Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2022-3821: Off-by-one Error (CWE-193)
value: An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service.
CWE description: A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CVSS v3 base score: 5.5
Published: 2022-11-08T22:15Z
Repository: https://github.com/systemd/systemd
Language: C
Files changed: src/basic/time-util.c, src/test/test-time-util.c
Commit date: 2022-07-08 16:09:46 +0200
Commit message: time-util: fix buffer-over-run

Fixes #23928.

Diff: diff --git a/src/basic/time-util.c b/src/basic/time-util.c
index abbc4ad5cd7..26d59de1234 100644
--- a/src/basic/time-util.c
+++ b/src/basic/time-util.c
@@ -589,11 +589,11 @@ char *format_timespan(char *buf, size_t l, usec_t t, usec_t accuracy) {
                                      table[i].suffix);
 
                         t = b;
                 }
 
-                n = MIN((size_t) k, l);
+                n = MIN((size_t) k, l-1);
 
                 l -= n;
                 p += n;
 
                 something = true;
diff --git a/src/test/test-time-util.c b/src/test/test-time-util.c
index e8e4e2a67bb..58c5fa9be40 100644
--- a/src/test/test-time-util.c
+++ b/src/test/test-time-util.c
@@ -236,10 +236,15 @@ static void test_format_timespan_accuracy(usec_t accuracy) {
 
 TEST(format_timespan) {
         test_format_timespan_accuracy(1);
         test_format_timespan_accuracy(USEC_PER_MSEC);
         test_format_timespan_accuracy(USEC_PER_SEC);
+
+        /* See issue #23928. */
+        _cleanup_free_ char *buf;
+        assert_se(buf = new(char, 5));
+        assert_se(buf == format_timespan(buf, 5, 100005, 1000));
 }
 
 TEST(verify_timezone) {
         assert_se(verify_timezone("Europe/Berlin", LOG_DEBUG) == 0);
         assert_se(verify_timezone("Australia/Sydney", LOG_DEBUG) == 0);

Vulnerable code:                 n = MIN((size_t) k, l);
Fixed code:                 n = MIN((size_t) k, l-1);

        /* See issue #23928. */
        _cleanup_free_ char *buf;
        assert_se(buf = new(char, 5));
        assert_se(buf == format_timespan(buf, 5, 100005, 1000));
CVE-2022-4415: Insufficient Information (NVD-CWE-noinfo)
value: A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.5
Published: 2023-01-11T15:15Z
Repository: https://github.com/systemd/systemd
Language: Unknown
Commit date: 2022-12-20 17:56:28 +0100
Commit message: Merge branch 'systemd-security/coredump-capabilities'

CVE-2022-4415: systemd: coredump not respecting fs.suid_dumpable kernel setting
Affects systemd >= 247 with libacl support enabled.

This is a merge of https://github.com/systemd/systemd-security/pull/12/.
I'm doing the merge locally because github doesn't support merging directly
from systemd/systemd-security to systemd/systemd.

Diff: diff --cc src/coredump/coredump.c
index 4ca19370f3e,b6f3a2f256f..c8c8158eef4
--- a/src/coredump/coredump.c
+++ b/src/coredump/coredump.c
@@@ -452,15 -607,17 +607,17 @@@ static int save_external_coredump
          if (r < 0)
                  return log_error_errno(r, "Cannot store coredump of %s (%s): %m",
                                  context->meta[META_ARGV_PID], context->meta[META_COMM]);
          truncated = r == 1;
  
+         bool allow_user = grant_user_access(fd, context) > 0;
+ 
  #if HAVE_COMPRESSION
          if (arg_compress) {
                  _cleanup_(unlink_and_freep) char *tmp_compressed = NULL;
                  _cleanup_free_ char *fn_compressed = NULL;
 -                _cleanup_close_ int fd_compressed = -1;
 +                _cleanup_close_ int fd_compressed = -EBADF;
                  uint64_t uncompressed_size = 0;
  
                  if (lseek(fd, 0, SEEK_SET) == (off_t) -1)
                          return log_error_errno(errno, "Failed to seek on coredump %s: %m", fn);
  
@@@ -764,16 -921,16 +921,16 @@@ static int change_uid_gid(const Contex
  
          return drop_privileges(uid, gid, 0);
  }
  
  static int submit_coredump(
-                 Context *context,
+                 const Context *context,
                  struct iovec_wrapper *iovw,
                  int input_fd) {
  
          _cleanup_(json_variant_unrefp) JsonVariant *json_metadata = NULL;
 -        _cleanup_close_ int coredump_fd = -1, coredump_node_fd = -1;
 +        _cleanup_close_ int coredump_fd = -EBADF, coredump_node_fd = -EBADF;
          _cleanup_free_ char *filename = NULL, *coredump_data = NULL;
          _cleanup_free_ char *stacktrace = NULL;
          char *core_message;
          const char *module_name;
          uint64_t coredump_size = UINT64_MAX, coredump_compressed_size = UINT64_MAX;
CVE-2017-20005: Integer Overflow or Wraparound (CWE-190)
value: NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date far in the future), when encountered by the autoindex module.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2021-06-06T22:15Z
Repository: https://github.com/nginx/nginx
Language: C
Files changed: src/core/ngx_times.c
Commit date: 2017-09-13 15:53:19 +0300
Commit message: Introduced time truncation to December 31, 9999 (ticket #1368).

Various buffers are allocated in an assumption that there would be
no more than 4 year digits.  This might not be true on platforms
with 64-bit time_t, as 64-bit time_t is able to represent more than that.
Such dates with more than 4 year digits hardly make sense though, as
various date formats in use do not allow them anyway.

As such, all dates are now truncated by ngx_gmtime() to December 31, 9999.
This should have no effect on valid dates, though will prevent potential
buffer overflows on invalid ones.

Diff: diff --git a/src/core/ngx_times.c b/src/core/ngx_times.c
index ef63f1e3..b2edf1a5 100644
--- a/src/core/ngx_times.c
+++ b/src/core/ngx_times.c
@@ -309,10 +309,20 @@ ngx_gmtime(time_t t, ngx_tm_t *tp)
     }
 
     days = t / 86400;
     sec = t % 86400;
 
+    /*
+     * no more than 4 year digits supported,
+     * truncate to December 31, 9999, 23:59:59
+     */
+
+    if (days > 2932896) {
+        days = 2932896;
+        sec = 86399;
+    }
+
     /* January 1, 1970 was Thursday */
 
     wday = (4 + days) % 7;
 
     hour = sec / 3600;

Fixed code:     /*
     * no more than 4 year digits supported,
     * truncate to December 31, 9999, 23:59:59
     */

    if (days > 2932896) {
        days = 2932896;
        sec = 86399;
    }
CVE-2017-20005: Integer Overflow or Wraparound (CWE-190)
value: NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date far in the future), when encountered by the autoindex module.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2021-06-06T22:15Z
Repository: https://github.com/nginx/nginx
Language: C
Files changed: src/core/ngx_times.c
Commit date: 2017-09-13 15:52:01 +0300
Commit message: Fixed ngx_gmtime() on 32-bit platforms with 64-bit time_t.

In ngx_gmtime(), instead of casting to ngx_uint_t we now work with
time_t directly.  This allows using dates after 2038 on 32-bit platforms
which use 64-bit time_t, notably NetBSD and OpenBSD.

As the code is not able to work with negative time_t values, argument
is now set to 0 for negative values.  As a positive side effect, this
results in Epoch being used for such values instead of a date in distant
future.

Diff: diff --git a/src/core/ngx_times.c b/src/core/ngx_times.c
index 1e36675e..ef63f1e3 100644
--- a/src/core/ngx_times.c
+++ b/src/core/ngx_times.c
@@ -298,27 +298,29 @@ ngx_http_cookie_time(u_char *buf, time_t t)
 
 void
 ngx_gmtime(time_t t, ngx_tm_t *tp)
 {
     ngx_int_t   yday;
-    ngx_uint_t  n, sec, min, hour, mday, mon, year, wday, days, leap;
+    ngx_uint_t  sec, min, hour, mday, mon, year, wday, days, leap;
 
     /* the calculation is valid for positive time_t only */
 
-    n = (ngx_uint_t) t;
+    if (t < 0) {
+        t = 0;
+    }
 
-    days = n / 86400;
+    days = t / 86400;
+    sec = t % 86400;
 
     /* January 1, 1970 was Thursday */
 
     wday = (4 + days) % 7;
 
-    n %= 86400;
-    hour = n / 3600;
-    n %= 3600;
-    min = n / 60;
-    sec = n % 60;
+    hour = sec / 3600;
+    sec %= 3600;
+    min = sec / 60;
+    sec %= 60;
 
     /*
      * the algorithm based on Gauss' formula,
      * see src/core/ngx_parse_time.c
      */

Vulnerable code:     ngx_uint_t  n, sec, min, hour, mday, mon, year, wday, days, leap;
    n = (ngx_uint_t) t;
    days = n / 86400;
    n %= 86400;
    hour = n / 3600;
    n %= 3600;
    min = n / 60;
    sec = n % 60;
Fixed code:     ngx_uint_t  sec, min, hour, mday, mon, year, wday, days, leap;
    if (t < 0) {
        t = 0;
    }
    days = t / 86400;
    sec = t % 86400;
    hour = sec / 3600;
    sec %= 3600;
    min = sec / 60;
    sec %= 60;
CVE-2019-20372: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') (CWE-444)
value: NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.
CWE description: The product acts as an intermediary HTTP agent
         (such as a proxy or firewall) in the data flow between two
         entities such as a client and server, but it does not
         interpret malformed HTTP requests or responses in ways that
         are consistent with how the messages will be processed by
         those entities that are at the ultimate destination.
CVSS v3 base score: 5.3
Published: 2020-01-09T21:15Z
Repository: https://github.com/nginx/nginx
Language: C
Files changed: src/http/ngx_http_special_response.c
Commit date: 2019-12-23 15:45:46 +0300
Commit message: Discard request body when redirecting to a URL via error_page.

Reported by Bert JW Regeer and Francisco Oca Gonzalez.

Diff: diff --git a/src/http/ngx_http_special_response.c b/src/http/ngx_http_special_response.c
index 4ffb2cc8a..76e670588 100644
--- a/src/http/ngx_http_special_response.c
+++ b/src/http/ngx_http_special_response.c
@@ -621,10 +621,16 @@ ngx_http_send_error_page(ngx_http_request_t *r, ngx_http_err_page_t *err_page)
 
     if (uri.len && uri.data[0] == '@') {
         return ngx_http_named_location(r, &uri);
     }
 
+    r->expect_tested = 1;
+
+    if (ngx_http_discard_request_body(r) != NGX_OK) {
+        r->keepalive = 0;
+    }
+
     location = ngx_list_push(&r->headers_out.headers);
 
     if (location == NULL) {
         return NGX_ERROR;
     }

Fixed code:     r->expect_tested = 1;

    if (ngx_http_discard_request_body(r) != NGX_OK) {
        r->keepalive = 0;
    }
CVE-2024-22200: Insufficient Information (NVD-CWE-noinfo)
value: vantage6-UI is the User Interface for vantage6. The docker image used to run the UI leaks the nginx version. To mitigate the vulnerability, users can run the UI as an angular application.  This vulnerability was patched in 4.2.0.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.3
Published: 2024-01-30T16:15Z
Repository: https://github.com/vantage6/vantage6-UI
Language: Unknown
Commit date: 2024-01-19 14:10:24 +0100
Commit message: Merge pull request from GHSA-8wxq-346h-xmr8

Hide nginx version from the dockerfile headers
CVE-2024-24562: Insufficient Information (NVD-CWE-noinfo)
value: vantage6-UI is the official user interface for the vantage6 server. In affected versions a number of security headers are not set. This issue has been addressed in commit `68dfa6614` which is expected to be included in future releases. Users are advised to upgrade when a new release is made. While an upgrade path is not available users may modify the docker image build to insert the headers into nginx.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-14T19:15Z
Repository: https://github.com/vantage6/vantage6-UI
Language: Unknown
Commit date: 2024-03-07 12:09:47 +0100
Commit message: Merge pull request from GHSA-gwq3-pvwq-4c9w

Added security headers to UI requests
CVE-2022-21189: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: The package dexie before 3.2.2, from 4.0.0-alpha.1 and before 4.0.0-alpha.3 are vulnerable to Prototype Pollution in the Dexie.setByKeyPath(obj, keyPath, value) function which does not properly check the keys being set (like __proto__ or constructor). This can allow an attacker to add/modify properties of the Object.prototype leading to prototype pollution vulnerability. **Note:** This vulnerability can occur in multiple ways, for example when modifying a collection with untrusted user input.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.8
Published: 2022-05-01T16:15Z
Repository: https://github.com/dexie/Dexie.js
Language: TypeScript
Files changed: src/functions/utils.ts
Commit date: 2022-04-27 12:27:20 +0200
Commit message: Prohibit prototype pollution

Diff: diff --git a/src/functions/utils.ts b/src/functions/utils.ts
index da97860..8485c93 100644
--- a/src/functions/utils.ts
+++ b/src/functions/utils.ts
@@ -149,11 +149,11 @@ export function setByKeyPath(obj, keyPath, value) {
                     if (isArray(obj) && !isNaN(parseInt(currentKeyPath))) obj.splice(currentKeyPath, 1);
                     else delete obj[currentKeyPath];
                 } else obj[currentKeyPath] = value;
             else {
                 var innerObj = obj[currentKeyPath];
-                if (!innerObj) innerObj = (obj[currentKeyPath] = {});
+                if (!innerObj || !hasOwn(obj, currentKeyPath)) innerObj = (obj[currentKeyPath] = {});
                 setByKeyPath(innerObj, remainingKeyPath, value);
             }
         } else {
             if (value === undefined) {
                 if (isArray(obj) && !isNaN(parseInt(keyPath))) obj.splice(keyPath, 1);

Vulnerable code:                 if (!innerObj) innerObj = (obj[currentKeyPath] = {});
Fixed code:                 if (!innerObj || !hasOwn(obj, currentKeyPath)) innerObj = (obj[currentKeyPath] = {});
CVE-2017-12424: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors. This crosses a privilege boundary in, for example, certain web-hosting environments in which a Control Panel allows an unprivileged user account to create subaccounts.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2017-08-04T09:29Z
Repository: https://github.com/shadow-maint/shadow
Language: C
Files changed: lib/commonio.c
Commit date: 2017-03-31 16:25:06 +0200
Commit message: Fix buffer overflow if NULL line is present in db.

If ptr->line == NULL for an entry, the first cycle will exit,
but the second one will happily write past entries buffer.
We actually do not want to exit the first cycle prematurely
on ptr->line == NULL.
Signed-off-by: Tomas Mraz <tmraz@fedoraproject.org>

Diff: diff --git a/lib/commonio.c b/lib/commonio.c
index b10da06a..31edbaaf 100644
--- a/lib/commonio.c
+++ b/lib/commonio.c
@@ -749,20 +749,20 @@ commonio_sort (struct commonio_db *db, int (*cmp) (const void *, const void *))
 #endif
 
 	for (ptr = db->head;
 	        (NULL != ptr)
 #if KEEP_NIS_AT_END
-	     && (NULL != ptr->line)
-	     && (   ('+' != ptr->line[0])
-	         && ('-' != ptr->line[0]))
+	     && ((NULL == ptr->line)
+	         || (('+' != ptr->line[0])
+	             && ('-' != ptr->line[0])))
 #endif
 	     ;
 	     ptr = ptr->next) {
 		n++;
 	}
 #if KEEP_NIS_AT_END
-	if ((NULL != ptr) && (NULL != ptr->line)) {
+	if (NULL != ptr) {
 		nis = ptr;
 	}
 #endif
 
 	if (n <= 1) {

Vulnerable code: 	     && (NULL != ptr->line)
	     && (   ('+' != ptr->line[0])
	         && ('-' != ptr->line[0]))
	if ((NULL != ptr) && (NULL != ptr->line)) {
Fixed code: 	     && ((NULL == ptr->line)
	         || (('+' != ptr->line[0])
	             && ('-' != ptr->line[0])))
	if (NULL != ptr) {
CVE-2019-19882: Incorrect Permission Assignment for Critical Resource (CWE-732)
value: shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).
CWE description: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CVSS v3 base score: 7.8
Published: 2019-12-18T16:15Z
Repository: https://github.com/shadow-maint/shadow
Language: Other
Files changed: src/Makefile.am
Commit date: 2019-08-02 18:42:34 -0400
Commit message: Fix failing chmod calls on installation for suidubins

suidubins should be suidusbins, since these binaries are installed
${prefix}/sbin. This historically hasn't broken the build because
chmod of newgidmap/newuidmap succeeds, causing make to think the command
succeeded. Configuring shadow with --with-fcaps removes these final two
entries and exposes the chmod failure to make.

Diff: diff --git a/src/Makefile.am b/src/Makefile.am
index 34690ced..a8c29c91 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -50,17 +50,18 @@ usbin_PROGRAMS = \
 	vipw
 
 # id and groups are from gnu, sulogin from sysvinit
 noinst_PROGRAMS = id sulogin
 
+suidusbins     =
 suidbins       = su
 suidubins      = chage chfn chsh expiry gpasswd newgrp
 if !WITH_TCB
 suidubins += passwd
 endif
 if ACCT_TOOLS_SETUID
-suidubins += chgpasswd chpasswd groupadd groupdel groupmod newusers useradd userdel usermod
+suidusbins += chgpasswd chpasswd groupadd groupdel groupmod newusers useradd userdel usermod
 endif
 if ENABLE_SUBIDS
 if !FCAPS
 suidubins += newgidmap newuidmap
 endif
@@ -132,10 +133,13 @@ install-am: all-am
 		chmod $(suidperms) $(DESTDIR)$(bindir)/$$i; \
 	done
 	for i in $(suidubins); do \
 		chmod $(suidperms) $(DESTDIR)$(ubindir)/$$i; \
 	done
+	for i in $(suidusbins); do \
+		chmod $(suidperms) $(DESTDIR)$(usbindir)/$$i; \
+	done
 if WITH_TCB
 	for i in $(shadowsgidubins); do \
 		chown root:shadow $(DESTDIR)$(ubindir)/$$i; \
 		chmod $(sgidperms) $(DESTDIR)$(ubindir)/$$i; \
 	done

Vulnerable code: suidubins += chgpasswd chpasswd groupadd groupdel groupmod newusers useradd userdel usermod
Fixed code: suidusbins     =
suidusbins += chgpasswd chpasswd groupadd groupdel groupmod newusers useradd userdel usermod
	for i in $(suidusbins); do \
		chmod $(suidperms) $(DESTDIR)$(usbindir)/$$i; \
	done
CVE-2017-20156: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: A vulnerability was found in Exciting Printer and classified as critical. This issue affects some unknown processing of the file lib/printer/jobs/prepare_page.rb of the component Argument Handler. The manipulation of the argument URL leads to command injection. The patch is named 5f8c715d6e2cc000f621a6833f0a86a673462136. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217139.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2022-12-31T10:15Z
Repository: https://github.com/exciting-io/printer
Language: Ruby
Files changed: lib/printer/jobs/prepare_page.rb
Commit date: 2017-07-08 11:32:01 +0100
Commit message: Patch shell injection vulnerability in prepare page

By escaping the URL argument, we prevent arbitrary commands from being
able to be injected there.

Fixes #56

Diff: diff --git a/lib/printer/jobs/prepare_page.rb b/lib/printer/jobs/prepare_page.rb
index 1737e80..d27f958 100644
--- a/lib/printer/jobs/prepare_page.rb
+++ b/lib/printer/jobs/prepare_page.rb
@@ -1,10 +1,11 @@
 require "printer/configuration"
 require "printer/jobs/image_to_bits"
 require "printer/id_generator"
 require "printer/preview"
 require "timeout"
+require "shellwords"
 
 class Printer::Jobs::PreparePage
   def self.queue
     :printer_prepare_page
   end
@@ -34,11 +35,11 @@ class Printer::Jobs::PreparePage
       Printer::Preview.store(id, url, result_data)
     end
   end
 
   def self.save_url_to_path(url, width, path)
-    cmd = "phantomjs rasterise.js #{url} #{width} #{path}"
+    cmd = "phantomjs rasterise.js #{url.shellescape} #{width} #{path}"
     run(cmd)
   end
 
   def self.run(cmd)
     output = ''

Vulnerable code:     cmd = "phantomjs rasterise.js #{url} #{width} #{path}"
Fixed code: require "shellwords"
    cmd = "phantomjs rasterise.js #{url.shellescape} #{width} #{path}"
CVE-2013-3722: Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
value: A Denial of Service (infinite loop) exists in OpenSIPS before 1.10 in lookup.c.
CWE description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CVSS v3 base score: 7.5
Published: 2020-02-17T17:15Z
Repository: https://github.com/OpenSIPS/opensips
Language: C
Files changed: modules/registrar/lookup.c
Commit date: 2013-04-28 16:59:25 +0000
Commit message: backport from 1.9 (rev #9980)
fixed temporary GRUU bug that lead to infinite loop
Credits to Tolga Tarhan



git-svn-id: svn+ssh://svn.code.sf.net/p/opensips/svn/trunk@9982 689a6050-402a-0410-94f2-e92a70836424

Diff: diff --git a/modules/registrar/lookup.c b/modules/registrar/lookup.c
index 0c056960a..d67c71f6a 100644
--- a/modules/registrar/lookup.c
+++ b/modules/registrar/lookup.c
@@ -170,10 +170,11 @@ search_valid_contact:
 					if (it->last_modified > ptr->last_modified) {
 						/* same instance id, but newer modified -> expired GRUU, no match at all */
 						break;
 					}
 			}
+			it=it->next;
 		}
 
 		if (it != NULL) {
 			ret = -1;
 			goto done;

Fixed code: 			it=it->next;
CVE-2023-27596: Allocation of Resources Without Limits or Throttling (CWE-770)
value: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.8 and 3.2.5, OpenSIPS crashes when a malformed SDP body is sent multiple times to an OpenSIPS configuration that makes use of the `stream_process` function. This issue was discovered during coverage guided fuzzing of the function `codec_delete_except_re`. By abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function `codec_delete_except_re`. This issue has been fixed in version 3.1.8 and 3.2.5.
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 7.5
Published: 2023-03-15T21:15Z
Repository: https://github.com/OpenSIPS/opensips
Language: C
Files changed: modules/sipmsgops/codecs.c
Commit date: 2022-03-24 11:42:00 +0200
Commit message: [sipmsgops] fix codec_delete_XX() parsing

Issue discovered during OpenSIPS Security Audit 2021/2022,
by Alfred Farrugia & Sandro Gauci (Enable Security)

https://github.com/OpenSIPS/opensips/security/advisories/GHSA-3ghx-j39m-cw4f

Diff: diff --git a/modules/sipmsgops/codecs.c b/modules/sipmsgops/codecs.c
index 81a276767..e292a81f9 100644
--- a/modules/sipmsgops/codecs.c
+++ b/modules/sipmsgops/codecs.c
@@ -557,11 +557,11 @@ static int stream_process(struct sip_msg * msg, struct sdp_stream_cell *cell,
 					}
 
 					/* when trimming the very last payload, avoid trailing ws */
 					if (cur == lmp->u.value + lmp->len) {
 						tmp = found.s;
-						while (*(--tmp) == ' ') {
+						while (tmp>lmp->u.value && *(--tmp) == ' ') {
 							found.s--;
 							found.len++;
 						}
 					}
 

Vulnerable code: 						while (*(--tmp) == ' ') {
Fixed code: 						while (tmp>lmp->u.value && *(--tmp) == ' ') {
CVE-2023-27598: Use of Uninitialized Resource (CWE-908)
value: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, sending a malformed `Via` header to OpenSIPS triggers a segmentation fault when the function `calc_tag_suffix` is called. A specially crafted `Via` header, which is deemed correct by the parser, will pass uninitialized strings to the function `MD5StringArray` which leads to the crash. Abuse of this vulnerability leads to Denial of Service due to a crash. Since the uninitialized string points to memory location `0x0`, no further exploitation appears to be possible. No special network privileges are required to perform this attack, as long as the OpenSIPS configuration makes use of functions such as `sl_send_reply` or `sl_gen_totag` that trigger the vulnerable code. This issue has been fixed in versions 3.1.7 and 3.2.4.
CWE description: The product uses or accesses a resource that has not been initialized.
CVSS v3 base score: 7.5
Published: 2023-03-15T21:15Z
Repository: https://github.com/OpenSIPS/opensips
Language: C
Files changed: parser/parse_via.c
Commit date: 2021-11-12 16:01:47 +0200
Commit message: [core] fix parse_via() parsing

Issue discovered during OpenSIPS Security Audit 2021,
	by Alfred Farrugia & Sandro Gauci (Enable Security)

https://github.com/OpenSIPS/opensips/security/advisories/GHSA-wxfg-3gwh-rhvx

Diff: diff --git a/parser/parse_via.c b/parser/parse_via.c
index c487ac4b2..e497bb2ba 100644
--- a/parser/parse_via.c
+++ b/parser/parse_via.c
@@ -1802,11 +1802,10 @@ parse_again:
 				}
 			break;
 
 			case ':':
 				switch(state){
-					case F_HOST:
 					case F_IP6HOST:
 						state=P_IP6HOST;
 						break;
 					case P_IP6HOST:
 						break;

Vulnerable code: 					case F_HOST:
CVE-2023-27599: Insufficient Information (NVD-CWE-noinfo)
value: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, when the function `append_hf` handles a SIP message with a malformed To header, a call to the function `abort()` is performed, resulting in a crash. This is due to the following check in `data_lump.c:399` in the function `anchor_lump`. An attacker abusing this vulnerability will crash OpenSIPS leading to Denial of Service. It affects configurations containing functions that make use of the affected code, such as the function `append_hf`. This issue has been fixed in versions 3.1.7 and 3.2.4.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2023-03-15T21:15Z
Repository: https://github.com/OpenSIPS/opensips
Language: C
Files changed: parser/parse_to.c
Commit date: 2021-11-12 14:14:23 +0200
Commit message: [sipmsgops] fix parse_to_param() parsing

Issue discovered during OpenSIPS Security Audit 2021,
	by Alfred Farrugia & Sandro Gauci (Enable Security)

https://github.com/OpenSIPS/opensips/security/advisories/GHSA-qvj2-vqrg-f5jx

Diff: diff --git a/parser/parse_to.c b/parser/parse_to.c
index f8ac0b14f..ba71a3cfe 100644
--- a/parser/parse_to.c
+++ b/parser/parse_to.c
@@ -230,10 +230,12 @@ static inline char* parse_to_param(char *buffer, char *end,
 				break;
 			case '\\':
 				switch (status)
 				{
 					case PARA_VALUE_QUOTED:
+						if (tmp+1==end)
+							goto parse_error;
 						switch (*(tmp+1))
 						{
 							case '\r':
 							case '\n':
 								break;
@@ -451,12 +453,17 @@ static inline char* parse_to_param(char *buffer, char *end,
 						goto error;
 				}
 		}/*switch*/
 	}/*for*/
 
+	if (status==PARA_VALUE_QUOTED) {
+			LM_ERR("unexpected end of header in state %d\n", status);
+			goto parse_error;
+	}
 
 endofheader:
+	LM_DBG("end of header reached, state=%d\n", status);
 	if (param) {
 		if (saved_status==S_EQUAL||saved_status==S_PARA_VALUE) {
 			saved_status = E_PARA_VALUE;
 			param->value.s= 0;
 			param->value.len=0;

Fixed code: 						if (tmp+1==end)
							goto parse_error;
	if (status==PARA_VALUE_QUOTED) {
			LM_ERR("unexpected end of header in state %d\n", status);
			goto parse_error;
	}
	LM_DBG("end of header reached, state=%d\n", status);
CVE-2023-27600: Insufficient Information (NVD-CWE-noinfo)
value: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is received and is processed by the `delete_sdp_line` function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e. `\n`).

The vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions `codec_delete_except_re` and `codec_delete_re`. The same issue was also discovered while performing coverage guided fuzzing on the function `codec_delete_except_re`. The crash happens because the function `delete_sdp_line` expects that an SDP line is terminated by a line feed (`\n`).

By abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function `codec_delete_except_re`. Due to the sanity check that is performed in the `del_lump` function, exploitation of this issue will generate an `abort` in the lumps processing function, resulting in a Denial of Service. This issue is patched in versions 3.1.7 and 3.2.4.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2023-03-15T22:15Z
Repository: https://github.com/OpenSIPS/opensips
Language: C
Files changed: modules/sipmsgops/codecs.c
Commit date: 2021-11-11 17:42:42 +0200
Commit message: [sipmsgops] fix codec_delete_XX() parsing (2)

Issue discovered during OpenSIPS Security Audit 2021,
	by Alfred Farrugia & Sandro Gauci (Enable Security)

https://github.com/OpenSIPS/opensips/security/advisories/GHSA-67w7-g4j8-3wcx

Diff: diff --git a/modules/sipmsgops/codecs.c b/modules/sipmsgops/codecs.c
index fce3e4c5c..81a276767 100644
--- a/modules/sipmsgops/codecs.c
+++ b/modules/sipmsgops/codecs.c
@@ -364,11 +364,12 @@ int delete_sdp_line( struct sip_msg * msg, char * s, struct sdp_stream_cell *str
 		start--;
 	start++;
 
 	while(*end != '\n' && end < (stream->body.s+stream->body.len) )
 		end++;
-	end++;
+	if ( *end == '\n')
+		end++;
 
 	/* delete the entry */
 	if( del_lump(msg, start - msg->buf, end - start,0) == NULL )
 	{
 		return -1;

Vulnerable code: 	end++;
Fixed code: 	if ( *end == '\n')
		end++;
CVE-2023-28097: Integer Overflow or Wraparound (CWE-190)
value: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, a malformed SIP message containing a large _Content-Length_ value and a specially crafted Request-URI causes a segmentation fault in OpenSIPS. This issue occurs when a large amount of shared memory using the `-m` flag was allocated to OpenSIPS, such as 10 GB of RAM. On the test system, this issue occurred when shared memory was set to `2362` or higher. This issue is fixed in versions 3.1.9 and 3.2.6. The only workaround is to guarantee that the Content-Length value of input messages is never larger than `2147483647`.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 7.5
Published: 2023-03-15T23:15Z
Repository: https://github.com/OpenSIPS/opensips
Language: C
Files changed: parser/parse_content.c
Commit date: 2022-03-18 13:57:21 +0200
Commit message: core: Fix Content-Length parsing

Issue discovered during OpenSIPS Security Audit 2022,
        by Alfred Farrugia & Sandro Gauci (Enable Security)

https://github.com/OpenSIPS/opensips/security/advisories/GHSA-c6j5-f4h4-2xrq

Diff: diff --git a/parser/parse_content.c b/parser/parse_content.c
index f7d77a6f3..d105d860b 100644
--- a/parser/parse_content.c
+++ b/parser/parse_content.c
@@ -239,16 +239,18 @@ char* parse_content_length( char* buffer, char* end, int* length)
 		goto error;
 	/* parse the number */
 	size = 0;
 	number = 0;
 	while (p<end && *p>='0' && *p<='9') {
-		number = number*10 + (*p)-'0';
-		if (number<0) {
-			LM_ERR("number overflow at pos %d in len number [%.*s]\n",
+		/* do not actually cause an integer overflow, as it is UB! --liviu */
+		if (number > 214748363) {
+			LM_ERR("integer overflow risk at pos %d in len number [%.*s]\n",
 				(int)(p-buffer),(int)(end-buffer), buffer);
 			return 0;
 		}
+
+		number = number*10 + (*p)-'0';
 		size ++;
 		p++;
 	}
 	if (p==end || size==0)
 		goto error;

Vulnerable code: 		number = number*10 + (*p)-'0';
		if (number<0) {
			LM_ERR("number overflow at pos %d in len number [%.*s]\n",
Fixed code: 		/* do not actually cause an integer overflow, as it is UB! --liviu */
		if (number > 214748363) {
			LM_ERR("integer overflow risk at pos %d in len number [%.*s]\n",

		number = number*10 + (*p)-'0';
CVE-2017-7185: Use After Free (CWE-416)
value: Use-after-free vulnerability in the mg_http_multipart_wait_for_boundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.7 and earlier and Mongoose OS 1.2 and earlier allows remote attackers to cause a denial of service (crash) via a multipart/form-data POST request without a MIME boundary string.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 7.5
Published: 2017-04-10T15:59Z
Repository: https://github.com/cesanta/mongoose
Language: C
Files changed: mongoose.c
Commit date: 2017-04-03 09:25:12 +0000
Commit message: Fix crash in multipart handling

Close cesanta/dev#6974

PUBLISHED_FROM=4d4e4a46eceba10aec8dacb7f8f58bd078c92307

Diff: diff --git a/mongoose.c b/mongoose.c
index 8bc2546..bd95357 100644
--- a/mongoose.c
+++ b/mongoose.c
@@ -5959,10 +5959,16 @@ static int mg_http_multipart_finalize(struct mg_connection *c) {
 static int mg_http_multipart_wait_for_boundary(struct mg_connection *c) {
   const char *boundary;
   struct mbuf *io = &c->recv_mbuf;
   struct mg_http_proto_data *pd = mg_http_get_proto_data(c);
 
+  if (pd->mp_stream.boundary == NULL) {
+    pd->mp_stream.state = MPS_FINALIZE;
+    DBG(("Invalid request: boundary not initilaized"));
+    return 0;
+  }
+
   if ((int) io->len < pd->mp_stream.boundary_len + 2) {
     return 0;
   }
 
   boundary = c_strnstr(io->buf, pd->mp_stream.boundary, io->len);

Fixed code:   if (pd->mp_stream.boundary == NULL) {
    pd->mp_stream.state = MPS_FINALIZE;
    DBG(("Invalid request: boundary not initilaized"));
    return 0;
  }
CVE-2021-4244: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as problematic has been found in yikes-inc-easy-mailchimp-extender Plugin up to 6.8.5. This affects an unknown part of the file admin/partials/ajax/add_field_to_form.php. The manipulation of the argument field_name/merge_tag/field_type/list_id leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 6.8.6 is able to address this issue. The name of the patch is 3662c6593aa1bb4286781214891d26de2e947695. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215307.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-12T14:15Z
Repository: https://github.com/EvanHerman/yikes-inc-easy-mailchimp-extender
Language: Unknown
Commit date: 2021-12-17 15:07:24 -0500
Commit message: Merge pull request #889 from yikesinc/fix/audit

Fix Reflected Cross-Site Scripting issue
CVE-2024-24765: Insufficient Information (NVD-CWE-noinfo)
value: CasaOS-UserService provides user management functionalities to CasaOS. Prior to version 0.4.7, path filtering of the URL for user avatar image files was not strict, making it possible to get any file on the system. This could allow an unauthorized actor to access, for example, the CasaOS user database, and possibly obtain system root privileges. Version 0.4.7 fixes this issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-06T18:15Z
Repository: https://github.com/IceWhaleTech/CasaOS-UserService
Language: Go
Files changed: route/v1/user.go
Commit date: 2024-02-04 11:08:01 +0800
Commit message: Merge pull request from GHSA-h5gf-cmm8-cg7c


Diff: diff --git a/route/v1/user.go b/route/v1/user.go
index bdc352e..21fe0cb 100644
--- a/route/v1/user.go
+++ b/route/v1/user.go
@@ -11,10 +11,11 @@ import (
 	"net/http"
 	url2 "net/url"
 	"os"
 	"path"
 	"path/filepath"
+	"regexp"
 	"strconv"
 	"strings"
 	"time"
 
 	"github.com/IceWhaleTech/CasaOS-Common/utils/common_err"
@@ -665,10 +666,20 @@ func GetUserImage(c *gin.Context) {
 	if !strings.Contains(filePath, config.AppInfo.UserDataPath) {
 		c.JSON(http.StatusNotFound, model.Result{Success: common_err.INSUFFICIENT_PERMISSIONS, Message: common_err.GetMsg(common_err.INSUFFICIENT_PERMISSIONS)})
 		return
 	}
 
+	matched, err := regexp.MatchString(`^/var/lib/casaos/\d`, filePath)
+	if err != nil {
+		c.JSON(http.StatusNotFound, model.Result{Success: common_err.INSUFFICIENT_PERMISSIONS, Message: common_err.GetMsg(common_err.INSUFFICIENT_PERMISSIONS)})
+		return
+	}
+	if !matched {
+		c.JSON(http.StatusNotFound, model.Result{Success: common_err.INSUFFICIENT_PERMISSIONS, Message: common_err.GetMsg(common_err.INSUFFICIENT_PERMISSIONS)})
+		return
+	}
+
 	fileTmp, _ := os.Open(filePath)
 	defer fileTmp.Close()
 
 	fileName := path.Base(filePath)
 

Fixed code: 	"regexp"
	matched, err := regexp.MatchString(`^/var/lib/casaos/\d`, filePath)
	if err != nil {
		c.JSON(http.StatusNotFound, model.Result{Success: common_err.INSUFFICIENT_PERMISSIONS, Message: common_err.GetMsg(common_err.INSUFFICIENT_PERMISSIONS)})
		return
	}
	if !matched {
		c.JSON(http.StatusNotFound, model.Result{Success: common_err.INSUFFICIENT_PERMISSIONS, Message: common_err.GetMsg(common_err.INSUFFICIENT_PERMISSIONS)})
		return
	}
CVE-2024-24766: Insufficient Information (NVD-CWE-noinfo)
value: CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS Login page disclosed the username enumeration vulnerability in the login page. An attacker can enumerate the CasaOS username using the application response. If the username is incorrect application gives the error `**User does not exist**`.  If the password is incorrect application gives the error `**Invalid password**`.  Version 0.4.7 fixes this issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-06T19:15Z
Repository: https://github.com/IceWhaleTech/CasaOS-UserService
Language: Go
Files changed: route/v1/user.go
Commit date: 2024-02-05 14:13:58 +0800
Commit message: Merge pull request from GHSA-c967-2652-gfjm

* fix: fix username enumeration

* fix typo msg type

* fix: recovery error patch

* fix: recovery error patch

---------

Signed-off-by: CorrectRoadH <a778917369@gmail.com>
Diff: diff --git a/route/v1/user.go b/route/v1/user.go
index 87e0077..90a7c01 100644
--- a/route/v1/user.go
+++ b/route/v1/user.go
@@ -114,11 +114,11 @@ func PostUserLogin(c *gin.Context) {
 			model.Result{Success: common_err.USER_NOT_EXIST, Message: common_err.GetMsg(common_err.USER_NOT_EXIST)})
 		return
 	}
 	if user.Password != encryption.GetMD5ByStr(password) {
 		c.JSON(common_err.CLIENT_ERROR,
-			model.Result{Success: common_err.PWD_INVALID, Message: common_err.GetMsg(common_err.PWD_INVALID)})
+			model.Result{Success: common_err.USER_NOT_EXIST_OR_PWD_INVALID, Message: common_err.GetMsg(common_err.USER_NOT_EXIST_OR_PWD_INVALID)})
 		return
 	}
 
 	privateKey, _ := service.MyService.User().GetKeyPair()
 
@@ -256,11 +256,11 @@ func PutUserInfo(c *gin.Context) {
 	json := model2.UserDBModel{}
 	c.ShouldBind(&json)
 	user := service.MyService.User().GetUserInfoById(id)
 	if user.Id == 0 {
 		c.JSON(common_err.SERVICE_ERROR,
-			model.Result{Success: common_err.USER_NOT_EXIST, Message: common_err.GetMsg(common_err.USER_NOT_EXIST)})
+			model.Result{Success: common_err.USER_NOT_EXIST_OR_PWD_INVALID, Message: common_err.GetMsg(common_err.USER_NOT_EXIST_OR_PWD_INVALID)})
 		return
 	}
 	if len(json.Username) > 0 {
 		u := service.MyService.User().GetUserInfoByUserName(json.Username)
 		if u.Id > 0 {

Vulnerable code: 			model.Result{Success: common_err.PWD_INVALID, Message: common_err.GetMsg(common_err.PWD_INVALID)})
			model.Result{Success: common_err.USER_NOT_EXIST, Message: common_err.GetMsg(common_err.USER_NOT_EXIST)})
Fixed code: 			model.Result{Success: common_err.USER_NOT_EXIST_OR_PWD_INVALID, Message: common_err.GetMsg(common_err.USER_NOT_EXIST_OR_PWD_INVALID)})
			model.Result{Success: common_err.USER_NOT_EXIST_OR_PWD_INVALID, Message: common_err.GetMsg(common_err.USER_NOT_EXIST_OR_PWD_INVALID)})
CVE-2024-28232: Insufficient Information (NVD-CWE-noinfo)
value: Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in version 0.4.7. This issue in CVE-2024-28232 has been patched in version 0.4.8 but that version has not yet been uploaded to Go's package manager.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-01T17:15Z
Repository: https://github.com/IceWhaleTech/CasaOS-UserService
Language: Go
Files changed: route/v1/user.go
Commit date: 2024-03-12 18:17:46 +0800
Commit message: Merge pull request from GHSA-hcw2-2r9c-gc6p


Diff: diff --git a/route/v1/user.go b/route/v1/user.go
index c19d833..fcc2005 100644
--- a/route/v1/user.go
+++ b/route/v1/user.go
@@ -123,11 +123,11 @@ func PostUserLogin(c *gin.Context) {
 		return
 	}
 	user := service.MyService.User().GetUserAllInfoByName(username)
 	if user.Id == 0 {
 		c.JSON(common_err.CLIENT_ERROR,
-			model.Result{Success: common_err.USER_NOT_EXIST, Message: common_err.GetMsg(common_err.USER_NOT_EXIST)})
+			model.Result{Success: common_err.USER_NOT_EXIST_OR_PWD_INVALID, Message: common_err.GetMsg(common_err.USER_NOT_EXIST_OR_PWD_INVALID)})
 		return
 	}
 	if user.Password != encryption.GetMD5ByStr(password) {
 		c.JSON(common_err.CLIENT_ERROR,
 			model.Result{Success: common_err.USER_NOT_EXIST_OR_PWD_INVALID, Message: common_err.GetMsg(common_err.USER_NOT_EXIST_OR_PWD_INVALID)})

Vulnerable code: 			model.Result{Success: common_err.USER_NOT_EXIST, Message: common_err.GetMsg(common_err.USER_NOT_EXIST)})
Fixed code: 			model.Result{Success: common_err.USER_NOT_EXIST_OR_PWD_INVALID, Message: common_err.GetMsg(common_err.USER_NOT_EXIST_OR_PWD_INVALID)})
CVE-2024-34083: Insufficient Information (NVD-CWE-noinfo)
value: aiosmptd is  a reimplementation of the Python stdlib smtpd.py based on asyncio. Prior to version 1.4.6, servers based on aiosmtpd accept extra unencrypted commands after STARTTLS, treating them as if they came from inside the encrypted connection. This could be exploited by a man-in-the-middle attack. Version 1.4.6 contains a patch for the issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-18T19:15Z
Repository: https://github.com/aio-libs/aiosmtpd
Language: Python
Files changed: aiosmtpd/docs/NEWS.rst, aiosmtpd/smtp.py
Commit date: 2024-05-18 12:07:13 +0100
Commit message: starttls: Clear unencrypted commands from buffer (#380)


Diff: diff --git a/aiosmtpd/docs/NEWS.rst b/aiosmtpd/docs/NEWS.rst
index 7cc773c..e0b2281 100644
--- a/aiosmtpd/docs/NEWS.rst
+++ b/aiosmtpd/docs/NEWS.rst
@@ -2,10 +2,14 @@
  NEWS for aiosmtpd
 ###################
 
 .. towncrier release notes start
 
+1.4.6 (2024-05-06)
+==================
+
+* STARTTLS is now fully enforced if used.
 
 1.4.5 (2024-03-02)
 ==================
 
 * Fixed incorrect handling of newlines.
diff --git a/aiosmtpd/smtp.py b/aiosmtpd/smtp.py
index c6605a5..3b85fcf 100644
--- a/aiosmtpd/smtp.py
+++ b/aiosmtpd/smtp.py
@@ -502,10 +502,13 @@ class SMTP(asyncio.StreamReaderProtocol):
         if self.transport is not None and seen_starttls:
             # It is STARTTLS connection over normal connection.
             self._reader._transport = transport  # type: ignore[attr-defined]
             self._writer._transport = transport  # type: ignore[attr-defined]
             self.transport = transport
+            # Discard any leftover unencrypted data
+            # See https://tools.ietf.org/html/rfc3207#page-7
+            self._reader._buffer.clear()  # type: ignore[attr-defined]
             # Do SSL certificate checking as rfc3207 part 4.1 says.  Why is
             # _extra a protected attribute?
             assert self._tls_protocol is not None
             self.session.ssl = self._tls_protocol._extra
             hook = self._handle_hooks.get("STARTTLS")

Fixed code: 1.4.6 (2024-05-06)
==================

* STARTTLS is now fully enforced if used.
            # Discard any leftover unencrypted data
            # See https://tools.ietf.org/html/rfc3207#page-7
            self._reader._buffer.clear()  # type: ignore[attr-defined]