Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2023-3228: Other (NVD-CWE-Other)
value: Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 5.7
Published: 2023-06-14T06:15Z
Repository: https://github.com/fossbilling/fossbilling
Language: PHP
Files changed: src/modules/Cart/Api/Guest.php
Commit date: 2023-06-12 06:30:20 +0200
Commit message: Validate add-on configs before adding to cart (#1313)

* Validate addon configs before adding to cart

* Fix spelling mistake
Diff: diff --git a/src/modules/Cart/Api/Guest.php b/src/modules/Cart/Api/Guest.php
index 7c11e92a..2992d8c3 100644
--- a/src/modules/Cart/Api/Guest.php
+++ b/src/modules/Cart/Api/Guest.php
@@ -157,16 +157,32 @@ class Guest extends \Api_Abstract
     public function add_item($data)
     {
         $required = [
             'id' => 'Product id not passed',
         ];
+
         $this->di['validator']->checkRequiredParamsForArray($required, $data);
 
         $cart = $this->getService()->getSessionCart();
 
         $product = $this->di['db']->getExistingModelById('Product', $data['id'], 'Product not found');
 
+        if ($product->is_addon) {
+            throw new \Box_Exception('Addon products cannot be added separately.');
+        }
+
+        $validAddons = json_decode($product->addons ?? '');
+        if(empty($validAddons)){
+            $validAddons = [];
+        }
+
+        foreach ($data['addons'] as $addon => $properties) {
+            if($properties['selected'] && !in_array($addon, $validAddons)){
+                throw new \Box_Exception('One or more of your selected addons are not valid for the associated product.');
+            }
+        }
+
         // reset cart by default
         if (!isset($data['multiple']) || !$data['multiple']) {
             $this->reset();
         }
 

Fixed code: 
        if ($product->is_addon) {
            throw new \Box_Exception('Addon products cannot be added separately.');
        }

        $validAddons = json_decode($product->addons ?? '');
        if(empty($validAddons)){
            $validAddons = [];
        }

        foreach ($data['addons'] as $addon => $properties) {
            if($properties['selected'] && !in_array($addon, $validAddons)){
                throw new \Box_Exception('One or more of your selected addons are not valid for the associated product.');
            }
        }
CVE-2023-3493: Improper Neutralization of Formula Elements in a CSV File (CWE-1236)
value: Improper Neutralization of Formula Elements in a CSV File in GitHub repository fossbilling/fossbilling prior to 0.5.3.
CWE description: The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
CVSS v3 base score: 8
Published: 2023-06-30T22:15Z
Repository: https://github.com/fossbilling/fossbilling
Language: PHP
Files changed: src/di.php
Commit date: 2023-06-30 22:51:37 +0200
Commit message: Apply the EscapeFormula CSV formatter (#1391)


Diff: diff --git a/src/di.php b/src/di.php
index 99f11da56..c4f095073 100644
--- a/src/di.php
+++ b/src/di.php
@@ -773,12 +773,12 @@ $di['table_export_csv'] = $di->protect(function (string $table, string $outputNa
         }, $rows);
     } else {
         $headers = array_keys(reset($rows));
     }
 
-    $csv = League\Csv\Writer::createFromFileObject(new SplTempFileObject());
-
+    $csv = League\Csv\Writer::createFromFileObject(new SplTempFileObject);
+    $csv->addFormatter(new League\Csv\EscapeFormula);
     $csv->insertOne($headers);
     $csv->insertAll($rows);
 
     $csv->output($outputName);
 

Vulnerable code:     $csv = League\Csv\Writer::createFromFileObject(new SplTempFileObject());

Fixed code:     $csv = League\Csv\Writer::createFromFileObject(new SplTempFileObject);
    $csv->addFormatter(new League\Csv\EscapeFormula);
CVE-2011-2765: Improper Link Resolution Before File Access ('Link Following') (CWE-59)
value: pyro before 3.15 unsafely handles pid files in temporary directory locations and opening the pid file as root. An attacker can use this flaw to overwrite arbitrary files via symlinks.
CWE description: The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CVSS v3 base score: 7.5
Published: 2018-08-20T13:29Z
Repository: https://github.com/irmen/Pyro3
Language: Python
Files changed: Pyro/ext/daemonizer.py
Commit date: 2011-09-01 13:32:40 +0000
Commit message: changed pidfile location because of security vulnerability, debian bug #631912

Diff: diff --git a/Pyro/ext/daemonizer.py b/Pyro/ext/daemonizer.py
index e481877..11b5061 100644
--- a/Pyro/ext/daemonizer.py
+++ b/Pyro/ext/daemonizer.py
@@ -45,11 +45,13 @@ class Daemonizer:
     Note: Since Daemonizer uses fork(), it will not work on non-Unix
     systems.
     """
     def __init__(self, pidfile=None):
         if not pidfile:
-            self.pidfile = "/tmp/%s.pid" % self.__class__.__name__.lower()
+            # PID file moved out of /tmp to avoid security vulnerability
+            # changed by Debian maintainer per Debian bug #631912
+            self.pidfile = "/var/run/pyro-%s.pid" % self.__class__.__name__.lower()
         else:
             self.pidfile = pidfile
 
     def become_daemon(self, root_dir='/'):
         if os.fork() != 0:  # launch child and ...
@@ -119,16 +121,20 @@ class Daemonizer:
               self.__class__.__name__
         raise DaemonizerException(msg)
 
     def process_command_line(self, argv, verbose=1):
         usage = "usage:  %s  start | stop | restart | status | debug " \
+                "[--pidfile=...] " \
                 "(run as non-daemon)" % os.path.basename(argv[0])
         if len(argv) < 2:
             print usage
             raise SystemExit
         else:
             operation = argv[1]
+            if len(argv) > 2 and argv[2].startswith('--pidfile=') and \
+                len(argv[2]) > len('--pidfile='):
+                self.pidfile = argv[2][len('--pidfile='):]
         pid = self.get_pid()
         if operation == 'status':
             if self.is_process_running():
                 print "Server process %s is running." % pid
             else:

Vulnerable code:             self.pidfile = "/tmp/%s.pid" % self.__class__.__name__.lower()
Fixed code:             # PID file moved out of /tmp to avoid security vulnerability
            # changed by Debian maintainer per Debian bug #631912
            self.pidfile = "/var/run/pyro-%s.pid" % self.__class__.__name__.lower()
                "[--pidfile=...] " \
            if len(argv) > 2 and argv[2].startswith('--pidfile=') and \
                len(argv[2]) > len('--pidfile='):
                self.pidfile = argv[2][len('--pidfile='):]
CVE-2021-21319: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Galette is a membership management web application geared towards non profit organizations. In versions prior to 0.9.5, malicious javascript code can be stored to be displayed later on self subscription page. The self subscription feature can be disabled as a workaround (this is the default state). Malicious javascript code can be executed (not stored) on login and retrieve password pages. This issue is patched in version 0.9.5.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-10-25T16:15Z
Repository: https://github.com/galette/galette
Language: PHP
Files changed: tests/Galette/Entity/tests/units/Adherent.php
Commit date: 2021-04-05 09:47:02 +0200
Commit message: Add test on stored xss

Diff: diff --git a/tests/Galette/Entity/tests/units/Adherent.php b/tests/Galette/Entity/tests/units/Adherent.php
index aff3b0bbb..a2d97da8a 100644
--- a/tests/Galette/Entity/tests/units/Adherent.php
+++ b/tests/Galette/Entity/tests/units/Adherent.php
@@ -430,6 +430,26 @@ class Adherent extends GaletteTestCase
         }
         $this->boolean($check)->isTrue();
         $this->boolean($child->store())->isTrue();
         $this->variable($child->parent)->isNull();
     }
+
+    /**
+     * Test XSS/SQL injection
+     *
+     * @return void
+     */
+    public function testInjection()
+    {
+        $data = [
+            'nom_adh'           => 'Doe',
+            'prenom_adh'        => 'Johny <script>console.log("anything");</script>',
+            'email_adh'         => 'jdoe@doe.com',
+            'login_adh'         => 'jdoe',
+            'info_public_adh'   => 'Any <script>console.log("useful");</script> information'
+        ] + $this->dataAdherentOne();
+        $member = $this->createMember($data);
+
+        $this->string($member->sfullname)->isIdenticalTo('DOE Johny Console.log("anything");');
+        $this->string($member->others_infos)->isIdenticalTo('Any console.log("useful"); information');
+    }
 }

Fixed code: 
    /**
     * Test XSS/SQL injection
     *
     * @return void
     */
    public function testInjection()
    {
        $data = [
            'nom_adh'           => 'Doe',
            'prenom_adh'        => 'Johny <script>console.log("anything");</script>',
            'email_adh'         => 'jdoe@doe.com',
            'login_adh'         => 'jdoe',
            'info_public_adh'   => 'Any <script>console.log("useful");</script> information'
        ] + $this->dataAdherentOne();
        $member = $this->createMember($data);

        $this->string($member->sfullname)->isIdenticalTo('DOE Johny Console.log("anything");');
        $this->string($member->others_infos)->isIdenticalTo('Any console.log("useful"); information');
    }
CVE-2023-25156: Improper Restriction of Excessive Authentication Attempts (CWE-307)
value: Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and configure a rate-limiting proxy in front of Kiwi TCMS.
CWE description: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
CVSS v3 base score: 9.8
Published: 2023-02-15T15:15Z
Repository: https://github.com/kiwitcms/Kiwi
Language: Other
Files changed: etc/nginx.conf
Commit date: 2023-02-08 10:07:55 +0100
Commit message: Rate limit everything under /accounts/

Diff: diff --git a/etc/nginx.conf b/etc/nginx.conf
index b6148ab59..a0a98e815 100644
--- a/etc/nginx.conf
+++ b/etc/nginx.conf
@@ -49,10 +49,17 @@ http {
 
     # default proxy settings
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;
 
+    map $request_uri $limit_key {
+        default "";
+        ~^/accounts/ $binary_remote_addr;
+    }
+    limit_req_zone $limit_key zone=ten-per-sec:10m rate=10r/s;
+    limit_req_status 429;
+
     upstream kiwitcms {
         server unix:///tmp/kiwitcms.sock;
     }
 
     server {
@@ -79,8 +86,10 @@ http {
         }
 
         location / {
             include     /etc/nginx/uwsgi_params;
             uwsgi_pass  kiwitcms;
+
+            limit_req zone=ten-per-sec burst=20 nodelay;
         }
     }
 }

Fixed code:     map $request_uri $limit_key {
        default "";
        ~^/accounts/ $binary_remote_addr;
    }
    limit_req_zone $limit_key zone=ten-per-sec:10m rate=10r/s;
    limit_req_status 429;


            limit_req zone=ten-per-sec burst=20 nodelay;
CVE-2024-38516: Insufficient Information (NVD-CWE-noinfo)
value: ai-client-html is an Aimeos e-commerce HTML client component. Debug information revealed sensitive information from environment variables in error log. This issue has been patched in versions 2024.04.7, 2023.10.15, 2022.10.13 and 2021.10.22.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-06-25T21:15Z
Repository: https://github.com/aimeos/ai-client-html
Language: PHP
Files changed: src/Client/Html/Checkout/Confirm/Standard.php
Commit date: 2024-06-24 19:56:10 +0200
Commit message: Don't log security relevant data to prevent revealing information

Diff: diff --git a/src/Client/Html/Checkout/Confirm/Standard.php b/src/Client/Html/Checkout/Confirm/Standard.php
index 3afd9b89..1fec8c40 100644
--- a/src/Client/Html/Checkout/Confirm/Standard.php
+++ b/src/Client/Html/Checkout/Confirm/Standard.php
@@ -113,15 +113,11 @@ class Standard
 	public function data( \Aimeos\Base\View\Iface $view, array &$tags = [], string &$expire = null ) : \Aimeos\Base\View\Iface
 	{
 		$context = $this->context();
 		$config = $context->config();
 
-		if( ( $id = $context->session()->get( 'aimeos/orderid' ) ) === null )
-		{
-			$context->logger()->log( 'Lost session at confirmation page' . PHP_EOL
-				. '$_COOKIE: ' . print_r( $_COOKIE, true ) . PHP_EOL
-				. '$_SERVER: ' . print_r( $_SERVER, true ) );
+		if( ( $id = $context->session()->get( 'aimeos/orderid' ) ) === null ) {
 			throw new \Aimeos\Client\Html\Exception( $context->translate( 'client', 'No order ID available in session' ) );
 		}
 
 		/** client/html/checkout/confirm/domains
 		 * List of domains to fetch items related to the order

Vulnerable code: 		if( ( $id = $context->session()->get( 'aimeos/orderid' ) ) === null )
		{
			$context->logger()->log( 'Lost session at confirmation page' . PHP_EOL
				. '$_COOKIE: ' . print_r( $_COOKIE, true ) . PHP_EOL
				. '$_SERVER: ' . print_r( $_SERVER, true ) );
Fixed code: 		if( ( $id = $context->session()->get( 'aimeos/orderid' ) ) === null ) {
CVE-2023-30536: Interpretation Conflict (CWE-436)
value: slim/psr7 is a PSR-7 implementation for use with Slim 4. In versions prior to 1.6.1 an attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. An attacker that is able to control the header names that are passed to Slilm-Psr7 would be able to intentionally craft invalid messages, possibly causing application errors or invalid HTTP requests being sent out with an PSR-18 HTTP client. The latter might present a denial of service vector if a remote service’s web application firewall bans the application due to the receipt of malformed requests. The issue has been patched in version 1.6.1. There are no known workarounds to this issue. Users are advised to upgrade.
CWE description: Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
CVSS v3 base score: 6.5
Published: 2023-04-17T22:15Z
Repository: https://github.com/slimphp/Slim-Psr7
Language: Unknown
Commit date: 2023-04-17 17:02:20 +0100
Commit message: Merge pull request from GHSA-q2qj-628g-vhfw

Security fix: Reject newlines at end of header names
CVE-2014-8760: Cryptographic Issues (CWE-310)
value: ejabberd before 2.1.13 does not enforce the starttls_required setting when compression is used, which causes clients to establish connections without encryption.
CWE description: Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
Published: 2014-10-25T00:55Z
Repository: https://github.com/processone/ejabberd
Language: Other
Files changed: src/ejabberd_c2s.erl
Commit date: 2014-10-12 02:08:08 +0200
Commit message: Make sure "starttls_required" can't be bypassed

Don't allow clients to circumvent the "starttls_required" option by
enabling XMPP stream compression.

Diff: diff --git a/src/ejabberd_c2s.erl b/src/ejabberd_c2s.erl
index 9bfe225c..1591e6ff 100644
--- a/src/ejabberd_c2s.erl
+++ b/src/ejabberd_c2s.erl
@@ -733,11 +733,11 @@ wait_for_feature_request({xmlstreamelement, El},
     TLSRequired = StateData#state.tls_required,
     SockMod =
 	(StateData#state.sockmod):get_sockmod(StateData#state.socket),
     case {xml:get_attr_s(<<"xmlns">>, Attrs), Name} of
       {?NS_SASL, <<"auth">>}
-	  when not ((SockMod == gen_tcp) and TLSRequired) ->
+	  when TLSEnabled or not TLSRequired ->
 	  Mech = xml:get_attr_s(<<"mechanism">>, Attrs),
 	  ClientIn = jlib:decode_base64(xml:get_cdata(Els)),
 	  case cyrsasl:server_start(StateData#state.sasl_state,
 				    Mech, ClientIn)
 	      of
@@ -854,11 +854,11 @@ wait_for_feature_request({xmlstreamelement, El},
 						      children = []}]}),
 		      fsm_next_state(wait_for_feature_request, StateData)
 		end
 	  end;
       _ ->
-	  if (SockMod == gen_tcp) and TLSRequired ->
+	  if TLSRequired and not TLSEnabled ->
 		 Lang = StateData#state.lang,
 		 send_element(StateData,
 			      ?POLICY_VIOLATION_ERR(Lang,
 						    <<"Use of STARTTLS required">>)),
 		 send_trailer(StateData),

Vulnerable code: 	  when not ((SockMod == gen_tcp) and TLSRequired) ->
	  if (SockMod == gen_tcp) and TLSRequired ->
Fixed code: 	  when TLSEnabled or not TLSRequired ->
	  if TLSRequired and not TLSEnabled ->
CVE-2014-0978: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Stack-based buffer overflow in the yyerror function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via a long line in a dot file.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Published: 2014-01-10T17:55Z
Repository: https://github.com/ellson/graphviz
Language: Other
Files changed: lib/cgraph/scan.l
Commit date: 2013-10-04 09:06:39 -0400
Commit message: Fix buffer overflow problem when reporting a syntax error with a very long
input line

Diff: diff --git a/lib/cgraph/scan.l b/lib/cgraph/scan.l
index 3cfde0fd..2efd203c 100644
--- a/lib/cgraph/scan.l
+++ b/lib/cgraph/scan.l
@@ -14,10 +14,11 @@
 
 /* requires flex (i.e. not lex)  */
 %{
 #include <grammar.h>
 #include <cghdr.h>
+#include <agxbuf.h>
 #include <ctype.h>
 #define GRAPH_EOF_TOKEN		'@'		/* lex class must be defined below */
 	/* this is a workaround for linux flex */
 static int line_num = 1;
 static int html_nest = 0;  /* nesting level for html strings */
@@ -189,17 +190,25 @@ ID		({NAME}|{NUMBER})
 <hstring>([^><\n]*)		addstr(yytext);
 .						return (yytext[0]);
 %%
 void yyerror(char *str)
 {
+	unsigned char	xbuf[BUFSIZ];
 	char	buf[BUFSIZ];
-	if (InputFile)
-		sprintf(buf,"%s:%d: %s in line %d near '%s'\n",InputFile, line_num,
-			str,line_num,yytext);
-	else
-		sprintf(buf," %s in line %d near '%s'\n", str,line_num,yytext);
-	agerr(AGWARN,buf);
+	agxbuf  xb;
+
+	agxbinit(&xb, BUFSIZ, xbuf);
+	if (InputFile) {
+		agxbput (&xb, InputFile);
+		agxbput (&xb, ": ");
+	}
+	sprintf(buf," %s in line %d near '", str,line_num);
+	agxbput (&xb, buf);
+	agxbput (&xb, yytext);
+	agxbput (&xb,"'\n");
+	agerr(AGWARN,agxbuse(&xb));
+	agxbfree(&xb);
 }
 /* must be here to see flex's macro defns */
 void aglexeof() { unput(GRAPH_EOF_TOKEN); }
 
 #ifndef YY_CALL_ONLY_ARG

Vulnerable code: 	if (InputFile)
		sprintf(buf,"%s:%d: %s in line %d near '%s'\n",InputFile, line_num,
			str,line_num,yytext);
	else
		sprintf(buf," %s in line %d near '%s'\n", str,line_num,yytext);
	agerr(AGWARN,buf);
Fixed code: #include <agxbuf.h>
	unsigned char	xbuf[BUFSIZ];
	agxbuf  xb;

	agxbinit(&xb, BUFSIZ, xbuf);
	if (InputFile) {
		agxbput (&xb, InputFile);
		agxbput (&xb, ": ");
	}
	sprintf(buf," %s in line %d near '", str,line_num);
	agxbput (&xb, buf);
	agxbput (&xb, yytext);
	agxbput (&xb,"'\n");
	agerr(AGWARN,agxbuse(&xb));
	agxbfree(&xb);
CVE-2014-1235: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Stack-based buffer overflow in the "yyerror" function in Graphviz 2.34.0 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted file.  NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-0978.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 7.8
Published: 2017-08-07T20:29Z
Repository: https://github.com/ellson/graphviz
Language: Other
Files changed: lib/cgraph/scan.l
Commit date: 2014-01-07 10:45:36 -0500
Commit message: Prevent possible buffer overflow in yyerror()

Diff: diff --git a/lib/cgraph/scan.l b/lib/cgraph/scan.l
index 3efe1d5f4..212967c70 100644
--- a/lib/cgraph/scan.l
+++ b/lib/cgraph/scan.l
@@ -199,11 +199,12 @@ void yyerror(char *str)
 	agxbinit(&xb, BUFSIZ, xbuf);
 	if (InputFile) {
 		agxbput (&xb, InputFile);
 		agxbput (&xb, ": ");
 	}
-	sprintf(buf," %s in line %d near '", str,line_num);
+	agxbput (&xb, str);
+	sprintf(buf," in line %d near '", line_num);
 	agxbput (&xb, buf);
 	agxbput (&xb, yytext);
 	agxbput (&xb,"'\n");
 	agerr(AGWARN,agxbuse(&xb));
 	agxbfree(&xb);

Vulnerable code: 	sprintf(buf," %s in line %d near '", str,line_num);
Fixed code: 	agxbput (&xb, str);
	sprintf(buf," in line %d near '", line_num);
CVE-2014-9157: Use of Externally-Controlled Format String (CWE-134)
value: Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vectors, which are not properly handled in an error string.
CWE description: The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
Published: 2014-12-03T21:59Z
Repository: https://github.com/ellson/graphviz
Language: Other
Files changed: lib/cgraph/scan.l
Commit date: 2014-11-24 14:32:58 -0500
Commit message: Fix format string vulnerability in using agerr() to report errors during parsing.
We now use a fixed format %s, and pass the error string as an argument.

Diff: diff --git a/lib/cgraph/scan.l b/lib/cgraph/scan.l
index 85a150acb..a5872f4a3 100644
--- a/lib/cgraph/scan.l
+++ b/lib/cgraph/scan.l
@@ -223,10 +223,11 @@ ID		({NAME}|{NUMBER})
 <hstring>[<]			html_nest++; addstr(yytext);
 <hstring>[\n]			addstr(yytext); line_num++; /* add newlines */
 <hstring>([^><\n]*)		addstr(yytext);
 .						return (yytext[0]);
 %%
+ 
 void yyerror(char *str)
 {
 	unsigned char	xbuf[BUFSIZ];
 	char	buf[BUFSIZ];
 	agxbuf  xb;
@@ -271,11 +272,11 @@ void yyerror(char *str)
 		sprintf(buf, " scanning a /*...*/ comment (missing '*/? longer than %d?)", YY_BUF_SIZE);
 		agxbput (&xb, buf);
 		break;
 	}
 	agxbputc (&xb, '\n');
-	agerr(AGERR,agxbuse(&xb));
+	agerr(AGERR, "%s", agxbuse(&xb));
 	agxbfree(&xb);
 }
 /* must be here to see flex's macro defns */
 void aglexeof() { unput(GRAPH_EOF_TOKEN); }
 

Vulnerable code: 	agerr(AGERR,agxbuse(&xb));
Fixed code:  
	agerr(AGERR, "%s", agxbuse(&xb));
CVE-2024-37152: Insufficient Information (NVD-CWE-noinfo)
value: Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by  /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-06-06T16:15Z
Repository: https://github.com/argoproj/argo-cd
Language: Go
Files changed: server/settings/settings.go
Commit date: 2024-06-06 11:25:55 +0300
Commit message: Merge pull request from GHSA-87p9-x75h-p4j2

Signed-off-by: Blake Pettersson <blake.pettersson@gmail.com>
Diff: diff --git a/server/settings/settings.go b/server/settings/settings.go
index 32f5016419..131ddc1924 100644
--- a/server/settings/settings.go
+++ b/server/settings/settings.go
@@ -107,11 +107,10 @@ func (s *Server) Get(ctx context.Context, q *settingspkg.SettingsQuery) (*settin
 			BinaryUrls: help.BinaryURLs,
 		},
 		UserLoginsDisabled:        userLoginsDisabled,
 		KustomizeVersions:         kustomizeVersions,
 		UiCssURL:                  argoCDSettings.UiCssURL,
-		PasswordPattern:           argoCDSettings.PasswordPattern,
 		TrackingMethod:            trackingMethod,
 		ExecEnabled:               argoCDSettings.ExecEnabled,
 		AppsInAnyNamespaceEnabled: s.appsInAnyNamespaceEnabled,
 	}
 
@@ -120,10 +119,13 @@ func (s *Server) Get(ctx context.Context, q *settingspkg.SettingsQuery) (*settin
 		set.UiBannerURL = argoCDSettings.UiBannerURL
 		set.UiBannerPermanent = argoCDSettings.UiBannerPermanent
 		set.UiBannerPosition = argoCDSettings.UiBannerPosition
 		set.ControllerNamespace = s.mgr.GetNamespace()
 	}
+	if sessionmgr.LoggedIn(ctx) {
+		set.PasswordPattern = argoCDSettings.PasswordPattern
+	}
 	if argoCDSettings.DexConfig != "" {
 		var cfg settingspkg.DexConfig
 		err = yaml.Unmarshal([]byte(argoCDSettings.DexConfig), &cfg)
 		if err == nil {
 			set.DexConfig = &cfg

Vulnerable code: 		PasswordPattern:           argoCDSettings.PasswordPattern,
Fixed code: 	if sessionmgr.LoggedIn(ctx) {
		set.PasswordPattern = argoCDSettings.PasswordPattern
	}
CVE-2017-5589: Improper Input Validation (CWE-20)
value: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for yaxim and Bruno (0.8.6 - 0.8.8; Android).
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 5.9
Published: 2017-02-09T20:59Z
Repository: https://github.com/ge0rg/yaxim
Language: Java
Files changed: src/org/yaxim/androidclient/service/SmackableImp.java
Commit date: 2017-01-30 15:36:48 +0100
Commit message: Smackable: improved carbon checks

Diff: diff --git a/src/org/yaxim/androidclient/service/SmackableImp.java b/src/org/yaxim/androidclient/service/SmackableImp.java
index 6c3b001..13dcbb5 100644
--- a/src/org/yaxim/androidclient/service/SmackableImp.java
+++ b/src/org/yaxim/androidclient/service/SmackableImp.java
@@ -1240,10 +1240,14 @@ public class SmackableImp implements Smackable {
 
 					String[] fromJID = getJabberID(msg.getFrom());
 					
 					int direction = ChatConstants.INCOMING;
 					Carbon cc = CarbonManager.getCarbon(msg);
+					if (cc != null && !msg.getFrom().equalsIgnoreCase(mConfig.jabberID)) {
+						Log.w(TAG, "Received illegal carbon from " + msg.getFrom() + ": " + cc.toXML());
+						cc = null;
+					}
 
 					// extract timestamp
 					long ts;
 					DelayInfo timestamp = (DelayInfo)msg.getExtension("delay", "urn:xmpp:delay");
 					if (timestamp == null)

Fixed code: 					if (cc != null && !msg.getFrom().equalsIgnoreCase(mConfig.jabberID)) {
						Log.w(TAG, "Received illegal carbon from " + msg.getFrom() + ": " + cc.toXML());
						cc = null;
					}
CVE-2017-5589: Origin Validation Error (CWE-346)
value: An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for yaxim and Bruno (0.8.6 - 0.8.8; Android).
CWE description: The product does not properly verify that the source of data or communication is valid.
CVSS v3 base score: 5.9
Published: 2017-02-09T20:59Z
Repository: https://github.com/ge0rg/yaxim
Language: Java
Files changed: src/org/yaxim/androidclient/service/SmackableImp.java
Commit date: 2017-01-30 15:36:48 +0100
Commit message: Smackable: improved carbon checks

Diff: diff --git a/src/org/yaxim/androidclient/service/SmackableImp.java b/src/org/yaxim/androidclient/service/SmackableImp.java
index 6c3b001..13dcbb5 100644
--- a/src/org/yaxim/androidclient/service/SmackableImp.java
+++ b/src/org/yaxim/androidclient/service/SmackableImp.java
@@ -1240,10 +1240,14 @@ public class SmackableImp implements Smackable {
 
 					String[] fromJID = getJabberID(msg.getFrom());
 					
 					int direction = ChatConstants.INCOMING;
 					Carbon cc = CarbonManager.getCarbon(msg);
+					if (cc != null && !msg.getFrom().equalsIgnoreCase(mConfig.jabberID)) {
+						Log.w(TAG, "Received illegal carbon from " + msg.getFrom() + ": " + cc.toXML());
+						cc = null;
+					}
 
 					// extract timestamp
 					long ts;
 					DelayInfo timestamp = (DelayInfo)msg.getExtension("delay", "urn:xmpp:delay");
 					if (timestamp == null)

Fixed code: 					if (cc != null && !msg.getFrom().equalsIgnoreCase(mConfig.jabberID)) {
						Log.w(TAG, "Received illegal carbon from " + msg.getFrom() + ": " + cc.toXML());
						cc = null;
					}
CVE-2013-2765: NULL Pointer Dereference (CWE-476)
value: The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
Published: 2013-07-15T15:55Z
Repository: https://github.com/SpiderLabs/ModSecurity
Language: C
Files changed: apache2/msc_reqbody.c
Commit date: 2013-04-04 11:04:22 -0400
Commit message: Fixed: chuck null pointer when unknown CT is sent and over in-memory limit

Diff: diff --git a/apache2/msc_reqbody.c b/apache2/msc_reqbody.c
index b76056b..55e2e6d 100644
--- a/apache2/msc_reqbody.c
+++ b/apache2/msc_reqbody.c
@@ -168,10 +168,11 @@ static apr_status_t modsecurity_request_body_store_memory(modsec_rec *msr,
 {
     *error_msg = NULL;
 
     /* Would storing this chunk mean going over the limit? */
     if ((msr->msc_reqbody_spilltodisk)
+        && (msr->txcfg->reqbody_buffering != REQUEST_BODY_FORCEBUF_ON)
         && (msr->msc_reqbody_length + length > (apr_size_t)msr->txcfg->reqbody_inmemory_limit))
     {
         msc_data_chunk **chunks;
         unsigned int disklen = 0;
         int i;

Fixed code:         && (msr->txcfg->reqbody_buffering != REQUEST_BODY_FORCEBUF_ON)
CVE-2013-5705: Insufficient Information (NVD-CWE-noinfo)
value: apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2014-04-15T10:55Z
Repository: https://github.com/SpiderLabs/ModSecurity
Language: C
Files changed: apache2/modsecurity.c
Commit date: 2013-09-04 08:57:07 -0300
Commit message: Fix Chunked string case sensitive issue - CVE-2013-5705

Diff: diff --git a/apache2/modsecurity.c b/apache2/modsecurity.c
index 6b77132d..b36775d2 100644
--- a/apache2/modsecurity.c
+++ b/apache2/modsecurity.c
@@ -295,11 +295,11 @@ apr_status_t modsecurity_tx_init(modsec_rec *msr) {
     msr->reqbody_chunked = 0;
     msr->reqbody_should_exist = 0;
     if (msr->request_content_length == -1) {
         /* There's no C-L, but is chunked encoding used? */
         char *transfer_encoding = (char *)apr_table_get(msr->request_headers, "Transfer-Encoding");
-        if ((transfer_encoding != NULL)&&(strstr(transfer_encoding, "chunked") != NULL)) {
+        if ((transfer_encoding != NULL)&&(m_strcasestr(transfer_encoding, "chunked") != NULL)) {
             msr->reqbody_should_exist = 1;
             msr->reqbody_chunked = 1;
         }
     } else {
         /* C-L found */

Vulnerable code:         if ((transfer_encoding != NULL)&&(strstr(transfer_encoding, "chunked") != NULL)) {
Fixed code:         if ((transfer_encoding != NULL)&&(m_strcasestr(transfer_encoding, "chunked") != NULL)) {
CVE-2021-39160: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. This has been resolved in version 0.10.2 and all users are advised to upgrade. No work around exist for users who can not upgrade.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2021-08-25T18:15Z
Repository: https://github.com/jupyterhub/nbgitpuller
Language: Unknown
Commit date: 2021-08-25 14:23:02 +0200
Commit message: Merge pull request from GHSA-mq5p-2mcr-m52j

make positional args explicit
CVE-2018-25067: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability, which was classified as critical, was found in JoomGallery up to 3.3.3. This affects an unknown part of the file administrator/components/com_joomgallery/views/config/tmpl/default.php of the component Image Sort Handler. The manipulation leads to sql injection. Upgrading to version 3.3.4 is able to address this issue. The identifier of the patch is dc414ee954e849082260f8613e15a1c1e1d354a1. It is recommended to upgrade the affected component. The identifier VDB-217569 was assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 7.2
Published: 2023-01-06T21:15Z
Repository: https://github.com/JoomGallery/JoomGallery
Language: Unknown
Commit date: 2018-01-20 19:29:10 -0500
Commit message: Merge pull request #122 from Erftralle/fix-sql-injection-image-ordering

Fix SQL Injection Attack Vulnerability via image sorting options
CVE-2011-0992: Resource Management Errors (CWE-399)
value: Use-after-free vulnerability in Mono, when Moonlight 2.x before 2.4.1 or 3.x before 3.99.3 is used, allows remote attackers to cause a denial of service (plugin crash) or obtain sensitive information via vectors related to member data in a resurrected MonoThread instance.
CWE description: Weaknesses in this category are related to improper management of system resources.
Published: 2011-04-13T21:55Z
Repository: https://github.com/mono/mono
Language: C
Files changed: mono/metadata/threads.c
Commit date: 2011-04-06 13:27:40 -0400
Commit message: Fix access to freed members of a dead thread

* threads.c: Fix access to freed members of a dead thread. Found
and fixed by Rodrigo Kumpera <rkumpera@novell.com>
Ref: CVE-2011-0992

Diff: diff --git a/mono/metadata/threads.c b/mono/metadata/threads.c
index 3fe4e9302bb..a7a721dca85 100644
--- a/mono/metadata/threads.c
+++ b/mono/metadata/threads.c
@@ -1034,16 +1034,21 @@ void ves_icall_System_Threading_InternalThread_Thread_free_internal (MonoInterna
 
 	if (thread)
 		CloseHandle (thread);
 
 	if (this->synch_cs) {
-		DeleteCriticalSection (this->synch_cs);
-		g_free (this->synch_cs);
+		CRITICAL_SECTION *synch_cs = this->synch_cs;
 		this->synch_cs = NULL;
+		DeleteCriticalSection (synch_cs);
+		g_free (synch_cs);
 	}
 
-	g_free (this->name);
+	if (this->name) {
+		void *name = this->name;
+		this->name = NULL;
+		g_free (name);
+	}
 }
 
 static void mono_thread_start (MonoThread *thread)
 {
 	MonoInternalThread *internal = thread->internal_thread;

Vulnerable code: 		DeleteCriticalSection (this->synch_cs);
		g_free (this->synch_cs);
	g_free (this->name);
Fixed code: 		CRITICAL_SECTION *synch_cs = this->synch_cs;
		DeleteCriticalSection (synch_cs);
		g_free (synch_cs);
	if (this->name) {
		void *name = this->name;
		this->name = NULL;
		g_free (name);
	}
CVE-2012-3382: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in the ProcessRequest function in mcs/class/System.Web/System.Web/HttpForbiddenHandler.cs in Mono 2.10.8 and earlier allows remote attackers to inject arbitrary web script or HTML via a file with a crafted name and a forbidden extension, which is not properly handled in an error message.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-07-12T21:55Z
Repository: https://github.com/mono/mono
Language: C#
Files changed: mcs/class/System.Web/System.Web/HttpForbiddenHandler.cs
Commit date: 2012-07-06 13:42:43 -0400
Commit message: HtmlEncode the path

	Fixes Novell bug #769799.

Diff: diff --git a/mcs/class/System.Web/System.Web/HttpForbiddenHandler.cs b/mcs/class/System.Web/System.Web/HttpForbiddenHandler.cs
index af5ddf45a7a..7e87d487a60 100644
--- a/mcs/class/System.Web/System.Web/HttpForbiddenHandler.cs
+++ b/mcs/class/System.Web/System.Web/HttpForbiddenHandler.cs
@@ -40,11 +40,11 @@ public void ProcessRequest (HttpContext context)
 				(path == null ? String.Empty : VirtualPathUtility.GetExtension (path)) +
 				"' may be incorrect. Please review the URL below and make sure that it is spelled correctly.";
 				
 			throw new HttpException (403,
 						 "This type of page is not served.",
-						 req != null ? req.Path : null,
+						 req != null ? HttpUtility.HtmlEncode (req.Path) : null,
 						 description);
 		}
 
 		public bool IsReusable
 		{

Vulnerable code: 						 req != null ? req.Path : null,
Fixed code: 						 req != null ? HttpUtility.HtmlEncode (req.Path) : null,
CVE-2022-39202: Improper Privilege Management (CWE-269)
value: matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. The Internet Relay Chat (IRC) protocol allows you to specify multiple modes in a single mode command. Due to a bug in the underlying matrix-org/node-irc library, affected versions of matrix-appservice-irc perform parsing of such modes incorrectly, potentially resulting in the wrong user being given permissions. Mode commands can only be executed by privileged users, so this can only be abused if an operator is tricked into running the command on behalf of an attacker. The vulnerability has been patched in matrix-appservice-irc 0.35.0. As a workaround users should refrain from entering mode commands suggested by untrusted users. Avoid using multiple modes in a single command.
CWE description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CVSS v3 base score: 6.3
Published: 2022-09-13T18:15Z
Repository: https://github.com/matrix-org/matrix-appservice-irc
Language: Unknown
Commit date: 2022-05-04 08:34:34 +0000
Commit message: Merge pull request from GHSA-37hr-348p-rmf4

Update node-irc to 1.2.1
CVE-2022-3971: Improper Neutralization (CWE-707)
value: A vulnerability was found in matrix-appservice-irc up to 0.35.1. It has been declared as critical. This vulnerability affects unknown code of the file src/datastore/postgres/PgDataStore.ts. The manipulation of the argument roomIds leads to sql injection. Upgrading to version 0.36.0 is able to address this issue. The name of the patch is 179313a37f06b298150edba3e2b0e5a73c1415e7. It is recommended to upgrade the affected component. VDB-213550 is the identifier assigned to this vulnerability.
CWE description: The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
CVSS v3 base score: 5.6
Published: 2022-11-13T10:15Z
Repository: https://github.com/matrix-org/matrix-appservice-irc
Language: Other
Files changed: changelog.d/1619.bugfix, src/datastore/postgres/PgDataStore.ts
Commit date: 2022-09-26 12:12:24 +0100
Commit message: Prevent low-risk SQL injection from roomId values when entered into the config (#1619)

* Prevent SQL injection from roomId values when checking room visibility

* Add newsfile

* Update newsfile

* Update 1619.bugfix

Co-authored-by: Will Hunt <will@half-shot.uk>
Diff: diff --git a/changelog.d/1619.bugfix b/changelog.d/1619.bugfix
new file mode 100644
index 00000000..5b156125
--- /dev/null
+++ b/changelog.d/1619.bugfix
@@ -0,0 +1 @@
+Prevent possible attack by provisisioning a room with a specific roomID.
diff --git a/src/datastore/postgres/PgDataStore.ts b/src/datastore/postgres/PgDataStore.ts
index e007f3c6..c3c17090 100644
--- a/src/datastore/postgres/PgDataStore.ts
+++ b/src/datastore/postgres/PgDataStore.ts
@@ -659,12 +659,13 @@ export class PgDataStore implements DataStore {
         return res.rows.map((u) => u.user_id);
     }
 
     public async getRoomsVisibility(roomIds: string[]) {
         const map: {[roomId: string]: "public"|"private"} = {};
-        const list = `('${roomIds.join("','")}')`;
-        const res = await this.pgPool.query(`SELECT room_id, visibility FROM room_visibility WHERE room_id IN ${list}`);
+        const res = await this.pgPool.query("SELECT room_id, visibility FROM room_visibility WHERE room_id IN $1", [
+            roomIds,
+        ]);
         for (const row of res.rows) {
             map[row.room_id] = row.visibility ? "public" : "private";
         }
         return map;
     }

Vulnerable code:         const list = `('${roomIds.join("','")}')`;
        const res = await this.pgPool.query(`SELECT room_id, visibility FROM room_visibility WHERE room_id IN ${list}`);
Fixed code: Prevent possible attack by provisisioning a room with a specific roomID.
        const res = await this.pgPool.query("SELECT room_id, visibility FROM room_visibility WHERE room_id IN $1", [
            roomIds,
        ]);
CVE-2024-39691: Insufficient Information (NVD-CWE-noinfo)
value: matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The fix for GHSA-wm4w-7h2q-3pf7 / CVE-2024-32000 included in matrix-appservice-irc 2.0.0 relied on the Matrix homeserver-provided timestamp to determine whether a user has access to the event they're replying to when determining whether or not to include a truncated version of the original event in the IRC message. Since this value is controlled by external entities, a malicious Matrix homeserver joined to a room in which a matrix-appservice-irc bridge instance (before version 2.0.1) is present can fabricate the timestamp with the intent of tricking the bridge into leaking room messages the homeserver should not have access to. matrix-appservice-irc 2.0.1 drops the reliance on `origin_server_ts` when determining whether or not an event should be visible to a user, instead tracking the event timestamps internally. As a workaround, it's possible to limit the amount of information leaked by setting a reply template that doesn't contain the original message.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-05T19:15Z
Repository: https://github.com/matrix-org/matrix-appservice-irc
Language: TypeScript
Files changed: changelog.d/1804.misc, src/bridge/MatrixHandler.ts
Commit date: 2024-05-21 10:16:52 +0100
Commit message: Don't use origin_server_ts when tracking joins, use bridge-time instead (#1804)

* Don't use origin_server_ts when tracking joins, use bridge-time instead

* Changelog
Diff: diff --git a/changelog.d/1804.misc b/changelog.d/1804.misc
new file mode 100644
index 000000000..fd2546f87
--- /dev/null
+++ b/changelog.d/1804.misc
@@ -0,0 +1 @@
+Don't use origin_server_ts when tracking joins, use bridge-time instead.
diff --git a/src/bridge/MatrixHandler.ts b/src/bridge/MatrixHandler.ts
index 94e03ac79..89a0885b7 100644
--- a/src/bridge/MatrixHandler.ts
+++ b/src/bridge/MatrixHandler.ts
@@ -412,11 +412,11 @@ export class MatrixHandler {
      * Called when the AS receives a new Matrix invite/join/leave event.
      * @param {Object} event : The Matrix member event.
      */
     private _onMemberEvent(req: BridgeRequest, event: OnMemberEventData) {
         if (event.content.membership === 'join') {
-            this.memberJoinTs.set(`${event.room_id}/${event.state_key}`, event.origin_server_ts ?? Date.now());
+            this.memberJoinTs.set(`${event.room_id}/${event.state_key}`, Date.now());
         }
         else {
             this.memberJoinTs.delete(`${event.room_id}/${event.state_key}`);
         }
         this.memberTracker?.onEvent(event);

Vulnerable code:             this.memberJoinTs.set(`${event.room_id}/${event.state_key}`, event.origin_server_ts ?? Date.now());
Fixed code: Don't use origin_server_ts when tracking joins, use bridge-time instead.
            this.memberJoinTs.set(`${event.room_id}/${event.state_key}`, Date.now());
CVE-2021-37847: Insufficient Information (NVD-CWE-noinfo)
value: crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest verification.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2021-08-02T20:15Z
Repository: https://github.com/saschahauer/barebox
Language: C
Files changed: crypto/digest.c
Commit date: 2021-07-30 19:50:36 +0200
Commit message: crypto: digest: use crypto_memneq()

When verifying a digest it is important not to leak timing information
through memcmp(). Use crypto_memneq() instead.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

Diff: diff --git a/crypto/digest.c b/crypto/digest.c
index d23245e15f..621d384168 100644
--- a/crypto/digest.c
+++ b/crypto/digest.c
@@ -20,10 +20,11 @@
 #include <fcntl.h>
 #include <linux/stat.h>
 #include <errno.h>
 #include <module.h>
 #include <linux/err.h>
+#include <crypto.h>
 #include <crypto/internal.h>
 
 static LIST_HEAD(digests);
 
 static struct digest_algo *digest_algo_get_by_name(const char *name);
@@ -45,12 +46,14 @@ int digest_generic_verify(struct digest *d, const unsigned char *md)
 
 	ret = digest_final(d, tmp);
 	if (ret)
 		goto end;
 
-	ret = memcmp(md, tmp, len);
-	ret = ret ? -EINVAL : 0;
+	if (crypto_memneq(md, tmp, len))
+		ret = -EINVAL;
+	else
+		ret = 0;
 end:
 	free(tmp);
 	return ret;
 }
 

Vulnerable code: 	ret = memcmp(md, tmp, len);
	ret = ret ? -EINVAL : 0;
Fixed code: #include <crypto.h>
	if (crypto_memneq(md, tmp, len))
		ret = -EINVAL;
	else
		ret = 0;