Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2020-16088: Improper Authentication (CWE-287)
value: iked in OpenIKED, as used in OpenBSD through 6.7, allows authentication bypass because ca.c has the wrong logic for checking whether a public key matches.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 9.8
Published: 2020-07-28T12:15Z
Repository: https://github.com/openbsd/src
Language: C
Files changed: sbin/iked/ca.c
Commit date: 2020-07-27 14:22:53 +0000
Commit message: Fix return value check for openssl API used during pubkey validation.

Found thanks to bug report by Michael Scheibel <m.Scheibel (at) tuvit (dot) de>
ok patrick@, markus@, tb@

Diff: diff --git a/sbin/iked/ca.c b/sbin/iked/ca.c
index 15a0e4bcbfff..afb45a24d922 100644
--- a/sbin/iked/ca.c
+++ b/sbin/iked/ca.c
@@ -1,6 +1,6 @@
-/*	$OpenBSD: ca.c,v 1.64 2020/07/15 14:45:15 tobhe Exp $	*/
+/*	$OpenBSD: ca.c,v 1.65 2020/07/27 14:22:53 tobhe Exp $	*/
 
 /*
  * Copyright (c) 2010-2013 Reyk Floeter <reyk@openbsd.org>
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -1418,11 +1418,11 @@ ca_validate_pubkey(struct iked *env, struct iked_static_id *id,
 		fclose(fp);
 	}
 	if (localkey == NULL)
 		goto sslerr;
 
-	if (peerkey && !EVP_PKEY_cmp(peerkey, localkey)) {
+	if (peerkey && EVP_PKEY_cmp(peerkey, localkey) != 1) {
 		log_debug("%s: public key does not match %s", __func__, file);
 		goto done;
 	}
 
 	log_debug("%s: valid public key in file %s", __func__, file);

Vulnerable code: /*	$OpenBSD: ca.c,v 1.64 2020/07/15 14:45:15 tobhe Exp $	*/
	if (peerkey && !EVP_PKEY_cmp(peerkey, localkey)) {
Fixed code: /*	$OpenBSD: ca.c,v 1.65 2020/07/27 14:22:53 tobhe Exp $	*/
	if (peerkey && EVP_PKEY_cmp(peerkey, localkey) != 1) {
CVE-2020-35679: Missing Release of Memory after Effective Lifetime (CWE-401)
value: smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very significant" memory leak via messages to an instance that performs many regex lookups.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 7.5
Published: 2020-12-24T16:15Z
Repository: https://github.com/openbsd/src
Language: C
Files changed: usr.sbin/smtpd/table.c
Commit date: 2020-12-23 08:12:14 +0000
Commit message: Use regfree after we're done with preg.

From gilles@

Diff: diff --git a/usr.sbin/smtpd/table.c b/usr.sbin/smtpd/table.c
index b79451caadd4..1d82d88b81a4 100644
--- a/usr.sbin/smtpd/table.c
+++ b/usr.sbin/smtpd/table.c
@@ -1,6 +1,6 @@
-/*	$OpenBSD: table.c,v 1.48 2019/01/10 07:40:52 eric Exp $	*/
+/*	$OpenBSD: table.c,v 1.49 2020/12/23 08:12:14 martijn Exp $	*/
 
 /*
  * Copyright (c) 2013 Eric Faurot <eric@openbsd.org>
  * Copyright (c) 2008 Gilles Chehade <gilles@poolp.org>
  *
@@ -462,20 +462,25 @@ table_inet6_match(struct sockaddr_in6 *ss, struct netaddr *ssmask)
 int
 table_regex_match(const char *string, const char *pattern)
 {
 	regex_t preg;
 	int	cflags = REG_EXTENDED|REG_NOSUB;
+	int ret;
 
 	if (strncmp(pattern, "(?i)", 4) == 0) {
 		cflags |= REG_ICASE;
 		pattern += 4;
 	}
 
 	if (regcomp(&preg, pattern, cflags) != 0)
 		return (0);
 
-	if (regexec(&preg, string, 0, NULL, 0) != 0)
+	ret = regexec(&preg, string, 0, NULL, 0);
+
+	regfree(&preg);
+
+	if (ret != 0)
 		return (0);
 
 	return (1);
 }
 

Vulnerable code: /*	$OpenBSD: table.c,v 1.48 2019/01/10 07:40:52 eric Exp $	*/
	if (regexec(&preg, string, 0, NULL, 0) != 0)
Fixed code: /*	$OpenBSD: table.c,v 1.49 2020/12/23 08:12:14 martijn Exp $	*/
	int ret;
	ret = regexec(&preg, string, 0, NULL, 0);

	regfree(&preg);

	if (ret != 0)
CVE-2023-38408: Unquoted Search Path or Element (CWE-428)
value: The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.
CWE description: The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
CVSS v3 base score: 9.8
Published: 2023-07-20T03:15Z
Repository: https://github.com/openbsd/src
Language: C
Files changed: usr.bin/ssh/ssh-pkcs11.c
Commit date: 2023-07-19 13:55:53 +0000
Commit message: terminate process if requested to load a PKCS#11 provider that
isn't a PKCS#11 provider; from / ok markus@

Diff: diff --git a/usr.bin/ssh/ssh-pkcs11.c b/usr.bin/ssh/ssh-pkcs11.c
index 3d9a92f77f27a..da2efd13d62e2 100644
--- a/usr.bin/ssh/ssh-pkcs11.c
+++ b/usr.bin/ssh/ssh-pkcs11.c
@@ -1,6 +1,6 @@
-/* $OpenBSD: ssh-pkcs11.c,v 1.56 2023/03/08 05:33:53 tb Exp $ */
+/* $OpenBSD: ssh-pkcs11.c,v 1.57 2023/07/19 13:55:53 djm Exp $ */
 /*
  * Copyright (c) 2010 Markus Friedl.  All rights reserved.
  * Copyright (c) 2014 Pedro Martelletto. All rights reserved.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -1510,14 +1510,12 @@ pkcs11_register_provider(char *provider_id, char *pin,
 	/* open shared pkcs11-library */
 	if ((handle = dlopen(provider_id, RTLD_NOW)) == NULL) {
 		error("dlopen %s failed: %s", provider_id, dlerror());
 		goto fail;
 	}
-	if ((getfunctionlist = dlsym(handle, "C_GetFunctionList")) == NULL) {
-		error("dlsym(C_GetFunctionList) failed: %s", dlerror());
-		goto fail;
-	}
+	if ((getfunctionlist = dlsym(handle, "C_GetFunctionList")) == NULL)
+		fatal("dlsym(C_GetFunctionList) failed: %s", dlerror());
 	p = xcalloc(1, sizeof(*p));
 	p->name = xstrdup(provider_id);
 	p->handle = handle;
 	/* setup the pkcs11 callbacks */
 	if ((rv = (*getfunctionlist)(&f)) != CKR_OK) {

Vulnerable code: /* $OpenBSD: ssh-pkcs11.c,v 1.56 2023/03/08 05:33:53 tb Exp $ */
	if ((getfunctionlist = dlsym(handle, "C_GetFunctionList")) == NULL) {
		error("dlsym(C_GetFunctionList) failed: %s", dlerror());
		goto fail;
	}
Fixed code: /* $OpenBSD: ssh-pkcs11.c,v 1.57 2023/07/19 13:55:53 djm Exp $ */
	if ((getfunctionlist = dlsym(handle, "C_GetFunctionList")) == NULL)
		fatal("dlsym(C_GetFunctionList) failed: %s", dlerror());
CVE-2023-52557: Insufficient Information (NVD-CWE-noinfo)
value: In OpenBSD 7.3 before errata 016, npppd(8) could crash by a l2tp message which has an AVP (Attribute-Value Pair) with wrong length.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-01T17:15Z
Repository: https://github.com/openbsd/src
Language: C
Files changed: usr.sbin/npppd/l2tp/l2tp_subr.c
Commit date: 2023-09-11 07:33:07 +0000
Commit message: Check if the avp->length is not broken.   Also make sure that
avp_enum() checks if avp->length is valid.

ok mvp

Diff: diff --git a/usr.sbin/npppd/l2tp/l2tp_subr.c b/usr.sbin/npppd/l2tp/l2tp_subr.c
index da1a0fe8c82f9..a312d7bc5b087 100644
--- a/usr.sbin/npppd/l2tp/l2tp_subr.c
+++ b/usr.sbin/npppd/l2tp/l2tp_subr.c
@@ -1,6 +1,6 @@
-/*	$OpenBSD: l2tp_subr.c,v 1.4 2012/05/08 13:15:11 yasuoka Exp $	*/
+/*	$OpenBSD: l2tp_subr.c,v 1.5 2023/09/11 07:33:07 yasuoka Exp $	*/
 
 /*-
  * Copyright (c) 2009 Internet Initiative Japan Inc.
  * All rights reserved.
  *
@@ -23,11 +23,11 @@
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
-/* $Id: l2tp_subr.c,v 1.4 2012/05/08 13:15:11 yasuoka Exp $ */
+/* $Id: l2tp_subr.c,v 1.5 2023/09/11 07:33:07 yasuoka Exp $ */
 /**@file L2TP related sub-routines */
 #include <sys/types.h>
 #include <sys/time.h>
 #include <sys/socket.h>
 #include <netinet/in.h>
@@ -78,14 +78,14 @@ avp_enum(struct l2tp_avp *avp, const u_char *pkt, int pktlen, int filldata)
 
 	avp->attr_type = *pkt << 8;
 	avp->attr_type |= *(pkt + 1);
 	pkt += 2;
 
-	if (avp->length > pktlen)
+	if (avp->length < 6 || avp->length > pktlen)
 		return -1;
 
-	if (filldata != 0)
+	if (avp->length > 6 && filldata != 0)
 		memcpy(avp->attr_value, pkt, avp->length - 6);
 
 	return avp->length;
 }
 
@@ -283,13 +283,12 @@ avp_find(struct l2tp_avp *avp, const u_char *pkt, int pktlen,
 {
 	int avpsz;
 
 	while (pktlen >= 6 &&
 	    (avpsz = avp_enum(avp, pkt, pktlen, fill_data)) > 0) {
+		L2TP_SUBR_ASSERT(avpsz >= 6);
 		if (avp->vendor_id != vendor_id || avp->attr_type != attr_type) {
-			if (avpsz < 6)
-				return NULL;
 			pkt += avpsz;
 			pktlen -= avpsz;
 			continue;
 		}
 		return avp;

Vulnerable code: /*	$OpenBSD: l2tp_subr.c,v 1.4 2012/05/08 13:15:11 yasuoka Exp $	*/
/* $Id: l2tp_subr.c,v 1.4 2012/05/08 13:15:11 yasuoka Exp $ */
	if (avp->length > pktlen)
	if (filldata != 0)
			if (avpsz < 6)
				return NULL;
Fixed code: /*	$OpenBSD: l2tp_subr.c,v 1.5 2023/09/11 07:33:07 yasuoka Exp $	*/
/* $Id: l2tp_subr.c,v 1.5 2023/09/11 07:33:07 yasuoka Exp $ */
	if (avp->length < 6 || avp->length > pktlen)
	if (avp->length > 6 && filldata != 0)
		L2TP_SUBR_ASSERT(avpsz >= 6);
CVE-2023-52558: Insufficient Information (NVD-CWE-noinfo)
value: In OpenBSD 7.4 before errata 002 and OpenBSD 7.3 before errata 019, a network buffer that had to be split at certain length that could crash the kernel after receiving specially crafted escape sequences.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-01T17:15Z
Repository: https://github.com/openbsd/src
Language: C
Files changed: sys/kern/uipc_mbuf.c
Commit date: 2023-10-20 16:25:15 +0000
Commit message: Avoid assertion failure when splitting mbuf cluster.

m_split() calls m_align() to initialize the data pointer of newly
allocated mbuf.  If the new mbuf will be converted to a cluster,
this is not necessary.  If additionally the new mbuf is larger than
MLEN, this can lead to a panic.
Only call m_align() when a valid m_data is needed.  This is the
case if we do not refecence the existing cluster, but memcpy() the
data into the new mbuf.

Reported-by: syzbot+0e6817f5877926f0e96a@syzkaller.appspotmail.com
OK claudio@ deraadt@

Diff: diff --git a/sys/kern/uipc_mbuf.c b/sys/kern/uipc_mbuf.c
index ba59f13a9541d..5d1f9a7b80286 100644
--- a/sys/kern/uipc_mbuf.c
+++ b/sys/kern/uipc_mbuf.c
@@ -1,6 +1,6 @@
-/*	$OpenBSD: uipc_mbuf.c,v 1.287 2023/06/23 04:36:49 gnezdo Exp $	*/
+/*	$OpenBSD: uipc_mbuf.c,v 1.288 2023/10/20 16:25:15 bluhm Exp $	*/
 /*	$NetBSD: uipc_mbuf.c,v 1.15.4.1 1996/06/13 17:11:44 cgd Exp $	*/
 
 /*
  * Copyright (c) 1982, 1986, 1988, 1991, 1993
  *	The Regents of the University of California.  All rights reserved.
@@ -1078,13 +1078,11 @@ m_split(struct mbuf *m0, int len0, int wait)
 			n->m_next = m->m_next;
 			m->m_next = NULL;
 			n->m_len = 0;
 			return (n);
 		}
-		if (m->m_flags & M_EXT)
-			goto extpacket;
-		if (remain > MHLEN) {
+		if ((m->m_flags & M_EXT) == 0 && remain > MHLEN) {
 			/* m can't be the lead packet */
 			m_align(n, 0);
 			n->m_next = m_split(m, len, wait);
 			if (n->m_next == NULL) {
 				(void) m_free(n);
@@ -1092,28 +1090,26 @@ m_split(struct mbuf *m0, int len0, int wait)
 				return (NULL);
 			} else {
 				n->m_len = 0;
 				return (n);
 			}
-		} else
-			m_align(n, remain);
+		}
 	} else if (remain == 0) {
 		n = m->m_next;
 		m->m_next = NULL;
 		return (n);
 	} else {
 		MGET(n, wait, m->m_type);
 		if (n == NULL)
 			return (NULL);
-		m_align(n, remain);
 	}
-extpacket:
 	if (m->m_flags & M_EXT) {
 		n->m_ext = m->m_ext;
 		MCLADDREFERENCE(m, n);
 		n->m_data = m->m_data + len;
 	} else {
+		m_align(n, remain);
 		memcpy(mtod(n, caddr_t), mtod(m, caddr_t) + len, remain);
 	}
 	n->m_len = remain;
 	m->m_len = len;
 	n->m_next = m->m_next;

Vulnerable code: /*	$OpenBSD: uipc_mbuf.c,v 1.287 2023/06/23 04:36:49 gnezdo Exp $	*/
		if (m->m_flags & M_EXT)
			goto extpacket;
		if (remain > MHLEN) {
		} else
			m_align(n, remain);
		m_align(n, remain);
extpacket:
Fixed code: /*	$OpenBSD: uipc_mbuf.c,v 1.288 2023/10/20 16:25:15 bluhm Exp $	*/
		if ((m->m_flags & M_EXT) == 0 && remain > MHLEN) {
		}
		m_align(n, remain);
CVE-2021-21381: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by the app's permissions. By putting the special tokens `@@` and/or `@@u` in the Exec field of a Flatpak app's .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had chosen to open a target file with their Flatpak app, which automatically makes that file available to the Flatpak app. This is fixed in version 1.10.2. A minimal solution is the first commit "`Disallow @@ and @@U usage in desktop files`". The follow-up commits "`dir: Reserve the whole @@ prefix`" and "`dir: Refuse to export .desktop files with suspicious uses of @@ tokens`" are recommended, but not strictly required. As a workaround, avoid installing Flatpak apps from untrusted sources, or check the contents of the exported `.desktop` files in `exports/share/applications/*.desktop` (typically `~/.local/share/flatpak/exports/share/applications/*.desktop` and `/var/lib/flatpak/exports/share/applications/*.desktop`) to make sure that literal filenames do not follow `@@` or `@@u`.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 8.2
Published: 2021-03-11T17:15Z
Repository: https://github.com/flatpak/flatpak
Language: C
Files changed: common/flatpak-dir.c
Commit date: 2021-03-10 11:13:38 +0100
Commit message: Disallow @@ and @@u usage in desktop files

Fixes #4146.

(cherry picked from commit 652a28ffab67cb6cd7d12dc3a93979bcd3731c7f)

Diff: diff --git a/common/flatpak-dir.c b/common/flatpak-dir.c
index 507a71b12..82f2ce68a 100644
--- a/common/flatpak-dir.c
+++ b/common/flatpak-dir.c
@@ -7137,10 +7137,12 @@ export_desktop_file (const char         *app,
 
               if (strcasecmp (arg, "%f") == 0)
                 g_string_append_printf (new_exec, " @@ %s @@", arg);
               else if (strcasecmp (arg, "%u") == 0)
                 g_string_append_printf (new_exec, " @@u %s @@", arg);
+              else if (strcmp (arg, "@@") == 0 || strcmp (arg, "@@u") == 0)
+                g_print (_("Skipping invalid Exec argument %s\n"), arg);
               else
                 g_string_append_printf (new_exec, " %s", arg);
             }
         }
       else

Fixed code:               else if (strcmp (arg, "@@") == 0 || strcmp (arg, "@@u") == 0)
                g_print (_("Skipping invalid Exec argument %s\n"), arg);
CVE-2021-41133: Other (NVD-CWE-Other)
value: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has. Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from upgrading to a patched version.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 7.8
Published: 2021-10-08T14:15Z
Repository: https://github.com/flatpak/flatpak
Language: C
Files changed: common/flatpak-run.c
Commit date: 2021-10-08 12:53:20 +0200
Commit message: run: Don't allow unmounting filesystems

If we don't allow mounting filesystems, we shouldn't allow unmounting
either.

Partially fixes GHSA-67h7-w3jq-vh4q.

Signed-off-by: Simon McVittie <smcv@collabora.com>

Diff: diff --git a/common/flatpak-run.c b/common/flatpak-run.c
index 277f2de3e..a6ef5042a 100644
--- a/common/flatpak-run.c
+++ b/common/flatpak-run.c
@@ -2932,10 +2932,12 @@ setup_seccomp (FlatpakBwrap   *bwrap,
 
     /* Don't allow subnamespace setups: */
     {SCMP_SYS (unshare), EPERM},
     {SCMP_SYS (setns), EPERM},
     {SCMP_SYS (mount), EPERM},
+    {SCMP_SYS (umount), EPERM},
+    {SCMP_SYS (umount2), EPERM},
     {SCMP_SYS (pivot_root), EPERM},
 #if defined(__s390__) || defined(__s390x__) || defined(__CRIS__)
     /* Architectures with CONFIG_CLONE_BACKWARDS2: the child stack
      * and flags arguments are reversed so the flags come second */
     {SCMP_SYS (clone), EPERM, &SCMP_A1 (SCMP_CMP_MASKED_EQ, CLONE_NEWUSER, CLONE_NEWUSER)},

Fixed code:     {SCMP_SYS (umount), EPERM},
    {SCMP_SYS (umount2), EPERM},
CVE-2021-41133: Other (NVD-CWE-Other)
value: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has. Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from upgrading to a patched version.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 7.8
Published: 2021-10-08T14:15Z
Repository: https://github.com/flatpak/flatpak
Language: C
Files changed: common/flatpak-run.c
Commit date: 2021-10-08 12:53:20 +0200
Commit message: run: Block setns()

If we don't allow unshare() or clone() with CLONE_NEWUSER, we also
shouldn't allow joining an existing (but different) namespace.

Partially fixes GHSA-67h7-w3jq-vh4q.

Signed-off-by: Simon McVittie <smcv@collabora.com>

Diff: diff --git a/common/flatpak-run.c b/common/flatpak-run.c
index 7cbabde07..277f2de3e 100644
--- a/common/flatpak-run.c
+++ b/common/flatpak-run.c
@@ -2930,10 +2930,11 @@ setup_seccomp (FlatpakBwrap   *bwrap,
     {SCMP_SYS (set_mempolicy), EPERM},
     {SCMP_SYS (migrate_pages), EPERM},
 
     /* Don't allow subnamespace setups: */
     {SCMP_SYS (unshare), EPERM},
+    {SCMP_SYS (setns), EPERM},
     {SCMP_SYS (mount), EPERM},
     {SCMP_SYS (pivot_root), EPERM},
 #if defined(__s390__) || defined(__s390x__) || defined(__CRIS__)
     /* Architectures with CONFIG_CLONE_BACKWARDS2: the child stack
      * and flags arguments are reversed so the flags come second */

Fixed code:     {SCMP_SYS (setns), EPERM},
CVE-2021-41133: Other (NVD-CWE-Other)
value: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has. Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from upgrading to a patched version.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 7.8
Published: 2021-10-08T14:15Z
Repository: https://github.com/flatpak/flatpak
Language: C
Files changed: common/flatpak-run.c
Commit date: 2021-10-08 12:53:20 +0200
Commit message: run: Add cross-references for some other seccomp syscall filters

Signed-off-by: Simon McVittie <smcv@collabora.com>

Diff: diff --git a/common/flatpak-run.c b/common/flatpak-run.c
index 7817ff94f..ff6403d39 100644
--- a/common/flatpak-run.c
+++ b/common/flatpak-run.c
@@ -2890,10 +2890,14 @@ setup_seccomp (FlatpakBwrap   *bwrap,
    *  https://github.com/flatpak/flatpak.git
    *    in common/flatpak-run.c
    *  https://git.gnome.org/browse/linux-user-chroot
    *    in src/setup-seccomp.c
    *
+   * Other useful resources:
+   * https://github.com/systemd/systemd/blob/HEAD/src/shared/seccomp-util.c
+   * https://github.com/moby/moby/blob/HEAD/profiles/seccomp/default.json
+   *
    **** END NOTE ON CODE SHARING
    */
   struct
   {
     int                  scall;

Fixed code:    * Other useful resources:
   * https://github.com/systemd/systemd/blob/HEAD/src/shared/seccomp-util.c
   * https://github.com/moby/moby/blob/HEAD/profiles/seccomp/default.json
   *
CVE-2021-41133: Other (NVD-CWE-Other)
value: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has. Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from upgrading to a patched version.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 7.8
Published: 2021-10-08T14:15Z
Repository: https://github.com/flatpak/flatpak
Language: C
Files changed: common/flatpak-run.c
Commit date: 2021-10-08 12:53:20 +0200
Commit message: run: Don't allow chroot()

If we don't allow pivot_root() then there seems no reason why we should
allow chroot().

Partially fixes GHSA-67h7-w3jq-vh4q.

Signed-off-by: Simon McVittie <smcv@collabora.com>

Diff: diff --git a/common/flatpak-run.c b/common/flatpak-run.c
index a6ef5042a..786134379 100644
--- a/common/flatpak-run.c
+++ b/common/flatpak-run.c
@@ -2935,10 +2935,11 @@ setup_seccomp (FlatpakBwrap   *bwrap,
     {SCMP_SYS (setns), EPERM},
     {SCMP_SYS (mount), EPERM},
     {SCMP_SYS (umount), EPERM},
     {SCMP_SYS (umount2), EPERM},
     {SCMP_SYS (pivot_root), EPERM},
+    {SCMP_SYS (chroot), EPERM},
 #if defined(__s390__) || defined(__s390x__) || defined(__CRIS__)
     /* Architectures with CONFIG_CLONE_BACKWARDS2: the child stack
      * and flags arguments are reversed so the flags come second */
     {SCMP_SYS (clone), EPERM, &SCMP_A1 (SCMP_CMP_MASKED_EQ, CLONE_NEWUSER, CLONE_NEWUSER)},
 #else

Fixed code:     {SCMP_SYS (chroot), EPERM},
CVE-2023-28101: Improper Encoding or Escaping of Output (CWE-116)
value: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME Software rather than the command-line interface, or only install apps whose maintainers you trust.
CWE description: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CVSS v3 base score: 4.3
Published: 2023-03-16T16:15Z
Repository: https://github.com/flatpak/flatpak
Language: C
Files changed: app/flatpak-cli-transaction.c
Commit date: 2023-03-16 09:54:14 +0000
Commit message: cli-transaction: Escape any special characters in the EOL reason

CVE-2023-28101, GHSA-h43h-fwqx-mpp8

Signed-off-by: Simon McVittie <smcv@collabora.com>

Diff: diff --git a/app/flatpak-cli-transaction.c b/app/flatpak-cli-transaction.c
index 53593bfc20..829f44b21b 100644
--- a/app/flatpak-cli-transaction.c
+++ b/app/flatpak-cli-transaction.c
@@ -753,10 +753,13 @@ print_eol_info_message (FlatpakDir        *dir,
                      on, ref_name, off, on, ref_branch, off, on, eolr_name, off, on, eolr_branch, off);
         }
     }
   else if (reason)
     {
+      g_autofree char *escaped_reason = flatpak_escape_string (reason,
+                                                               FLATPAK_ESCAPE_ALLOW_NEWLINES |
+                                                               FLATPAK_ESCAPE_DO_NOT_QUOTE);
       if (is_pinned)
         {
           /* Only runtimes can be pinned */
           g_print (_("\nInfo: (pinned) runtime %s%s%s branch %s%s%s is end-of-life, with reason:\n"),
                    on, ref_name, off, on, ref_branch, off);
@@ -768,11 +771,11 @@ print_eol_info_message (FlatpakDir        *dir,
                      on, ref_name, off, on, ref_branch, off);
           else
             g_print (_("\nInfo: app %s%s%s branch %s%s%s is end-of-life, with reason:\n"),
                      on, ref_name, off, on, ref_branch, off);
         }
-      g_print ("   %s\n", reason);
+      g_print ("   %s\n", escaped_reason);
     }
 }
 
 static void
 check_current_transaction_for_dependent_apps (GPtrArray          *apps,

Vulnerable code:       g_print ("   %s\n", reason);
Fixed code:       g_autofree char *escaped_reason = flatpak_escape_string (reason,
                                                               FLATPAK_ESCAPE_ALLOW_NEWLINES |
                                                               FLATPAK_ESCAPE_DO_NOT_QUOTE);
      g_print ("   %s\n", escaped_reason);
CVE-2024-37301: Insufficient Information (NVD-CWE-noinfo)
value: Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Versions 6.5.1 and prior are vulnerable to remote code execution via server-side template injection which, when executed as root, can result in full takeover of the affected system. As of time of publication, no patched version exists, nor have any known workarounds been disclosed.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-06-11T19:16Z
Repository: https://github.com/adfinis/document-merge-service
Language: Python
Files changed: document_merge_service/api/jinja.py
Commit date: 2024-06-12 08:51:07 +0200
Commit message: fix: use a sandboxed environment (#763)


Diff: diff --git a/document_merge_service/api/jinja.py b/document_merge_service/api/jinja.py
index 6267d4b..1e8cb27 100644
--- a/document_merge_service/api/jinja.py
+++ b/document_merge_service/api/jinja.py
@@ -4,11 +4,12 @@ from babel.dates import format_date, format_datetime, format_time
 from dateutil.parser import parse
 from django.conf import settings
 from django.utils.translation import to_locale
 from docx.shared import Mm
 from docxtpl import InlineImage, Listing
-from jinja2 import Environment, pass_context
+from jinja2 import pass_context
+from jinja2.sandbox import SandboxedEnvironment
 from rest_framework.exceptions import ValidationError
 
 
 def parse_string(value):
     return parse(str(value))
@@ -96,8 +97,8 @@ def get_jinja_filters():
         "image": image,
     }
 
 
 def get_jinja_env():
-    jinja_env = Environment(extensions=settings.DOCXTEMPLATE_JINJA_EXTENSIONS)
+    jinja_env = SandboxedEnvironment(extensions=settings.DOCXTEMPLATE_JINJA_EXTENSIONS)
     jinja_env.filters.update(get_jinja_filters())
     return jinja_env

Vulnerable code: from jinja2 import Environment, pass_context
    jinja_env = Environment(extensions=settings.DOCXTEMPLATE_JINJA_EXTENSIONS)
Fixed code: from jinja2 import pass_context
from jinja2.sandbox import SandboxedEnvironment
    jinja_env = SandboxedEnvironment(extensions=settings.DOCXTEMPLATE_JINJA_EXTENSIONS)
CVE-2010-5312: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2014-11-24T16:59Z
Repository: https://github.com/jquery/jquery-ui
Language: JavaScript
Files changed: ui/jquery.ui.dialog.js
Commit date: 2012-11-26 10:28:25 +0100
Commit message: Dialog: Extract setting the title into a _title method, use .text() to prevent XSS. Fixes #6016 - Dialog: Title XSS Vulnerability.

Diff: diff --git a/ui/jquery.ui.dialog.js b/ui/jquery.ui.dialog.js
index 5eb3e2ac..808d31d5 100644
--- a/ui/jquery.ui.dialog.js
+++ b/ui/jquery.ui.dialog.js
@@ -350,18 +350,25 @@ $.widget("ui.dialog", {
 		});
 
 		uiDialogTitle = $( "<span>" )
 			.uniqueId()
 			.addClass( "ui-dialog-title" )
-			.html( this.options.title || "&#160;" )
 			.prependTo( this.uiDialogTitlebar );
+		this._title( uiDialogTitle );
 
 		this.uiDialog.attr({
 			"aria-labelledby": uiDialogTitle.attr( "id" )
 		});
 	},
 
+	_title: function( title ) {
+		if ( !this.options.title ) {
+			title.html( "&#160;" );
+		}
+		title.text( this.options.title );
+	},
+
 	_createButtonPane: function() {
 		var uiDialogButtonPane = ( this.uiDialogButtonPane = $( "<div>" ) )
 			.addClass( "ui-dialog-buttonpane ui-widget-content ui-helper-clearfix" );
 
 		this.uiButtonSet = $( "<div>" )
@@ -598,13 +605,11 @@ $.widget("ui.dialog", {
 				this._makeResizable();
 			}
 		}
 
 		if ( key === "title" ) {
-			// convert whatever was passed in to a string, for html() to not throw up
-			$( ".ui-dialog-title", this.uiDialogTitlebar )
-				.html( "" + ( value || "&#160;" ) );
+			this._title( this.uiDialogTitlebar.find( ".ui-dialog-title" ) );
 		}
 	},
 
 	_size: function() {
 

Vulnerable code: 			.html( this.options.title || "&#160;" )
			// convert whatever was passed in to a string, for html() to not throw up
			$( ".ui-dialog-title", this.uiDialogTitlebar )
				.html( "" + ( value || "&#160;" ) );
Fixed code: 		this._title( uiDialogTitle );
	_title: function( title ) {
		if ( !this.options.title ) {
			title.html( "&#160;" );
		}
		title.text( this.options.title );
	},

			this._title( this.uiDialogTitlebar.find( ".ui-dialog-title" ) );
CVE-2012-6662: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-11-24T16:59Z
Repository: https://github.com/jquery/jquery-ui
Language: HTML
Files changed: demos/autocomplete/combobox.html
Commit date: 2012-11-27 10:52:40 -0500
Commit message: Autocomplete demo: Combobox: Encode search term inside tooltips. Fixes #8859 - Autocomplete: XSS in combobox demo.

Diff: diff --git a/demos/autocomplete/combobox.html b/demos/autocomplete/combobox.html
index 6229d47b2..8c6f59fc1 100644
--- a/demos/autocomplete/combobox.html
+++ b/demos/autocomplete/combobox.html
@@ -59,11 +59,11 @@
 
 					if ( !valid ) {
 						// remove invalid value, as it didn't match anything
 						$( element )
 							.val( "" )
-							.attr( "title", value + " didn't match any item" )
+							.attr( "title", $( "<a>" ).text( value ).html() + " didn't match any item" )
 							.tooltip( "open" );
 						select.val( "" );
 						setTimeout(function() {
 							input.tooltip( "close" ).attr( "title", "" );
 						}, 2500 );

Vulnerable code: 							.attr( "title", value + " didn't match any item" )
Fixed code: 							.attr( "title", $( "<a>" ).text( value ).html() + " didn't match any item" )
CVE-2021-21413: Improper Control of Dynamically-Managed Code Resources (CWE-913)
value: isolated-vm is a library for nodejs which gives you access to v8's Isolate interface. Versions of isolated-vm before v4.0.0 have API pitfalls which may make it easy for implementers to expose supposed secure isolates to the permissions of the main nodejs isolate. Reference objects allow access to the underlying reference's full prototype chain. In an environment where the implementer has exposed a Reference instance to an attacker they would be able to use it to acquire a Reference to the nodejs context's Function object. Similar application-specific attacks could be possible by modifying the local prototype of other API objects. Access to NativeModule objects could allow an attacker to load and run native code from anywhere on the filesystem. If combined with, for example, a file upload API this would allow for arbitrary code execution. This is addressed in v4.0.0 through a series of related changes.
CWE description: The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
CVSS v3 base score: 9.6
Published: 2021-03-30T23:15Z
Repository: https://github.com/laverdet/isolated-vm
Language: C++
Files changed: src/module/native_module_handle.cc
Commit date: 2021-03-18 15:20:24 -0500
Commit message: Disallow NativeModule creation unless main isolate

Diff: diff --git a/src/module/native_module_handle.cc b/src/module/native_module_handle.cc
index 895044a..1802c49 100644
--- a/src/module/native_module_handle.cc
+++ b/src/module/native_module_handle.cc
@@ -13,10 +13,13 @@ namespace ivm {
 
 /**
  * RAII wrapper around libuv dlopen
  */
 NativeModule::NativeModule(const std::string& filename) : init(nullptr) {
+	if (!IsolateEnvironment::GetCurrent()->IsDefault()) {
+		throw RuntimeGenericError("NativeModule may only be instantiated from default nodejs isolate");
+	}
 	if (uv_dlopen(filename.c_str(), &lib) != 0) {
 		throw RuntimeGenericError("Failed to load module");
 	}
 	if (uv_dlsym(&lib, "InitForContext", reinterpret_cast<void**>(&init)) != 0 || init == nullptr) {
 		uv_dlclose(&lib);

Fixed code: 	if (!IsolateEnvironment::GetCurrent()->IsDefault()) {
		throw RuntimeGenericError("NativeModule may only be instantiated from default nodejs isolate");
	}
CVE-2022-39266: Improper Input Validation (CWE-20)
value: isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is passed to the API through CachedDataOptions, attackers can bypass the sandbox and run arbitrary code in the nodejs process. Version 4.3.7 changes the documentation to warn users that they should not accept `cachedData` payloads from a user.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 9.8
Published: 2022-09-29T18:15Z
Repository: https://github.com/laverdet/isolated-vm
Language: Markdown
Files changed: README.md
Commit date: 2022-02-17 11:46:32 -0600
Commit message: Add note about `cachedData`

Diff: diff --git a/README.md b/README.md
index aa12d99..00bf22d 100644
--- a/README.md
+++ b/README.md
@@ -576,10 +576,13 @@ Most functions which compile or run code can produce and consume cached data. Yo
 data and use the data in later invocations to drastically speed up parsing of the same script. You
 can even save this data to disk and use it in a different process. You can set both `cachedData` and
 `produceCachedData`, in which case new cached data will only be produced if the data supplied was
 invalid.
 
+*NOTE*: CachedData contains compiled machine code. That means you should not accept `cachedData`
+payloads from a user, otherwise they may be able to run arbitrary code.
+
 ##### `ScriptOrigin`
 * `filename` *[string]* - Filename of this source code
 * `columnOffset` *[number]* - Column offset of this source code
 * `lineOffset` *[number]* - Line offset of this source code
 

Fixed code: *NOTE*: CachedData contains compiled machine code. That means you should not accept `cachedData`
payloads from a user, otherwise they may be able to run arbitrary code.
CVE-2022-39266: Protection Mechanism Failure (CWE-693)
value: isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is passed to the API through CachedDataOptions, attackers can bypass the sandbox and run arbitrary code in the nodejs process. Version 4.3.7 changes the documentation to warn users that they should not accept `cachedData` payloads from a user.
CWE description: The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
CVSS v3 base score: 9.8
Published: 2022-09-29T18:15Z
Repository: https://github.com/laverdet/isolated-vm
Language: Markdown
Files changed: README.md
Commit date: 2022-02-17 11:46:32 -0600
Commit message: Add note about `cachedData`

Diff: diff --git a/README.md b/README.md
index aa12d99..00bf22d 100644
--- a/README.md
+++ b/README.md
@@ -576,10 +576,13 @@ Most functions which compile or run code can produce and consume cached data. Yo
 data and use the data in later invocations to drastically speed up parsing of the same script. You
 can even save this data to disk and use it in a different process. You can set both `cachedData` and
 `produceCachedData`, in which case new cached data will only be produced if the data supplied was
 invalid.
 
+*NOTE*: CachedData contains compiled machine code. That means you should not accept `cachedData`
+payloads from a user, otherwise they may be able to run arbitrary code.
+
 ##### `ScriptOrigin`
 * `filename` *[string]* - Filename of this source code
 * `columnOffset` *[number]* - Column offset of this source code
 * `lineOffset` *[number]* - Line offset of this source code
 

Fixed code: *NOTE*: CachedData contains compiled machine code. That means you should not accept `cachedData`
payloads from a user, otherwise they may be able to run arbitrary code.
CVE-2019-14430: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: plugin/Audit/Objects/AuditTable.php in YouPHPTube through 7.2 allows SQL Injection.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 5.3
Published: 2019-08-20T14:15Z
Repository: https://github.com/YouPHPTube/YouPHPTube
Language: PHP
Files changed: plugin/Audit/Objects/AuditTable.php
Commit date: 2019-07-26 11:32:32 -0300
Diff: diff --git a/plugin/Audit/Objects/AuditTable.php b/plugin/Audit/Objects/AuditTable.php
old mode 100644
new mode 100755
index 1319050ba..143a3a4fa
--- a/plugin/Audit/Objects/AuditTable.php
+++ b/plugin/Audit/Objects/AuditTable.php
@@ -20,11 +20,11 @@ class AuditTable extends ObjectYPT {
     function audit($method, $class, $statement, $formats, $values, $users_id) {
         $this->method = $method;
         $this->class = $class;
         $this->statement = substr(str_replace("'", "", $statement),0,1000)."n";
         $this->formats = $formats;
-        $this->values = $values;
+        $this->values = str_replace(array("'","\\"), array("",""), $values);
         $this->ip = getRealIpAddr();
         $this->users_id = empty($users_id)?"NULL":$users_id;
         return $this->save();
     }
     

Vulnerable code:         $this->values = $values;
Fixed code:         $this->values = str_replace(array("'","\\"), array("",""), $values);
CVE-2019-16124: Missing Authorization (CWE-862)
value: In YouPHPTube 7.4, the file install/checkConfiguration.php has no access control, which leads to everyone being able to edit the configuration file, and insert malicious PHP code.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 9.8
Published: 2019-09-09T02:15Z
Repository: https://github.com/YouPHPTube/YouPHPTube
Language: PHP
Files changed: install/checkConfiguration.php
Commit date: 2019-08-26 18:28:37 -0300
Commit message: secury fix to not allow recreate the config file
Diff: diff --git a/install/checkConfiguration.php b/install/checkConfiguration.php
index 91ee8ad9f..56c45c62c 100644
--- a/install/checkConfiguration.php
+++ b/install/checkConfiguration.php
@@ -1,6 +1,10 @@
 <?php
+if (file_exists("../videos/configuration.php")) {
+    error_log("Can not create configuration again: ".  json_encode($_SERVER));
+    exit;
+}
 
 $installationVersion = "7.5";
 
 
 header('Content-Type: application/json');

Fixed code: if (file_exists("../videos/configuration.php")) {
    error_log("Can not create configuration again: ".  json_encode($_SERVER));
    exit;
}
CVE-2024-29901: Insufficient Information (NVD-CWE-noinfo)
value: The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js.
A user can reuse an expired session by controlling the `x-workos-session` header. The vulnerability is patched in v0.4.2.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-29T16:15Z
Repository: https://github.com/workos/authkit-nextjs
Language: TypeScript
Files changed: src/session.ts
Commit date: 2024-03-28 09:59:27 -0600
Commit message: always control the x-workos-session header (#17)


Diff: diff --git a/src/session.ts b/src/session.ts
index 7f7b6a5..8fd60ef 100644
--- a/src/session.ts
+++ b/src/session.ts
@@ -28,10 +28,12 @@ async function updateSession(request: NextRequest, debug: boolean) {
   newRequestHeaders.set('x-url', request.url);
 
   // Record that the request was routed through the middleware so we can check later for DX purposes
   newRequestHeaders.set(middlewareHeaderName, 'true');
 
+  newRequestHeaders.delete(sessionHeaderName);
+
   // If no session, just continue
   if (!session) {
     return NextResponse.next({
       request: { headers: newRequestHeaders },
     });
@@ -75,11 +77,13 @@ async function updateSession(request: NextRequest, debug: boolean) {
     // update the cookie
     response.cookies.set(cookieName, encryptedSession, cookieOptions);
     return response;
   } catch (e) {
     console.warn('Failed to refresh', e);
-    const response = NextResponse.next();
+    const response = NextResponse.next({
+      request: { headers: newRequestHeaders },
+    });
     response.cookies.delete(cookieName);
     return response;
   }
 }
 

Vulnerable code:     const response = NextResponse.next();
Fixed code:   newRequestHeaders.delete(sessionHeaderName);

    const response = NextResponse.next({
      request: { headers: newRequestHeaders },
    });