Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2022-31135: Improper Validation of Array Index (CWE-129)
value: Akashi is an open source server implementation of the Attorney Online video game based on the Ace Attorney universe. Affected versions of Akashi are subject to a denial of service attack. An attacker can use a specially crafted evidence packet to make an illegal modification, causing a server crash. This can be used to mount a denial-of-service exploit. Users are advised to upgrade. There is no known workaround for this issue.
CWE description: The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
CVSS v3 base score: 7.5
Published: 2022-07-07T18:15Z
Repository: https://github.com/AttorneyOnline/akashi
Language: C++
Files changed: core/src/packets.cpp
Commit date: 2021-07-27 22:57:29 -0500
Commit message: Fix out of bounds crash on evidence
Diff: diff --git a/core/src/packets.cpp b/core/src/packets.cpp
index 9fdb5e2..5e16d4f 100644
--- a/core/src/packets.cpp
+++ b/core/src/packets.cpp
@@ -376,11 +376,11 @@ void AOClient::pktRemoveEvidence(AreaData* area, int argc, QStringList argv, AOP
 {
     if (!checkEvidenceAccess(area))
         return;
     bool is_int = false;
     int idx = argv[0].toInt(&is_int);
-    if (is_int && idx <= area->evidence().size() && idx >= 0) {
+    if (is_int && idx < area->evidence().size() && idx >= 0) {
         area->deleteEvidence(idx);
     }
     sendEvidenceList(area);
 }
 
@@ -389,11 +389,11 @@ void AOClient::pktEditEvidence(AreaData* area, int argc, QStringList argv, AOPac
     if (!checkEvidenceAccess(area))
         return;
     bool is_int = false;
     int idx = argv[0].toInt(&is_int);
     AreaData::Evidence evi = {argv[1], argv[2], argv[3]};
-    if (is_int && idx <= area->evidence().size() && idx >= 0) {
+    if (is_int && idx < area->evidence().size() && idx >= 0) {
         area->replaceEvidence(idx, evi);
     }
     sendEvidenceList(area);
 }
 

Vulnerable code:     if (is_int && idx <= area->evidence().size() && idx >= 0) {
    if (is_int && idx <= area->evidence().size() && idx >= 0) {
Fixed code:     if (is_int && idx < area->evidence().size() && idx >= 0) {
    if (is_int && idx < area->evidence().size() && idx >= 0) {
CVE-2019-19576: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 9.8
Published: 2019-12-04T18:15Z
Repository: https://github.com/verot/class.upload.php
Language: PHP
Files changed: src/class.upload.php
Commit date: 2019-12-04 13:34:43 +0100
Commit message: blacklist .phar extension

Diff: diff --git a/src/class.upload.php b/src/class.upload.php
index 6a66a89..71192c7 100755
--- a/src/class.upload.php
+++ b/src/class.upload.php
@@ -3063,11 +3063,11 @@ class Upload {
                         $this->log .= '- file renamed as ' . $file_src_name_body . '.' . $file_src_name_ext . '!<br />';
                     }
                 }
                 // if the file is text based, or has a dangerous extension, we rename it as .txt
                 if ((((substr($this->file_src_mime, 0, 5) == 'text/' && $this->file_src_mime != 'text/rtf') || strpos($this->file_src_mime, 'javascript') !== false)  && (substr($file_src_name, -4) != '.txt'))
-                    || preg_match('/\.(php|php5|php4|php3|phtml|pl|py|cgi|asp|js)$/i', $this->file_src_name)
+                    || preg_match('/\.(php|php5|php4|php3|phtml|pl|py|cgi|asp|js|phar)$/i', $this->file_src_name)
                     || $this->file_force_extension && empty($file_src_name_ext)) {
                     $this->file_src_mime = 'text/plain';
                     if ($this->file_src_name_ext) $file_src_name_body = $file_src_name_body . '.' . $this->file_src_name_ext;
                     $file_src_name_ext = 'txt';
                     $file_src_name = $file_src_name_body . '.' . $file_src_name_ext;

Vulnerable code:                     || preg_match('/\.(php|php5|php4|php3|phtml|pl|py|cgi|asp|js)$/i', $this->file_src_name)
Fixed code:                     || preg_match('/\.(php|php5|php4|php3|phtml|pl|py|cgi|asp|js|phar)$/i', $this->file_src_name)
CVE-2016-6129: Improper Input Validation (CWE-20)
value: The rsa_verify_hash_ex function in rsa_verify_hash.c in LibTomCrypt, as used in OP-TEE before 2.2.0, does not validate that the message length is equal to the ASN.1 encoded data length, which makes it easier for remote attackers to forge RSA signatures or public certificates by leveraging a Bleichenbacher signature forgery attack.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2017-02-13T18:59Z
Repository: https://github.com/libtom/libtomcrypt
Language: C
Files changed: src/pk/rsa/rsa_verify_hash.c
Commit date: 2014-08-28 13:30:26 +0200
Commit message: rsa_verify_hash: fix possible bleichenbacher signature attack

Diff: diff --git a/src/pk/rsa/rsa_verify_hash.c b/src/pk/rsa/rsa_verify_hash.c
index 5639cd4..fc000de 100644
--- a/src/pk/rsa/rsa_verify_hash.c
+++ b/src/pk/rsa/rsa_verify_hash.c
@@ -101,11 +101,11 @@ int rsa_verify_hash_ex(const unsigned char *sig,      unsigned long siglen,
     }
 
   } else {
     /* PKCS #1 v1.5 decode it */
     unsigned char *out;
-    unsigned long outlen, loid[16];
+    unsigned long outlen, loid[16], reallen;
     int           decoded;
     ltc_asn1_list digestinfo[2], siginfo[2];
 
     /* not all hashes have OIDs... so sad */
     if (hash_descriptor[hash_idx].OIDlen == 0) {
@@ -143,12 +143,18 @@ int rsa_verify_hash_ex(const unsigned char *sig,      unsigned long siglen,
     if ((err = der_decode_sequence(out, outlen, siginfo, 2)) != CRYPT_OK) {
        XFREE(out);
        goto bail_2;
     }
 
+    if ((err = der_length_sequence(siginfo, 2, &reallen)) != CRYPT_OK) {
+       XFREE(out);
+       goto bail_2;
+    }
+
     /* test OID */
-    if ((digestinfo[0].size == hash_descriptor[hash_idx].OIDlen) &&
+    if ((reallen == outlen) &&
+        (digestinfo[0].size == hash_descriptor[hash_idx].OIDlen) &&
         (XMEMCMP(digestinfo[0].data, hash_descriptor[hash_idx].OID, sizeof(unsigned long) * hash_descriptor[hash_idx].OIDlen) == 0) &&
         (siginfo[1].size == hashlen) &&
         (XMEMCMP(siginfo[1].data, hash, hashlen) == 0)) {
        *stat = 1;
     }

Vulnerable code:     unsigned long outlen, loid[16];
    if ((digestinfo[0].size == hash_descriptor[hash_idx].OIDlen) &&
Fixed code:     unsigned long outlen, loid[16], reallen;
    if ((err = der_length_sequence(siginfo, 2, &reallen)) != CRYPT_OK) {
       XFREE(out);
       goto bail_2;
    }

    if ((reallen == outlen) &&
        (digestinfo[0].size == hash_descriptor[hash_idx].OIDlen) &&
CVE-2020-36254: Insufficient Information (NVD-CWE-noinfo)
value: scp.c in Dropbear before 2020.79 mishandles the filename of . or an empty filename, a related issue to CVE-2018-20685.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 8.1
Published: 2021-02-25T09:15Z
Repository: https://github.com/mkj/dropbear
Language: C
Files changed: scp.c
Commit date: 2020-05-25 20:54:29 +0800
Commit message: scp.c: Port OpenSSH CVE-2018-20685 fix (#80)


Diff: diff --git a/scp.c b/scp.c
index 742ae00..7b8e7d2 100644
--- a/scp.c
+++ b/scp.c
@@ -933,11 +933,12 @@ sink(int argc, char **argv)
 
 		for (size = 0; isdigit(*cp);)
 			size = size * 10 + (*cp++ - '0');
 		if (*cp++ != ' ')
 			SCREWUP("size not delimited");
-		if ((strchr(cp, '/') != NULL) || (strcmp(cp, "..") == 0)) {
+		if (*cp == '\0' || strchr(cp, '/') != NULL ||
+		    strcmp(cp, ".") == 0 || strcmp(cp, "..") == 0) {
 			run_err("error: unexpected filename: %s", cp);
 			exit(1);
 		}
 		if (targisdir) {
 			static char *namebuf = NULL;

Vulnerable code: 		if ((strchr(cp, '/') != NULL) || (strcmp(cp, "..") == 0)) {
Fixed code: 		if (*cp == '\0' || strchr(cp, '/') != NULL ||
		    strcmp(cp, ".") == 0 || strcmp(cp, "..") == 0) {
CVE-2023-49291: Insufficient Information (NVD-CWE-noinfo)
value: tj-actions/branch-names is a Github action to retrieve branch or tag names with support for all events. The `tj-actions/branch-names` GitHub Actions improperly references the `github.event.pull_request.head.ref` and `github.head_ref` context variables within a GitHub Actions `run` step. The head ref variable is the branch name and can be used to execute arbitrary code using a specially crafted branch name. As a result an attacker can use this vulnerability to steal secrets from or abuse `GITHUB_TOKEN` permissions. This vulnerability has been addressed in version 7.0.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2023-12-05T00:15Z
Repository: https://github.com/tj-actions/branch-names
Language: Unknown
Commit date: 2023-12-03 06:21:24 +0000
Commit message: Merge pull request #271 from tj-actions/security/prevent-arbitrary-code-injection-via-untrusted-inputs

security: prevent arbitrary code injection via untrusted inputs
CVE-2023-49291: Insufficient Information (NVD-CWE-noinfo)
value: tj-actions/branch-names is a Github action to retrieve branch or tag names with support for all events. The `tj-actions/branch-names` GitHub Actions improperly references the `github.event.pull_request.head.ref` and `github.head_ref` context variables within a GitHub Actions `run` step. The head ref variable is the branch name and can be used to execute arbitrary code using a specially crafted branch name. As a result an attacker can use this vulnerability to steal secrets from or abuse `GITHUB_TOKEN` permissions. This vulnerability has been addressed in version 7.0.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2023-12-05T00:15Z
Repository: https://github.com/tj-actions/branch-names
Language: Unknown
Commit date: 2023-12-03 06:33:07 +0000
Commit message: Merge pull request #272 from tj-actions/security/remove-vulnerable-events-from-test

security: remove vulnerable events from test
CVE-2023-49291: Insufficient Information (NVD-CWE-noinfo)
value: tj-actions/branch-names is a Github action to retrieve branch or tag names with support for all events. The `tj-actions/branch-names` GitHub Actions improperly references the `github.event.pull_request.head.ref` and `github.head_ref` context variables within a GitHub Actions `run` step. The head ref variable is the branch name and can be used to execute arbitrary code using a specially crafted branch name. As a result an attacker can use this vulnerability to steal secrets from or abuse `GITHUB_TOKEN` permissions. This vulnerability has been addressed in version 7.0.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2023-12-05T00:15Z
Repository: https://github.com/tj-actions/branch-names
Language: YAML
Files changed: .github/workflows/test.yml
Commit date: 2023-12-02 23:31:43 -0700
Commit message: security: remove vulnerable events from test
Diff: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 3d2f075..57aaa1c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -6,12 +6,10 @@ on:
       - '*'
     branches:
       - main
   release:
     types: [published, created]
-  pull_request_review:
-  pull_request_target:
   pull_request:
     branches:
       - main
 
 jobs:

Vulnerable code:   pull_request_review:
  pull_request_target:
CVE-2024-23840: Insertion of Sensitive Information into Log File (CWE-532)
value: GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. `goreleaser release --debug` log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0.
CWE description: Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
CVSS v3 base score: 5.5
Published: 2024-01-30T17:15Z
Repository: https://github.com/goreleaser/goreleaser
Language: Go
Files changed: internal/exec/exec.go, internal/pipe/sbom/sbom.go, internal/shell/shell.go
Commit date: 2024-01-29 20:53:46 -0300
Commit message: Merge pull request from GHSA-h3q2-8whx-c29h

this could potentially leak environment variables.

closes GHSA-h3q2-8whx-c29h

Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
Diff: diff --git a/internal/exec/exec.go b/internal/exec/exec.go
index 19c0fecc..af1a5259 100644
--- a/internal/exec/exec.go
+++ b/internal/exec/exec.go
@@ -84,11 +84,10 @@ func executePublisher(ctx *context.Context, publisher config.Publisher) error {
 	return g.Wait()
 }
 
 func executeCommand(c *command, artifact *artifact.Artifact) error {
 	log.WithField("args", c.Args).
-		WithField("env", c.Env).
 		WithField("artifact", artifact.Name).
 		Debug("executing command")
 
 	// nolint: gosec
 	cmd := exec.CommandContext(c.Ctx, c.Args[0], c.Args[1:]...)
diff --git a/internal/pipe/sbom/sbom.go b/internal/pipe/sbom/sbom.go
index 8e713e3a..594a211f 100644
--- a/internal/pipe/sbom/sbom.go
+++ b/internal/pipe/sbom/sbom.go
@@ -199,12 +199,11 @@ func catalogArtifact(ctx *context.Context, cfg config.SBOM, a *artifact.Artifact
 		}
 	}
 	cmd.Env = append(cmd.Env, envs...)
 	cmd.Dir = ctx.Config.Dist
 
-	log.WithField("env", cmd.Env).
-		WithField("dir", cmd.Dir).
+	log.WithField("dir", cmd.Dir).
 		WithField("cmd", cmd.Args).
 		Debug("running")
 
 	var b bytes.Buffer
 	w := gio.Safe(&b)
diff --git a/internal/shell/shell.go b/internal/shell/shell.go
index a879dd19..3d24cf47 100644
--- a/internal/shell/shell.go
+++ b/internal/shell/shell.go
@@ -16,11 +16,10 @@ import (
 
 // Run a shell command with given arguments and envs
 func Run(ctx *context.Context, dir string, command, env []string, output bool) error {
 	log := log.
 		WithField("cmd", command).
-		WithField("env", env).
 		WithField("dir", dir)
 
 	/* #nosec */
 	cmd := exec.CommandContext(ctx, command[0], command[1:]...)
 	cmd.Env = env

Vulnerable code: 		WithField("env", c.Env).
	log.WithField("env", cmd.Env).
		WithField("dir", cmd.Dir).
		WithField("env", env).
Fixed code: 	log.WithField("dir", cmd.Dir).
CVE-2024-26140: Insufficient Information (NVD-CWE-noinfo)
value: com.yetanalytics/lrs is the Yet Analytics Core LRS Library. Prior to version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS, a maliciously crafted xAPI statement could be used to perform script or other tag injection in the LRS Statement Browser. The problem is patched in version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS. No known workarounds exist.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-20T22:15Z
Repository: https://github.com/yetanalytics/lrs
Language: Unknown
Commit date: 2024-02-16 15:26:48 -0500
Commit message: Merge pull request #89 from yetanalytics/sanitize_value_outputs

sanitize possible html value injections in all value renders
CVE-2017-6391: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "admin_console/web/tools/SimpleJWPlayer.php" URL, the "admin_console/web/tools/AkamaiBroadcaster.php" URL, the "admin_console/web/tools/bigRedButton.php" URL, and the "admin_console/web/tools/bigRedButtonPtsPoc.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-03-02T06:59Z
Repository: https://github.com/kaltura/server
Language: Unknown
Commit date: 2017-02-27 22:48:03 +0200
Commit message: Merge pull request #5304 from kaltura/strip_tags

call strip_tags on all values extracted from $_GET[]
CVE-2017-6392: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "server-Lynx-12.11.0/admin_console/web/tools/XmlJWPlayer.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-03-02T06:59Z
Repository: https://github.com/kaltura/server
Language: Unknown
Commit date: 2017-02-27 22:48:03 +0200
Commit message: Merge pull request #5304 from kaltura/strip_tags

call strip_tags on all values extracted from $_GET[]
CVE-2024-27284: Insufficient Information (NVD-CWE-noinfo)
value: cassandra-rs is a Cassandra (CQL) driver for Rust. Code that attempts to use an item (e.g., a row) returned by an iterator after the iterator has advanced to the next item will be accessing freed memory and experience undefined behaviour.  The problem has been fixed in version 3.0.0.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-29T01:44Z
Repository: https://github.com/Metaswitch/cassandra-rs
Language: Unknown
Commit date: 2024-02-28 11:35:06 +0000
Commit message: Merge pull request from GHSA-x9xc-63hg-vcfq

Make `ResultIterator` a `LendingIterator`
CVE-2010-1152: Improper Input Validation (CWE-20)
value: memcached.c in memcached before 1.4.3 allows remote attackers to cause a denial of service (daemon hang or crash) via a long line that triggers excessive memory allocation.  NOTE: some of these details are obtained from third party information.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2010-04-12T18:30Z
Repository: https://github.com/memcached/memcached
Language: C
Files changed: memcached.c
Commit date: 2009-11-02 09:52:45 -0800
Commit message: Use strncmp when checking for large ascii multigets.

Diff: diff --git a/memcached.c b/memcached.c
index ed67eb0..3e2e9c5 100644
--- a/memcached.c
+++ b/memcached.c
@@ -3146,11 +3146,13 @@ static int try_read_command(conn *c) {
                 char *ptr = c->rcurr;
                 while (*ptr == ' ') { /* ignore leading whitespaces */
                     ++ptr;
                 }
 
-                if (strcmp(ptr, "get ") && strcmp(ptr, "gets ")) {
+                if (ptr - c->rcurr > 100 ||
+                    (strncmp(ptr, "get ", 4) && strncmp(ptr, "gets ", 5))) {
+
                     conn_set_state(c, conn_closing);
                     return 1;
                 }
             }
 

Vulnerable code:                 if (strcmp(ptr, "get ") && strcmp(ptr, "gets ")) {
Fixed code:                 if (ptr - c->rcurr > 100 ||
                    (strncmp(ptr, "get ", 4) && strncmp(ptr, "gets ", 5))) {
CVE-2018-1000127: Integer Overflow or Wraparound (CWE-190)
value: memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service. This vulnerability appears to have been fixed in 1.4.37 and later.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 7.5
Published: 2018-03-13T21:29Z
Repository: https://github.com/memcached/memcached
Language: C
Files changed: memcached.c
Commit date: 2017-05-22 22:05:53 -0700
Commit message: Don't overflow item refcount on get

Counts as a miss if the refcount is too high. ASCII multigets are the only
time refcounts can be held for so long.

doing a dirty read of refcount. is aligned.

trying to avoid adding an extra refcount branch for all calls of item_get due
to performance. might be able to move it in there after logging refactoring
simplifies some of the branches.

Diff: diff --git a/memcached.c b/memcached.c
index d0533c5..044064f 100644
--- a/memcached.c
+++ b/memcached.c
@@ -3247,10 +3247,20 @@ static inline int make_ascii_get_suffix(char *suffix, item *it, bool return_cas)
     *(p+1) = '\n';
     *(p+2) = '\0';
     return (p - suffix) + 2;
 }
 
+#define IT_REFCOUNT_LIMIT 60000
+static inline item* limited_get(char *key, size_t nkey, conn *c) {
+    item *it = item_get(key, nkey, c, DO_UPDATE);
+    if (it && it->refcount > IT_REFCOUNT_LIMIT) {
+        item_remove(it);
+        it = NULL;
+    }
+    return it;
+}
+
 /* ntokens is overwritten here... shrug.. */
 static inline void process_get_command(conn *c, token_t *tokens, size_t ntokens, bool return_cas) {
     char *key;
     size_t nkey;
     int i = 0;
@@ -3271,11 +3281,11 @@ static inline void process_get_command(conn *c, token_t *tokens, size_t ntokens,
                     item_remove(*(c->ilist + i));
                 }
                 return;
             }
 
-            it = item_get(key, nkey, c, DO_UPDATE);
+            it = limited_get(key, nkey, c);
             if (settings.detail_enabled) {
                 stats_prefix_record_get(key, nkey, NULL != it);
             }
             if (it) {
                 if (i >= c->isize) {

Vulnerable code:             it = item_get(key, nkey, c, DO_UPDATE);
Fixed code: #define IT_REFCOUNT_LIMIT 60000
static inline item* limited_get(char *key, size_t nkey, conn *c) {
    item *it = item_get(key, nkey, c, DO_UPDATE);
    if (it && it->refcount > IT_REFCOUNT_LIMIT) {
        item_remove(it);
        it = NULL;
    }
    return it;
}

            it = limited_get(key, nkey, c);
CVE-2018-1000127: Improper Locking (CWE-667)
value: memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service. This vulnerability appears to have been fixed in 1.4.37 and later.
CWE description: The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
CVSS v3 base score: 7.5
Published: 2018-03-13T21:29Z
Repository: https://github.com/memcached/memcached
Language: C
Files changed: memcached.c
Commit date: 2017-05-22 22:05:53 -0700
Commit message: Don't overflow item refcount on get

Counts as a miss if the refcount is too high. ASCII multigets are the only
time refcounts can be held for so long.

doing a dirty read of refcount. is aligned.

trying to avoid adding an extra refcount branch for all calls of item_get due
to performance. might be able to move it in there after logging refactoring
simplifies some of the branches.

Diff: diff --git a/memcached.c b/memcached.c
index d0533c5..044064f 100644
--- a/memcached.c
+++ b/memcached.c
@@ -3247,10 +3247,20 @@ static inline int make_ascii_get_suffix(char *suffix, item *it, bool return_cas)
     *(p+1) = '\n';
     *(p+2) = '\0';
     return (p - suffix) + 2;
 }
 
+#define IT_REFCOUNT_LIMIT 60000
+static inline item* limited_get(char *key, size_t nkey, conn *c) {
+    item *it = item_get(key, nkey, c, DO_UPDATE);
+    if (it && it->refcount > IT_REFCOUNT_LIMIT) {
+        item_remove(it);
+        it = NULL;
+    }
+    return it;
+}
+
 /* ntokens is overwritten here... shrug.. */
 static inline void process_get_command(conn *c, token_t *tokens, size_t ntokens, bool return_cas) {
     char *key;
     size_t nkey;
     int i = 0;
@@ -3271,11 +3281,11 @@ static inline void process_get_command(conn *c, token_t *tokens, size_t ntokens,
                     item_remove(*(c->ilist + i));
                 }
                 return;
             }
 
-            it = item_get(key, nkey, c, DO_UPDATE);
+            it = limited_get(key, nkey, c);
             if (settings.detail_enabled) {
                 stats_prefix_record_get(key, nkey, NULL != it);
             }
             if (it) {
                 if (i >= c->isize) {

Vulnerable code:             it = item_get(key, nkey, c, DO_UPDATE);
Fixed code: #define IT_REFCOUNT_LIMIT 60000
static inline item* limited_get(char *key, size_t nkey, conn *c) {
    item *it = item_get(key, nkey, c, DO_UPDATE);
    if (it && it->refcount > IT_REFCOUNT_LIMIT) {
        item_remove(it);
        it = NULL;
    }
    return it;
}

            it = limited_get(key, nkey, c);
CVE-2019-11596: NULL Pointer Dereference (CWE-476)
value: In memcached before 1.5.14, a NULL pointer dereference was found in the "lru mode" and "lru temp_ttl" commands. This causes a denial of service when parsing crafted lru command messages in process_lru_command in memcached.c.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2019-04-29T15:29Z
Repository: https://github.com/memcached/memcached
Language: C
Files changed: memcached.c
Commit date: 2019-04-27 01:17:57 -0700
Commit message: fix segfault in "lru" command

fixes #474 - off by one in token count.

Diff: diff --git a/memcached.c b/memcached.c
index d64a8381..7fd3e40e 100644
--- a/memcached.c
+++ b/memcached.c
@@ -4630,22 +4630,22 @@ static void process_lru_command(conn *c, token_t *tokens, const size_t ntokens)
                 settings.hot_max_factor = hot_factor;
                 settings.warm_max_factor = factor;
                 out_string(c, "OK");
             }
         }
-    } else if (strcmp(tokens[1].value, "mode") == 0 && ntokens >= 3 &&
+    } else if (strcmp(tokens[1].value, "mode") == 0 && ntokens >= 4 &&
                settings.lru_maintainer_thread) {
         if (strcmp(tokens[2].value, "flat") == 0) {
             settings.lru_segmented = false;
             out_string(c, "OK");
         } else if (strcmp(tokens[2].value, "segmented") == 0) {
             settings.lru_segmented = true;
             out_string(c, "OK");
         } else {
             out_string(c, "ERROR");
         }
-    } else if (strcmp(tokens[1].value, "temp_ttl") == 0 && ntokens >= 3 &&
+    } else if (strcmp(tokens[1].value, "temp_ttl") == 0 && ntokens >= 4 &&
                settings.lru_maintainer_thread) {
         if (!safe_strtol(tokens[2].value, &ttl)) {
             out_string(c, "ERROR");
         } else {
             if (ttl < 0) {

Vulnerable code:     } else if (strcmp(tokens[1].value, "mode") == 0 && ntokens >= 3 &&
    } else if (strcmp(tokens[1].value, "temp_ttl") == 0 && ntokens >= 3 &&
Fixed code:     } else if (strcmp(tokens[1].value, "mode") == 0 && ntokens >= 4 &&
    } else if (strcmp(tokens[1].value, "temp_ttl") == 0 && ntokens >= 4 &&
CVE-2020-10931: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: Memcached 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted binary protocol header to try_read_command_binary in memcached.c.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 7.5
Published: 2020-03-24T15:15Z
Repository: https://github.com/memcached/memcached
Language: C
Files changed: memcached.c
Commit date: 2020-03-23 10:16:33 -0700
Commit message: Fix security issue reported by someone.

someone will get their name attributed for future issues if they bother
following procedure.

Diff: diff --git a/memcached.c b/memcached.c
index b9ce8b16..2592b3f9 100644
--- a/memcached.c
+++ b/memcached.c
@@ -6173,12 +6173,13 @@ static int try_read_command_binary(conn *c) {
         c->last_cmd_time = current_time;
         // sigh. binprot has no "largest possible extlen" define, and I don't
         // want to refactor a ton of code either. Header is only ever used out
         // of c->binary_header, but the extlen stuff is used for the latter
         // bytes. Just wastes 24 bytes on the stack this way.
-        char extbuf[sizeof(c->binary_header) + BIN_MAX_EXTLEN];
-        memcpy(extbuf + sizeof(c->binary_header), c->rcurr + sizeof(c->binary_header), extlen);
+        char extbuf[sizeof(c->binary_header) + BIN_MAX_EXTLEN+1];
+        memcpy(extbuf + sizeof(c->binary_header), c->rcurr + sizeof(c->binary_header),
+                extlen > BIN_MAX_EXTLEN ? BIN_MAX_EXTLEN : extlen);
         c->rbytes -= sizeof(c->binary_header) + extlen + keylen;
         c->rcurr += sizeof(c->binary_header) + extlen + keylen;
 
         dispatch_bin_command(c, extbuf);
     }

Vulnerable code:         char extbuf[sizeof(c->binary_header) + BIN_MAX_EXTLEN];
        memcpy(extbuf + sizeof(c->binary_header), c->rcurr + sizeof(c->binary_header), extlen);
Fixed code:         char extbuf[sizeof(c->binary_header) + BIN_MAX_EXTLEN+1];
        memcpy(extbuf + sizeof(c->binary_header), c->rcurr + sizeof(c->binary_header),
                extlen > BIN_MAX_EXTLEN ? BIN_MAX_EXTLEN : extlen);
CVE-2022-48571: Uncontrolled Resource Consumption (CWE-400)
value: memcached 1.6.7 allows a Denial of Service via multi-packet uploads in UDP.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 7.5
Published: 2023-08-22T19:16Z
Repository: https://github.com/memcached/memcached
Language: C
Files changed: memcached.c
Commit date: 2020-10-26 16:29:07 -0700
Commit message: udp: crash fix when receiving multi-packet uploads

multi-packet sets aren't supported in UDP. It was trying to write an
error message in response, but no mc_resp object was initialized at the
time, leading to a null reference crash.

Instead drop the packet quietly since that's a pretty fatal bug anyway
and keeps the parser simplified.

For credits see accompanying release notes.

Diff: diff --git a/memcached.c b/memcached.c
index a21b4aa9..ebcbdee1 100644
--- a/memcached.c
+++ b/memcached.c
@@ -1181,13 +1181,13 @@ bool resp_has_stack(conn *c) {
     return c->resp_head->next != NULL ? true : false;
 }
 
 void out_string(conn *c, const char *str) {
     size_t len;
+    assert(c != NULL);
     mc_resp *resp = c->resp;
 
-    assert(c != NULL);
     // if response was original filled with something, but we're now writing
     // out an error or similar, have to reset the object first.
     // TODO: since this is often redundant with allocation, how many callers
     // are actually requiring it be reset? Can we fast test by just looking at
     // tosend and reset if nonzero?
@@ -2602,11 +2602,10 @@ static enum try_read_result try_read_udp(conn *c) {
         /* Beginning of UDP packet is the request ID; save it. */
         c->request_id = buf[0] * 256 + buf[1];
 
         /* If this is a multi-packet request, drop it. */
         if (buf[4] != 0 || buf[5] != 1) {
-            out_string(c, "SERVER_ERROR multi-packet request not supported");
             return READ_NO_DATA_RECEIVED;
         }
 
         /* Don't care about any of the rest of the header. */
         res -= 8;

Vulnerable code:     assert(c != NULL);
            out_string(c, "SERVER_ERROR multi-packet request not supported");
Fixed code:     assert(c != NULL);
CVE-2021-41232: Improper Encoding or Escaping of Output (CWE-116)
value: Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in version 1.16.3. If users are unable to update they should disable the LDAP feature if in use.
CWE description: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CVSS v3 base score: 9.8
Published: 2021-11-02T18:15Z
Repository: https://github.com/StevenWeathers/thunderdome-planning-poker
Language: Go
Files changed: auth.go
Commit date: 2021-11-01 20:48:52 -0400
Commit message: Fix LDAP vulnerability

Diff: diff --git a/auth.go b/auth.go
index 8f74555..43cb141 100644
--- a/auth.go
+++ b/auth.go
@@ -66,11 +66,11 @@ func (s *server) authAndCreateUserLdap(UserName string, UserPassword string) (*d
 		}
 	}
 
 	searchRequest := ldap.NewSearchRequest(viper.GetString("auth.ldap.basedn"),
 		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
-		fmt.Sprintf(viper.GetString("auth.ldap.filter"), UserName),
+		fmt.Sprintf(viper.GetString("auth.ldap.filter"), ldap.EscapeFilter(UserName)),
 		[]string{"dn", viper.GetString("auth.ldap.mail_attr"), viper.GetString("auth.ldap.cn_attr")},
 		nil,
 	)
 
 	sr, err := l.Search(searchRequest)

Vulnerable code: 		fmt.Sprintf(viper.GetString("auth.ldap.filter"), UserName),
Fixed code: 		fmt.Sprintf(viper.GetString("auth.ldap.filter"), ldap.EscapeFilter(UserName)),
CVE-2021-41232: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in version 1.16.3. If users are unable to update they should disable the LDAP feature if in use.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2021-11-02T18:15Z
Repository: https://github.com/StevenWeathers/thunderdome-planning-poker
Language: Go
Files changed: auth.go
Commit date: 2021-11-01 20:48:52 -0400
Commit message: Fix LDAP vulnerability

Diff: diff --git a/auth.go b/auth.go
index 8f74555..43cb141 100644
--- a/auth.go
+++ b/auth.go
@@ -66,11 +66,11 @@ func (s *server) authAndCreateUserLdap(UserName string, UserPassword string) (*d
 		}
 	}
 
 	searchRequest := ldap.NewSearchRequest(viper.GetString("auth.ldap.basedn"),
 		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
-		fmt.Sprintf(viper.GetString("auth.ldap.filter"), UserName),
+		fmt.Sprintf(viper.GetString("auth.ldap.filter"), ldap.EscapeFilter(UserName)),
 		[]string{"dn", viper.GetString("auth.ldap.mail_attr"), viper.GetString("auth.ldap.cn_attr")},
 		nil,
 	)
 
 	sr, err := l.Search(searchRequest)

Vulnerable code: 		fmt.Sprintf(viper.GetString("auth.ldap.filter"), UserName),
Fixed code: 		fmt.Sprintf(viper.GetString("auth.ldap.filter"), ldap.EscapeFilter(UserName)),
CVE-2013-7378: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2020-02-12T14:15Z
Repository: https://github.com/github/hubot-scripts
Language: Other
Files changed: src/scripts/email.coffee
Commit date: 2013-04-26 15:00:24 -0400
Commit message: Fix code execution issue in email command.

Diff: diff --git a/src/scripts/email.coffee b/src/scripts/email.coffee
index c65c47f..d6498f6 100644
--- a/src/scripts/email.coffee
+++ b/src/scripts/email.coffee
@@ -16,18 +16,20 @@
 # Additional Requirements
 #   unix mail client installed on the system
 
 util = require 'util'
 child_process = require 'child_process'
-exec = child_process.exec
 
 module.exports = (robot) ->
   emailTime = null
   sendEmail = (recipients, subject, msg, from) ->
-    mailCommand = """echo '#{msg}' | mail -s '#{subject}' -r '#{from}' '#{recipients}'"""
-    exec mailCommand, (error, stdout, stderr) ->
+    mailArgs = ['-s', subject, '-a', "From: #{from}", '--']
+    mailArgs = mailArgs.concat recipients
+    p = child_process.execFile 'mail', mailArgs, {}, (error, stdout, stderr) ->
       util.print 'stdout: ' + stdout
       util.print 'stderr: ' + stderr
+    p.stdin.write "#{msg}\n"
+    p.stdin.end()
 
   robot.respond /email (.*) -s (.*) -m (.*)/i, (msg) ->
-    sendEmail msg.match[1], msg.match[2], msg.match[3], msg.message.user.id
+    sendEmail msg.match[1].split(" "), msg.match[2], msg.match[3], msg.message.user.id
     msg.send "email sent"

Vulnerable code: exec = child_process.exec
    mailCommand = """echo '#{msg}' | mail -s '#{subject}' -r '#{from}' '#{recipients}'"""
    exec mailCommand, (error, stdout, stderr) ->
    sendEmail msg.match[1], msg.match[2], msg.match[3], msg.message.user.id
Fixed code:     mailArgs = ['-s', subject, '-a', "From: #{from}", '--']
    mailArgs = mailArgs.concat recipients
    p = child_process.execFile 'mail', mailArgs, {}, (error, stdout, stderr) ->
    p.stdin.write "#{msg}\n"
    p.stdin.end()
    sendEmail msg.match[1].split(" "), msg.match[2], msg.match[3], msg.message.user.id
CVE-2020-5238: Improper Input Validation (CWE-20)
value: The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse certain inputs. An attacker could craft a markdown table which would take an unreasonably long time to process, causing a denial of service. This issue does not affect the upstream cmark project. The issue has been fixed in version 0.29.0.gfm.1.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 6.5
Published: 2020-07-01T23:15Z
Repository: https://github.com/github/cmark-gfm
Language: Unknown
Commit date: 2020-06-30 13:02:43 -0400
Commit message: Merge pull request from GHSA-7gc6-9qr5-hc85

Fix pathological table parsing
CVE-2022-39209: Inefficient Algorithmic Complexity (CWE-407)
value: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by running `python3 -c 'print("![l"* 100000 + "\n")' | ./cmark-gfm -e autolink`, which will resource exhaust on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink extension.
CWE description: An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
CVSS v3 base score: 6.5
Published: 2022-09-15T18:15Z
Repository: https://github.com/github/cmark-gfm
Language: Unknown
Commit date: 2022-09-14 16:56:39 -0400
Commit message: Merge pull request from GHSA-cgh3-p57x-9q7q

0.29.0.gfm.6
CVE-2023-24824: Uncontrolled Resource Consumption (CWE-400)
value: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `>` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.
CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 7.5
Published: 2023-03-31T23:15Z
Repository: https://github.com/github/cmark-gfm
Language: Unknown
Commit date: 2023-03-31 13:27:53 -0400
Commit message: Merge pull request from GHSA-66g8-4hjf-77xh

Keep a count of the number of open blocks (WIP)
CVE-2023-24824: Inefficient Algorithmic Complexity (CWE-407)
value: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `>` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.
CWE description: An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
CVSS v3 base score: 7.5
Published: 2023-03-31T23:15Z
Repository: https://github.com/github/cmark-gfm
Language: Unknown
Commit date: 2023-03-31 13:27:53 -0400
Commit message: Merge pull request from GHSA-66g8-4hjf-77xh

Keep a count of the number of open blocks (WIP)
CVE-2023-26485: Uncontrolled Resource Consumption (CWE-400)
value: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `_` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.




### Impact

A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service.

### Proof of concept

```
$ ~/cmark-gfm$ python3 -c 'pad = "_" * 100000; print(pad + "." + pad, end="")' | time ./build/src/cmark-gfm --to plaintext
```

Increasing the number 10000 in the above commands causes the running time to increase quadratically.

### Patches

This vulnerability have been patched in 0.29.0.gfm.10.

### Note on cmark and cmark-gfm

XXX: TBD

[cmark-gfm](https://github.com/github/cmark-gfm) is a fork of [cmark](https://github.com/commonmark/cmark) that adds the GitHub Flavored Markdown extensions. The two codebases have diverged over time, but share a common core. These bugs affect both `cmark` and `cmark-gfm`. 

### Credit

We would like to thank @gravypod for reporting this vulnerability.

### References

https://en.wikipedia.org/wiki/Time_complexity

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [github/cmark-gfm](https://github.com/github/cmark-gfm)

CWE description: The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVSS v3 base score: 7.5
Published: 2023-03-31T23:15Z
Repository: https://github.com/github/cmark-gfm
Language: Unknown
Commit date: 2023-03-31 13:29:29 -0400
Commit message: Merge pull request from GHSA-r8vr-c48j-fcc5

Fix quadratic behavior in rendering
CVE-2023-26485: Inefficient Algorithmic Complexity (CWE-407)
value: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `_` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.




### Impact

A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service.

### Proof of concept

```
$ ~/cmark-gfm$ python3 -c 'pad = "_" * 100000; print(pad + "." + pad, end="")' | time ./build/src/cmark-gfm --to plaintext
```

Increasing the number 10000 in the above commands causes the running time to increase quadratically.

### Patches

This vulnerability have been patched in 0.29.0.gfm.10.

### Note on cmark and cmark-gfm

XXX: TBD

[cmark-gfm](https://github.com/github/cmark-gfm) is a fork of [cmark](https://github.com/commonmark/cmark) that adds the GitHub Flavored Markdown extensions. The two codebases have diverged over time, but share a common core. These bugs affect both `cmark` and `cmark-gfm`. 

### Credit

We would like to thank @gravypod for reporting this vulnerability.

### References

https://en.wikipedia.org/wiki/Time_complexity

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [github/cmark-gfm](https://github.com/github/cmark-gfm)

CWE description: An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
CVSS v3 base score: 7.5
Published: 2023-03-31T23:15Z
Repository: https://github.com/github/cmark-gfm
Language: Unknown
Commit date: 2023-03-31 13:29:29 -0400
Commit message: Merge pull request from GHSA-r8vr-c48j-fcc5

Fix quadratic behavior in rendering