Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2020-15229: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Singularity (an open source container platform) from version 3.1.1 through 3.6.3 has a vulnerability. Due to insecure handling of path traversal and the lack of path sanitization within `unsquashfs`, it is possible to overwrite/create any files on the host filesystem during the extraction with a crafted squashfs filesystem. The extraction occurs automatically for unprivileged (either installation or with `allow setuid = no`) run of Singularity when a user attempt to run an image which is a local SIF image or a single file containing a squashfs filesystem and is coming from remote sources `library://` or `shub://`. Image build is also impacted in a more serious way as it can be used by a root user, allowing an attacker to overwrite/create files leading to a system compromise, so far bootstrap methods `library`, `shub` and `localimage` are triggering the squashfs extraction. This issue is addressed in Singularity 3.6.4. All users are advised to upgrade to 3.6.4 especially if they use Singularity mainly for building image as root user. There is no solid workaround except to temporary avoid to use unprivileged mode with single file images in favor of sandbox images instead. Regarding image build, temporary avoid to build from `library` and `shub` sources and as much as possible use `--fakeroot` or a VM for that.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.3
Published: 2020-10-14T19:15Z
Repository: https://github.com/hpcng/singularity
Language: Unknown
Commit date: 2020-10-13 09:35:54 -0500
Commit message: Merge pull request #5611 from dctrud/36-sec

Merge GHSA-7gcp-w6ww-2xv9 fixes for release 3.6.4
CVE-2024-30564: Insufficient Information (NVD-CWE-noinfo)
value: An issue inandrei-tatar nora-firebase-common between v.1.0.41 and v.1.12.2 allows a remote attacker to execute arbitrary code via a crafted script to the updateState parameter of the updateStateInternal method.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-18T15:15Z
Repository: https://github.com/andrei-tatar/nora-firebase-common
Language: TypeScript
Files changed: src/update-state.test.ts, src/update-state.ts
Commit date: 2024-03-19 06:57:29 +0200
Commit message: simple fix for prototype pollution

Diff: diff --git a/src/update-state.test.ts b/src/update-state.test.ts
index 654bfe8..c869728 100644
--- a/src/update-state.test.ts
+++ b/src/update-state.test.ts
@@ -220,7 +220,16 @@ describe('updateState', () => {
                 name: 'RainDetection',
                 currentSensorState: 'rain detected',
             }],
         });
     });
+
+    it('should not update via prototype props', () => {
+        var BAD_JSON = JSON.parse('{"__proto__":{"polluted":true}}')
+
+        const { hasChanges } = updateState(BAD_JSON, {})
+
+        expect(hasChanges).to.be.false;
+        expect((Object.prototype as any).polluted).to.be.undefined;
+    });
 });
 
diff --git a/src/update-state.ts b/src/update-state.ts
index ead8d61..eeaeb6a 100644
--- a/src/update-state.ts
+++ b/src/update-state.ts
@@ -14,10 +14,13 @@ export function deepClone<T>(o: T): T {
 const arrayItemKeyMap = new Map<string, string>([
     ['openState', 'openDirection'],
     ['currentSensorStateData', 'name'],
 ]);
 
+// https://github.com/andrei-tatar/nora-firebase-common/issues/9
+const ignoreKeys: any[] = ['__proto__', 'constructor', 'prototype'];
+
 function updateArrayState(update: any[], state: any[], path = ''): boolean {
     let hasChanges = false;
 
     const key = arrayItemKeyMap.get(path);
     if (key) {
@@ -49,10 +52,12 @@ function updateStateInternal(update: any, state: any, path = ''): boolean {
         return updateArrayState(update, state, path);
     }
 
     let hasChanges = false;
     for (const [key, newValue] of entries(update)) {
+        if (ignoreKeys.includes(key)) { continue; }
+
         const oldValue = state[key];
         const newType = typeof newValue;
         const oldType = typeof oldValue;
 
         if (newType !== oldType) {

Fixed code: 
    it('should not update via prototype props', () => {
        var BAD_JSON = JSON.parse('{"__proto__":{"polluted":true}}')

        const { hasChanges } = updateState(BAD_JSON, {})

        expect(hasChanges).to.be.false;
        expect((Object.prototype as any).polluted).to.be.undefined;
    });
// https://github.com/andrei-tatar/nora-firebase-common/issues/9
const ignoreKeys: any[] = ['__proto__', 'constructor', 'prototype'];

        if (ignoreKeys.includes(key)) { continue; }
CVE-2024-25678: Insufficient Information (NVD-CWE-noinfo)
value: In LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2024-02-09T10:15Z
Repository: https://github.com/litespeedtech/lsquic
Language: C
Files changed: src/liblsquic/lsquic_full_conn_ietf.c
Commit date: 2024-01-09 17:42:07 -0500
Commit message: Release 4.0.4

Diff: diff --git a/src/liblsquic/lsquic_full_conn_ietf.c b/src/liblsquic/lsquic_full_conn_ietf.c
index ca15988..718a688 100644
--- a/src/liblsquic/lsquic_full_conn_ietf.c
+++ b/src/liblsquic/lsquic_full_conn_ietf.c
@@ -7281,11 +7281,12 @@ static int
 on_dcid_change (struct ietf_full_conn *conn, const lsquic_cid_t *dcid_in)
 {
     struct lsquic_conn *const lconn = &conn->ifc_conn;  /* Shorthand */
     struct conn_cid_elem *cce;
 
-    LSQ_DEBUG("peer switched its DCID, attempt to switch own SCID");
+    LSQ_DEBUGC("peer switched its DCID to %"CID_FMT
+              ", attempt to switch own SCID", CID_BITS(dcid_in));
 
     for (cce = lconn->cn_cces; cce < END_OF_CCES(lconn); ++cce)
         if (cce - lconn->cn_cces != lconn->cn_cur_cce_idx
                 && (lconn->cn_cces_mask & (1 << (cce - lconn->cn_cces)))
                     && LSQUIC_CIDS_EQ(&cce->cce_cid, dcid_in))
@@ -7543,11 +7544,13 @@ process_regular_packet (struct ietf_full_conn *conn,
                         "on it", packet_in->pi_path_id);
                     conn->ifc_send_flags &= ~(SF_SEND_PATH_RESP
                                                     << packet_in->pi_path_id);
                 }
             }
-            else if (is_dcid_changed)
+            else if (is_dcid_changed
+                && !LSQUIC_CIDS_EQ(CN_SCID(&conn->ifc_conn),
+                                   &packet_in->pi_dcid))
             {
                 if (0 != on_dcid_change(conn, &packet_in->pi_dcid))
                     return -1;
             }
         }

Vulnerable code:     LSQ_DEBUG("peer switched its DCID, attempt to switch own SCID");
            else if (is_dcid_changed)
Fixed code:     LSQ_DEBUGC("peer switched its DCID to %"CID_FMT
              ", attempt to switch own SCID", CID_BITS(dcid_in));
            else if (is_dcid_changed
                && !LSQUIC_CIDS_EQ(CN_SCID(&conn->ifc_conn),
                                   &packet_in->pi_dcid))
CVE-2017-5545: Out-of-bounds Read (CWE-125)
value: The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2017-01-21T01:59Z
Repository: https://github.com/libimobiledevice/libplist
Language: C
Files changed: tools/plistutil.c
Commit date: 2017-01-18 15:44:51 +0100
Commit message: plistutil: Prevent OOB heap buffer read by checking input size

As pointed out in #87 plistutil would do a memcmp with a heap buffer
without checking the size. If the size is less than 8 it would read
beyond the bounds of this heap buffer. This commit prevents that.

Diff: diff --git a/tools/plistutil.c b/tools/plistutil.c
index 6451604..e943e76 100644
--- a/tools/plistutil.c
+++ b/tools/plistutil.c
@@ -127,10 +127,16 @@ int main(int argc, char *argv[])
         free(options);
         return 1;
     }
 
     stat(options->in_file, &filestats);
+
+    if (filestats.st_size < 8) {
+        printf("ERROR: Input file is too small to contain valid plist data.\n");
+        return -1;
+    }
+
     plist_entire = (char *) malloc(sizeof(char) * (filestats.st_size + 1));
     read_size = fread(plist_entire, sizeof(char), filestats.st_size, iplist);
     fclose(iplist);
 
     // convert from binary to xml or vice-versa

Fixed code: 
    if (filestats.st_size < 8) {
        printf("ERROR: Input file is too small to contain valid plist data.\n");
        return -1;
    }
CVE-2017-6435: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory corruption) via a crafted plist file.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 5
Published: 2017-03-15T14:59Z
Repository: https://github.com/libimobiledevice/libplist
Language: C
Files changed: src/bplist.c
Commit date: 2017-02-07 12:43:27 +0100
Commit message: bplist: Make sure to bail out if malloc() fails in parse_string_node()

Credit to Wang Junjie <zhunkibatu@gmail.com> (#93)

Diff: diff --git a/src/bplist.c b/src/bplist.c
index 81bd716..20e5090 100644
--- a/src/bplist.c
+++ b/src/bplist.c
@@ -287,10 +287,15 @@ static plist_t parse_string_node(const char **bnode, uint64_t size)
 {
     plist_data_t data = plist_new_plist_data();
 
     data->type = PLIST_STRING;
     data->strval = (char *) malloc(sizeof(char) * (size + 1));
+    if (!data->strval) {
+        plist_free_data(data);
+        PLIST_BIN_ERR("%s: Could not allocate %" PRIu64 " bytes\n", __func__, sizeof(char) * (size + 1));
+        return NULL;
+    }
     memcpy(data->strval, *bnode, size);
     data->strval[size] = '\0';
     data->length = strlen(data->strval);
 
     return node_create(NULL, data);

Fixed code:     if (!data->strval) {
        plist_free_data(data);
        PLIST_BIN_ERR("%s: Could not allocate %" PRIu64 " bytes\n", __func__, sizeof(char) * (size + 1));
        return NULL;
    }
CVE-2022-1813: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: OS Command Injection in GitHub repository yogeshojha/rengine prior to 1.2.0.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2022-05-22T16:15Z
Repository: https://github.com/yogeshojha/rengine
Language: Python
Files changed: web/reNgine/common_func.py
Commit date: 2022-05-22 21:11:29 +0530
Commit message: Fix command injection issue on detect cms

Diff: diff --git a/web/reNgine/common_func.py b/web/reNgine/common_func.py
index 27580467..10c108cf 100644
--- a/web/reNgine/common_func.py
+++ b/web/reNgine/common_func.py
@@ -4,10 +4,11 @@ import json
 import random
 import requests
 import tldextract
 import logging
 import shutil
+import subprocess
 
 from threading import Thread
 
 from urllib.parse import urlparse
 
@@ -666,12 +667,16 @@ def get_whois(ip_domain, save_db=False, fetch_from_db=True):
 
 
 def get_cms_details(url):
     # this function will fetch cms details using cms_detector
     response = {}
-    cms_detector_command = 'python3 /usr/src/github/CMSeeK/cmseek.py -u {} --random-agent --batch --follow-redirect'.format(url)
-    os.system(cms_detector_command)
+    cms_detector_command = 'python3 /usr/src/github/CMSeeK/cmseek.py --random-agent --batch --follow-redirect'
+    subprocess_splitted_command = cms_detector_command.split()
+    subprocess_splitted_command.append('-u')
+    subprocess_splitted_command.append(url)
+    process = subprocess.Popen(subprocess_splitted_command)
+    process.wait()
 
     response['status'] = False
     response['message'] = 'Could not detect CMS!'
 
     parsed_url = urlparse(url)

Vulnerable code:     cms_detector_command = 'python3 /usr/src/github/CMSeeK/cmseek.py -u {} --random-agent --batch --follow-redirect'.format(url)
    os.system(cms_detector_command)
Fixed code: import subprocess
    cms_detector_command = 'python3 /usr/src/github/CMSeeK/cmseek.py --random-agent --batch --follow-redirect'
    subprocess_splitted_command = cms_detector_command.split()
    subprocess_splitted_command.append('-u')
    subprocess_splitted_command.append(url)
    process = subprocess.Popen(subprocess_splitted_command)
    process.wait()
CVE-2020-1732: Improper Input Validation (CWE-20)
value: A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security identity corruption across concurrent threads when using EE Security with WildFly Elytron which can lead to the possibility of being handled using the identity from another request.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 4.2
Published: 2020-05-04T17:15Z
Repository: https://github.com/wildfly-security/soteria
Language: Unknown
Commit date: 2020-02-14 11:57:21 -0500
Commit message: Merge pull request #1 from darranl/CVE-2020-1732

[CVE-2020-1732] Adjust JASPIC integration to create a new ServerAuthModule for each request.
CVE-2019-17544: Out-of-bounds Read (CWE-125)
value: libaspell.a in GNU Aspell before 0.60.8 has a stack-based buffer over-read in acommon::unescape in common/getdata.cpp via an isolated \ character.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2019-10-14T02:15Z
Repository: https://github.com/GNUAspell/aspell
Language: C++
Files changed: common/config.cpp, common/file_util.cpp, common/getdata.cpp
Commit date: 2019-08-04 04:20:29 -0400
Commit message: Fix various bugs found by OSS-Fuze.

Diff: diff --git a/common/config.cpp b/common/config.cpp
index 017e741..e117d3c 100644
--- a/common/config.cpp
+++ b/common/config.cpp
@@ -761,11 +761,11 @@ namespace acommon {
           res.append('\\');
         res.append(*s);
       }
       res.append(':');
     }
-    if (res.back() == ':') res.pop_back();
+    if (!res.empty() && res.back() == ':') res.pop_back();
   }
 
   struct ListAddHelper : public AddableContainer 
   {
     Config * config;
diff --git a/common/file_util.cpp b/common/file_util.cpp
index 8515832..56ea501 100644
--- a/common/file_util.cpp
+++ b/common/file_util.cpp
@@ -179,10 +179,11 @@ namespace acommon {
     const char * dir;
     String path;
     while ( (dir = els.next()) != 0 ) 
     {
       path = dir;
+      if (path.empty()) continue;
       if (path.back() != '/') path += '/';
       unsigned dir_len = path.size();
       path += filename;
       if (file_exists(path)) {
         filename.swap(path);
diff --git a/common/getdata.cpp b/common/getdata.cpp
index 7e822c9..1b04823 100644
--- a/common/getdata.cpp
+++ b/common/getdata.cpp
@@ -62,11 +62,11 @@ namespace acommon {
   }
 
   char * unescape(char * dest, const char * src)
   {
     while (*src) {
-      if (*src == '\\') {
+      if (*src == '\\' && src[1]) {
 	++src;
 	switch (*src) {
 	case 'n': *dest = '\n'; break;
 	case 'r': *dest = '\r'; break;
 	case 't': *dest = '\t'; break;

Vulnerable code:     if (res.back() == ':') res.pop_back();
      if (*src == '\\') {
Fixed code:     if (!res.empty() && res.back() == ':') res.pop_back();
      if (path.empty()) continue;
      if (*src == '\\' && src[1]) {
CVE-2023-45292: Insufficient Verification of Data Authenticity (CWE-345)
value: When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct.
CWE description: The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CVSS v3 base score: 5.3
Published: 2023-12-11T22:15Z
Repository: https://github.com/mojocn/base64Captcha
Language: Go
Files changed: store_memory.go
Commit date: 2022-09-07 12:25:00 +0800
Commit message: feat(inmemory): verify method must check the empty id and answer.

Diff: diff --git a/store_memory.go b/store_memory.go
index aab4c7d..eb9bfb4 100644
--- a/store_memory.go
+++ b/store_memory.go
@@ -65,11 +65,11 @@ func (s *memoryStore) Set(id string, value string) error {
 	return nil
 }
 
 func (s *memoryStore) Verify(id, answer string, clear bool) bool {
 	v := s.Get(id, clear)
-	return v == answer
+	return v != "" && v == answer
 }
 
 func (s *memoryStore) Get(id string, clear bool) (value string) {
 	if !clear {
 		// When we don't need to clear captcha, acquire read lock.

Vulnerable code: 	return v == answer
Fixed code: 	return v != "" && v == answer
CVE-2023-45292: Insufficient Verification of Data Authenticity (CWE-345)
value: When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct.
CWE description: The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CVSS v3 base score: 5.3
Published: 2023-12-11T22:15Z
Repository: https://github.com/mojocn/base64Captcha
Language: Go
Files changed: store_memory.go, store_memory_test.go
Commit date: 2023-12-08 12:48:09 +0000
Commit message: fix verify bug

Diff: diff --git a/store_memory.go b/store_memory.go
index eb9bfb4..9ad79c9 100644
--- a/store_memory.go
+++ b/store_memory.go
@@ -64,10 +64,13 @@ func (s *memoryStore) Set(id string, value string) error {
 	}
 	return nil
 }
 
 func (s *memoryStore) Verify(id, answer string, clear bool) bool {
+	if id == "" || answer == "" {
+		return false
+	}
 	v := s.Get(id, clear)
 	return v != "" && v == answer
 }
 
 func (s *memoryStore) Get(id string, clear bool) (value string) {
diff --git a/store_memory_test.go b/store_memory_test.go
index df68764..90cb7ac 100644
--- a/store_memory_test.go
+++ b/store_memory_test.go
@@ -141,10 +141,14 @@ func Test_memoryStore_Verify(t *testing.T) {
 	got = thisStore.Verify("xx", "xx", true)
 
 	if got {
 		t.Error("failed3")
 	}
+	got = DefaultMemStore.Verify("saaf", "", true)
+	if got {
+		t.Error("CVE-2023-45292 GO-2023-2386")
+	}
 }
 
 func Test_memoryStore_Get(t *testing.T) {
 	thisStore := NewMemoryStore(10, time.Hour)
 	_ = thisStore.Set("xx", "xx")

Fixed code: 	if id == "" || answer == "" {
		return false
	}
	got = DefaultMemStore.Verify("saaf", "", true)
	if got {
		t.Error("CVE-2023-45292 GO-2023-2386")
	}
CVE-2016-10509: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL injection vulnerability in the updateAmazonOrderTracking function in upload/admin/model/openbay/amazon.php in OpenCart before version 2.3.0.0 allows remote authenticated administrators to execute arbitrary SQL commands via a carrier (aka courier_id) parameter to openbay.php.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 7.2
Published: 2017-08-31T20:29Z
Repository: https://github.com/opencart/opencart
Language: PHP
Files changed: upload/admin/model/openbay/amazon.php
Commit date: 2016-03-14 20:19:45 +0800
Commit message: https://github.com/opencart/opencart/issues/4114

Diff: diff --git a/upload/admin/model/openbay/amazon.php b/upload/admin/model/openbay/amazon.php
index 26d87b080..8d9a306d9 100644
--- a/upload/admin/model/openbay/amazon.php
+++ b/upload/admin/model/openbay/amazon.php
@@ -491,13 +491,13 @@ class ModelOpenbayAmazon extends Model {
 	}
 
 	public function updateAmazonOrderTracking($order_id, $courier_id, $courier_from_list, $tracking_no) {
 		$this->db->query("
 			UPDATE `" . DB_PREFIX . "amazon_order`
-			SET `courier_id` = '" . $courier_id . "',
+			SET `courier_id` = '" . $this->db->escape($courier_id) . "',
 				`courier_other` = " . (int)!$courier_from_list . ",
-				`tracking_no` = '" . $tracking_no . "'
+				`tracking_no` = '" . $this->db->escape($tracking_no) . "'
 			WHERE `order_id` = " . (int)$order_id . "");
 	}
 
 	public function getAmazonOrderId($order_id) {
 		$row = $this->db->query("

Vulnerable code: 			SET `courier_id` = '" . $courier_id . "',
				`tracking_no` = '" . $tracking_no . "'
Fixed code: 			SET `courier_id` = '" . $this->db->escape($courier_id) . "',
				`tracking_no` = '" . $this->db->escape($tracking_no) . "'
CVE-2023-2315: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2 allows an authenticated user with access/modify privilege on the Log component to empty out arbitrary files on the server
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 8.8
Published: 2023-09-27T15:18Z
Repository: https://github.com/opencart/opencart
Language: PHP
Files changed: upload/admin/controller/tool/log.php
Commit date: 2023-09-16 03:49:45 +0800
Commit message: Update log.php

Diff: diff --git a/upload/admin/controller/tool/log.php b/upload/admin/controller/tool/log.php
index 3afe067fb0..cf1ceb5879 100644
--- a/upload/admin/controller/tool/log.php
+++ b/upload/admin/controller/tool/log.php
@@ -102,11 +102,11 @@ class Log extends \Opencart\System\Engine\Controller {
 	 */
 	public function download(): void {
 		$this->load->language('tool/log');
 
 		if (isset($this->request->get['filename'])) {
-			$filename = (string)basename($this->request->get['filename']);
+			$filename = (string)basename(html_entity_decode($this->request->get['filename'], ENT_QUOTES, 'UTF-8'));
 		} else {
 			$filename = '';
 		}
 
 		$file = DIR_LOGS . $filename;
@@ -138,11 +138,11 @@ class Log extends \Opencart\System\Engine\Controller {
 	 */
 	public function clear(): void {
 		$this->load->language('tool/log');
 
 		if (isset($this->request->get['filename'])) {
-			$filename = (string)$this->request->get['filename'];
+			$filename = (string)basename(html_entity_decode($this->request->get['filename'], ENT_QUOTES, 'UTF-8'));
 		} else {
 			$filename = '';
 		}
 
 		$json = [];

Vulnerable code: 			$filename = (string)basename($this->request->get['filename']);
			$filename = (string)$this->request->get['filename'];
Fixed code: 			$filename = (string)basename(html_entity_decode($this->request->get['filename'], ENT_QUOTES, 'UTF-8'));
			$filename = (string)basename(html_entity_decode($this->request->get['filename'], ENT_QUOTES, 'UTF-8'));
CVE-2022-31133: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: HumHub is an Open Source Enterprise Social Network. Affected versions of HumHub are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, the attacker would need a permission to administer the Spaces feature. The names of individual "spaces" are not properly escaped and so an attacker with sufficient privilege could insert malicious javascript into a space name and exploit system users who visit that space. It is recommended that the HumHub is upgraded to 1.11.4, 1.10.5. There are no known workarounds for this issue.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2022-07-07T18:15Z
Repository: https://github.com/humhub/humhub
Language: PHP
Files changed: protected/humhub/modules/user/widgets/PeopleFilters.php
Commit date: 2022-07-06 10:21:44 +0200
Commit message: Fix format of displaying user profile title field on "People" page (#5797)


Diff: diff --git a/protected/humhub/modules/user/widgets/PeopleFilters.php b/protected/humhub/modules/user/widgets/PeopleFilters.php
index 6d901fef91..3bafb46a91 100644
--- a/protected/humhub/modules/user/widgets/PeopleFilters.php
+++ b/protected/humhub/modules/user/widgets/PeopleFilters.php
@@ -100,11 +100,11 @@ class PeopleFilters extends DirectoryFilters
 
         $definition = $profileFieldType->getFieldFormDefinition();
         $fieldType = isset($definition[$profileField->internal_name]['type']) ? $definition[$profileField->internal_name]['type'] : null;
 
         $filterData = [
-            'title' => Yii::t($profileField->getTranslationCategory(), $profileField->title),
+            'title' => Html::encode(Yii::t($profileField->getTranslationCategory(), $profileField->title)),
             'type' => $fieldType,
             'sortOrder' => $sortOrder,
         ];
 
         switch ($fieldType) {

Vulnerable code:             'title' => Yii::t($profileField->getTranslationCategory(), $profileField->title),
Fixed code:             'title' => Html::encode(Yii::t($profileField->getTranslationCategory(), $profileField->title)),
CVE-2016-1000232: Improper Input Validation (CWE-20)
value: NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 5.3
Published: 2018-09-05T17:29Z
Repository: https://github.com/salesforce/tough-cookie
Language: Unknown
Commit date: 2016-07-21 11:43:19 -0700
Commit message: Merge pull request #68 from SalesforceEng/fix-too-many-semicolons

Reduce parse time for many semicolons.
CVE-2021-31800: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Multiple path traversal vulnerabilities exist in smbserver.py in Impacket through 0.9.22. An attacker that connects to a running smbserver instance can list and write to arbitrary files via ../ directory traversal. This could potentially be abused to achieve arbitrary code execution by replacing /etc/shadow or an SSH authorized key.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.8
Published: 2021-05-05T11:15Z
Repository: https://github.com/SecureAuthCorp/impacket
Language: Unknown
Commit date: 2021-05-03 12:43:02 -0300
Commit message: Merge pull request #1066 from omriinbar/master

Fix Path Traversal vulnerabilities by checking path prefix against in…
CVE-2024-21485: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-components before 2.0.16 are vulnerable to Cross-site Scripting (XSS) when the href of the a tag is controlled by an adversary. An authenticated attacker who stores a view that exploits this vulnerability could steal the data that's visible to another user who opens that view - not just the data already included on the page, but they could also, in theory, make additional requests and access other data accessible to this user. In some cases, they could also steal the access tokens of that user, which would allow the attacker to act as that user, including viewing other apps and resources hosted on the same server.**Note:**This is only exploitable in Dash apps that include some mechanism to store user input to be reloaded by a different user.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2024-02-02T05:15Z
Repository: https://github.com/plotly/dash
Language: Unknown
Commit date: 2024-01-30 15:48:39 -0500
Commit message: Merge pull request #2732 from plotly/fix/xss-props

Sanitize html props with xss vulnerability.
CVE-2020-9395: Out-of-bounds Write (CWE-787)
value: An issue was discovered on Realtek RTL8195AM, RTL8711AM, RTL8711AF, and RTL8710AF devices before 2.0.6. A stack-based buffer overflow exists in the client code that takes care of WPA2's 4-way-handshake via a malformed EAPOL-Key packet with a long keydata buffer.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8
Published: 2020-07-06T22:15Z
Repository: https://github.com/ambiot/amb1_sdk
Language: Unknown
Commit date: 2020-02-25 17:45:30 +0800
Commit message: [WLAN] Update wlan library

Change Notes:
	bug fixed

Revision Notes:
	r22259+r40932

Diff: diff --git a/component/soc/realtek/8195a/misc/bsp/lib/common/GCC/lib_wlan.a b/component/soc/realtek/8195a/misc/bsp/lib/common/GCC/lib_wlan.a
index 393e0ec..6c28204 100644
Binary files a/component/soc/realtek/8195a/misc/bsp/lib/common/GCC/lib_wlan.a and b/component/soc/realtek/8195a/misc/bsp/lib/common/GCC/lib_wlan.a differ
diff --git a/component/soc/realtek/8195a/misc/bsp/lib/common/IAR/lib_wlan.a b/component/soc/realtek/8195a/misc/bsp/lib/common/IAR/lib_wlan.a
index 00ef071..2785b2f 100644
Binary files a/component/soc/realtek/8195a/misc/bsp/lib/common/IAR/lib_wlan.a and b/component/soc/realtek/8195a/misc/bsp/lib/common/IAR/lib_wlan.a differ
diff --git a/component/soc/realtek/8711b/misc/bsp/lib/common/GCC/lib_wlan.a b/component/soc/realtek/8711b/misc/bsp/lib/common/GCC/lib_wlan.a
index 9a5dd97..b5cabff 100644
Binary files a/component/soc/realtek/8711b/misc/bsp/lib/common/GCC/lib_wlan.a and b/component/soc/realtek/8711b/misc/bsp/lib/common/GCC/lib_wlan.a differ
diff --git a/component/soc/realtek/8711b/misc/bsp/lib/common/IAR/lib_wlan.a b/component/soc/realtek/8711b/misc/bsp/lib/common/IAR/lib_wlan.a
index 53fe92e..686840c 100644
Binary files a/component/soc/realtek/8711b/misc/bsp/lib/common/IAR/lib_wlan.a and b/component/soc/realtek/8711b/misc/bsp/lib/common/IAR/lib_wlan.a differ
CVE-2022-4876: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in Kaltura mwEmbed up to 2.96.rc1 and classified as problematic. This issue affects some unknown processing of the file includes/DefaultSettings.php. The manipulation of the argument HTTP_X_FORWARDED_HOST leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.96.rc2 is able to address this issue. The patch is named 13b8812ebc8c9fa034eed91ab35ba8423a528c0b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217427.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-04T23:15Z
Repository: https://github.com/kaltura/mwEmbed
Language: PHP
Files changed: includes/DefaultSettings.php
Commit date: 2022-05-29 15:52:44 +0300
Commit message: fix(FEC-12267): Fix XSS Vulnerability in mwEmbed - enforce valid domain format (#4266)

ignore non valid hostname in HTTP_X_FORWARDED_HOST header (same regex as [the server](https://github.com/kaltura/server/blob/Rigel-18.6.0/infra/storage/file_transfer_managers/asperaMgr.class.php#L81))
Diff: diff --git a/includes/DefaultSettings.php b/includes/DefaultSettings.php
index 592d3c91a..b9b70d843 100644
--- a/includes/DefaultSettings.php
+++ b/includes/DefaultSettings.php
@@ -8,12 +8,16 @@
 
 if (isset($_SERVER["HTTP_X_FORWARDED_HOST"]))
 {
     // support multiple hosts (comma separated) in HTTP_X_FORWARDED_HOST
     $xForwardedHosts = explode(',', $_SERVER['HTTP_X_FORWARDED_HOST']);
-    $_SERVER["HTTP_HOST"] = $xForwardedHosts[0];
-    $_SERVER["SERVER_NAME"] = $xForwardedHosts[0];
+    $VALID_HOSTNAME_PATTERN = "/^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\\-]*[a-zA-Z0-9])\\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\\-]*[A-Za-z0-9])$/";
+    if (preg_match($VALID_HOSTNAME_PATTERN, $xForwardedHosts[0]) === 1)
+    {
+        $_SERVER["HTTP_HOST"] = $xForwardedHosts[0];
+        $_SERVER["SERVER_NAME"] = $xForwardedHosts[0];
+    }
 }
 
 // The default cache directory
 $wgScriptCacheDirectory = realpath( dirname( __FILE__ ) ) . '/cache';
 

Vulnerable code:     $_SERVER["HTTP_HOST"] = $xForwardedHosts[0];
    $_SERVER["SERVER_NAME"] = $xForwardedHosts[0];
Fixed code:     $VALID_HOSTNAME_PATTERN = "/^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\\-]*[a-zA-Z0-9])\\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\\-]*[A-Za-z0-9])$/";
    if (preg_match($VALID_HOSTNAME_PATTERN, $xForwardedHosts[0]) === 1)
    {
        $_SERVER["HTTP_HOST"] = $xForwardedHosts[0];
        $_SERVER["SERVER_NAME"] = $xForwardedHosts[0];
    }
CVE-2022-4882: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in kaltura mwEmbed up to 2.91. It has been rated as problematic. Affected by this issue is some unknown functionality of the file modules/KalturaSupport/components/share/share.js of the component Share Plugin. The manipulation of the argument res leads to cross site scripting. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.92.rc1 is able to address this issue. The name of the patch is 4f11b6f6610acd6d89de5f8be47cf7c610643845. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217664.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.7
Published: 2023-01-09T09:15Z
Repository: https://github.com/kaltura/mwEmbed
Language: JavaScript
Files changed: modules/KalturaSupport/components/share/share.js
Commit date: 2022-01-03 09:59:59 +0200
Commit message: fix(FEC-11791): share url has cross-site scripting vulnerability (#4255)

**description of the issue:**
when share plugin is enabled for the player, the share url is not being sanitized, which exposes a security vulnerability.

**the solution:**
sanitizing encoded and decoded share url.

Solves FEC-11791
Diff: diff --git a/modules/KalturaSupport/components/share/share.js b/modules/KalturaSupport/components/share/share.js
index 1c2c4f0df..ecc3cae5b 100644
--- a/modules/KalturaSupport/components/share/share.js
+++ b/modules/KalturaSupport/components/share/share.js
@@ -614,11 +614,12 @@
 				res = document.referrer;
 				if (res === "") {
 					res = document.URL;
 				}
 			}
-			return res;
+			var sanitized = kWidget.sanitize(decodeURIComponent(res));
+			return encodeURIComponent(sanitized);
 		}
 		// -------------- finish setup player url according to the socialShareURL flashvar ------- //
 
 	}));
 

Vulnerable code: 			return res;
Fixed code: 			var sanitized = kWidget.sanitize(decodeURIComponent(res));
			return encodeURIComponent(sanitized);
CVE-2017-17439: NULL Pointer Dereference (CWE-476)
value: In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to the _kdc_as_rep function in kdc/kerberos5.c and the der_length_visible_string function in lib/asn1/der_length.c.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2017-12-06T15:29Z
Repository: https://github.com/heimdal/heimdal
Language: C
Files changed: kdc/kerberos5.c
Commit date: 2017-12-05 18:49:50 -0500
Commit message: Security: Avoid NULL structure pointer member dereference

This can happen in the error path when processing malformed AS
requests with a NULL client name.  Bug originally introduced on
Fri Feb 13 09:26:01 2015 +0100 in commit:

    a873e21d7c06f22943a90a41dc733ae76799390d

    kdc: base _kdc_fast_mk_error() on krb5_mk_error_ext()

Original patch by Jeffrey Altman <jaltman@secure-endpoints.com>

Diff: diff --git a/kdc/kerberos5.c b/kdc/kerberos5.c
index 98989bd64..1582fee75 100644
--- a/kdc/kerberos5.c
+++ b/kdc/kerberos5.c
@@ -2230,19 +2230,21 @@ out:
     free_AS_REP(&rep);
 
     /*
      * In case of a non proxy error, build an error message.
      */
-    if(ret != 0 && ret != HDB_ERR_NOT_FOUND_HERE && reply->length == 0) {
+    if (ret != 0 && ret != HDB_ERR_NOT_FOUND_HERE && reply->length == 0) {
 	ret = _kdc_fast_mk_error(context, r,
 				 &error_method,
 				 r->armor_crypto,
 				 &req->req_body,
 				 ret, r->e_text,
 				 r->server_princ,
-				 &r->client_princ->name,
-				 &r->client_princ->realm,
+				 r->client_princ ?
+                                     &r->client_princ->name : NULL,
+				 r->client_princ ?
+                                     &r->client_princ->realm : NULL,
 				 NULL, NULL,
 				 reply);
 	if (ret)
 	    goto out2;
     }

Vulnerable code:     if(ret != 0 && ret != HDB_ERR_NOT_FOUND_HERE && reply->length == 0) {
				 &r->client_princ->name,
				 &r->client_princ->realm,
Fixed code:     if (ret != 0 && ret != HDB_ERR_NOT_FOUND_HERE && reply->length == 0) {
				 r->client_princ ?
                                     &r->client_princ->name : NULL,
				 r->client_princ ?
                                     &r->client_princ->realm : NULL,
CVE-2021-3671: NULL Pointer Dereference (CWE-476)
value: A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 6.5
Published: 2021-10-12T18:15Z
Repository: https://github.com/heimdal/heimdal
Language: C
Files changed: kdc/krb5tgs.c
Commit date: 2021-08-27 11:45:41 +1000
Commit message: kdc: validate sname in TGS-REQ

In tgs_build_reply(), validate the server name in the TGS-REQ is present before
dereferencing.

Diff: diff --git a/kdc/krb5tgs.c b/kdc/krb5tgs.c
index e8a3d1b372..3394150162 100644
--- a/kdc/krb5tgs.c
+++ b/kdc/krb5tgs.c
@@ -1697,10 +1697,14 @@ tgs_build_reply(astgs_request_t priv,
 	    goto out;
         }
 
 	s = &adtkt.cname;
 	r = adtkt.crealm;
+    } else if (s == NULL) {
+	ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
+	_kdc_set_e_text(r, "No server in request");
+	goto out;
     }
 
     _krb5_principalname2krb5_principal(context, &sp, *s, r);
     ret = krb5_unparse_name(context, sp, &priv->sname);
     if (ret)

Fixed code:     } else if (s == NULL) {
	ret = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
	_kdc_set_e_text(r, "No server in request");
	goto out;
CVE-2020-5281: Incorrect Permission Assignment for Critical Resource (CWE-732)
value: In Perun before version 3.9.1, VO or group manager can modify configuration of the LDAP extSource to retrieve all from Perun LDAP. Issue is fixed in version 3.9.1 by sanitisation of the input.
CWE description: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CVSS v3 base score: 7.5
Published: 2020-03-25T18:15Z
Repository: https://github.com/CESNET/perun
Language: Unknown
Commit date: 2020-03-24 20:31:08 +0100
Commit message: Merge pull request #2635 from stavamichal/fixVulnerablityInLDAPBasedExtSources

Fix vulnerability in communication with LDAP connector
CVE-2023-42457: Allocation of Resources Without Limits or Throttling (CWE-770)
value: plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches are available in `plone.rest` 2.0.1 and 3.0.1.  Series 1.x is not affected. As a workaround, one may redirect `/++api++/++api++` to `/++api++` in one's frontend web server (nginx, Apache).

CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 7.5
Published: 2023-09-21T15:15Z
Repository: https://github.com/plone/plone.rest
Language: Unknown
Commit date: 2023-09-21 13:15:43 +0200
Commit message: Merge pull request from GHSA-h6rp-mprm-xgcq

When ++api++ is in the url multiple times, redirect to the proper url. [master]
CVE-2022-36752: Out-of-bounds Write (CWE-787)
value: png2webp v1.0.4 was discovered to contain an out-of-bounds write via the function w2p. This vulnerability is exploitable via a crafted png file.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2022-07-28T23:15Z
Repository: https://github.com/landfillbaby/png2webp
Language: C
Files changed: png2webp.c
Commit date: 2022-07-23 21:18:44 +0100
Commit message: v1.0.5: fix buffer overrun when reading bad WebPs

Diff: diff --git a/png2webp.c b/png2webp.c
index 42443f5..9caaca1 100644
--- a/png2webp.c
+++ b/png2webp.c
@@ -1,8 +1,8 @@
 // anti-copyright Lucy Phipps 2022
 // vi: sw=2 tw=80
-#define VERSION "v1.0.4"
+#define VERSION "v1.0.5"
 #include <errno.h>
 #include <inttypes.h>
 #include <limits.h>
 #include <setjmp.h>
 #include <stdbool.h>
@@ -317,10 +317,18 @@ static bool w2p(char *ip, char *op) {
     PF("ERROR reading %s: %s", IP, k[2]);
     goto w2p_close;
   }
   size_t l = ((uint32_t)(i[4] | (i[5] << 8) | (i[6] << 16) | (i[7] << 24))) + 8;
   // ^ RIFF header size
+  if(l <= 12
+#ifdef SSIZE_MAX
+    || l - 12 > SSIZE_MAX
+#endif
+  ) {
+    PF("ERROR reading %s: %s", IP, k[2]);
+    goto w2p_close;
+  }
   x = malloc(l);
   if(!x) {
     PF("ERROR reading %s: %s", IP, *k);
     goto w2p_close;
   }

Vulnerable code: #define VERSION "v1.0.4"
Fixed code: #define VERSION "v1.0.5"
  if(l <= 12
#ifdef SSIZE_MAX
    || l - 12 > SSIZE_MAX
#endif
  ) {
    PF("ERROR reading %s: %s", IP, k[2]);
    goto w2p_close;
  }
CVE-2024-34713: Insufficient Information (NVD-CWE-noinfo)
value: sshproxy is used on a gateway to transparently proxy a user SSH connection on the gateway to an internal host via SSH. Prior to version 1.6.3, any user authorized to connect to a ssh server using `sshproxy` can inject options to the `ssh` command executed by `sshproxy`. All versions of `sshproxy` are impacted. The problem is patched starting in version 1.6.3. The only workaround is to use the `force_command` option in `sshproxy.yaml`, but it's rarely relevant.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-14T16:17Z
Repository: https://github.com/cea-hpc/sshproxy
Language: Other
Files changed: cmd/sshproxy/sshproxy.go, test/fedora-image/Dockerfile
Commit date: 2024-05-14 16:21:16 +0200
Commit message: Prevent ssh option injection (#16)


Diff: diff --git a/cmd/sshproxy/sshproxy.go b/cmd/sshproxy/sshproxy.go
index 0a61aa6..1729986 100644
--- a/cmd/sshproxy/sshproxy.go
+++ b/cmd/sshproxy/sshproxy.go
@@ -472,11 +472,11 @@ func mainExitCode() int {
 		}
 		for fromCmd, translateCmdConf := range config.TranslateCommands {
 			if doCmd == fromCmd {
 				log.Debugf("translateCmdConf = %+v", translateCmdConf)
 				sshArgs = append(sshArgs, translateCmdConf.SSHArgs...)
-				sshArgs = append(sshArgs, "--", host, translateCmdConf.Command)
+				sshArgs = append(sshArgs, host, "--", translateCmdConf.Command)
 				if config.Dump != "" && translateCmdConf.DisableDump {
 					config.Dump = "etcd"
 				}
 				commandTranslated = true
 				break
@@ -485,11 +485,11 @@ func mainExitCode() int {
 		if !commandTranslated {
 			if interactiveCommand {
 				// Force TTY allocation because the user probably asked for it.
 				sshArgs = append(sshArgs, "-t")
 			}
-			sshArgs = append(sshArgs, host, doCmd)
+			sshArgs = append(sshArgs, host, "--", doCmd)
 		}
 	} else {
 		sshArgs = append(sshArgs, host)
 	}
 	cmd := exec.CommandContext(ctx, config.SSH.Exe, sshArgs...)
diff --git a/test/fedora-image/Dockerfile b/test/fedora-image/Dockerfile
index 0a5437a..62c63ff 100644
--- a/test/fedora-image/Dockerfile
+++ b/test/fedora-image/Dockerfile
@@ -1,6 +1,6 @@
-FROM fedora:latest
+FROM fedora:39
 
 # Install development environment to compile RPM
 RUN set -ex \
 	&& yum -y update \
 	&& yum -y install asciidoc etcd git golang hostname iproute make openssh-server rpm-build procps

Vulnerable code: 				sshArgs = append(sshArgs, "--", host, translateCmdConf.Command)
			sshArgs = append(sshArgs, host, doCmd)
FROM fedora:latest
Fixed code: 				sshArgs = append(sshArgs, host, "--", translateCmdConf.Command)
			sshArgs = append(sshArgs, host, "--", doCmd)
FROM fedora:39