Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2023-1537: Authentication Bypass by Capture-replay (CWE-294)
value: Authentication Bypass by Capture-replay in GitHub repository answerdev/answer prior to 1.0.6.
CWE description: A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
CVSS v3 base score: 9.8
Published: 2023-03-21T05:15Z
Repository: https://github.com/answerdev/answer
Language: Go
Files changed: internal/repo/captcha/captcha.go, internal/service/action/captcha_service.go
Commit date: 2023-02-24 16:30:21 +0800
Commit message: update VerifyCaptcha

Diff: diff --git a/internal/repo/captcha/captcha.go b/internal/repo/captcha/captcha.go
index bda41d1e3..382e45e70 100644
--- a/internal/repo/captcha/captcha.go
+++ b/internal/repo/captcha/captcha.go
@@ -66,5 +66,13 @@ func (cr *captchaRepo) GetCaptcha(ctx context.Context, key string) (captcha stri
 	if err != nil {
 		log.Debug(err)
 	}
 	return captcha, nil
 }
+
+func (cr *captchaRepo) DelCaptcha(ctx context.Context, key string) (err error) {
+	err = cr.data.Cache.Del(ctx, key)
+	if err != nil {
+		log.Debug(err)
+	}
+	return nil
+}
diff --git a/internal/service/action/captcha_service.go b/internal/service/action/captcha_service.go
index a6ee8e045..84a189ed2 100644
--- a/internal/service/action/captcha_service.go
+++ b/internal/service/action/captcha_service.go
@@ -14,10 +14,11 @@ import (
 
 // CaptchaRepo captcha repository
 type CaptchaRepo interface {
 	SetCaptcha(ctx context.Context, key, captcha string) (err error)
 	GetCaptcha(ctx context.Context, key string) (captcha string, err error)
+	DelCaptcha(ctx context.Context, key string) (err error)
 	SetActionType(ctx context.Context, ip, actionType string, amount int) (err error)
 	GetActionType(ctx context.Context, ip, actionType string) (amount int, err error)
 	DelActionType(ctx context.Context, ip, actionType string) (err error)
 }
 
@@ -141,9 +142,15 @@ func (cs *CaptchaService) GenerateCaptcha(ctx context.Context) (key, captchaBase
 
 // VerifyCaptcha generate captcha
 func (cs *CaptchaService) VerifyCaptcha(ctx context.Context, key, captcha string) (isCorrect bool, err error) {
 	realCaptcha, err := cs.captchaRepo.GetCaptcha(ctx, key)
 	if err != nil {
+		log.Error("VerifyCaptcha GetCaptcha Error", err.Error())
+		return false, nil
+	}
+	err = cs.captchaRepo.DelCaptcha(ctx, key)
+	if err != nil {
+		log.Error("VerifyCaptcha DelCaptcha Error", err.Error())
 		return false, nil
 	}
 	return strings.TrimSpace(captcha) == realCaptcha, nil
 }

Fixed code: 
func (cr *captchaRepo) DelCaptcha(ctx context.Context, key string) (err error) {
	err = cr.data.Cache.Del(ctx, key)
	if err != nil {
		log.Debug(err)
	}
	return nil
}
	DelCaptcha(ctx context.Context, key string) (err error)
		log.Error("VerifyCaptcha GetCaptcha Error", err.Error())
		return false, nil
	}
	err = cs.captchaRepo.DelCaptcha(ctx, key)
	if err != nil {
		log.Error("VerifyCaptcha DelCaptcha Error", err.Error())
CVE-2023-1538: Observable Discrepancy (CWE-203)
value: Observable Timing Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.
CWE description: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CVSS v3 base score: 5.3
Published: 2023-03-21T05:15Z
Repository: https://github.com/answerdev/answer
Language: Go
Files changed: internal/repo/captcha/captcha.go, internal/service/action/captcha_service.go
Commit date: 2023-02-24 16:30:21 +0800
Commit message: update VerifyCaptcha

Diff: diff --git a/internal/repo/captcha/captcha.go b/internal/repo/captcha/captcha.go
index bda41d1e3..382e45e70 100644
--- a/internal/repo/captcha/captcha.go
+++ b/internal/repo/captcha/captcha.go
@@ -66,5 +66,13 @@ func (cr *captchaRepo) GetCaptcha(ctx context.Context, key string) (captcha stri
 	if err != nil {
 		log.Debug(err)
 	}
 	return captcha, nil
 }
+
+func (cr *captchaRepo) DelCaptcha(ctx context.Context, key string) (err error) {
+	err = cr.data.Cache.Del(ctx, key)
+	if err != nil {
+		log.Debug(err)
+	}
+	return nil
+}
diff --git a/internal/service/action/captcha_service.go b/internal/service/action/captcha_service.go
index a6ee8e045..84a189ed2 100644
--- a/internal/service/action/captcha_service.go
+++ b/internal/service/action/captcha_service.go
@@ -14,10 +14,11 @@ import (
 
 // CaptchaRepo captcha repository
 type CaptchaRepo interface {
 	SetCaptcha(ctx context.Context, key, captcha string) (err error)
 	GetCaptcha(ctx context.Context, key string) (captcha string, err error)
+	DelCaptcha(ctx context.Context, key string) (err error)
 	SetActionType(ctx context.Context, ip, actionType string, amount int) (err error)
 	GetActionType(ctx context.Context, ip, actionType string) (amount int, err error)
 	DelActionType(ctx context.Context, ip, actionType string) (err error)
 }
 
@@ -141,9 +142,15 @@ func (cs *CaptchaService) GenerateCaptcha(ctx context.Context) (key, captchaBase
 
 // VerifyCaptcha generate captcha
 func (cs *CaptchaService) VerifyCaptcha(ctx context.Context, key, captcha string) (isCorrect bool, err error) {
 	realCaptcha, err := cs.captchaRepo.GetCaptcha(ctx, key)
 	if err != nil {
+		log.Error("VerifyCaptcha GetCaptcha Error", err.Error())
+		return false, nil
+	}
+	err = cs.captchaRepo.DelCaptcha(ctx, key)
+	if err != nil {
+		log.Error("VerifyCaptcha DelCaptcha Error", err.Error())
 		return false, nil
 	}
 	return strings.TrimSpace(captcha) == realCaptcha, nil
 }

Fixed code: 
func (cr *captchaRepo) DelCaptcha(ctx context.Context, key string) (err error) {
	err = cr.data.Cache.Del(ctx, key)
	if err != nil {
		log.Debug(err)
	}
	return nil
}
	DelCaptcha(ctx context.Context, key string) (err error)
		log.Error("VerifyCaptcha GetCaptcha Error", err.Error())
		return false, nil
	}
	err = cs.captchaRepo.DelCaptcha(ctx, key)
	if err != nil {
		log.Error("VerifyCaptcha DelCaptcha Error", err.Error())
CVE-2023-1539: Improper Restriction of Excessive Authentication Attempts (CWE-307)
value: Improper Restriction of Excessive Authentication Attempts in GitHub repository answerdev/answer prior to 1.0.6.
CWE description: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
CVSS v3 base score: 5.3
Published: 2023-03-21T05:15Z
Repository: https://github.com/answerdev/answer
Language: Go
Files changed: internal/repo/captcha/captcha.go, internal/service/action/captcha_service.go
Commit date: 2023-02-24 16:30:21 +0800
Commit message: update VerifyCaptcha

Diff: diff --git a/internal/repo/captcha/captcha.go b/internal/repo/captcha/captcha.go
index bda41d1e3..382e45e70 100644
--- a/internal/repo/captcha/captcha.go
+++ b/internal/repo/captcha/captcha.go
@@ -66,5 +66,13 @@ func (cr *captchaRepo) GetCaptcha(ctx context.Context, key string) (captcha stri
 	if err != nil {
 		log.Debug(err)
 	}
 	return captcha, nil
 }
+
+func (cr *captchaRepo) DelCaptcha(ctx context.Context, key string) (err error) {
+	err = cr.data.Cache.Del(ctx, key)
+	if err != nil {
+		log.Debug(err)
+	}
+	return nil
+}
diff --git a/internal/service/action/captcha_service.go b/internal/service/action/captcha_service.go
index a6ee8e045..84a189ed2 100644
--- a/internal/service/action/captcha_service.go
+++ b/internal/service/action/captcha_service.go
@@ -14,10 +14,11 @@ import (
 
 // CaptchaRepo captcha repository
 type CaptchaRepo interface {
 	SetCaptcha(ctx context.Context, key, captcha string) (err error)
 	GetCaptcha(ctx context.Context, key string) (captcha string, err error)
+	DelCaptcha(ctx context.Context, key string) (err error)
 	SetActionType(ctx context.Context, ip, actionType string, amount int) (err error)
 	GetActionType(ctx context.Context, ip, actionType string) (amount int, err error)
 	DelActionType(ctx context.Context, ip, actionType string) (err error)
 }
 
@@ -141,9 +142,15 @@ func (cs *CaptchaService) GenerateCaptcha(ctx context.Context) (key, captchaBase
 
 // VerifyCaptcha generate captcha
 func (cs *CaptchaService) VerifyCaptcha(ctx context.Context, key, captcha string) (isCorrect bool, err error) {
 	realCaptcha, err := cs.captchaRepo.GetCaptcha(ctx, key)
 	if err != nil {
+		log.Error("VerifyCaptcha GetCaptcha Error", err.Error())
+		return false, nil
+	}
+	err = cs.captchaRepo.DelCaptcha(ctx, key)
+	if err != nil {
+		log.Error("VerifyCaptcha DelCaptcha Error", err.Error())
 		return false, nil
 	}
 	return strings.TrimSpace(captcha) == realCaptcha, nil
 }

Fixed code: 
func (cr *captchaRepo) DelCaptcha(ctx context.Context, key string) (err error) {
	err = cr.data.Cache.Del(ctx, key)
	if err != nil {
		log.Debug(err)
	}
	return nil
}
	DelCaptcha(ctx context.Context, key string) (err error)
		log.Error("VerifyCaptcha GetCaptcha Error", err.Error())
		return false, nil
	}
	err = cs.captchaRepo.DelCaptcha(ctx, key)
	if err != nil {
		log.Error("VerifyCaptcha DelCaptcha Error", err.Error())
CVE-2023-1541: Insufficient Information (NVD-CWE-noinfo)
value: Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 3.8
Published: 2023-03-21T05:15Z
Repository: https://github.com/answerdev/answer
Language: Go
Files changed: i18n/en_US.yaml, internal/base/reason/reason.go, internal/service/user_admin/user_backyard.go
Commit date: 2023-02-23 11:37:42 +0800
Commit message: fix(admin): add restriction about admin modify their password

Diff: diff --git a/i18n/en_US.yaml b/i18n/en_US.yaml
index 69a39c12a..237d410c9 100644
--- a/i18n/en_US.yaml
+++ b/i18n/en_US.yaml
@@ -33,10 +33,12 @@ backend:
     other: Password
   email_or_password_wrong_error:
     other: Email and password do not match.
   error:
     admin:
+      cannot_update_their_password:
+        other: You cannot modify your password.
       email_or_password_wrong:
         other: Email and password do not match.
     answer:
       not_found:
         other: Answer do not found.
diff --git a/internal/base/reason/reason.go b/internal/base/reason/reason.go
index a33e33cc2..86b448d91 100644
--- a/internal/base/reason/reason.go
+++ b/internal/base/reason/reason.go
@@ -62,6 +62,7 @@ const (
 	RevisionNoPermission             = "error.revision.no_permission"
 	UserCannotUpdateYourRole         = "error.user.cannot_update_your_role"
 	TagCannotSetSynonymAsItself      = "error.tag.cannot_set_synonym_as_itself"
 	NotAllowedRegistration           = "error.user.not_allowed_registration"
 	SMTPConfigFromNameCannotBeEmail  = "error.smtp.config_from_name_cannot_be_email"
+	AdminCannotUpdateTheirPassword   = "error.admin.cannot_update_their_password"
 )
diff --git a/internal/service/user_admin/user_backyard.go b/internal/service/user_admin/user_backyard.go
index ae09ce856..5712610d2 100644
--- a/internal/service/user_admin/user_backyard.go
+++ b/internal/service/user_admin/user_backyard.go
@@ -151,10 +151,14 @@ func (us *UserAdminService) AddUser(ctx context.Context, req *schema.AddUserReq)
 	return
 }
 
 // UpdateUserPassword update user password
 func (us *UserAdminService) UpdateUserPassword(ctx context.Context, req *schema.UpdateUserPasswordReq) (err error) {
+	// Users cannot modify their password
+	if req.UserID == req.LoginUserID {
+		return errors.BadRequest(reason.AdminCannotUpdateTheirPassword)
+	}
 	userInfo, exist, err := us.userRepo.GetUserInfo(ctx, req.UserID)
 	if err != nil {
 		return err
 	}
 	if !exist {

Fixed code:       cannot_update_their_password:
        other: You cannot modify your password.
	AdminCannotUpdateTheirPassword   = "error.admin.cannot_update_their_password"
	// Users cannot modify their password
	if req.UserID == req.LoginUserID {
		return errors.BadRequest(reason.AdminCannotUpdateTheirPassword)
	}
CVE-2023-1543: Insufficient Session Expiration (CWE-613)
value: Insufficient Session Expiration in GitHub repository answerdev/answer prior to 1.0.6.
CWE description: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
CVSS v3 base score: 8.8
Published: 2023-03-21T05:15Z
Repository: https://github.com/answerdev/answer
Language: Go
Files changed: internal/controller/user_controller.go
Commit date: 2023-03-01 11:47:31 +0800
Commit message: fix(user): Remove admin cache when user logout.

Diff: diff --git a/internal/controller/user_controller.go b/internal/controller/user_controller.go
index f69bc16e2..a1489e41c 100644
--- a/internal/controller/user_controller.go
+++ b/internal/controller/user_controller.go
@@ -201,10 +201,11 @@ func (uc *UserController) UserLogout(ctx *gin.Context) {
 	if len(accessToken) == 0 {
 		handler.HandleResponse(ctx, nil, nil)
 		return
 	}
 	_ = uc.authService.RemoveUserCacheInfo(ctx, accessToken)
+	_ = uc.authService.RemoveAdminUserCacheInfo(ctx, accessToken)
 	handler.HandleResponse(ctx, nil, nil)
 }
 
 // UserRegisterByEmail godoc
 // @Summary UserRegisterByEmail

Fixed code: 	_ = uc.authService.RemoveAdminUserCacheInfo(ctx, accessToken)
CVE-2023-1976: Password Aging with Long Expiration (CWE-263)
value: Password Aging with Long Expiration in GitHub repository answerdev/answer prior to 1.0.6.
CWE description: The product supports password aging, but the expiration period is too long.
CVSS v3 base score: 8.8
Published: 2023-04-11T11:15Z
Repository: https://github.com/answerdev/answer
Language: Go
Files changed: internal/repo/captcha/captcha.go, internal/service/action/captcha_service.go
Commit date: 2023-02-24 16:30:21 +0800
Commit message: update VerifyCaptcha

Diff: diff --git a/internal/repo/captcha/captcha.go b/internal/repo/captcha/captcha.go
index bda41d1e3..382e45e70 100644
--- a/internal/repo/captcha/captcha.go
+++ b/internal/repo/captcha/captcha.go
@@ -66,5 +66,13 @@ func (cr *captchaRepo) GetCaptcha(ctx context.Context, key string) (captcha stri
 	if err != nil {
 		log.Debug(err)
 	}
 	return captcha, nil
 }
+
+func (cr *captchaRepo) DelCaptcha(ctx context.Context, key string) (err error) {
+	err = cr.data.Cache.Del(ctx, key)
+	if err != nil {
+		log.Debug(err)
+	}
+	return nil
+}
diff --git a/internal/service/action/captcha_service.go b/internal/service/action/captcha_service.go
index a6ee8e045..84a189ed2 100644
--- a/internal/service/action/captcha_service.go
+++ b/internal/service/action/captcha_service.go
@@ -14,10 +14,11 @@ import (
 
 // CaptchaRepo captcha repository
 type CaptchaRepo interface {
 	SetCaptcha(ctx context.Context, key, captcha string) (err error)
 	GetCaptcha(ctx context.Context, key string) (captcha string, err error)
+	DelCaptcha(ctx context.Context, key string) (err error)
 	SetActionType(ctx context.Context, ip, actionType string, amount int) (err error)
 	GetActionType(ctx context.Context, ip, actionType string) (amount int, err error)
 	DelActionType(ctx context.Context, ip, actionType string) (err error)
 }
 
@@ -141,9 +142,15 @@ func (cs *CaptchaService) GenerateCaptcha(ctx context.Context) (key, captchaBase
 
 // VerifyCaptcha generate captcha
 func (cs *CaptchaService) VerifyCaptcha(ctx context.Context, key, captcha string) (isCorrect bool, err error) {
 	realCaptcha, err := cs.captchaRepo.GetCaptcha(ctx, key)
 	if err != nil {
+		log.Error("VerifyCaptcha GetCaptcha Error", err.Error())
+		return false, nil
+	}
+	err = cs.captchaRepo.DelCaptcha(ctx, key)
+	if err != nil {
+		log.Error("VerifyCaptcha DelCaptcha Error", err.Error())
 		return false, nil
 	}
 	return strings.TrimSpace(captcha) == realCaptcha, nil
 }

Fixed code: 
func (cr *captchaRepo) DelCaptcha(ctx context.Context, key string) (err error) {
	err = cr.data.Cache.Del(ctx, key)
	if err != nil {
		log.Debug(err)
	}
	return nil
}
	DelCaptcha(ctx context.Context, key string) (err error)
		log.Error("VerifyCaptcha GetCaptcha Error", err.Error())
		return false, nil
	}
	err = cs.captchaRepo.DelCaptcha(ctx, key)
	if err != nil {
		log.Error("VerifyCaptcha DelCaptcha Error", err.Error())
CVE-2021-39131: Improper Handling of Exceptional Conditions (CWE-755)
value: ced detects character encoding using Google’s compact_enc_det library. In ced v0.1.0, passing data types other than `Buffer` causes the Node.js process to crash. The problem has been patched in ced v1.0.0. As a workaround, before passing an argument to ced, verify it’s a `Buffer` using `Buffer.isBuffer(obj)`.
CWE description: The product does not handle or incorrectly handles an exceptional condition.
CVSS v3 base score: 7.5
Published: 2021-08-17T23:15Z
Repository: https://github.com/sonicdoe/ced
Language: JavaScript
Files changed: index.js, test.js
Commit date: 2018-07-22 16:46:20 +0200
Commit message: Throw TypeError if argument is not a buffer

Diff: diff --git a/index.js b/index.js
index b5507ce..d1e177b 100644
--- a/index.js
+++ b/index.js
@@ -1,7 +1,11 @@
 'use strict'
 
 const bindings = require('bindings')('ced.node')
 
 module.exports = buf => {
+  if (!Buffer.isBuffer(buf)) {
+    throw new TypeError('Expected a buffer')
+  }
+
   return bindings.detectEncoding(buf)
 }
diff --git a/test.js b/test.js
index e0b0c4b..b84ae19 100644
--- a/test.js
+++ b/test.js
@@ -8,5 +8,11 @@ test('detects UTF-8', t => {
 
 test('detects ASCII', t => {
   const buf = Buffer.from('tést', 'ascii')
   t.is(ced(buf), 'ASCII')
 })
+
+test('throws a TypeError if the argument is not a buffer', t => {
+  t.throws(() => {
+    ced('tést')
+  }, TypeError)
+})

Fixed code:   if (!Buffer.isBuffer(buf)) {
    throw new TypeError('Expected a buffer')
  }


test('throws a TypeError if the argument is not a buffer', t => {
  t.throws(() => {
    ced('tést')
  }, TypeError)
})
CVE-2022-31026: Use of Uninitialized Resource (CWE-908)
value: Trilogy is a client library for MySQL. When authenticating, a malicious server could return a specially crafted authentication packet, causing the client to read and return up to 12 bytes of data from an uninitialized variable in stack memory. Users of the trilogy gem should upgrade to version 2.1.1 This issue can be avoided by only connecting to trusted servers.
CWE description: The product uses or accesses a resource that has not been initialized.
CVSS v3 base score: 7.5
Published: 2022-06-09T13:15Z
Repository: https://github.com/github/trilogy
Language: Unknown
Commit date: 2022-06-06 13:12:42 -0700
Commit message: Merge pull request from GHSA-5g4r-2qhx-vqfm

Verify exact length of auth_data_len
CVE-2022-31084: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)
value: LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 There are cases where LAM instantiates objects from arbitrary classes. An attacker can inject the first constructor argument. This can lead to code execution if non-LAM classes are instantiated that execute code during object creation. This issue has been fixed in version 8.0.
CWE description: The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
CVSS v3 base score: 8.1
Published: 2022-06-27T21:15Z
Repository: https://github.com/LDAPAccountManager/lam
Language: Unknown
Commit date: 2022-06-27 20:20:38 +0200
Commit message: Merge pull request from GHSA-r387-grjx-qgvw

Fixes
CVE-2022-31085: Insufficiently Protected Credentials (CWE-522)
value: LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the session files include the LDAP user name and password in clear text if the PHP OpenSSL extension is not installed or encryption is disabled by configuration. This issue has been fixed in version 8.0. Users unable to upgrade should install the PHP OpenSSL extension and make sure session encryption is enabled in LAM main configuration.
CWE description: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CVSS v3 base score: 6.1
Published: 2022-06-27T21:15Z
Repository: https://github.com/LDAPAccountManager/lam
Language: Unknown
Commit date: 2022-06-27 20:20:38 +0200
Commit message: Merge pull request from GHSA-r387-grjx-qgvw

Fixes
CVE-2022-31086: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 incorrect regular expressions allow to upload PHP scripts to config/templates/pdf. This vulnerability could lead to a Remote Code Execution if the /config/templates/pdf/ directory is accessible for remote users. This is not a default configuration of LAM. This issue has been fixed in version 8.0. There are no known workarounds for this issue.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 8.8
Published: 2022-06-27T21:15Z
Repository: https://github.com/LDAPAccountManager/lam
Language: Unknown
Commit date: 2022-06-27 20:20:38 +0200
Commit message: Merge pull request from GHSA-r387-grjx-qgvw

Fixes
CVE-2022-31087: Incorrect Authorization (CWE-863)
value: LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the tmp directory, which is accessible by /lam/tmp/, allows interpretation of .php (and .php5/.php4/.phpt/etc) files. An attacker capable of writing files under www-data privileges can write a web-shell into this directory, and gain a Code Execution on the host. This issue has been fixed in version 8.0. Users unable to upgrade should disallow executing PHP scripts in (/var/lib/ldap-account-manager/)tmp directory.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 7.8
Published: 2022-06-27T21:15Z
Repository: https://github.com/LDAPAccountManager/lam
Language: Unknown
Commit date: 2022-06-27 20:20:38 +0200
Commit message: Merge pull request from GHSA-r387-grjx-qgvw

Fixes
CVE-2022-31088: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the user name field at login could be used to enumerate LDAP data. This is only the case for LDAP search configuration. This issue has been fixed in version 8.0.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 5.3
Published: 2022-06-27T21:15Z
Repository: https://github.com/LDAPAccountManager/lam
Language: Unknown
Commit date: 2022-06-27 20:20:38 +0200
Commit message: Merge pull request from GHSA-r387-grjx-qgvw

Fixes
CVE-2020-5232: Other (NVD-CWE-Other)
value: A user who owns an ENS domain can set a trapdoor, allowing them to transfer ownership to another user, and later regain ownership without the new owners consent or awareness. A new ENS deployment is being rolled out that fixes this vulnerability in the ENS registry.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 8.7
Published: 2020-01-31T00:15Z
Repository: https://github.com/ensdomains/ens
Language: Unknown
Commit date: 2020-01-30 02:27:40 +0100
Commit message: Merge pull request from GHSA-8f9f-pc5v-9r5h

feature/migration
CVE-2024-22365: Insufficient Information (NVD-CWE-noinfo)
value: linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.5
Published: 2024-02-06T08:15Z
Repository: https://github.com/linux-pam/linux-pam
Language: C
Files changed: modules/pam_namespace/pam_namespace.c
Commit date: 2024-01-17 08:00:00 +0000
Commit message: pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS situations

Without O_DIRECTORY the path crawling logic is subject to e.g. FIFOs
being placed in user controlled directories, causing the PAM module to
block indefinitely during `openat()`.

Pass O_DIRECTORY to cause the `openat()` to fail if the path does not
refer to a directory.

With this the check whether the final path element is a directory
becomes unnecessary, drop it.

Diff: diff --git a/modules/pam_namespace/pam_namespace.c b/modules/pam_namespace/pam_namespace.c
index 2528cff8..f72d6718 100644
--- a/modules/pam_namespace/pam_namespace.c
+++ b/modules/pam_namespace/pam_namespace.c
@@ -1199,11 +1199,11 @@ static int protect_dir(const char *path, mode_t mode, int do_mkdir,
 	char *d;
 	char *dir = p;
 	int dfd = AT_FDCWD;
 	int dfd_next;
 	int save_errno;
-	int flags = O_RDONLY;
+	int flags = O_RDONLY | O_DIRECTORY;
 	int rv = -1;
 	struct stat st;
 
 	if (p == NULL) {
 		goto error;
@@ -1253,26 +1253,10 @@ static int protect_dir(const char *path, mode_t mode, int do_mkdir,
 			goto error;
 		}
 		rv = openat(dfd, dir, flags);
 	}
 
-	if (rv != -1) {
-		if (fstat(rv, &st) != 0) {
-			save_errno = errno;
-			close(rv);
-			rv = -1;
-			errno = save_errno;
-			goto error;
-		}
-		if (!S_ISDIR(st.st_mode)) {
-			close(rv);
-			errno = ENOTDIR;
-			rv = -1;
-			goto error;
-		}
-	}
-
 	if (flags & O_NOFOLLOW) {
 		/* we are inside user-owned dir - protect */
 		if (protect_mount(rv, p, idata) == -1) {
 			save_errno = errno;
 			close(rv);

Vulnerable code: 	int flags = O_RDONLY;
	if (rv != -1) {
		if (fstat(rv, &st) != 0) {
			save_errno = errno;
			close(rv);
			rv = -1;
			errno = save_errno;
			goto error;
		}
		if (!S_ISDIR(st.st_mode)) {
			close(rv);
			errno = ENOTDIR;
			rv = -1;
			goto error;
		}
	}

Fixed code: 	int flags = O_RDONLY | O_DIRECTORY;
CVE-2019-14323: Off-by-one Error (CWE-193)
value: SSDP Responder 1.x through 1.5 mishandles incoming network messages, leading to a stack-based buffer overflow by 1 byte. This results in a crash of the server, but only when strict stack checking is enabled. This is caused by an off-by-one error in ssdp_recv in ssdpd.c.
CWE description: A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CVSS v3 base score: 7.5
Published: 2019-07-28T13:15Z
Repository: https://github.com/troglobit/ssdp-responder
Language: C
Files changed: ssdpd.c
Commit date: 2019-07-24 07:35:23 +0200
Commit message: Fix #1: Ensure recv buf is always NUL terminated

Signed-off-by: Joachim Nilsson <troglobit@gmail.com>

Diff: diff --git a/ssdpd.c b/ssdpd.c
index 7fe5cab..f6a1297 100644
--- a/ssdpd.c
+++ b/ssdpd.c
@@ -430,17 +430,15 @@ static void send_message(struct ifsock *ifs, char *type, struct sockaddr *sa)
 static void ssdp_recv(int sd)
 {
 	ssize_t len;
 	struct sockaddr sa;
 	socklen_t salen;
-	char buf[MAX_PKT_SIZE];
+	char buf[MAX_PKT_SIZE + 1];
 
 	memset(buf, 0, sizeof(buf));
-	len = recvfrom(sd, buf, sizeof(buf), MSG_DONTWAIT, &sa, &salen);
+	len = recvfrom(sd, buf, sizeof(buf) - 1, MSG_DONTWAIT, &sa, &salen);
 	if (len > 0) {
-		buf[len] = 0;
-
 		if (sa.sa_family != AF_INET)
 			return;
 
 		if (strstr(buf, "M-SEARCH *")) {
 			size_t i;

Vulnerable code: 	char buf[MAX_PKT_SIZE];
	len = recvfrom(sd, buf, sizeof(buf), MSG_DONTWAIT, &sa, &salen);
		buf[len] = 0;

Fixed code: 	char buf[MAX_PKT_SIZE + 1];
	len = recvfrom(sd, buf, sizeof(buf) - 1, MSG_DONTWAIT, &sa, &salen);
CVE-2019-14323: Out-of-bounds Write (CWE-787)
value: SSDP Responder 1.x through 1.5 mishandles incoming network messages, leading to a stack-based buffer overflow by 1 byte. This results in a crash of the server, but only when strict stack checking is enabled. This is caused by an off-by-one error in ssdp_recv in ssdpd.c.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2019-07-28T13:15Z
Repository: https://github.com/troglobit/ssdp-responder
Language: C
Files changed: ssdpd.c
Commit date: 2019-07-24 07:35:23 +0200
Commit message: Fix #1: Ensure recv buf is always NUL terminated

Signed-off-by: Joachim Nilsson <troglobit@gmail.com>

Diff: diff --git a/ssdpd.c b/ssdpd.c
index 7fe5cab..f6a1297 100644
--- a/ssdpd.c
+++ b/ssdpd.c
@@ -430,17 +430,15 @@ static void send_message(struct ifsock *ifs, char *type, struct sockaddr *sa)
 static void ssdp_recv(int sd)
 {
 	ssize_t len;
 	struct sockaddr sa;
 	socklen_t salen;
-	char buf[MAX_PKT_SIZE];
+	char buf[MAX_PKT_SIZE + 1];
 
 	memset(buf, 0, sizeof(buf));
-	len = recvfrom(sd, buf, sizeof(buf), MSG_DONTWAIT, &sa, &salen);
+	len = recvfrom(sd, buf, sizeof(buf) - 1, MSG_DONTWAIT, &sa, &salen);
 	if (len > 0) {
-		buf[len] = 0;
-
 		if (sa.sa_family != AF_INET)
 			return;
 
 		if (strstr(buf, "M-SEARCH *")) {
 			size_t i;

Vulnerable code: 	char buf[MAX_PKT_SIZE];
	len = recvfrom(sd, buf, sizeof(buf), MSG_DONTWAIT, &sa, &salen);
		buf[len] = 0;

Fixed code: 	char buf[MAX_PKT_SIZE + 1];
	len = recvfrom(sd, buf, sizeof(buf) - 1, MSG_DONTWAIT, &sa, &salen);
CVE-2022-31098: Insertion of Sensitive Information into Log File (CWE-532)
value: Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in the logging of Weave GitOps could allow an authenticated remote attacker to view sensitive cluster configurations, aka KubeConfg, of registered Kubernetes clusters, including the service account tokens in plain text from Weave GitOps's pod logs on the management cluster. An unauthorized remote attacker can also view these sensitive configurations from external log storage if enabled by the management cluster. This vulnerability is due to the client factory dumping cluster configurations and their service account tokens when the cluster manager tries to connect to an API server of a registered cluster, and a connection error occurs. An attacker could exploit this vulnerability by either accessing logs of a pod of Weave GitOps, or from external log storage and obtaining all cluster configurations of registered clusters. A successful exploit could allow the attacker to use those cluster configurations to manage the registered Kubernetes clusters. This vulnerability has been fixed by commit 567356f471353fb5c676c77f5abc2a04631d50ca. Users should upgrade to Weave GitOps core version v0.8.1-rc.6 or newer. There is no known workaround for this vulnerability.
CWE description: Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
CVSS v3 base score: 7.5
Published: 2022-06-27T22:15Z
Repository: https://github.com/weaveworks/weave-gitops
Language: Go
Files changed: core/clustersmngr/factory.go
Commit date: 2022-05-28 15:43:50 +0300
Commit message: Fix logging on cluster connection error
Remove the client config from the error log since the wrapped error already contains the cluster name for which the connection couldn't be established.

Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>

Diff: diff --git a/core/clustersmngr/factory.go b/core/clustersmngr/factory.go
index 513eda59..b7bc2c84 100644
--- a/core/clustersmngr/factory.go
+++ b/core/clustersmngr/factory.go
@@ -129,11 +129,11 @@ func (cf *clientsFactory) watchNamespaces(ctx context.Context) {
 }
 
 func (cf *clientsFactory) UpdateNamespaces(ctx context.Context) error {
 	clients, err := clientsForClusters(cf.clusters.Get())
 	if err != nil {
-		cf.log.Error(err, "failed to create clients for", "clusters", cf.clusters.Get())
+		cf.log.Error(err, "failed to create client")
 		return err
 	}
 
 	cf.syncCaches()
 

Vulnerable code: 		cf.log.Error(err, "failed to create clients for", "clusters", cf.clusters.Get())
Fixed code: 		cf.log.Error(err, "failed to create client")
CVE-2022-24802: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. deepmerge-ts is vulnerable to Prototype Pollution via file deepmerge.ts, function defaultMergeRecords(). This issue has been patched in version 4.0.2. There are no known workarounds for this issue.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.8
Published: 2022-04-01T00:15Z
Repository: https://github.com/RebeccaStevens/deepmerge-ts
Language: TypeScript
Files changed: src/deepmerge.ts, tests/deepmerge.test.ts
Commit date: 2022-03-31 20:49:31 +1300
Commit message: fix: protect against prototype pollution

Diff: diff --git a/src/deepmerge.ts b/src/deepmerge.ts
index 777929f..82c580e 100644
--- a/src/deepmerge.ts
+++ b/src/deepmerge.ts
@@ -436,11 +436,20 @@ function defaultMergeRecords<
 
     if (propertyResult === actions.skip) {
       continue;
     }
 
-    result[key] = propertyResult;
+    if (key === "__proto__") {
+      Object.defineProperty(result, key, {
+        value: propertyResult,
+        configurable: true,
+        enumerable: true,
+        writable: true,
+      });
+    } else {
+      result[key] = propertyResult;
+    }
   }
 
   /* eslint-enable functional/no-loop-statement, functional/no-conditional-statement */
 
   return result as DeepMergeRecordsDefaultHKT<Ts, MF, M>;
diff --git a/tests/deepmerge.test.ts b/tests/deepmerge.test.ts
index d8f29b7..b352b5d 100644
--- a/tests/deepmerge.test.ts
+++ b/tests/deepmerge.test.ts
@@ -537,5 +537,21 @@ test(`merging objects with null prototype`, (t) => {
 
   const merged = deepmerge(x, y);
 
   t.deepEqual(merged, expected);
 });
+
+test("prototype pollution", (t) => {
+  const payload = '{"__proto__":{"a0":true}}';
+
+  const x: any = JSON.parse(payload);
+  const y: any = {};
+
+  const merged: any = deepmerge(x, y);
+
+  t.deepEqual(JSON.stringify(merged), payload);
+
+  t.not(({} as any).a0, true, "Safe POJO");
+  t.not(x.a0, true, "Safe x input");
+  t.not(y.a0, true, "Safe y input");
+  t.not(merged.a0, true, "Safe output");
+});

Vulnerable code:     result[key] = propertyResult;
Fixed code:     if (key === "__proto__") {
      Object.defineProperty(result, key, {
        value: propertyResult,
        configurable: true,
        enumerable: true,
        writable: true,
      });
    } else {
      result[key] = propertyResult;
    }

test("prototype pollution", (t) => {
  const payload = '{"__proto__":{"a0":true}}';

  const x: any = JSON.parse(payload);
  const y: any = {};

  const merged: any = deepmerge(x, y);

  t.deepEqual(JSON.stringify(merged), payload);

  t.not(({} as any).a0, true, "Safe POJO");
  t.not(x.a0, true, "Safe x input");
  t.not(y.a0, true, "Safe y input");
  t.not(merged.a0, true, "Safe output");
});
CVE-2022-24802: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. deepmerge-ts is vulnerable to Prototype Pollution via file deepmerge.ts, function defaultMergeRecords(). This issue has been patched in version 4.0.2. There are no known workarounds for this issue.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.8
Published: 2022-04-01T00:15Z
Repository: https://github.com/RebeccaStevens/deepmerge-ts
Language: Unknown
Commit date: 2022-03-31 21:01:53 +1300
Commit message: Merge pull request #86 from RebeccaStevens/security/prototype-pollution
CVE-2022-3969: Insecure Temporary File (CWE-377)
value: A vulnerability was found in OpenKM up to 6.3.11 and classified as problematic. Affected by this issue is the function getFileExtension of the file src/main/java/com/openkm/util/FileUtils.java. The manipulation leads to insecure temporary file. Upgrading to version 6.3.12 is able to address this issue. The name of the patch is c069e4d73ab8864345c25119d8459495f45453e1. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213548.
CWE description: Creating and using insecure temporary files can leave application and system data vulnerable to attack.
CVSS v3 base score: 5.5
Published: 2022-11-13T08:15Z
Repository: https://github.com/openkm/document-management-system
Language: Java
Files changed: src/main/java/com/openkm/util/FileUtils.java
Commit date: 2022-09-05 10:18:54 +0200
Commit message: Fix Temporary Directory Hijacking or Information Disclosure Vulnerability

fix #332

Diff: diff --git a/src/main/java/com/openkm/util/FileUtils.java b/src/main/java/com/openkm/util/FileUtils.java
index be0dea90..3eef8c92 100644
--- a/src/main/java/com/openkm/util/FileUtils.java
+++ b/src/main/java/com/openkm/util/FileUtils.java
@@ -29,10 +29,11 @@ import com.openkm.util.impexp.RepositoryImporter;
 import org.apache.commons.io.IOUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import java.io.*;
+import java.nio.file.Files;
 import java.text.SimpleDateFormat;
 import java.util.Collection;
 import java.util.Date;
 
 public class FileUtils {
@@ -64,17 +65,11 @@ public class FileUtils {
 	 * Creates a temporal and unique directory
 	 *
 	 * @throws IOException If something fails.
 	 */
 	public static File createTempDir() throws IOException {
-		File tmpFile = File.createTempFile("okm", null);
-
-		if (!tmpFile.delete())
-			throw new IOException();
-		if (!tmpFile.mkdir())
-			throw new IOException();
-		return tmpFile;
+		return Files.createTempDirectory("okm").toFile();
 	}
 
 	/**
 	 * Create temp file
 	 */
@@ -227,11 +222,11 @@ public class FileUtils {
 	public static void copy(File input, File output) throws IOException {
 		org.apache.commons.io.FileUtils.copyFile(input, output);
 	}
 
 	/**
-	 * Create "year / month / day" directory structure. 
+	 * Create "year / month / day" directory structure.
 	 */
 	public static File createDateDir(String parent) {
 		SimpleDateFormat sdf = new SimpleDateFormat("yyyy" + File.separator + "MM" + File.separator + "dd");
 		File dateDir = new File(parent, sdf.format(new Date()));
 

Vulnerable code: 		File tmpFile = File.createTempFile("okm", null);

		if (!tmpFile.delete())
			throw new IOException();
		if (!tmpFile.mkdir())
			throw new IOException();
		return tmpFile;
	 * Create "year / month / day" directory structure. 
Fixed code: import java.nio.file.Files;
		return Files.createTempDirectory("okm").toFile();
	 * Create "year / month / day" directory structure.
CVE-2014-3980: Permissions, Privileges, and Access Controls (CWE-264)
value: libfep 0.0.5 before 0.1.0 does not properly use UNIX domain sockets in the abstract namespace, which allows local users to gain privileges via unspecified vectors.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Published: 2014-06-11T14:55Z
Repository: https://github.com/ueno/libfep
Language: C
Files changed: fep/control.c, libfep/client.c
Commit date: 2014-06-04 17:35:31 +0900
Commit message: Don't use abstract Unix domain sockets

Diff: diff --git a/fep/control.c b/fep/control.c
index 7a19da4..5a25d26 100644
--- a/fep/control.c
+++ b/fep/control.c
@@ -95,19 +95,12 @@ _fep_open_control_socket (Fep *fep)
     }
 
   memset (&sun, 0, sizeof(sun));
   sun.sun_family = AF_UNIX;
 
-#ifdef __linux__
-  sun.sun_path[0] = '\0';
-  memcpy (sun.sun_path + 1, path, strlen (path));
-  sun_len = offsetof (struct sockaddr_un, sun_path) + strlen (path) + 1;
-  remove_control_socket (path);
-#else
   memcpy (sun.sun_path, path, strlen (path));
   sun_len = sizeof (struct sockaddr_un);
-#endif
 
   if (bind (fd, (const struct sockaddr *) &sun, sun_len) < 0)
     {
       perror ("bind");
       free (path);
diff --git a/libfep/client.c b/libfep/client.c
index d267b0a..5076522 100644
--- a/libfep/client.c
+++ b/libfep/client.c
@@ -88,18 +88,12 @@ fep_client_open (const char *address)
   client->messages = NULL;
 
   memset (&sun, 0, sizeof(struct sockaddr_un));
   sun.sun_family = AF_UNIX;
 
-#ifdef __linux__
-  sun.sun_path[0] = '\0';
-  memcpy (sun.sun_path + 1, address, strlen (address));
-  sun_len = offsetof (struct sockaddr_un, sun_path) + strlen (address) + 1;
-#else
   memcpy (sun.sun_path, address, strlen (address));
   sun_len = sizeof (struct sockaddr_un);
-#endif
 
   client->control = socket (AF_UNIX, SOCK_STREAM, 0);
   if (client->control < 0)
     {
       free (client);

Vulnerable code: #ifdef __linux__
  sun.sun_path[0] = '\0';
  memcpy (sun.sun_path + 1, path, strlen (path));
  sun_len = offsetof (struct sockaddr_un, sun_path) + strlen (path) + 1;
  remove_control_socket (path);
#else
#endif
#ifdef __linux__
  sun.sun_path[0] = '\0';
  memcpy (sun.sun_path + 1, address, strlen (address));
  sun_len = offsetof (struct sockaddr_un, sun_path) + strlen (address) + 1;
#else
#endif
CVE-2024-0217: Use After Free (CWE-416)
value: A use-after-free flaw was found in PackageKitd. In some conditions, the order of cleanup mechanics for a transaction could be impacted. As a result, some memory access could occur on memory regions that were previously freed. Once freed, a memory region can be reused for other allocations and any previously stored data in this memory region is considered lost.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 3.3
Published: 2024-01-03T17:15Z
Repository: https://github.com/PackageKit/PackageKit
Language: C
Files changed: src/pk-transaction.c
Commit date: 2023-05-29 19:55:52 +0200
Commit message: pk-transaction: Check that Finished signal is emitted at most once

While I haven’t seen it being emitted more than once, the transaction
code is quite complex, and it would make things more robust to add a
check to verify this.

Signed-off-by: Philip Withnall <pwithnall@endlessos.org>

Diff: diff --git a/src/pk-transaction.c b/src/pk-transaction.c
index 192ef2347..ad53cace1 100644
--- a/src/pk-transaction.c
+++ b/src/pk-transaction.c
@@ -88,10 +88,11 @@ struct PkTransactionPrivate
 	guint			 elapsed_time;
 	guint			 remaining_time;
 	guint			 speed;
 	guint			 download_size_remaining;
 	gboolean		 finished;
+	gboolean		 emitted_finished;
 	gboolean		 allow_cancel;
 	gboolean		 waiting_for_auth;
 	gboolean		 emit_eula_required;
 	gboolean		 emit_signature_required;
 	gboolean		 emit_media_change_required;
@@ -508,10 +509,13 @@ pk_transaction_status_changed_emit (PkTransaction *transaction, PkStatusEnum sta
 static void
 pk_transaction_finished_emit (PkTransaction *transaction,
 			      PkExitEnum exit_enum,
 			      guint time_ms)
 {
+	g_assert (!transaction->priv->emitted_finished);
+	transaction->priv->emitted_finished = TRUE;
+
 	g_debug ("emitting finished '%s', %i",
 		 pk_exit_enum_to_string (exit_enum),
 		 time_ms);
 	g_dbus_connection_emit_signal (transaction->priv->connection,
 				       NULL,

Fixed code: 	gboolean		 emitted_finished;
	g_assert (!transaction->priv->emitted_finished);
	transaction->priv->emitted_finished = TRUE;
CVE-2022-43995: Out-of-bounds Read (CWE-125)
value: Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by arbitrary local users with access to Sudo by entering a password of seven characters or fewer. The impact could vary depending on the system libraries, compiler, and processor architecture.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.1
Published: 2022-11-02T14:15Z
Repository: https://github.com/sudo-project/sudo
Language: C
Files changed: plugins/sudoers/auth/passwd.c
Commit date: 2022-10-28 07:29:55 -0600
Commit message: Fix CVE-2022-43995, potential heap overflow for passwords < 8 characters.
Starting with sudo 1.8.0 the plaintext password buffer is dynamically
sized so it is not safe to assume that it is at least 9 bytes in size.
Found by Hugo Lefeuvre (University of Manchester) with ConfFuzz.

Diff: diff --git a/plugins/sudoers/auth/passwd.c b/plugins/sudoers/auth/passwd.c
index b2046eca2..0416861e9 100644
--- a/plugins/sudoers/auth/passwd.c
+++ b/plugins/sudoers/auth/passwd.c
@@ -61,11 +61,11 @@ sudo_passwd_init(struct passwd *pw, sudo_auth *auth)
 
 #ifdef HAVE_CRYPT
 int
 sudo_passwd_verify(struct passwd *pw, char *pass, sudo_auth *auth, struct sudo_conv_callback *callback)
 {
-    char sav, *epass;
+    char des_pass[9], *epass;
     char *pw_epasswd = auth->data;
     size_t pw_len;
     int matched = 0;
     debug_decl(sudo_passwd_verify, SUDOERS_DEBUG_AUTH);
 
@@ -73,24 +73,23 @@ sudo_passwd_verify(struct passwd *pw, char *pass, sudo_auth *auth, struct sudo_c
     if (pass[0] == '\0')
 	debug_return_int(pw_epasswd[0] ? AUTH_FAILURE : AUTH_SUCCESS);
 
     /*
      * Truncate to 8 chars if standard DES since not all crypt()'s do this.
-     * If this turns out not to be safe we will have to use OS #ifdef's (sigh).
      */
-    sav = pass[8];
     pw_len = strlen(pw_epasswd);
-    if (pw_len == DESLEN || HAS_AGEINFO(pw_epasswd, pw_len))
-	pass[8] = '\0';
+    if (pw_len == DESLEN || HAS_AGEINFO(pw_epasswd, pw_len)) {
+	strlcpy(des_pass, pass, sizeof(des_pass));
+	pass = des_pass;
+    }
 
     /*
      * Normal UN*X password check.
      * HP-UX may add aging info (separated by a ',') at the end so
      * only compare the first DESLEN characters in that case.
      */
     epass = (char *) crypt(pass, pw_epasswd);
-    pass[8] = sav;
     if (epass != NULL) {
 	if (HAS_AGEINFO(pw_epasswd, pw_len) && strlen(epass) == DESLEN)
 	    matched = !strncmp(pw_epasswd, epass, DESLEN);
 	else
 	    matched = !strcmp(pw_epasswd, epass);

Vulnerable code:     char sav, *epass;
     * If this turns out not to be safe we will have to use OS #ifdef's (sigh).
    sav = pass[8];
    if (pw_len == DESLEN || HAS_AGEINFO(pw_epasswd, pw_len))
	pass[8] = '\0';
    pass[8] = sav;
Fixed code:     char des_pass[9], *epass;
    if (pw_len == DESLEN || HAS_AGEINFO(pw_epasswd, pw_len)) {
	strlcpy(des_pass, pass, sizeof(des_pass));
	pass = des_pass;
    }