Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2022-25927: Inefficient Regular Expression Complexity (CWE-1333)
value: Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2023-01-26T21:15Z
Repository: https://github.com/faisalman/ua-parser-js
Language: JavaScript
Files changed: src/ua-parser.js
Commit date: 2023-01-22 22:19:45 +0700
Commit message: Remove unsafe regex in trim() function

`trim()` function contains a regular expression that is vulnerable to ReDoS but was uncaught by `safe-regex` module.

Diff: diff --git a/src/ua-parser.js b/src/ua-parser.js
index b050833..9e3c715 100755
--- a/src/ua-parser.js
+++ b/src/ua-parser.js
@@ -91,11 +91,11 @@
         majorize = function (version) {
             return typeof(version) === STR_TYPE ? version.replace(/[^\d\.]/g, EMPTY).split('.')[0] : undefined;
         },
         trim = function (str, len) {
             if (typeof(str) === STR_TYPE) {
-                str = str.replace(/^\s\s*/, EMPTY).replace(/\s\s*$/, EMPTY);
+                str = str.replace(/^\s\s*/, EMPTY);
                 return typeof(len) === UNDEF_TYPE ? str : str.substring(0, UA_MAX_LENGTH);
             }
     };
 
     ///////////////

Vulnerable code:                 str = str.replace(/^\s\s*/, EMPTY).replace(/\s\s*$/, EMPTY);
Fixed code:                 str = str.replace(/^\s\s*/, EMPTY);
CVE-2020-5390: Improper Verification of Cryptographic Signature (CWE-347)
value: PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping (XSW). The signature information and the node/object that is signed can be in different places and thus the signature verification will succeed, but the wrong data will be used. This specifically affects the verification of assertion that have been signed.
CWE description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CVSS v3 base score: 7.5
Published: 2020-01-13T19:15Z
Repository: https://github.com/IdentityPython/pysaml2
Language: Other
Files changed: CHANGELOG.md, VERSION
Commit date: 2020-01-13 11:37:28 +0200
Commit message: Release version 5.0.0

Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index a07c0c76..2afba34a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,7 +1,28 @@
 # Changelog
 
+## 5.0.0 (2020-01-13)
+
+- Fix XML Signature Wrapping (XSW) vulnerabilities - CVE-2020-5390
+- Add freshness period feature for MetaDataMDX
+- Fix bug in duration calculation in time_util library
+- Fix ipv6 validation to accommodate for addresses with brackets
+- Fix xmlsec temporary files deletions
+- Add method to get supported algorithms from metadata
+- Add mdstore method to extract assurance certifications
+- Add mdstore method to extract contact_person data
+- Add attribute mappings from the Swiss eduPerson Schema
+- Make AESCipher and Fernet interfaces compatible
+- Remove deprecated saml2.aes module
+- Remove deprecated saml2.extensions.ui module
+- Replace deprecated mongodb operations
+- Rename ToOld error to TooOld
+- Fix pytest warnings
+- Mock tests that need a network connection
+- Start dropping python2 support
+
+
 ## 4.9.0 (2019-11-03)
 
 - Add mdstore methods to extract mdui uiinfo elements
 - Add attribute mapping for umbrellaID attributes
 - Fix logic error in pick_binding method for Entity class
diff --git a/VERSION b/VERSION
index 6ed7776b..0062ac97 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-4.9.0
+5.0.0

Vulnerable code: 4.9.0
Fixed code: ## 5.0.0 (2020-01-13)

- Fix XML Signature Wrapping (XSW) vulnerabilities - CVE-2020-5390
- Add freshness period feature for MetaDataMDX
- Fix bug in duration calculation in time_util library
- Fix ipv6 validation to accommodate for addresses with brackets
- Fix xmlsec temporary files deletions
- Add method to get supported algorithms from metadata
- Add mdstore method to extract assurance certifications
- Add mdstore method to extract contact_person data
- Add attribute mappings from the Swiss eduPerson Schema
- Make AESCipher and Fernet interfaces compatible
- Remove deprecated saml2.aes module
- Remove deprecated saml2.extensions.ui module
- Replace deprecated mongodb operations
- Rename ToOld error to TooOld
- Fix pytest warnings
- Mock tests that need a network connection
- Start dropping python2 support


5.0.0
CVE-2021-21238: Improper Verification of Cryptographic Signature (CWE-347)
value: PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is a variant of XML Signature wrapping because it did not validate the SAML document against an XML schema. This allowed invalid XML documents to be processed and such a document can trick pysaml2 with a wrapped signature. This is fixed in PySAML2 6.5.0.
CWE description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CVSS v3 base score: 6.5
Published: 2021-01-21T15:15Z
Repository: https://github.com/IdentityPython/pysaml2
Language: Unknown
Commit date: 2021-01-20 14:34:45 +0200
Commit message: Merge pull request from GHSA-f4g9-h89h-jgv9

Validate XML documents before verifying the signature
CVE-2021-21239: Improper Verification of Cryptographic Signature (CWE-347)
value: PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. Users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. PySAML2 does not ensure that a signed SAML document is correctly signed. The default CryptoBackendXmlSec1 backend is using the xmlsec1 binary to verify the signature of signed SAML documents, but by default xmlsec1 accepts any type of key found within the given document. xmlsec1 needs to be configured explicitly to only use only _x509 certificates_ for the verification process of the SAML document signature. This is fixed in PySAML2 6.5.0.
CWE description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CVSS v3 base score: 6.5
Published: 2021-01-21T15:15Z
Repository: https://github.com/IdentityPython/pysaml2
Language: Unknown
Commit date: 2021-01-20 14:33:19 +0200
Commit message: Merge pull request from GHSA-5p3x-r448-pc62

Restrict the key data that xmlsec1 accepts to only x509 certs
CVE-2021-41246: Session Fixation (CWE-384)
value: Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including `2.5.1` do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities. Versions `2.5.2` contains a patch for this issue.
CWE description: Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
CVSS v3 base score: 8.8
Published: 2021-12-09T16:15Z
Repository: https://github.com/auth0/express-openid-connect
Language: Unknown
Commit date: 2021-12-09 09:10:57 +0000
Commit message: Merge pull request from GHSA-7rg2-qxmf-hhx9

Advisory fix 1
CVE-2020-36403: Out-of-bounds Write (CWE-787)
value: HTSlib through 1.10.2 allows out-of-bounds write access in vcf_parse_format (called from vcf_parse and vcf_read).
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2021-07-01T03:15Z
Repository: https://github.com/samtools/htslib
Language: C
Files changed: vcf.c
Commit date: 2020-07-15 09:26:33 +0100
Commit message: Fix check for VCF record size

The check for excessive record size in vcf_parse_format() only
looked at individual fields.  It was therefore possible to
exceed the limit and overflow fmt_aux_t::offset by having
multiple fields with a combined size that went over INT_MAX.
Fix by including the amount of memory used so far in the check.

Credit to OSS-Fuzz
Fixes oss-fuzz 24097

Diff: diff --git a/vcf.c b/vcf.c
index 80376ab..c96eba1 100644
--- a/vcf.c
+++ b/vcf.c
@@ -2352,20 +2352,21 @@ static int vcf_parse_format(kstring_t *s, const bcf_hdr_t *h, bcf1_t *v, char *p
         if (align_mem(mem) < 0) {
             hts_log_error("Memory allocation failure at %s:%"PRIhts_pos, bcf_seqname_safe(h,v), v->pos+1);
             v->errcode |= BCF_ERR_LIMITS;
             return -1;
         }
-        f->offset = mem->l;
 
         // Limit the total memory to ~2Gb per VCF row.  This should mean
         // malformed VCF data is less likely to take excessive memory and/or
         // time.
-        if (v->n_sample * (uint64_t)f->size > INT_MAX) {
+        if ((uint64_t) mem->l + v->n_sample * (uint64_t)f->size > INT_MAX) {
             hts_log_error("Excessive memory required by FORMAT fields at %s:%"PRIhts_pos, bcf_seqname_safe(h,v), v->pos+1);
             v->errcode |= BCF_ERR_LIMITS;
             return -1;
         }
+
+        f->offset = mem->l;
         if (ks_resize(mem, mem->l + v->n_sample * (size_t)f->size) < 0) {
             hts_log_error("Memory allocation failure at %s:%"PRIhts_pos, bcf_seqname_safe(h,v), v->pos+1);
             v->errcode |= BCF_ERR_LIMITS;
             return -1;
         }

Vulnerable code:         f->offset = mem->l;
        if (v->n_sample * (uint64_t)f->size > INT_MAX) {
Fixed code:         if ((uint64_t) mem->l + v->n_sample * (uint64_t)f->size > INT_MAX) {

        f->offset = mem->l;
CVE-2018-10937: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A cross site scripting flaw exists in the tetonic-console component of Openshift Container Platform 3.11. An attacker with the ability to create pods can use this flaw to perform actions on the K8s API as the victim.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2018-09-11T16:29Z
Repository: https://github.com/openshift/console
Language: Unknown
Commit date: 2018-08-27 12:49:52 -0700
Commit message: Merge pull request #461 from spadgett/proxy

Bug 1622372 - Require CSRF token on all proxied requests
CVE-2023-37457: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk versions 18.20.0 and prior, 20.5.0 and prior, and 21.0.0; as well as ceritifed-asterisk 18.9-cert5 and prior, the 'update' functionality of the PJSIP_HEADER dialplan function can exceed the available buffer space for storing the new value of a header. By doing so this can overwrite memory or cause a crash. This is not externally exploitable, unless dialplan is explicitly written to update a header based on data from an outside source. If the 'update' functionality is not used the vulnerability does not occur. A patch is available at commit a1ca0268254374b515fa5992f01340f7717113fa.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 8.2
Published: 2023-12-14T20:15Z
Repository: https://github.com/asterisk/asterisk
Language: C
Files changed: res/res_pjsip_header_funcs.c
Commit date: 2023-12-14 18:48:45 +0000
Commit message: res_pjsip_header_funcs: Duplicate new header value, don't copy.

When updating an existing header the 'update' code incorrectly
just copied the new value into the existing buffer. If the
new value exceeded the available buffer size memory outside
of the buffer would be written into, potentially causing
a crash.

This change makes it so that the 'update' now duplicates
the new header value instead of copying it into the existing
buffer.

Diff: diff --git a/res/res_pjsip_header_funcs.c b/res/res_pjsip_header_funcs.c
index 6909a53b4..3272d18c0 100644
--- a/res/res_pjsip_header_funcs.c
+++ b/res/res_pjsip_header_funcs.c
@@ -674,10 +674,11 @@ static int add_header(void *obj)
  * Add the entry to the list.
  */
 static int update_header(void *obj)
 {
 	struct header_data *data = obj;
+	pj_pool_t *pool = data->channel->session->inv_session->dlg->pool;
 	pjsip_hdr *hdr = NULL;
 	RAII_VAR(struct ast_datastore *, datastore,
 			 ast_sip_session_get_datastore(data->channel->session, data->header_datastore->type),
 			 ao2_cleanup);
 
@@ -692,11 +693,11 @@ static int update_header(void *obj)
 	if (!hdr) {
 		ast_log(AST_LOG_ERROR, "There was no header named %s.\n", data->header_name);
 		return -1;
 	}
 
-	pj_strcpy2(&((pjsip_generic_string_hdr *) hdr)->hvalue, data->header_value);
+	pj_strdup2(pool, &((pjsip_generic_string_hdr *) hdr)->hvalue, data->header_value);
 
 	return 0;
 }
 
 /*!

Vulnerable code: 	pj_strcpy2(&((pjsip_generic_string_hdr *) hdr)->hvalue, data->header_value);
Fixed code: 	pj_pool_t *pool = data->channel->session->inv_session->dlg->pool;
	pj_strdup2(pool, &((pjsip_generic_string_hdr *) hdr)->hvalue, data->header_value);
CVE-2021-3766: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: objection.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.8
Published: 2021-09-06T12:15Z
Repository: https://github.com/Vincit/objection.js
Language: JavaScript
Files changed: lib/utils/objectUtils.js
Commit date: 2021-09-15 15:57:55 +0300
Commit message: Security Fix for Prototype Pollution

Fix prototype pollution when path components are not strings
Diff: diff --git a/lib/utils/objectUtils.js b/lib/utils/objectUtils.js
index d7e90853..9930eaf4 100644
--- a/lib/utils/objectUtils.js
+++ b/lib/utils/objectUtils.js
@@ -223,10 +223,13 @@ function get(obj, path) {
 function set(obj, path, value) {
   const inputObj = obj;
 
   for (let i = 0, l = path.length - 1; i < l; ++i) {
     const key = path[i];
+    if (key === '__proto__') {
+      return false;
+    }
     let child = obj[key];
 
     if (!isObject(child)) {
       const nextKey = path[i + 1];
 
@@ -250,11 +253,14 @@ function set(obj, path, value) {
 }
 
 function zipObject(keys, values) {
   const out = {};
 
-  for (let i = 0, l = keys.length; i < l; ++i) {
+  for (let i = 0, l = keys.length; i < l; ++i) {    
+    if (keys[i] === '__proto__') {
+      return false;
+    }
     out[keys[i]] = values[i];
   }
 
   return out;
 }

Vulnerable code:   for (let i = 0, l = keys.length; i < l; ++i) {
Fixed code:     if (key === '__proto__') {
      return false;
    }
  for (let i = 0, l = keys.length; i < l; ++i) {    
    if (keys[i] === '__proto__') {
      return false;
    }
CVE-2023-0055: Cleartext Transmission of Sensitive Information (CWE-319)
value: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32.
CWE description: The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
CVSS v3 base score: 5.3
Published: 2023-01-04T22:15Z
Repository: https://github.com/pyload/pyload
Language: Python
Files changed: src/pyload/webui/app/__init__.py
Commit date: 2023-01-04 22:47:25 +0200
Commit message: Set 'Secure' Attribute in session cookie

Diff: diff --git a/src/pyload/webui/app/__init__.py b/src/pyload/webui/app/__init__.py
index 5fa4bf085..3441f5bab 100644
--- a/src/pyload/webui/app/__init__.py
+++ b/src/pyload/webui/app/__init__.py
@@ -76,11 +76,11 @@ class App:
 
         os.makedirs(cache_path, exist_ok=True)
 
         app.create_jinja_environment()
 
-        # NOTE: enable autoescape for all file extensions (included .js)
+        # NOTE: enable auto escape for all file extensions (including .js)
         #       maybe this will break .txt rendering, but we don't render this kind of files actually
         #       that does not change 'default_for_string=False' (by default)
         app.jinja_env.autoescape = jinja2.select_autoescape(default=True)
         app.jinja_env.bytecode_cache = jinja2.FileSystemBytecodeCache(cache_path)
 
@@ -100,10 +100,11 @@ class App:
         os.makedirs(cache_path, exist_ok=True)
 
         app.config["SESSION_FILE_DIR"] = cache_path
         app.config["SESSION_TYPE"] = "filesystem"
         app.config["SESSION_COOKIE_NAME"] = "pyload_session"
+        app.config["SESSION_COOKIE_SECURE"] = app.config["PYLOAD_API"].get_config_value("webui", "use_ssl")
         app.config["SESSION_PERMANENT"] = False
 
         session_lifetime = max(app.config["PYLOAD_API"].get_config_value("webui", "session_lifetime"), 1) * 60
         app.config["PERMANENT_SESSION_LIFETIME"] = session_lifetime
 

Vulnerable code:         # NOTE: enable autoescape for all file extensions (included .js)
Fixed code:         # NOTE: enable auto escape for all file extensions (including .js)
        app.config["SESSION_COOKIE_SECURE"] = app.config["PYLOAD_API"].get_config_value("webui", "use_ssl")
CVE-2023-0057: Improper Restriction of Rendered UI Layers or Frames (CWE-1021)
value: Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33.
CWE description: The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
CVSS v3 base score: 6.1
Published: 2023-01-05T01:15Z
Repository: https://github.com/pyload/pyload
Language: Python
Files changed: src/pyload/webui/app/__init__.py
Commit date: 2023-01-05 01:28:27 +0200
Commit message: Add X-Frame-Options: DENY header

Diff: diff --git a/src/pyload/webui/app/__init__.py b/src/pyload/webui/app/__init__.py
index 3441f5bab..ffdc15eeb 100644
--- a/src/pyload/webui/app/__init__.py
+++ b/src/pyload/webui/app/__init__.py
@@ -58,15 +58,20 @@ class App:
             theme.init_app(app, path_prefix)
 
     @classmethod
     def _configure_handlers(cls, app):
         """
-        Register error handlers.
+        Register app handlers.
         """
         for exc, fn in cls.FLASK_ERROR_HANDLERS:
             app.register_error_handler(exc, fn)
 
+        @app.after_request
+        def deny_iframe(response):
+            response.headers["X-Frame-Options"] = "DENY"
+            return response
+
     @classmethod
     def _configure_json_encoding(cls, app):
         app.json_encoder = JSONEncoder
 
     @classmethod

Vulnerable code:         Register error handlers.
Fixed code:         Register app handlers.
        @app.after_request
        def deny_iframe(response):
            response.headers["X-Frame-Options"] = "DENY"
            return response
CVE-2023-0297: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2023-01-14T03:15Z
Repository: https://github.com/pyload/pyload
Language: Python
Files changed: src/pyload/core/utils/misc.py
Commit date: 2023-01-03 22:56:42 +0200
Commit message: fix arbitrary python code execution by abusing js2py functionality

Diff: diff --git a/src/pyload/core/utils/misc.py b/src/pyload/core/utils/misc.py
index 0c8f02dde6..6d2f23cc5e 100644
--- a/src/pyload/core/utils/misc.py
+++ b/src/pyload/core/utils/misc.py
@@ -1,14 +1,13 @@
 # -*- coding: utf-8 -*-
 
 import random
-import socket
 import string
 
 import js2py
 
-from .check import is_mapping
+js2py.disable_pyimport()
 
 
 def random_string(length):
     seq = string.ascii_letters + string.digits + string.punctuation
     return "".join(random.choice(seq) for _ in range(length))

Vulnerable code: import socket
from .check import is_mapping
Fixed code: js2py.disable_pyimport()
CVE-2023-0434: Improper Input Validation (CWE-20)
value: Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2023-01-22T01:15Z
Repository: https://github.com/pyload/pyload
Language: Python
Files changed: src/pyload/core/config/parser.py
Commit date: 2023-01-22 01:14:49 +0200
Commit message: validate time config values

Diff: diff --git a/src/pyload/core/config/parser.py b/src/pyload/core/config/parser.py
index ce31142d73..6410faa861 100644
--- a/src/pyload/core/config/parser.py
+++ b/src/pyload/core/config/parser.py
@@ -277,19 +277,36 @@ class ConfigParser:
         elif typ == "bool":
             value = "" if value is None else str(value)
             return value.lower() in ("1", "true", "on", "yes", "y")
 
         elif typ == "time":
+            default_value = "0:00"
             value = "" if value is None else str(value)
             if not value:
-                value = "0:00"
-            if ":" not in value:
+                value = default_value
+            elif ":" not in value:
                 value += ":00"
+
+            hours, seconds = value.split(":", 1)
+            if (
+                hours.isnumeric()
+                and seconds.isnumeric()
+                and 0 <= int(hours) <= 23
+                and 0 <= int(seconds) <= 59
+            ):
+                pass
+            else:
+                value = default_value
+
             return value
 
         elif typ in ("file", "folder"):
-            return "" if value in (None, "") else os.path.realpath(os.path.expanduser(os.fsdecode(value)))
+            return (
+                ""
+                if value in (None, "")
+                else os.path.realpath(os.path.expanduser(os.fsdecode(value)))
+            )
 
         else:
             return value
 
     def save(self):

Vulnerable code:                 value = "0:00"
            if ":" not in value:
            return "" if value in (None, "") else os.path.realpath(os.path.expanduser(os.fsdecode(value)))
Fixed code:             default_value = "0:00"
                value = default_value
            elif ":" not in value:

            hours, seconds = value.split(":", 1)
            if (
                hours.isnumeric()
                and seconds.isnumeric()
                and 0 <= int(hours) <= 23
                and 0 <= int(seconds) <= 59
            ):
                pass
            else:
                value = default_value

            return (
                ""
                if value in (None, "")
                else os.path.realpath(os.path.expanduser(os.fsdecode(value)))
            )
CVE-2024-22416: Cross-Site Request Forgery (CSRF) (CWE-352)
value: pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery (CSRF) attack. As a result any API call can be made via a CSRF attack by an unauthenticated user. This issue has been addressed in release `0.5.0b3.dev78`. All users are advised to upgrade.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2024-01-18T00:15Z
Repository: https://github.com/pyload/pyload
Language: Python
Files changed: src/pyload/webui/app/__init__.py
Commit date: 2024-01-18 01:11:24 +0200
Commit message: fix GHSA-pgpj-v85q-h5fm security advisory (2)

Diff: diff --git a/src/pyload/webui/app/__init__.py b/src/pyload/webui/app/__init__.py
index 7f4ecf016e..3e2933f0ec 100644
--- a/src/pyload/webui/app/__init__.py
+++ b/src/pyload/webui/app/__init__.py
@@ -110,11 +110,11 @@ class App:
         os.makedirs(cache_path, exist_ok=True)
 
         app.config["SESSION_FILE_DIR"] = cache_path
         app.config["SESSION_TYPE"] = "filesystem"
         app.config["SESSION_COOKIE_NAME"] = "pyload_session"
-        app.config["SESSION_COOKIE_SAMESITE"] = "None"
+        app.config["SESSION_COOKIE_SAMESITE"] = "Strict"
         app.config["SESSION_COOKIE_SECURE"] = app.config["PYLOAD_API"].get_config_value("webui", "use_ssl")
         app.config["SESSION_PERMANENT"] = False
 
         session_lifetime = max(app.config["PYLOAD_API"].get_config_value("webui", "session_lifetime"), 1) * 60
         app.config["PERMANENT_SESSION_LIFETIME"] = session_lifetime

Vulnerable code:         app.config["SESSION_COOKIE_SAMESITE"] = "None"
Fixed code:         app.config["SESSION_COOKIE_SAMESITE"] = "Strict"
CVE-2024-22416: Cross-Site Request Forgery (CSRF) (CWE-352)
value: pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery (CSRF) attack. As a result any API call can be made via a CSRF attack by an unauthenticated user. This issue has been addressed in release `0.5.0b3.dev78`. All users are advised to upgrade.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2024-01-18T00:15Z
Repository: https://github.com/pyload/pyload
Language: Other
Files changed: setup.cfg, src/pyload/webui/app/__init__.py
Commit date: 2024-01-18 00:56:58 +0200
Commit message: fix GHSA-pgpj-v85q-h5fm security advisory

Diff: diff --git a/setup.cfg b/setup.cfg
index 85c7e1ac7f..109cb4e429 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -64,17 +64,16 @@ packages = find:
 include_package_data = True
 package_dir =
     = src
 install_requires =
     Cheroot~=8.4
-    Flask;python_version<"3.8"
-    Flask~=2.3.0;python_version>="3.8"
+    Flask
     Flask-Babel~=1.0
     Flask-Caching~=1.9
     Flask-Compress~=1.8
-    Flask-Session~=0.3;python_version<"3.7"
-    Flask-Session2~=1.3;python_version>="3.7"
+    Flask-Session~=0.4.1;python_version<"3.7"
+    Flask-Session;python_version>="3.7"
     Flask-Themes2~=1.0
     bitmath~=1.3
     cryptography>=35.0.0;platform_python_implementation!="PyPy"
     cryptography>=35.0.0,<40.0.0;platform_python_implementation=='PyPy'
     filetype~=1.0
diff --git a/src/pyload/webui/app/__init__.py b/src/pyload/webui/app/__init__.py
index 2c9226b1cc..7f4ecf016e 100644
--- a/src/pyload/webui/app/__init__.py
+++ b/src/pyload/webui/app/__init__.py
@@ -110,10 +110,11 @@ class App:
         os.makedirs(cache_path, exist_ok=True)
 
         app.config["SESSION_FILE_DIR"] = cache_path
         app.config["SESSION_TYPE"] = "filesystem"
         app.config["SESSION_COOKIE_NAME"] = "pyload_session"
+        app.config["SESSION_COOKIE_SAMESITE"] = "None"
         app.config["SESSION_COOKIE_SECURE"] = app.config["PYLOAD_API"].get_config_value("webui", "use_ssl")
         app.config["SESSION_PERMANENT"] = False
 
         session_lifetime = max(app.config["PYLOAD_API"].get_config_value("webui", "session_lifetime"), 1) * 60
         app.config["PERMANENT_SESSION_LIFETIME"] = session_lifetime

Vulnerable code:     Flask;python_version<"3.8"
    Flask~=2.3.0;python_version>="3.8"
    Flask-Session~=0.3;python_version<"3.7"
    Flask-Session2~=1.3;python_version>="3.7"
Fixed code:     Flask
    Flask-Session~=0.4.1;python_version<"3.7"
    Flask-Session;python_version>="3.7"
        app.config["SESSION_COOKIE_SAMESITE"] = "None"
CVE-2023-33955: Insufficient Information (NVD-CWE-noinfo)
value: Minio Console is the UI for MinIO Object Storage. Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. This issue has been patched in version 0.28.0.


CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.3
Published: 2023-05-30T07:15Z
Repository: https://github.com/minio/console
Language: Other
Files changed: portal-ui/src/common/utils.ts, portal-ui/src/screens/Console/Buckets/ListBuckets/Objects/ListObjects/IconWithLabel.tsx
Commit date: 2023-05-23 09:47:12 -0600
Commit message: Replace RIGHT-TO-LEFT OVERRIDE unicode (#2828)

Signed-off-by: Daniel Valdivia <18384552+dvaldivia@users.noreply.github.com>
Diff: diff --git a/portal-ui/src/common/utils.ts b/portal-ui/src/common/utils.ts
index a253cf10..1d463b38 100644
--- a/portal-ui/src/common/utils.ts
+++ b/portal-ui/src/common/utils.ts
@@ -710,5 +710,11 @@ export const getRandomString = function (length = 16): string {
     retval +=
       legalcharacters[Math.floor(Math.random() * legalcharacters.length)];
   }
   return retval;
 };
+
+// replaces bad unicode characters
+export const replaceUnicodeChar = (inputString: string): string => {
+  let unicodeChar = "\u202E";
+  return inputString.split(unicodeChar).join("<�202e>");
+};
diff --git a/portal-ui/src/screens/Console/Buckets/ListBuckets/Objects/ListObjects/IconWithLabel.tsx b/portal-ui/src/screens/Console/Buckets/ListBuckets/Objects/ListObjects/IconWithLabel.tsx
index c334d554..34e7b4df 100644
--- a/portal-ui/src/screens/Console/Buckets/ListBuckets/Objects/ListObjects/IconWithLabel.tsx
+++ b/portal-ui/src/screens/Console/Buckets/ListBuckets/Objects/ListObjects/IconWithLabel.tsx
@@ -1,9 +1,10 @@
 import React from "react";
 import createStyles from "@mui/styles/createStyles";
 import withStyles from "@mui/styles/withStyles";
 import { Theme } from "@mui/material/styles";
+import { replaceUnicodeChar } from "../../../../../../common/utils";
 
 interface IIconWithLabel {
   classes: any;
   icon: JSX.Element;
   strings: string[];
@@ -32,11 +33,11 @@ const styles = (theme: Theme) =>
 const IconWithLabel = ({ classes, icon, strings }: IIconWithLabel) => {
   return (
     <div className={classes.fileName}>
       {icon}
       <span className={classes.fileNameText}>
-        {strings[strings.length - 1]}
+        {replaceUnicodeChar(strings[strings.length - 1])}
       </span>
     </div>
   );
 };
 

Vulnerable code:         {strings[strings.length - 1]}
Fixed code: 
// replaces bad unicode characters
export const replaceUnicodeChar = (inputString: string): string => {
  let unicodeChar = "\u202E";
  return inputString.split(unicodeChar).join("<�202e>");
};
import { replaceUnicodeChar } from "../../../../../../common/utils";
        {replaceUnicodeChar(strings[strings.length - 1])}
CVE-2018-1000070: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: Bitmessage PyBitmessage version v0.6.2 (and introduced in or after commit 8ce72d8d2d25973b7064b1cf76a6b0b3d62f0ba0) contains a Eval injection vulnerability in main program, file src/messagetypes/__init__.py function constructObject that can result in Code Execution. This attack appears to be exploitable via remote attacker using a malformed message which must be processed by the victim - e.g. arrive from any sender on bitmessage network. This vulnerability appears to have been fixed in v0.6.3.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 8.8
Published: 2018-03-13T15:29Z
Repository: https://github.com/Bitmessage/PyBitmessage
Language: Python
Files changed: src/messagetypes/__init__.py
Commit date: 2018-02-13 16:39:35 +0100
Commit message: Fix message encoding bug

- prevent loading invalid message types

Diff: diff --git a/src/messagetypes/__init__.py b/src/messagetypes/__init__.py
index c3911df..d929101 100644
--- a/src/messagetypes/__init__.py
+++ b/src/messagetypes/__init__.py
@@ -10,13 +10,14 @@ class MsgBase(object):
         self.data = {"": lower(type(self).__name__)}
 
 
 def constructObject(data):
     try:
-        classBase = eval(data[""] + "." + data[""].title())
-    except NameError:
-        logger.error("Don't know how to handle message type: \"%s\"", data[""])
+        m = import_module("messagetypes." + data[""])
+        classBase = getattr(m, data[""].title())
+    except (NameError, ImportError):
+        logger.error("Don't know how to handle message type: \"%s\"", data[""], exc_info=True)
         return None
     try:
         returnObj = classBase()
         returnObj.decode(data)
     except KeyError as e:

Vulnerable code:         classBase = eval(data[""] + "." + data[""].title())
    except NameError:
        logger.error("Don't know how to handle message type: \"%s\"", data[""])
Fixed code:         m = import_module("messagetypes." + data[""])
        classBase = getattr(m, data[""].title())
    except (NameError, ImportError):
        logger.error("Don't know how to handle message type: \"%s\"", data[""], exc_info=True)
CVE-2014-7193: Improper Access Control (CWE-284)
value: The Crumb plugin before 3.0.0 for Node.js does not properly restrict token access in situations where a hapi route handler has CORS enabled, which allows remote attackers to obtain sensitive information, and potentially obtain the ability to spoof requests to non-CORS routes, via a crafted web site that is visited by an application consumer.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Published: 2014-12-25T11:59Z
Repository: https://github.com/hapijs/crumb
Language: Unknown
Commit date: 2014-07-31 16:05:07 -0400
Commit message: Merge pull request #16 from spumko/security-updates

Security update
CVE-2023-45139: Improper Restriction of XML External Entity Reference (CWE-611)
value: fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. This vulnerability has been patched in version 4.43.0.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 7.5
Published: 2024-01-10T16:15Z
Repository: https://github.com/fonttools/fonttools
Language: Python
Files changed: Lib/fontTools/subset/svg.py
Commit date: 2023-09-15 16:50:38 +0200
Commit message: subset: parse OT-SVG with resolve_entities=False

to guard against XXE attacks as recommended in https://codeql.github.com/codeql-query-help/python/py-xxe/

Diff: diff --git a/Lib/fontTools/subset/svg.py b/Lib/fontTools/subset/svg.py
index f6d74a400..2e55bf54c 100644
--- a/Lib/fontTools/subset/svg.py
+++ b/Lib/fontTools/subset/svg.py
@@ -223,10 +223,13 @@ def subset_glyphs(self, s) -> bool:
                 # when parsing big fonts e.g. noto-emoji-picosvg.ttf.
                 huge_tree=True,
                 # ignore blank text as it's not meaningful in OT-SVG; it also prevents
                 # dangling tail text after removing an element when pretty_print=True
                 remove_blank_text=True,
+                # don't replace entities; we don't expect any in OT-SVG and they may
+                # aboused for XXE attacks
+                resolve_entities=False,
             ),
         )
 
         elements = group_elements_by_id(svg)
         gids = {rev_orig_glyph_map[g] for g in glyphs}

Fixed code:                 # don't replace entities; we don't expect any in OT-SVG and they may
                # aboused for XXE attacks
                resolve_entities=False,
CVE-2019-25100: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in happyman twmap. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file twmap3/data/ajaxCRUD/pointdata2.php. The manipulation of the argument id leads to sql injection. Upgrading to version v2.9_v4.31 is able to address this issue. The identifier of the patch is babbec79b3fa4efb3bd581ea68af0528d11bba0c. It is recommended to upgrade the affected component. The identifier VDB-217645 was assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-08T11:15Z
Repository: https://github.com/happyman/twmap
Language: PHP
Files changed: twmap3/data/ajaxCRUD/pointdata2.php, twmap3/data/ajaxCRUD_old/pointdata2.php
Commit date: 2019-09-12 07:54:59 +0800
Commit message: #42 fix SQL-Injection

Diff: diff --git a/twmap3/data/ajaxCRUD/pointdata2.php b/twmap3/data/ajaxCRUD/pointdata2.php
index d17bbf8..cd1649e 100644
--- a/twmap3/data/ajaxCRUD/pointdata2.php
+++ b/twmap3/data/ajaxCRUD/pointdata2.php
@@ -17,11 +17,11 @@ $sql="select * from point ";
 $order=" order by number,class desc ";
 if (!empty($q)) {
 	$sql .= " where name like '%" . addslashes($q) . "%'";
 	$order = " order by length(name)";
 } else if (!empty($id)) {
-	$sql .= " where id = $id";
+	$sql .= " where id = ". pg_escape_string($id);
 	$order = "";
 }
 
 $sql.=$order;
 $result = q($sql);
diff --git a/twmap3/data/ajaxCRUD_old/pointdata2.php b/twmap3/data/ajaxCRUD_old/pointdata2.php
index 41ee738..0c009cf 100644
--- a/twmap3/data/ajaxCRUD_old/pointdata2.php
+++ b/twmap3/data/ajaxCRUD_old/pointdata2.php
@@ -17,11 +17,11 @@ $sql="select * from point ";
 $order=" order by number,class desc ";
 if (!empty($q)) {
 	$sql .= " where name like '%" . addslashes($q) . "%'";
 	$order = " order by length(name)";
 } else if (!empty($id)) {
-	$sql .= " where id = $id";
+	$sql .= " where id = ".pg_escape_string($id);
 	$order = "";
 }
 
 $sql.=$order;
 $res = mysqli_query($db, $sql);

Vulnerable code: 	$sql .= " where id = $id";
	$sql .= " where id = $id";
Fixed code: 	$sql .= " where id = ". pg_escape_string($id);
	$sql .= " where id = ".pg_escape_string($id);
CVE-2017-9527: Use After Free (CWE-416)
value: The mark_context_stack function in gc.c in mruby through 1.2.0 allows attackers to cause a denial of service (heap-based use-after-free and application crash) or possibly have unspecified other impact via a crafted .rb file.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 7.8
Published: 2017-06-11T17:29Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: src/gc.c
Commit date: 2017-04-10 09:46:09 +0900
Commit message: Clear unused stack region that may refer freed objects; fix #3596

Diff: diff --git a/src/gc.c b/src/gc.c
index 116fd0bf..19bc1ad4 100644
--- a/src/gc.c
+++ b/src/gc.c
@@ -542,27 +542,28 @@ add_gray_list(mrb_state *mrb, mrb_gc *gc, struct RBasic *obj)
 static void
 mark_context_stack(mrb_state *mrb, struct mrb_context *c)
 {
   size_t i;
   size_t e;
+  mrb_value nil;
 
   if (c->stack == NULL) return;
   e = c->stack - c->stbase;
   if (c->ci) e += c->ci->nregs;
   if (c->stbase + e > c->stend) e = c->stend - c->stbase;
   for (i=0; i<e; i++) {
     mrb_value v = c->stbase[i];
 
     if (!mrb_immediate_p(v)) {
-      if (mrb_basic_ptr(v)->tt == MRB_TT_FREE) {
-        c->stbase[i] = mrb_nil_value();
-      }
-      else {
-        mrb_gc_mark(mrb, mrb_basic_ptr(v));
-      }
+      mrb_gc_mark(mrb, mrb_basic_ptr(v));
     }
   }
+  e = c->stend - c->stbase;
+  nil = mrb_nil_value();
+  for (; i<e; i++) {
+    c->stbase[i] = nil;
+  }
 }
 
 static void
 mark_context(mrb_state *mrb, struct mrb_context *c)
 {

Vulnerable code:       if (mrb_basic_ptr(v)->tt == MRB_TT_FREE) {
        c->stbase[i] = mrb_nil_value();
      }
      else {
        mrb_gc_mark(mrb, mrb_basic_ptr(v));
      }
Fixed code:   mrb_value nil;
      mrb_gc_mark(mrb, mrb_basic_ptr(v));
  e = c->stend - c->stbase;
  nil = mrb_nil_value();
  for (; i<e; i++) {
    c->stbase[i] = nil;
  }
CVE-2018-10191: Integer Overflow or Wraparound (CWE-190)
value: In versions of mruby up to and including 1.4.0, an integer overflow exists in src/vm.c::mrb_vm_exec() when handling OP_GETUPVAR in the presence of deep scope nesting, resulting in a use-after-free. An attacker that can cause Ruby code to be run can use this to possibly execute arbitrary code.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 9.8
Published: 2018-04-17T21:29Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: src/vm.c
Commit date: 2018-04-11 10:24:44 +0900
Commit message: Check length of env stack before accessing upvar; fix #3995

Diff: diff --git a/src/vm.c b/src/vm.c
index ae9bf2e69..0acdd1ba8 100644
--- a/src/vm.c
+++ b/src/vm.c
@@ -1199,15 +1199,15 @@ RETRY_TRY_BLOCK:
       int b = GETARG_B(i);
       int c = GETARG_C(i);
       mrb_value *regs_a = regs + a;
       struct REnv *e = uvenv(mrb, c);
 
-      if (!e) {
-        *regs_a = mrb_nil_value();
+      if (e && b < MRB_ENV_STACK_LEN(e)) {
+        *regs_a = e->stack[b];
       }
       else {
-        *regs_a = e->stack[b];
+        *regs_a = mrb_nil_value();
       }
       NEXT;
     }
 
     CASE(OP_SETUPVAR) {

Vulnerable code:       if (!e) {
        *regs_a = mrb_nil_value();
        *regs_a = e->stack[b];
Fixed code:       if (e && b < MRB_ENV_STACK_LEN(e)) {
        *regs_a = e->stack[b];
        *regs_a = mrb_nil_value();
CVE-2018-10199: Use After Free (CWE-416)
value: In versions of mruby up to and including 1.4.0, a use-after-free vulnerability exists in src/io.c::File#initilialize_copy(). An attacker that can cause Ruby code to be run can possibly use this to execute arbitrary code.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 9.8
Published: 2018-04-18T15:29Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: mrbgems/mruby-io/src/io.c
Commit date: 2018-04-17 09:57:41 +0900
Commit message: Fix `use after free in File#initilialize_copy`; fix #4001

The bug and the fix were reported by https://hackerone.com/pnoltof

Diff: diff --git a/mrbgems/mruby-io/src/io.c b/mrbgems/mruby-io/src/io.c
index 58bcdd1ee..6ace9e167 100644
--- a/mrbgems/mruby-io/src/io.c
+++ b/mrbgems/mruby-io/src/io.c
@@ -559,17 +559,17 @@ mrb_io_initialize_copy(mrb_state *mrb, mrb_value copy)
   struct mrb_io *fptr_copy;
   struct mrb_io *fptr_orig;
   mrb_bool failed = TRUE;
 
   mrb_get_args(mrb, "o", &orig);
+  fptr_orig = io_get_open_fptr(mrb, orig);
   fptr_copy = (struct mrb_io *)DATA_PTR(copy);
   if (fptr_copy != NULL) {
     fptr_finalize(mrb, fptr_copy, FALSE);
     mrb_free(mrb, fptr_copy);
   }
   fptr_copy = (struct mrb_io *)mrb_io_alloc(mrb);
-  fptr_orig = io_get_open_fptr(mrb, orig);
 
   DATA_TYPE(copy) = &mrb_io_type;
   DATA_PTR(copy) = fptr_copy;
 
   buf = mrb_iv_get(mrb, orig, mrb_intern_cstr(mrb, "@buf"));

Vulnerable code:   fptr_orig = io_get_open_fptr(mrb, orig);
Fixed code:   fptr_orig = io_get_open_fptr(mrb, orig);
CVE-2018-11743: Access of Uninitialized Pointer (CWE-824)
value: The init_copy function in kernel.c in mruby 1.4.1 makes initialize_copy calls for TT_ICLASS objects, which allows attackers to cause a denial of service (mrb_hash_keys uninitialized pointer and application crash) or possibly have unspecified other impact.
CWE description: The product accesses or uses a pointer that has not been initialized.
CVSS v3 base score: 9.8
Published: 2018-06-05T13:29Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: src/kernel.c
Commit date: 2018-05-30 17:05:40 +0900
Commit message: Should not call `initialize_copy` for `TT_ICLASS`; fix #4027

Since `TT_ICLASS` is a internal object that should never be revealed
to Ruby world.

Diff: diff --git a/src/kernel.c b/src/kernel.c
index 8551b50ea..2a50d3126 100644
--- a/src/kernel.c
+++ b/src/kernel.c
@@ -277,10 +277,13 @@ copy_class(mrb_state *mrb, mrb_value dst, mrb_value src)
 
 static void
 init_copy(mrb_state *mrb, mrb_value dest, mrb_value obj)
 {
   switch (mrb_type(obj)) {
+    case MRB_TT_ICLASS:
+      copy_class(mrb, dest, obj);
+      return;
     case MRB_TT_CLASS:
     case MRB_TT_MODULE:
       copy_class(mrb, dest, obj);
       mrb_iv_copy(mrb, dest, obj);
       mrb_iv_remove(mrb, dest, mrb_intern_lit(mrb, "__classname__"));

Fixed code:     case MRB_TT_ICLASS:
      copy_class(mrb, dest, obj);
      return;
CVE-2018-12247: NULL Pointer Dereference (CWE-476)
value: An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrb_class, related to certain .clone usage, because mrb_obj_clone in kernel.c copies flags other than the MRB_FLAG_IS_FROZEN flag (e.g., the embedded flag).
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2018-06-12T14:29Z
Repository: https://github.com/mruby/mruby
Language: C
Files changed: src/kernel.c
Commit date: 2018-06-07 16:17:00 +0900
Commit message: Allow `Object#clone` to copy frozen status only; fix #4036

Copying all flags from the original object may overwrite the clone's
flags e.g. the embedded flag.

Diff: diff --git a/src/kernel.c b/src/kernel.c
index f378004cb..bbe6e8bb7 100644
--- a/src/kernel.c
+++ b/src/kernel.c
@@ -346,11 +346,11 @@ mrb_obj_clone(mrb_state *mrb, mrb_value self)
   p = (struct RObject*)mrb_obj_alloc(mrb, mrb_type(self), mrb_obj_class(mrb, self));
   p->c = mrb_singleton_class_clone(mrb, self);
   mrb_field_write_barrier(mrb, (struct RBasic*)p, (struct RBasic*)p->c);
   clone = mrb_obj_value(p);
   init_copy(mrb, clone, self);
-  p->flags = mrb_obj_ptr(self)->flags;
+  p->flags |= mrb_obj_ptr(self)->flags & MRB_FLAG_IS_FROZEN;
 
   return clone;
 }
 
 /* 15.3.1.3.9  */

Vulnerable code:   p->flags = mrb_obj_ptr(self)->flags;
Fixed code:   p->flags |= mrb_obj_ptr(self)->flags & MRB_FLAG_IS_FROZEN;