示解压失败，文件夹名称过长

Fixed code:     //fix 232873
    if(strFileName.indexOf("../") != -1) {
        qInfo() << "skipped ../ path component(s) in " << strFileName;
        strFileName = strFileName.replace("../", "");
    }
CVE-2012-6550: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in ZeroClipboard before 1.1.4 allows remote attackers to inject arbitrary web script or HTML via "the clipText returned from the flash object," a different vulnerability than CVE-2013-1808.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2013-04-02T03:22Z
Repository: https://github.com/jonrohan/ZeroClipboard
Language: Other
Files changed: docs/releases.md, src/flash/ZeroClipboard.as
Commit date: 2012-12-31 14:31:13 -0800
Commit message: XSS Bug escaping clipText returned

Diff: diff --git a/ZeroClipboard.swf b/ZeroClipboard.swf
index e751a05..6ed8d8f 100644
Binary files a/ZeroClipboard.swf and b/ZeroClipboard.swf differ
diff --git a/docs/releases.md b/docs/releases.md
index a7ea5b4..2d4c1c7 100644
--- a/docs/releases.md
+++ b/docs/releases.md
@@ -1,10 +1,11 @@
 ### ZeroClipboard 1.1.4
 
 To the future, 1.1.4 will address any bugs from the previous release.
 
 * [SECURITY] Removing `flash.system.Security.allowDomain("*");` default. now should be set via flashvars.
+* [SECURITY] XSS Vunerability, the clipText returned from the flash object needs to be escaped.
 
 ### ZeroClipboard 1.1.1, 1.1.2, 1.1.3
 
 Emergency bug release.
 
diff --git a/src/flash/ZeroClipboard.as b/src/flash/ZeroClipboard.as
index 10415ae..fdf2a04 100755
--- a/src/flash/ZeroClipboard.as
+++ b/src/flash/ZeroClipboard.as
@@ -84,11 +84,11 @@
       // set the clipboard data from the variable
       Clipboard.generalClipboard.setData(clipFormat, clipText);
 
       // signal to the page it is done
       ExternalInterface.call( 'ZeroClipboard.dispatch', 'complete',  metaData(event, {
-        text: clipText,
+        text: clipText.split("\\").join("\\\\"),
         format: clipFormat
       }));
     }
 
     // mouseOver

Vulnerable code:         text: clipText,
Fixed code: * [SECURITY] XSS Vunerability, the clipText returned from the flash object needs to be escaped.
        text: clipText.split("\\").join("\\\\"),
CVE-2013-1808: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in ZeroClipboard.swf and ZeroClipboard10.swf in ZeroClipboard before 1.0.8, as used in em-shorty, RepRapCalculator, Fulcrum, Django, aCMS, and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter.  NOTE: this is might be the same vulnerability as CVE-2013-1463. If so, it is likely that CVE-2013-1463 will be REJECTed.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2013-04-02T03:23Z
Repository: https://github.com/jonrohan/ZeroClipboard
Language: Other
Files changed: ZeroClipboard.as
Commit date: 2012-05-28 19:27:41 +0800
Commit message: escape fix becuse XSS risk like 
Diff: diff --git a/ZeroClipboard.as b/ZeroClipboard.as
index 26ad18b..d973b18 100755
--- a/ZeroClipboard.as
+++ b/ZeroClipboard.as
@@ -26,11 +26,11 @@
 			flash.system.Security.allowDomain("*");
 			
 			// import flashvars
 			var flashvars:Object = LoaderInfo( this.root.loaderInfo ).parameters;
 			id = flashvars.id;
-			
+			id = id.split("\\").join("\\\\");
 			// invisible button covers entire stage
 			button = new Sprite();
 			button.buttonMode = true;
 			button.useHandCursor = true;
 			button.graphics.beginFill(0xCCFF00);

Fixed code: 			id = id.split("\\").join("\\\\");
CVE-2024-29031: Insufficient Information (NVD-CWE-noinfo)
value: Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.17 allows a remote attacker to obtain sensitive information via the `order` parameter of `GetMeshSyncResources`. Version 0.7.17 contains a patch for this issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-21T23:15Z
Repository: https://github.com/meshery/meshery
Language: Unknown
Commit date: 2024-02-06 19:40:50 +0530
Commit message: Merge pull request #10207 from gyohuangxin/fix_sql_injection

Fix SQL injection in /api/system/meshsync/resources
CVE-2024-35181: Insufficient Information (NVD-CWE-noinfo)
value: Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.22 may lead to arbitrary file write by using a SQL injection stacked queries payload, and the ATTACH DATABASE command. Additionally, attackers may be able to access and modify any data stored in the database, like performance profiles (which may contain session cookies), Meshery application data, or any Kubernetes configuration added to the system. The Meshery project exposes the function `GetMeshSyncResourcesKinds` at the API URL `/api/system/meshsync/resources/kinds`. The order query parameter is directly used to build a SQL query in `meshync_handler.go`. Version 0.7.22 fixes this issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-27T19:15Z
Repository: https://github.com/meshery/meshery
Language: Unknown
Commit date: 2024-02-06 19:40:50 +0530
Commit message: Merge pull request #10207 from gyohuangxin/fix_sql_injection

Fix SQL injection in /api/system/meshsync/resources
CVE-2024-35181: Insufficient Information (NVD-CWE-noinfo)
value: Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.22 may lead to arbitrary file write by using a SQL injection stacked queries payload, and the ATTACH DATABASE command. Additionally, attackers may be able to access and modify any data stored in the database, like performance profiles (which may contain session cookies), Meshery application data, or any Kubernetes configuration added to the system. The Meshery project exposes the function `GetMeshSyncResourcesKinds` at the API URL `/api/system/meshsync/resources/kinds`. The order query parameter is directly used to build a SQL query in `meshync_handler.go`. Version 0.7.22 fixes this issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-27T19:15Z
Repository: https://github.com/meshery/meshery
Language: Unknown
Commit date: 2024-02-18 08:18:23 -0600
Commit message: Merge pull request #10280 from gyohuangxin/fix_sql_injection_2

Fix more SQL injections
CVE-2024-35182: Insufficient Information (NVD-CWE-noinfo)
value: Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.22 may lead to arbitrary file write by using a SQL injection stacked queries payload, and the ATTACH DATABASE command. Additionally, attackers may be able to access and modify any data stored in the database, like performance profiles (which may contain session cookies), Meshery application data, or any Kubernetes configuration added to the system. The Meshery project exposes the function `GetAllEvents` at the API URL `/api/v2/events`. The sort query parameter read in `events_streamer.go` is directly used to build a SQL query in `events_persister.go`. Version 0.7.22 fixes this issue by using the `SanitizeOrderInput` function.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-27T19:15Z
Repository: https://github.com/meshery/meshery
Language: Unknown
Commit date: 2024-02-18 08:18:23 -0600
Commit message: Merge pull request #10280 from gyohuangxin/fix_sql_injection_2

Fix more SQL injections
CVE-2021-4303: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, has been found in shannah Xataface up to 2.x. Affected by this issue is the function testftp of the file install/install_form.js.php of the component Installer. The manipulation leads to cross site scripting. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 3.0.0 is able to address this issue. The patch is identified as 94143a4299e386f33bf582139cd4702571d93bde. It is recommended to upgrade the affected component. VDB-217442 is the identifier assigned to this vulnerability. NOTE: Installer is disabled by default.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-05T09:15Z
Repository: https://github.com/shannah/xataface
Language: PHP
Files changed: install/install_form.js.php
Commit date: 2021-10-04 10:13:39 -0700
Commit message: Fixed XSS vulnerability reported by hitisec.  This is low threat since it is in the installer, which is disabled by default, and should only be enabled temporarily by trusted parties.  E.g. in order to even reach the vulnerability, the user would need to have a valid username/password for the MySQL database.

Diff: diff --git a/install/install_form.js.php b/install/install_form.js.php
index dc0ffb0..3cfdfff 100644
--- a/install/install_form.js.php
+++ b/install/install_form.js.php
@@ -13,22 +13,21 @@ function fieldInfo(id){
 
 function testftp(form){
 	
 	postDataReturnText('installer.php','-action=testftp&-ftphost='+escape(form.ftp_host.value)+'&-ftpuser='+escape(form.ftp_username.value)+'&-ftppass='+escape(form.ftp_password.value)+'&-ftppath='+escape(form.ftp_path.value), function(result){
 		var resultDiv = document.getElementById('ftp-test-results');
-		eval('var results = '+result+';');
-		resultDiv.innerHTML = results.message;
+		var results = JSON.parse(result);
+		resultDiv.innerText = results.message;
 		});
 	
 
 }
 
 function testdb(form){
 	postDataReturnText('installer.php','-action=testdb&-dbname='+escape(form.database_name.options[form.database_name.selectedIndex].value)+'&-dbuser='+escape(form.mysql_user.value)+'&-dbpass='+escape(form.mysql_password.value), function(result){
-		var resultDiv = document.getElementById('db-test-results');
-		eval('var results = '+result+';');
-		resultDiv.innerHTML = results.message;
+        var results = JSON.parse(result);
+		resultDiv.innerText = results.message;
 	});
 }
 
 
 var listeners = {

Vulnerable code: 		eval('var results = '+result+';');
		resultDiv.innerHTML = results.message;
		var resultDiv = document.getElementById('db-test-results');
		eval('var results = '+result+';');
		resultDiv.innerHTML = results.message;
Fixed code: 		var results = JSON.parse(result);
		resultDiv.innerText = results.message;
        var results = JSON.parse(result);
		resultDiv.innerText = results.message;
CVE-2017-1000458: Out-of-bounds Write (CWE-787)
value: Bro before Bro v2.5.2 is vulnerable to an out of bounds write in the ContentLine analyzer allowing remote attackers to cause a denial of service (crash) and possibly other exploitation.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2018-01-02T18:29Z
Repository: https://github.com/bro/bro
Language: C++
Files changed: src/analyzer/protocol/tcp/ContentLine.cc
Commit date: 2017-10-16 13:13:41 -0700
Commit message: Patch OOB write in content-line analyzer.

A combination of packets can trigger an out of bound write of '0' byte
in the content-line analyzer.

This bug was found by Frank Meier.

Addresses BIT-1856.

Diff: diff --git a/src/analyzer/protocol/tcp/ContentLine.cc b/src/analyzer/protocol/tcp/ContentLine.cc
index f5dd7aaf0..a830cc8a7 100644
--- a/src/analyzer/protocol/tcp/ContentLine.cc
+++ b/src/analyzer/protocol/tcp/ContentLine.cc
@@ -248,10 +248,20 @@ int ContentLine_Analyzer::DoDeliverOnce(int len, const u_char* data)
 			break;
 
 		case '\n':
 			if ( last_char == '\r' )
 				{
+				// Weird corner-case:
+				// this can happen if we see a \r at the end of a packet where crlf is
+				// set to CR_as_EOL | LF_as_EOL, with the packet causing crlf to be set to
+				// 0 and the next packet beginning with a \n. In this case we just swallow
+				// the character and re-set last_char.
+				if ( offset == 0 )
+					{
+					last_char = c;
+					break;
+					}
 				--offset; // remove '\r'
 				EMIT_LINE
 				}
 
 			else if ( CR_LF_as_EOL & LF_as_EOL )

Fixed code: 				// Weird corner-case:
				// this can happen if we see a \r at the end of a packet where crlf is
				// set to CR_as_EOL | LF_as_EOL, with the packet causing crlf to be set to
				// 0 and the next packet beginning with a \n. In this case we just swallow
				// the character and re-set last_char.
				if ( offset == 0 )
					{
					last_char = c;
					break;
					}
CVE-2018-16807: Missing Release of Resource after Effective Lifetime (CWE-772)
value: In Bro through 2.5.5, there is a memory leak potentially leading to DoS in scripts/base/protocols/krb/main.bro in the Kerberos protocol parser.
CWE description: The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CVSS v3 base score: 7.5
Published: 2018-09-11T02:29Z
Repository: https://github.com/bro/bro
Language: Other
Files changed: scripts/base/protocols/krb/main.bro, testing/btest/core/leaks/krb-service-name.test
Commit date: 2018-09-10 18:06:07 -0500
Commit message: Fix potential memory leak in Kerberos scripts

Reported by Maksim Shudrak.

Diff: diff --git a/scripts/base/protocols/krb/main.bro b/scripts/base/protocols/krb/main.bro
index e45ce92cd..076ea0e17 100644
--- a/scripts/base/protocols/krb/main.bro
+++ b/scripts/base/protocols/krb/main.bro
@@ -138,11 +138,12 @@ event krb_as_request(c: connection, msg: KDC_Request) &priority=5
 	if ( set_session(c) )
 		return;
 
 	c$krb$request_type = "AS";
 	c$krb$client       = fmt("%s/%s", msg?$client_name ? msg$client_name : "", msg$service_realm);
-	c$krb$service      = msg$service_name;
+	if ( msg?$service_name )
+		c$krb$service      = msg$service_name;
 
 	if ( msg?$from )
 		c$krb$from = msg$from;
 	c$krb$till        = msg$till;
 
@@ -181,11 +182,12 @@ event krb_tgs_request(c: connection, msg: KDC_Request) &priority=5
 	{
 	if ( set_session(c) )
 		return;
 
 	c$krb$request_type = "TGS";
-	c$krb$service = msg$service_name;
+	if ( msg?$service_name )
+		c$krb$service = msg$service_name;
 	if ( msg?$from ) 
 		c$krb$from = msg$from;
 	c$krb$till = msg$till;
 
 	c$krb$forwardable = msg$kdc_options$forwardable;
diff --git a/testing/btest/Traces/krb/optional-service-name.pcap b/testing/btest/Traces/krb/optional-service-name.pcap
new file mode 100755
index 000000000..85df6b2ae
Binary files /dev/null and b/testing/btest/Traces/krb/optional-service-name.pcap differ
diff --git a/testing/btest/core/leaks/krb-service-name.test b/testing/btest/core/leaks/krb-service-name.test
new file mode 100644
index 000000000..a0d8a8432
--- /dev/null
+++ b/testing/btest/core/leaks/krb-service-name.test
@@ -0,0 +1,8 @@
+# Needs perftools support.
+#
+# @TEST-REQUIRES: bro  --help 2>&1 | grep -q mem-leaks
+#
+# @TEST-GROUP: leaks
+#
+# @TEST-EXEC: HEAP_CHECK_DUMP_DIRECTORY=. HEAPCHECK=local btest-bg-run bro bro -m -r $TRACES/krb/optional-service-name.pcap
+# @TEST-EXEC: btest-bg-wait 60

Vulnerable code: 	c$krb$service      = msg$service_name;
	c$krb$service = msg$service_name;
Fixed code: 	if ( msg?$service_name )
		c$krb$service      = msg$service_name;
	if ( msg?$service_name )
		c$krb$service = msg$service_name;
# Needs perftools support.
#
# @TEST-REQUIRES: bro  --help 2>&1 | grep -q mem-leaks
#
# @TEST-GROUP: leaks
#
# @TEST-EXEC: HEAP_CHECK_DUMP_DIRECTORY=. HEAPCHECK=local btest-bg-run bro bro -m -r $TRACES/krb/optional-service-name.pcap
# @TEST-EXEC: btest-bg-wait 60
CVE-2022-21668: Improper Validation of Specified Quantity in Input (CWE-1284)
value: pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files allows an attacker to insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims who use pipenv to install the requirements file to download dependencies from a package index server controlled by the attacker. By embedding malicious code in packages served from their malicious index server, the attacker can trigger arbitrary remote code execution (RCE) on the victims' systems. If an attacker is able to hide a malicious `--index-url` option in a requirements file that a victim installs with pipenv, the attacker can embed arbitrary malicious code in packages served from their malicious index server that will be executed on the victim's host during installation (remote code execution/RCE). When pip installs from a source distribution, any code in the setup.py is executed by the install process. This issue is patched in version 2022.1.8. The GitHub Security Advisory contains more information about this vulnerability.
CWE description: The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
CVSS v3 base score: 8.6
Published: 2022-01-10T21:15Z
Repository: https://github.com/pypa/pipenv
Language: Unknown
Commit date: 2022-01-08 22:28:26 +0800
Commit message: Merge pull request from GHSA-qc9x-gjcv-465w

fix TLS validation for requirements.txt
CVE-2022-21668: Integer Overflow or Wraparound (CWE-190)
value: pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files allows an attacker to insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims who use pipenv to install the requirements file to download dependencies from a package index server controlled by the attacker. By embedding malicious code in packages served from their malicious index server, the attacker can trigger arbitrary remote code execution (RCE) on the victims' systems. If an attacker is able to hide a malicious `--index-url` option in a requirements file that a victim installs with pipenv, the attacker can embed arbitrary malicious code in packages served from their malicious index server that will be executed on the victim's host during installation (remote code execution/RCE). When pip installs from a source distribution, any code in the setup.py is executed by the install process. This issue is patched in version 2022.1.8. The GitHub Security Advisory contains more information about this vulnerability.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 8.6
Published: 2022-01-10T21:15Z
Repository: https://github.com/pypa/pipenv
Language: Unknown
Commit date: 2022-01-08 22:28:26 +0800
Commit message: Merge pull request from GHSA-qc9x-gjcv-465w

fix TLS validation for requirements.txt
CVE-2016-10749: Out-of-bounds Read (CWE-125)
value: parse_string in cJSON.c in cJSON before 2016-10-02 has a buffer over-read, as demonstrated by a string that begins with a " character and ends with a \ character.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2019-04-29T14:29Z
Repository: https://github.com/DaveGamble/cJSON
Language: C
Files changed: cJSON.c
Commit date: 2016-10-02 18:56:53 +0700
Commit message: fix buffer overflow (#30)

Diff: diff --git a/cJSON.c b/cJSON.c
index cbd3a89..93a1bec 100644
--- a/cJSON.c
+++ b/cJSON.c
@@ -192,13 +192,24 @@ static unsigned parse_hex4(const char *str)
 static const unsigned char firstByteMark[7] = { 0x00, 0x00, 0xC0, 0xE0, 0xF0, 0xF8, 0xFC };
 static const char *parse_string(cJSON *item,const char *str,const char **ep)
 {
 	const char *ptr=str+1,*end_ptr=str+1;char *ptr2;char *out;int len=0;unsigned uc,uc2;
 	if (*str!='\"') {*ep=str;return 0;}	/* not a string! */
-	
-	while (*end_ptr!='\"' && *end_ptr && ++len) if (*end_ptr++ == '\\') end_ptr++;	/* Skip escaped quotes. */
-	
+
+	while (*end_ptr!='\"' && *end_ptr && ++len)
+	{
+	    if (*end_ptr++ == '\\')
+	    {
+		if (*end_ptr == '\0')
+		{
+		    /* prevent buffer overflow when last input character is a backslash */
+		    return 0;
+		}
+		end_ptr++;	/* Skip escaped quotes. */
+	    }
+	}
+
 	out=(char*)cJSON_malloc(len+1);	/* This is how long we need for the string, roughly. */
 	if (!out) return 0;
 	item->valuestring=out; /* assign here so out will be deleted during cJSON_Delete() later */
 	item->type=cJSON_String;
 	

Vulnerable code: 	
	while (*end_ptr!='\"' && *end_ptr && ++len) if (*end_ptr++ == '\\') end_ptr++;	/* Skip escaped quotes. */
	
Fixed code: 
	while (*end_ptr!='\"' && *end_ptr && ++len)
	{
	    if (*end_ptr++ == '\\')
	    {
		if (*end_ptr == '\0')
		{
		    /* prevent buffer overflow when last input character is a backslash */
		    return 0;
		}
		end_ptr++;	/* Skip escaped quotes. */
	    }
	}
CVE-2024-1394: Missing Release of Memory after Effective Lifetime (CWE-401)
value: A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs?. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey? and ctx?. That function uses named return parameters to free pkey? and ctx? if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey? and ctx? will be nil inside the deferred function that should free them.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Published: 2024-03-21T13:00Z
Repository: https://github.com/microsoft/go-crypto-openssl
Language: Go
Files changed: openssl/evpkey.go
Commit date: 2024-02-08 09:25:43 +0100
Commit message: Fix memory leak in setupEVP

Diff: diff --git a/openssl/evpkey.go b/openssl/evpkey.go
index ef0753e..a6161b1 100644
--- a/openssl/evpkey.go
+++ b/openssl/evpkey.go
@@ -99,27 +99,27 @@ type initFunc func(C.GO_EVP_PKEY_CTX_PTR) error
 type cryptFunc func(C.GO_EVP_PKEY_CTX_PTR, *C.uchar, *C.size_t, *C.uchar, C.size_t) error
 type verifyFunc func(C.GO_EVP_PKEY_CTX_PTR, *C.uchar, C.size_t, *C.uchar, C.size_t) error
 
 func setupEVP(withKey withKeyFunc, padding C.int,
 	h, mgfHash hash.Hash, label []byte, saltLen C.int, ch crypto.Hash,
-	init initFunc) (ctx C.GO_EVP_PKEY_CTX_PTR, err error) {
+	init initFunc) (_ C.GO_EVP_PKEY_CTX_PTR, err error) {
+	var ctx C.GO_EVP_PKEY_CTX_PTR
+	withKey(func(pkey C.GO_EVP_PKEY_PTR) C.int {
+		ctx = C.go_openssl_EVP_PKEY_CTX_new(pkey, nil)
+		return 1
+	})
+	if ctx == nil {
+		return nil, newOpenSSLError("EVP_PKEY_CTX_new failed")
+	}
 	defer func() {
 		if err != nil {
 			if ctx != nil {
 				C.go_openssl_EVP_PKEY_CTX_free(ctx)
 				ctx = nil
 			}
 		}
 	}()
-
-	withKey(func(pkey C.GO_EVP_PKEY_PTR) C.int {
-		ctx = C.go_openssl_EVP_PKEY_CTX_new(pkey, nil)
-		return 1
-	})
-	if ctx == nil {
-		return nil, newOpenSSLError("EVP_PKEY_CTX_new failed")
-	}
 	if err := init(ctx); err != nil {
 		return nil, err
 	}
 	if padding == 0 {
 		return ctx, nil

Vulnerable code: 	init initFunc) (ctx C.GO_EVP_PKEY_CTX_PTR, err error) {

	withKey(func(pkey C.GO_EVP_PKEY_PTR) C.int {
		ctx = C.go_openssl_EVP_PKEY_CTX_new(pkey, nil)
		return 1
	})
	if ctx == nil {
		return nil, newOpenSSLError("EVP_PKEY_CTX_new failed")
	}
Fixed code: 	init initFunc) (_ C.GO_EVP_PKEY_CTX_PTR, err error) {
	var ctx C.GO_EVP_PKEY_CTX_PTR
	withKey(func(pkey C.GO_EVP_PKEY_PTR) C.int {
		ctx = C.go_openssl_EVP_PKEY_CTX_new(pkey, nil)
		return 1
	})
	if ctx == nil {
		return nil, newOpenSSLError("EVP_PKEY_CTX_new failed")
	}
CVE-2020-15888: Out-of-bounds Read (CWE-125)
value: Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2020-07-21T22:15Z
Repository: https://github.com/lua/lua
Language: C
Files changed: ldo.c
Commit date: 2020-07-06 12:11:54 -0300
Commit message: Keep minimum size when shrinking a stack

When shrinking a stack (during GC), do not make it smaller than the
initial stack size.

Diff: diff --git a/ldo.c b/ldo.c
index c563b1d9..a89ac010 100644
--- a/ldo.c
+++ b/ldo.c
@@ -243,17 +243,16 @@ static int stackinuse (lua_State *L) {
 }
 
 
 void luaD_shrinkstack (lua_State *L) {
   int inuse = stackinuse(L);
-  int goodsize = inuse + (inuse / 8) + 2*EXTRA_STACK;
+  int goodsize = inuse + BASIC_STACK_SIZE;
   if (goodsize > LUAI_MAXSTACK)
     goodsize = LUAI_MAXSTACK;  /* respect stack limit */
   /* if thread is currently not handling a stack overflow and its
      good size is smaller than current size, shrink its stack */
-  if (inuse <= (LUAI_MAXSTACK - EXTRA_STACK) &&
-      goodsize < L->stacksize)
+  if (inuse <= (LUAI_MAXSTACK - EXTRA_STACK) && goodsize < L->stacksize)
     luaD_reallocstack(L, goodsize, 0);  /* ok if that fails */
   else  /* don't change stack */
     condmovestack(L,{},{});  /* (change only for debugging) */
   luaE_shrinkCI(L);  /* shrink CI list */
 }

Vulnerable code:   int goodsize = inuse + (inuse / 8) + 2*EXTRA_STACK;
  if (inuse <= (LUAI_MAXSTACK - EXTRA_STACK) &&
      goodsize < L->stacksize)
Fixed code:   int goodsize = inuse + BASIC_STACK_SIZE;
  if (inuse <= (LUAI_MAXSTACK - EXTRA_STACK) && goodsize < L->stacksize)
CVE-2020-15888: Use After Free (CWE-416)
value: Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 8.8
Published: 2020-07-21T22:15Z
Repository: https://github.com/lua/lua
Language: C
Files changed: ldo.c
Commit date: 2020-07-06 12:11:54 -0300
Commit message: Keep minimum size when shrinking a stack

When shrinking a stack (during GC), do not make it smaller than the
initial stack size.

Diff: diff --git a/ldo.c b/ldo.c
index c563b1d9..a89ac010 100644
--- a/ldo.c
+++ b/ldo.c
@@ -243,17 +243,16 @@ static int stackinuse (lua_State *L) {
 }
 
 
 void luaD_shrinkstack (lua_State *L) {
   int inuse = stackinuse(L);
-  int goodsize = inuse + (inuse / 8) + 2*EXTRA_STACK;
+  int goodsize = inuse + BASIC_STACK_SIZE;
   if (goodsize > LUAI_MAXSTACK)
     goodsize = LUAI_MAXSTACK;  /* respect stack limit */
   /* if thread is currently not handling a stack overflow and its
      good size is smaller than current size, shrink its stack */
-  if (inuse <= (LUAI_MAXSTACK - EXTRA_STACK) &&
-      goodsize < L->stacksize)
+  if (inuse <= (LUAI_MAXSTACK - EXTRA_STACK) && goodsize < L->stacksize)
     luaD_reallocstack(L, goodsize, 0);  /* ok if that fails */
   else  /* don't change stack */
     condmovestack(L,{},{});  /* (change only for debugging) */
   luaE_shrinkCI(L);  /* shrink CI list */
 }

Vulnerable code:   int goodsize = inuse + (inuse / 8) + 2*EXTRA_STACK;
  if (inuse <= (LUAI_MAXSTACK - EXTRA_STACK) &&
      goodsize < L->stacksize)
Fixed code:   int goodsize = inuse + BASIC_STACK_SIZE;
  if (inuse <= (LUAI_MAXSTACK - EXTRA_STACK) && goodsize < L->stacksize)
CVE-2020-15888: Out-of-bounds Write (CWE-787)
value: Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2020-07-21T22:15Z
Repository: https://github.com/lua/lua
Language: C
Files changed: ldo.c
Commit date: 2020-07-06 12:11:54 -0300
Commit message: Keep minimum size when shrinking a stack

When shrinking a stack (during GC), do not make it smaller than the
initial stack size.

Diff: diff --git a/ldo.c b/ldo.c
index c563b1d9..a89ac010 100644
--- a/ldo.c
+++ b/ldo.c
@@ -243,17 +243,16 @@ static int stackinuse (lua_State *L) {
 }
 
 
 void luaD_shrinkstack (lua_State *L) {
   int inuse = stackinuse(L);
-  int goodsize = inuse + (inuse / 8) + 2*EXTRA_STACK;
+  int goodsize = inuse + BASIC_STACK_SIZE;
   if (goodsize > LUAI_MAXSTACK)
     goodsize = LUAI_MAXSTACK;  /* respect stack limit */
   /* if thread is currently not handling a stack overflow and its
      good size is smaller than current size, shrink its stack */
-  if (inuse <= (LUAI_MAXSTACK - EXTRA_STACK) &&
-      goodsize < L->stacksize)
+  if (inuse <= (LUAI_MAXSTACK - EXTRA_STACK) && goodsize < L->stacksize)
     luaD_reallocstack(L, goodsize, 0);  /* ok if that fails */
   else  /* don't change stack */
     condmovestack(L,{},{});  /* (change only for debugging) */
   luaE_shrinkCI(L);  /* shrink CI list */
 }

Vulnerable code:   int goodsize = inuse + (inuse / 8) + 2*EXTRA_STACK;
  if (inuse <= (LUAI_MAXSTACK - EXTRA_STACK) &&
      goodsize < L->stacksize)
Fixed code:   int goodsize = inuse + BASIC_STACK_SIZE;
  if (inuse <= (LUAI_MAXSTACK - EXTRA_STACK) && goodsize < L->stacksize)
CVE-2020-15889: Out-of-bounds Read (CWE-125)
value: Lua 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficient number of list members.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2020-07-21T22:15Z
Repository: https://github.com/lua/lua
Language: C
Files changed: lgc.c
Commit date: 2020-07-10 14:13:50 -0300
Commit message: Fixed bug of old finalized objects in the GC

When an object aged OLD1 is finalized, it is moved from the list
'finobj' to the *beginning* of the list 'allgc'. So, this part of the
list (and not only the survival list) must be visited by 'markold'.

Diff: diff --git a/lgc.c b/lgc.c
index f26c921a9..f7fd7a59a 100644
--- a/lgc.c
+++ b/lgc.c
@@ -1129,20 +1129,18 @@ static void finishgencycle (lua_State *L, global_State *g) {
     callallpendingfinalizers(L);
 }
 
 
 /*
-** Does a young collection. First, mark 'OLD1' objects.  (Only survival
-** and "recent old" lists can contain 'OLD1' objects. New lists cannot
-** contain 'OLD1' objects, at most 'OLD0' objects that were already
-** visited when marked old.) Then does the atomic step. Then,
-** sweep all lists and advance pointers. Finally, finish the collection.
+** Does a young collection. First, mark 'OLD1' objects. Then does the
+** atomic step. Then, sweep all lists and advance pointers. Finally,
+** finish the collection.
 */
 static void youngcollection (lua_State *L, global_State *g) {
   GCObject **psurvival;  /* to point to first non-dead survival object */
   lua_assert(g->gcstate == GCSpropagate);
-  markold(g, g->survival, g->reallyold);
+  markold(g, g->allgc, g->reallyold);
   markold(g, g->finobj, g->finobjrold);
   atomic(L);
 
   /* sweep nursery and get a pointer to its last live element */
   psurvival = sweepgen(L, g, &g->allgc, g->survival);

Vulnerable code: ** Does a young collection. First, mark 'OLD1' objects.  (Only survival
** and "recent old" lists can contain 'OLD1' objects. New lists cannot
** contain 'OLD1' objects, at most 'OLD0' objects that were already
** visited when marked old.) Then does the atomic step. Then,
** sweep all lists and advance pointers. Finally, finish the collection.
  markold(g, g->survival, g->reallyold);
Fixed code: ** Does a young collection. First, mark 'OLD1' objects. Then does the
** atomic step. Then, sweep all lists and advance pointers. Finally,
** finish the collection.
  markold(g, g->allgc, g->reallyold);
CVE-2020-24342: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Lua through 5.4.0 allows a stack redzone cross in luaO_pushvfstring because a protection mechanism wrongly calls luaD_callnoyield twice in a row.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.8
Published: 2020-08-13T19:15Z
Repository: https://github.com/lua/lua
Language: C
Files changed: ldo.c
Commit date: 2020-07-17 14:54:26 -0300
Commit message: Fixed bug: 'luaD_callnoyield' called twice in a row

In luaD_callnoyield, when there is a possible stack overflow, it
zeros the number of CallInfos to force a check when calling the
function. However, if the "function" is not a function, the code will
raise an error before checking the stack. Then, the error handling calls
luaD_callnoyield again and nCcalls is decremented again, crossing the
stack redzone without raising an error. (This loop can only happens
once, because the error handler must be a function.  But once is enough
to cross the redzone.)

Diff: diff --git a/ldo.c b/ldo.c
index 98dd9fbbf..5473815a1 100644
--- a/ldo.c
+++ b/ldo.c
@@ -513,18 +513,17 @@ void luaD_call (lua_State *L, StkId func, int nresults) {
 }
 
 
 /*
 ** Similar to 'luaD_call', but does not allow yields during the call.
-** If there is a stack overflow, freeing all CI structures will
-** force the subsequent call to invoke 'luaE_extendCI', which then
-** will raise any errors.
 */
 void luaD_callnoyield (lua_State *L, StkId func, int nResults) {
   incXCcalls(L);
-  if (getCcalls(L) <= CSTACKERR)  /* possible stack overflow? */
-    luaE_freeCI(L);
+  if (getCcalls(L) <= CSTACKERR) {  /* possible C stack overflow? */
+    luaE_exitCcall(L);  /* to compensate decrement in next call */
+    luaE_enterCcall(L);  /* check properly */
+  }
   luaD_call(L, func, nResults);
   decXCcalls(L);
 }
 
 

Vulnerable code: ** If there is a stack overflow, freeing all CI structures will
** force the subsequent call to invoke 'luaE_extendCI', which then
** will raise any errors.
  if (getCcalls(L) <= CSTACKERR)  /* possible stack overflow? */
    luaE_freeCI(L);
Fixed code:   if (getCcalls(L) <= CSTACKERR) {  /* possible C stack overflow? */
    luaE_exitCcall(L);  /* to compensate decrement in next call */
    luaE_enterCcall(L);  /* check properly */
  }
CVE-2020-24370: Integer Underflow (Wrap or Wraparound) (CWE-191)
value: ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).
CWE description: The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CVSS v3 base score: 5.3
Published: 2020-08-17T17:15Z
Repository: https://github.com/lua/lua
Language: C
Files changed: ldebug.c
Commit date: 2020-07-27 12:01:38 -0300
Commit message: Fixed bug: Negation overflow in getlocal/setlocal

Diff: diff --git a/ldebug.c b/ldebug.c
index 0c4439c18..9ff7edeb2 100644
--- a/ldebug.c
+++ b/ldebug.c
@@ -186,12 +186,12 @@ static const char *upvalname (const Proto *p, int uv) {
 
 
 static const char *findvararg (CallInfo *ci, int n, StkId *pos) {
   if (clLvalue(s2v(ci->func))->p->is_vararg) {
     int nextra = ci->u.l.nextraargs;
-    if (n <= nextra) {
-      *pos = ci->func - nextra + (n - 1);
+    if (n >= -nextra) {  /* 'n' is negative */
+      *pos = ci->func - nextra - (n + 1);
       return "(vararg)";  /* generic name for any vararg */
     }
   }
   return NULL;  /* no such vararg */
 }
@@ -200,11 +200,11 @@ static const char *findvararg (CallInfo *ci, int n, StkId *pos) {
 const char *luaG_findlocal (lua_State *L, CallInfo *ci, int n, StkId *pos) {
   StkId base = ci->func + 1;
   const char *name = NULL;
   if (isLua(ci)) {
     if (n < 0)  /* access to vararg values? */
-      return findvararg(ci, -n, pos);
+      return findvararg(ci, n, pos);
     else
       name = luaF_getlocalname(ci_func(ci)->p, n, currentpc(ci));
   }
   if (name == NULL) {  /* no 'standard' name? */
     StkId limit = (ci == L->ci) ? L->top : ci->next->func;

Vulnerable code:     if (n <= nextra) {
      *pos = ci->func - nextra + (n - 1);
      return findvararg(ci, -n, pos);
Fixed code:     if (n >= -nextra) {  /* 'n' is negative */
      *pos = ci->func - nextra - (n + 1);
      return findvararg(ci, n, pos);
CVE-2021-45985: Out-of-bounds Write (CWE-787)
value: In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2023-04-10T09:15Z
Repository: https://github.com/lua/lua
Language: C
Files changed: ldo.c
Commit date: 2021-12-15 11:29:07 -0300
Commit message: Bug: finalizers can be called with an invalid stack

The call to 'checkstackGC' can run finalizers, which will find an
inconsistent CallInfo, as 'ci' is half updated at the point of call.

Diff: diff --git a/ldo.c b/ldo.c
index f282a773e..a48e35f9d 100644
--- a/ldo.c
+++ b/ldo.c
@@ -528,14 +528,14 @@ int luaD_pretailcall (lua_State *L, CallInfo *ci, StkId func,
     case LUA_VLCL: {  /* Lua function */
       Proto *p = clLvalue(s2v(func))->p;
       int fsize = p->maxstacksize;  /* frame size */
       int nfixparams = p->numparams;
       int i;
+      checkstackGCp(L, fsize - delta, func);
       ci->func -= delta;  /* restore 'func' (if vararg) */
       for (i = 0; i < narg1; i++)  /* move down function and arguments */
         setobjs2s(L, ci->func + i, func + i);
-      checkstackGC(L, fsize);
       func = ci->func;  /* moved-down function */
       for (; narg1 <= nfixparams; narg1++)
         setnilvalue(s2v(func + narg1));  /* complete missing arguments */
       ci->top = func + 1 + fsize;  /* top for new function */
       lua_assert(ci->top <= L->stack_last);

Vulnerable code:       checkstackGC(L, fsize);
Fixed code:       checkstackGCp(L, fsize - delta, func);
CVE-2022-28805: Out-of-bounds Read (CWE-125)
value: singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2022-04-08T06:15Z
Repository: https://github.com/lua/lua
Language: C
Files changed: lparser.c, testes/attrib.lua
Commit date: 2022-02-15 12:28:46 -0300
Commit message: Bug: Lua can generate wrong code when _ENV is <const>

Diff: diff --git a/lparser.c b/lparser.c
index 3abe3d751..a5cd55257 100644
--- a/lparser.c
+++ b/lparser.c
@@ -466,10 +466,11 @@ static void singlevar (LexState *ls, expdesc *var) {
   singlevaraux(fs, varname, var, 1);
   if (var->k == VVOID) {  /* global name? */
     expdesc key;
     singlevaraux(fs, ls->envn, var, 1);  /* get environment variable */
     lua_assert(var->k != VVOID);  /* this one must exist */
+    luaK_exp2anyregup(fs, var);  /* but could be a constant */
     codestring(&key, varname);  /* key is variable name */
     luaK_indexed(fs, var, &key);  /* env[varname] */
   }
 }
 
diff --git a/testes/attrib.lua b/testes/attrib.lua
index b1076c768..83821c069 100644
--- a/testes/attrib.lua
+++ b/testes/attrib.lua
@@ -432,10 +432,20 @@ end
 assert(foo() == 10 and
 a.aVeryLongName012345678901234567890123456789012345678901234567890123456789 ==
 10)
 
 
+do
+  -- _ENV constant
+  local function foo ()
+    local _ENV <const> = 11
+    X = "hi"
+  end
+  local st, msg = pcall(foo)
+  assert(not st and string.find(msg, "number"))
+end
+
 
 -- test of large float/integer indices 
 
 -- compute maximum integer where all bits fit in a float
 local maxint = math.maxinteger

Fixed code:     luaK_exp2anyregup(fs, var);  /* but could be a constant */
do
  -- _ENV constant
  local function foo ()
    local _ENV <const> = 11
    X = "hi"
  end
  local st, msg = pcall(foo)
  assert(not st and string.find(msg, "number"))
end
CVE-2020-7981: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: sql.rb in Geocoder before 1.6.1 allows Boolean-based SQL injection when within_bounding_box is used in conjunction with untrusted sw_lat, sw_lng, ne_lat, or ne_lng data.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2020-01-25T20:15Z
Repository: https://github.com/alexreisner/geocoder
Language: Ruby
Files changed: lib/geocoder/sql.rb
Commit date: 2020-01-23 09:13:06 -0700
Commit message: Sanitize lat/lon for SQL query.

Diff: diff --git a/lib/geocoder/sql.rb b/lib/geocoder/sql.rb
index 71ea96f..6bca8a6 100644
--- a/lib/geocoder/sql.rb
+++ b/lib/geocoder/sql.rb
@@ -42,17 +42,17 @@ module Geocoder
       "(#{dy} * ABS(#{lat_attr} - #{latitude.to_f}) * #{factor}) + " +
         "(#{dx} * ABS(#{lon_attr} - #{longitude.to_f}) * #{factor})"
     end
 
     def within_bounding_box(sw_lat, sw_lng, ne_lat, ne_lng, lat_attr, lon_attr)
-      spans = "#{lat_attr} BETWEEN #{sw_lat} AND #{ne_lat} AND "
+      spans = "#{lat_attr} BETWEEN #{sw_lat.to_f} AND #{ne_lat.to_f} AND "
       # handle box that spans 180 longitude
       if sw_lng.to_f > ne_lng.to_f
-        spans + "(#{lon_attr} BETWEEN #{sw_lng} AND 180 OR " +
-        "#{lon_attr} BETWEEN -180 AND #{ne_lng})"
+        spans + "(#{lon_attr} BETWEEN #{sw_lng.to_f} AND 180 OR " +
+        "#{lon_attr} BETWEEN -180 AND #{ne_lng.to_f})"
       else
-        spans + "#{lon_attr} BETWEEN #{sw_lng} AND #{ne_lng}"
+        spans + "#{lon_attr} BETWEEN #{sw_lng.to_f} AND #{ne_lng.to_f}"
       end
     end
 
     ##
     # Fairly accurate bearing calculation. Takes a latitude, longitude,

Vulnerable code:       spans = "#{lat_attr} BETWEEN #{sw_lat} AND #{ne_lat} AND "
        spans + "(#{lon_attr} BETWEEN #{sw_lng} AND 180 OR " +
        "#{lon_attr} BETWEEN -180 AND #{ne_lng})"
        spans + "#{lon_attr} BETWEEN #{sw_lng} AND #{ne_lng}"
Fixed code:       spans = "#{lat_attr} BETWEEN #{sw_lat.to_f} AND #{ne_lat.to_f} AND "
        spans + "(#{lon_attr} BETWEEN #{sw_lng.to_f} AND 180 OR " +
        "#{lon_attr} BETWEEN -180 AND #{ne_lng.to_f})"
        spans + "#{lon_attr} BETWEEN #{sw_lng.to_f} AND #{ne_lng.to_f}"