Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2020-36646: NULL Pointer Dereference (CWE-476)
value: A vulnerability classified as problematic has been found in MediaArea ZenLib up to 0.4.38. This affects the function Ztring::Date_From_Seconds_1970_Local of the file Source/ZenLib/Ztring.cpp. The manipulation of the argument Value leads to unchecked return value to null pointer dereference. Upgrading to version 0.4.39 is able to address this issue. The identifier of the patch is 6475fcccd37c9cf17e0cfe263b5fe0e2e47a8408. It is recommended to upgrade the affected component. The identifier VDB-217629 was assigned to this vulnerability.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2023-01-07T20:15Z
Repository: https://github.com/MediaArea/ZenLib
Language: C++
Files changed: Source/ZenLib/Ztring.cpp
Commit date: 2020-09-12 07:46:47 +0300
Commit message: fix V522 [CWE-690] There might be dereferencing of a potential null pointer 'Gmt'.

Diff: diff --git a/Source/ZenLib/Ztring.cpp b/Source/ZenLib/Ztring.cpp
index bc38fe4..21bbc58 100644
--- a/Source/ZenLib/Ztring.cpp
+++ b/Source/ZenLib/Ztring.cpp
@@ -1362,10 +1362,12 @@ Ztring& Ztring::Date_From_Seconds_1970_Local (const int32u Value)
     #else
     struct tm *Gmt=localtime(&Time);
     #endif
     Ztring DateT;
     Ztring Date;
+    if (Gmt)
+    {
     Date+=Ztring::ToZtring((Gmt->tm_year+1900));
     Date+=__T("-");
     DateT.From_Number(Gmt->tm_mon+1); if (DateT.size()<2){DateT=Ztring(__T("0"))+Ztring::ToZtring(Gmt->tm_mon+1);}
     Date+=DateT;
     Date+=__T("-");
@@ -1379,10 +1381,11 @@ Ztring& Ztring::Date_From_Seconds_1970_Local (const int32u Value)
     Date+=DateT;
     Date+=__T(":");
     DateT.From_Number(Gmt->tm_sec); if (DateT.size()<2){DateT=Ztring(__T("0"))+Ztring::ToZtring(Gmt->tm_sec);}
     Date+=DateT;
     assign (Date.c_str());
+    }
     return *this;
 }
 
 Ztring& Ztring::Date_From_String (const char* Value, size_t Value_Size)
 {

Fixed code:     if (Gmt)
    {
    }
CVE-2024-29897: Insufficient Information (NVD-CWE-noinfo)
value: CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users with (delete) or (suppressrevision) on any wiki in the farm to access suppressed wiki requests by going to the request's entry on Special:RequestWikiQueue on the wiki where they have these rights. The same vulnerability was present briefly on the REST API before being quickly corrected in commit `6bc0685`. To our knowledge, the vulnerable commits of the REST API are not running in production anywhere. This vulnerability is fixed in 23415c17ffb4832667c06abcf1eadadefd4c8937.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-28T14:15Z
Repository: https://github.com/miraheze/mw-config
Language: PHP
Files changed: GlobalSettings.php
Commit date: 2024-03-27 15:35:08 +0100
Commit message: T11999: Disable Special:RequestWikiQueue outside of metawiki (#5518)


Diff: diff --git a/GlobalSettings.php b/GlobalSettings.php
index 4d417ac1..3ed4ee8b 100644
--- a/GlobalSettings.php
+++ b/GlobalSettings.php
@@ -1,10 +1,11 @@
 <?php
 
 use MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider;
 use MediaWiki\Extension\ConfirmEdit\Store\CaptchaCacheStore;
 use MediaWiki\Html\Html;
+use MediaWiki\SpecialPage\DisabledSpecialPage;
 use MediaWiki\SpecialPage\SpecialPage;
 use Miraheze\MirahezeMagic\MirahezeIRCRCFeedFormatter;
 
 $wgHooks['CreateWikiJsonGenerateDatabaseList'][] = 'MirahezeFunctions::onGenerateDatabaseLists';
 $wgHooks['ManageWikiCoreAddFormFields'][] = 'MirahezeFunctions::onManageWikiCoreAddFormFields';
@@ -24,10 +25,15 @@ if ( $wmgMirahezeContactPageFooter && $wi->isExtensionActive( 'ContactPage' ) )
 			);
 		}
 	};
 }
 
+// T11999: Disable Special:RequestWikiQueue outside of metawiki
+if ( $wi->dbname !== 'metawiki' ) {
+	$wgSpecialPages['RequestWikiQueue'] = DisabledSpecialPage::getCallback( 'RequestWikiQueue', 'createwiki-requestwikiqueue-disabled' );
+}
+
 // Extensions
 if ( $wi->dbname !== 'ldapwikiwiki' && $wi->dbname !== 'srewiki' ) {
 	wfLoadExtensions( [
 		'CentralAuth',
 		'GlobalPreferences',

Fixed code: use MediaWiki\SpecialPage\DisabledSpecialPage;
// T11999: Disable Special:RequestWikiQueue outside of metawiki
if ( $wi->dbname !== 'metawiki' ) {
	$wgSpecialPages['RequestWikiQueue'] = DisabledSpecialPage::getCallback( 'RequestWikiQueue', 'createwiki-requestwikiqueue-disabled' );
}
CVE-2024-34701: Insufficient Information (NVD-CWE-noinfo)
value: CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users to be considered as the requester of a specific wiki request if their local user ID on any wiki in a wiki farm matches the local ID of the requester at the wiki where the wiki request was made. This allows them to go to that request entry's on Special:RequestWikiQueue on the wiki where their local user ID matches and take any actions that the wiki requester is allowed to take from there.

Commit 02e0f298f8d35155c39aa74193cb7b867432c5b8 fixes the issue. Important note about the fix: This vulnerability has been fixed by disabling access to the REST API and special pages outside of the wiki configured as the "global wiki" in `$wgCreateWikiGlobalWiki` in a user's MediaWiki settings.

As a workaround, it is possible to disable the special pages outside of one's own global wiki by doing something similar to `miraheze/mw-config` commit e5664995fbb8644f9a80b450b4326194f20f9ddc that is adapted to one's own setup. As for the REST API, before the fix, there wasn't any REST endpoint that allowed one to make writes. Regardless, it is possible to also disable it outside of the global wiki by using `$wgCreateWikiDisableRESTAPI` and `$wgConf` in the configuration for one's own wiki farm..
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-14T15:39Z
Repository: https://github.com/miraheze/mw-config
Language: PHP
Files changed: LocalSettings.php
Commit date: 2024-05-01 20:03:07 +0200
Commit message: Add wgCreateWikiDisableRESTAPI (#5549)


Diff: diff --git a/LocalSettings.php b/LocalSettings.php
index dc93e3185..c57990640 100644
--- a/LocalSettings.php
+++ b/LocalSettings.php
@@ -926,10 +926,15 @@ $wgConf->settings += [
 	],
 	'wgCreateWikiDatabaseSuffix' => [
 		'default' => 'wiki',
 		'mirabeta' => 'wikibeta',
 	],
+	'wgCreateWikiDisableRESTAPI' => [
+		'default' => true,
+		'metawiki' => false,
+		'metawikibeta' => false,
+	],
 	'wgCreateWikiGlobalWiki' => [
 		'default' => 'metawiki',
 		'mirabeta' => 'metawikibeta',
 	],
 	'wgCreateWikiEmailNotifications' => [

Fixed code: 	'wgCreateWikiDisableRESTAPI' => [
		'default' => true,
		'metawiki' => false,
		'metawikibeta' => false,
	],
CVE-2023-43641: Out-of-bounds Write (CWE-787)
value: libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds array access. A user of the GNOME desktop environment can be exploited by downloading a cue sheet from a malicious webpage. Because the file is saved to `~/Downloads`, it is then automatically scanned by tracker-miners. And because it has a .cue filename extension, tracker-miners use libcue to parse the file. The file exploits the vulnerability in libcue to gain code execution. This issue is patched in version 2.3.0.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2023-10-09T22:15Z
Repository: https://github.com/lipnitsk/libcue
Language: Other
Files changed: CMakeLists.txt, ChangeLog
Commit date: 2023-10-10 13:38:11 -0700
Commit message: Changelog, CMakeLists.txt: Release 2.3.0

Signed-off-by: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>

Diff: diff --git a/CMakeLists.txt b/CMakeLists.txt
index c9d439e..2cc46a5 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,8 +1,8 @@
 SET(PACKAGE libcue)
 SET(PACKAGE_NAME libcue)
-SET(PACKAGE_VERSION 2.2.1)
+SET(PACKAGE_VERSION 2.3.0)
 SET(PACKAGE_SOVERSION 2)
 
 CMAKE_MINIMUM_REQUIRED(VERSION 2.8 FATAL_ERROR)
 
 PROJECT(libcue C)
diff --git a/ChangeLog b/ChangeLog
index bc07242..6545115 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,11 @@
+libcue (2.3.0)
+	[Vlad Stulikov, Vasiliy Sazonov]
+	* Bug fix - no EOF handling
+
+	[Kevin Backhouse]
+	* Fix CVE-2023-43641
 libcue (2.2.1)
 	[Ilya Lipnitskiy]
 	* cmake: Check for __attribute__ format
 
 	[Fabrice Fontaine]

Vulnerable code: SET(PACKAGE_VERSION 2.2.1)
Fixed code: SET(PACKAGE_VERSION 2.3.0)
libcue (2.3.0)
	[Vlad Stulikov, Vasiliy Sazonov]
	* Bug fix - no EOF handling

	[Kevin Backhouse]
	* Fix CVE-2023-43641
CVE-2023-43641: Out-of-bounds Write (CWE-787)
value: libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds array access. A user of the GNOME desktop environment can be exploited by downloading a cue sheet from a malicious webpage. Because the file is saved to `~/Downloads`, it is then automatically scanned by tracker-miners. And because it has a .cue filename extension, tracker-miners use libcue to parse the file. The file exploits the vulnerability in libcue to gain code execution. This issue is patched in version 2.3.0.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2023-10-09T22:15Z
Repository: https://github.com/lipnitsk/libcue
Language: C
Files changed: cd.c
Commit date: 2023-10-09 14:27:58 -0700
Commit message: Check that the array index isn't negative. This fixes CVE-2023-43641.

Signed-off-by: Kevin Backhouse <kevinbackhouse@github.com>

Diff: diff --git a/cd.c b/cd.c
index cf77a18..4bbea19 100644
--- a/cd.c
+++ b/cd.c
@@ -337,11 +337,11 @@ track_get_rem(const Track* track)
 		return NULL;
 }
 
 void track_set_index(Track *track, int i, long ind)
 {
-	if (i > MAXINDEX) {
+	if (i < 0 || i > MAXINDEX) {
 		fprintf(stderr, "too many indexes\n");
                 return;
         }
 
 	track->index[i] = ind;

Vulnerable code: 	if (i > MAXINDEX) {
Fixed code: 	if (i < 0 || i > MAXINDEX) {
CVE-2017-6504: Improper Input Validation (CWE-20)
value: WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which could potentially lead to clickjacking.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 6.1
Published: 2017-03-06T02:59Z
Repository: https://github.com/qbittorrent/qBittorrent
Language: C
Files changed: src/base/http/types.h, src/webui/abstractwebapplication.cpp
Commit date: 2017-03-03 21:28:27 +0200
Commit message: [WebUI] Avoid clickjacking attacks

Diff: diff --git a/src/base/http/types.h b/src/base/http/types.h
index d748d9342..ae401c719 100644
--- a/src/base/http/types.h
+++ b/src/base/http/types.h
@@ -41,10 +41,11 @@ namespace Http
     const QString HEADER_SET_COOKIE = "Set-Cookie";
     const QString HEADER_CONTENT_TYPE = "Content-Type";
     const QString HEADER_CONTENT_ENCODING = "Content-Encoding";
     const QString HEADER_CONTENT_LENGTH = "Content-Length";
     const QString HEADER_CACHE_CONTROL = "Cache-Control";
+    const QString HEADER_X_FRAME_OPTIONS = "X-Frame-Options";
 
     const QString CONTENT_TYPE_CSS = "text/css; charset=UTF-8";
     const QString CONTENT_TYPE_GIF = "image/gif";
     const QString CONTENT_TYPE_HTML = "text/html; charset=UTF-8";
     const QString CONTENT_TYPE_JS = "application/javascript; charset=UTF-8";
diff --git a/src/webui/abstractwebapplication.cpp b/src/webui/abstractwebapplication.cpp
index c0e42bf0a..738f7f4c2 100644
--- a/src/webui/abstractwebapplication.cpp
+++ b/src/webui/abstractwebapplication.cpp
@@ -101,11 +101,15 @@ Http::Response AbstractWebApplication::processRequest(const Http::Request &reque
 {
     session_ = 0;
     request_ = request;
     env_ = env;
 
-    clear(); // clear response
+    // clear response
+    clear();
+
+    // avoid clickjacking attacks
+    header(Http::HEADER_X_FRAME_OPTIONS, "SAMEORIGIN");
 
     sessionInitialize();
     if (!sessionActive() && !isAuthNeeded())
         sessionStart();
 

Vulnerable code:     clear(); // clear response
Fixed code:     const QString HEADER_X_FRAME_OPTIONS = "X-Frame-Options";
    // clear response
    clear();

    // avoid clickjacking attacks
    header(Http::HEADER_X_FRAME_OPTIONS, "SAMEORIGIN");
CVE-2023-51443: Improper Check or Handling of Exceptional Conditions (CWE-703)
value: FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.11, when handling DTLS-SRTP for media setup, FreeSWITCH is susceptible to Denial of Service due to a race condition in the hello handshake phase of the DTLS protocol. This attack can be done continuously, thus denying new DTLS-SRTP encrypted calls during the attack. If an attacker manages to send a ClientHello DTLS message with an invalid CipherSuite (such as `TLS_NULL_WITH_NULL_NULL`) to the port on the FreeSWITCH server that is expecting packets from the caller, a DTLS error is generated. This results in the media session being torn down, which is followed by teardown at signaling (SIP) level too. Abuse of this vulnerability may lead to a massive Denial of Service on vulnerable FreeSWITCH servers for calls that rely on DTLS-SRTP. To address this vulnerability, upgrade FreeSWITCH to 1.10.11 which includes the security fix. The solution implemented is to drop all packets from addresses that have not been validated by an ICE check.
CWE description: The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.
CVSS v3 base score: 5.9
Published: 2023-12-27T17:15Z
Repository: https://github.com/signalwire/freeswitch
Language: Unknown
Commit date: 2023-12-22 17:57:34 +0300
Commit message: Merge pull request from GHSA-39gv-hq72-j6m6

[Core] Reject DTLS packets coming from a source different than the current ICE negotiated path.
CVE-2021-43822: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data. In affected versions users can provoke SQL injections if they can specify a node name or query. Upgrade to version 1.7.4 to resolve this issue. If that is not possible, you can escape all places where `$property` is used to filter `sv:name` in the class `Jackalope\Transport\DoctrineDBAL\Query\QOMWalker`: `XPath::escape($property)`. Node names and xpaths can contain `"` or `;` according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection. If queries are never done from user input, or if you validate the user input to not contain `;`, you are not affected.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 7.5
Published: 2021-12-13T20:15Z
Repository: https://github.com/jackalope/jackalope-doctrine-dbal
Language: Unknown
Commit date: 2021-12-13 16:21:32 +0100
Commit message: Merge pull request from GHSA-ph98-v78f-jqrm

Fix SQL injection: Avoid property name closing a string
CVE-2013-7342: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in flowplayer.swf in the Flash fallback feature in Flowplayer HTML5 5.4.1 allows remote attackers to inject arbitrary web script or HTML via the callback parameter, a related issue to CVE-2013-7341.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-03-24T14:20Z
Repository: https://github.com/flowplayer/flowplayer
Language: Unknown
Commit date: 2013-05-14 12:08:18 -0700
Commit message: Merge pull request #382 from flowplayer/bug/381

don't accept callback to be passed in the query string (#381)
CVE-2013-7343: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in flowplayer.swf in the Flash fallback feature in Flowplayer HTML5 5.4.3 allows remote attackers to inject arbitrary web script or HTML by using URL encoding within the callback parameter name.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7342.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-03-24T14:20Z
Repository: https://github.com/flowplayer/flowplayer
Language: Unknown
Commit date: 2013-11-11 06:28:26 -0800
Commit message: Merge pull request #578 from flowplayer/bug/381

Decode the URL before checking the callback param.
CVE-2022-23467: Out-of-bounds Read (CWE-125)
value: OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. Using a modified USB device an attacker can leak stack addresses of the `razer_attr_read_dpi_stages`, potentially bypassing KASLR. To exploit this vulnerability an attacker would need to access to a users keyboard or mouse or would need to convince a user to use a modified device. The issue has been patched in v3.5.1. Users are advised to upgrade and should be reminded not to plug in unknown USB devices.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 4.6
Published: 2022-12-05T20:15Z
Repository: https://github.com/openrazer/openrazer
Language: C
Files changed: driver/razercommon.c
Commit date: 2022-12-04 12:45:07 +0100
Commit message: driver: Sanitize data_size value returned from devices

We're using this value for some bounds checks and we should ensure that
we don't potentially get a data_size that's bigger than the arguments
array to avoid out of bounds reads.

Diff: diff --git a/driver/razercommon.c b/driver/razercommon.c
index 125d160..5c1b298 100644
--- a/driver/razercommon.c
+++ b/driver/razercommon.c
@@ -105,10 +105,18 @@ int razer_get_usb_response(struct usb_device *usb_dev, uint report_index, struct
     if(len != 90) {
         printk(KERN_WARNING "razer driver: Invalid USB response. USB Report length: %d\n", len);
         result = 1;
     }
 
+    if (WARN_ONCE(response_report->data_size > ARRAY_SIZE(response_report->arguments),
+                  "Field data_size %d in response is bigger than arguments\n",
+                  response_report->data_size)) {
+        /* Sanitize the value since at the moment callers don't respect the return code */
+        response_report->data_size = ARRAY_SIZE(response_report->arguments);
+        return -EINVAL;
+    }
+
     return result;
 }
 
 /**
  * Calculate the checksum for the usb message

Fixed code:     if (WARN_ONCE(response_report->data_size > ARRAY_SIZE(response_report->arguments),
                  "Field data_size %d in response is bigger than arguments\n",
                  response_report->data_size)) {
        /* Sanitize the value since at the moment callers don't respect the return code */
        response_report->data_size = ARRAY_SIZE(response_report->arguments);
        return -EINVAL;
    }
CVE-2020-22808: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was found in yii2_fecshop 2.x. There is a reflected XSS vulnerability in the check cart page.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-04-29T19:15Z
Repository: https://github.com/fecshop/yii2_fecshop
Language: PHP
Files changed: app/appfront/theme/base/front/checkout/cart/index.php, app/apphtml5/theme/base/html5/checkout/cart/index.php
Commit date: 2020-05-26 17:18:45 +0800
Commit message: check cart page xss bug fix

Diff: diff --git a/app/appfront/theme/base/front/checkout/cart/index.php b/app/appfront/theme/base/front/checkout/cart/index.php
index 0f9d07c6..80e7d9a1 100644
--- a/app/appfront/theme/base/front/checkout/cart/index.php
+++ b/app/appfront/theme/base/front/checkout/cart/index.php
@@ -289,11 +289,11 @@ use fec\helpers\CRequest;
 <?php $this->beginBlock('changeCartInfo') ?>
 csrfName = "<?= CRequest::getCsrfName() ?>";
 csrfVal = "<?= CRequest::getCsrfValue() ?>";
 $(document).ready(function(){
     // set select all checkbox
-    selectall = "<?= Yii::$app->request->get('selectall') ?>";
+    selectall = "<?=  \Yii::$service->helper->htmlEncode(Yii::$app->request->get('selectall')) ?>";
     selectAllChecked = false;
     if (selectall == 1) {
         selectAllChecked = true;
     } else {
         item_select_all = 1;
diff --git a/app/apphtml5/theme/base/html5/checkout/cart/index.php b/app/apphtml5/theme/base/html5/checkout/cart/index.php
index 304c124b..41919f3a 100644
--- a/app/apphtml5/theme/base/html5/checkout/cart/index.php
+++ b/app/apphtml5/theme/base/html5/checkout/cart/index.php
@@ -170,11 +170,12 @@ use fec\helpers\CRequest;
 <?php $this->beginBlock('changeCartInfo') ?>
 csrfName = "<?= CRequest::getCsrfName() ?>";
 csrfVal = "<?= CRequest::getCsrfValue() ?>";
 $(document).ready(function(){
 	// set select all checkbox
-    selectall = "<?= Yii::$app->request->get('selectall') ?>";
+    // selectall = "<?= Yii::$app->request->get('selectall') ?>";
+    selectall = "<?=  \Yii::$service->helper->htmlEncode(Yii::$app->request->get('selectall')) ?>";
     selectAllChecked = false;
     if (selectall == 1) {
         selectAllChecked = true;
     } else {
         item_select_all = 1;

Vulnerable code:     selectall = "<?= Yii::$app->request->get('selectall') ?>";
    selectall = "<?= Yii::$app->request->get('selectall') ?>";
Fixed code:     selectall = "<?=  \Yii::$service->helper->htmlEncode(Yii::$app->request->get('selectall')) ?>";
    // selectall = "<?= Yii::$app->request->get('selectall') ?>";
    selectall = "<?=  \Yii::$service->helper->htmlEncode(Yii::$app->request->get('selectall')) ?>";
CVE-2022-36080: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Wikmd is a file based wiki that uses markdown. Prior to version 1.7.1, an attacker could capture user's session cookies or execute malicious Javascript when a victim edits a markdown file. Version 1.7.1 fixes this issue.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-09-07T21:15Z
Repository: https://github.com/Linbreux/wikmd
Language: Unknown
Commit date: 2022-09-04 09:54:03 +0200
Commit message: Merge pull request from GHSA-9m4m-6gqx-gfj3

SECURITY PATCH: prevent XSS by cleaning html code
CVE-2022-36081: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Wikmd is a file based wiki that uses markdown. Prior to version 1.7.1, Wikmd is vulnerable to path traversal when accessing `/list/<path:folderpath>` and discloses lists of files located on the server including sensitive data. Version 1.7.1 fixes this issue.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2022-09-07T21:15Z
Repository: https://github.com/Linbreux/wikmd
Language: Unknown
Commit date: 2022-09-04 13:53:10 +0200
Commit message: Merge pull request from GHSA-w4cf-92x9-v8w2

SECURITY PATCH: Local File Enumeration when accessing /list
CVE-2023-27582: Improper Authentication (CWE-287)
value: maddy is a composable, all-in-one mail server. Starting with version 0.2.0 and prior to version 0.6.3, maddy allows a full authentication bypass if SASL authorization username is specified when using the PLAIN authentication mechanisms. Instead of validating the specified username, it is accepted as is after checking the credentials for the authentication username. maddy 0.6.3 includes the fix for the bug. There are no known workarounds.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 9.8
Published: 2023-03-13T22:15Z
Repository: https://github.com/foxcpp/maddy
Language: Go
Files changed: internal/auth/sasl.go, internal/auth/sasl_test.go
Commit date: 2023-03-14 00:20:40 +0300
Commit message: auth: Actually check SASL identity argument before using it

Fixes GHSA-4g76-w3xw-2x6w.

Diff: diff --git a/internal/auth/sasl.go b/internal/auth/sasl.go
index 06417ce0..2103ab7e 100644
--- a/internal/auth/sasl.go
+++ b/internal/auth/sasl.go
@@ -79,10 +79,13 @@ func (s *SASLAuth) CreateSASL(mech string, remoteAddr net.Addr, successCb func(i
 	case sasl.Plain:
 		return sasl.NewPlainServer(func(identity, username, password string) error {
 			if identity == "" {
 				identity = username
 			}
+			if identity != username {
+				return ErrInvalidAuthCred
+			}
 
 			err := s.AuthPlain(username, password)
 			if err != nil {
 				s.Log.Error("authentication failed", err, "username", username, "src_ip", remoteAddr)
 				return ErrInvalidAuthCred
diff --git a/internal/auth/sasl_test.go b/internal/auth/sasl_test.go
index 625f0bb1..fcc193aa 100644
--- a/internal/auth/sasl_test.go
+++ b/internal/auth/sasl_test.go
@@ -73,17 +73,17 @@ func TestCreateSASL(t *testing.T) {
 		}
 	})
 
 	t.Run("PLAIN with authorization identity", func(t *testing.T) {
 		srv := a.CreateSASL("PLAIN", &net.TCPAddr{}, func(id string) error {
-			if id != "user1a" {
+			if id != "user1" {
 				t.Fatal("Wrong authorization identity passed:", id)
 			}
 			return nil
 		})
 
-		_, _, err := srv.Next([]byte("user1a\x00user1\x00aa"))
+		_, _, err := srv.Next([]byte("user1\x00user1\x00aa"))
 		if err != nil {
 			t.Error("Unexpected error:", err)
 		}
 	})
 }

Vulnerable code: 			if id != "user1a" {
		_, _, err := srv.Next([]byte("user1a\x00user1\x00aa"))
Fixed code: 			if identity != username {
				return ErrInvalidAuthCred
			}
			if id != "user1" {
		_, _, err := srv.Next([]byte("user1\x00user1\x00aa"))
CVE-2019-15541: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)
value: rustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to cause a denial of service (loop of conn_event and ready) by arranging for a client to never be writable.
CWE description: The product constructs a string for a command to be executed by a separate component
in another control sphere, but it does not properly delimit the
intended arguments, options, or switches within that command string.
CVSS v3 base score: 7.5
Published: 2019-08-26T12:15Z
Repository: https://github.com/ctz/rustls
Language: Rust
Files changed: rustls-mio/examples/tlsserver.rs
Commit date: 2019-08-10 09:47:06 +0100
Commit message: tlsserver: fix loop when client will never be writable

Diff: diff --git a/rustls-mio/examples/tlsserver.rs b/rustls-mio/examples/tlsserver.rs
index b22ed08..1b899a9 100644
--- a/rustls-mio/examples/tlsserver.rs
+++ b/rustls-mio/examples/tlsserver.rs
@@ -177,11 +177,11 @@ impl Connection {
 
         if ev.readiness().is_writable() {
             self.do_tls_write_and_handle_error();
         }
 
-        if self.closing && !self.tls_session.wants_write() {
+        if self.closing {
             let _ = self.socket.shutdown(Shutdown::Both);
             self.close_back();
             self.closed = true;
         } else {
             self.reregister(poll);

Vulnerable code:         if self.closing && !self.tls_session.wants_write() {
Fixed code:         if self.closing {
CVE-2020-24074: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The decode program in silk-v3-decoder Version:20160922 Build By kn007 does not strictly check data, resulting in a buffer overflow.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2020-09-09T14:15Z
Repository: https://github.com/kn007/silk-v3-decoder
Language: Unknown
Commit date: 2020-06-22 22:29:15 +0800
Commit message: Merge pull request #64 from WinMin/master

add "totBytes check, fix #62
CVE-2020-24074: Improper Input Validation (CWE-20)
value: The decode program in silk-v3-decoder Version:20160922 Build By kn007 does not strictly check data, resulting in a buffer overflow.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 9.8
Published: 2020-09-09T14:15Z
Repository: https://github.com/kn007/silk-v3-decoder
Language: Unknown
Commit date: 2020-06-22 22:29:15 +0800
Commit message: Merge pull request #64 from WinMin/master

add "totBytes check, fix #62
CVE-2021-4072: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: elgg is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-12-24T14:15Z
Repository: https://github.com/elgg/elgg
Language: PHP
Files changed: mod/reportedcontent/actions/reportedcontent/add.php
Commit date: 2021-12-06 15:39:10 +0100
Commit message: fix(reported_content): sanitize report URLs


Diff: diff --git a/mod/reportedcontent/actions/reportedcontent/add.php b/mod/reportedcontent/actions/reportedcontent/add.php
index f45a500eb5..dff05fb6fe 100644
--- a/mod/reportedcontent/actions/reportedcontent/add.php
+++ b/mod/reportedcontent/actions/reportedcontent/add.php
@@ -16,11 +16,11 @@ if (!$title || !$address) {
 }
 
 $report = new ElggReportedContent();
 $report->owner_guid = elgg_get_logged_in_user_guid();
 $report->title = $title;
-$report->address = $address;
+$report->address = elgg_normalize_site_url($address);
 $report->description = $description;
 $report->access_id = $access;
 
 if (!$report->save()) {
 	$fail();

Vulnerable code: $report->address = $address;
Fixed code: $report->address = elgg_normalize_site_url($address);
CVE-2024-22194: Insertion of Sensitive Information Into Debugging Code (CWE-215)
value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
CWE description: The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
CVSS v3 base score: 2.8
Published: 2024-01-11T03:15Z
Repository: https://github.com/casework/CASE-Utilities-Python
Language: Unknown
Commit date: 2023-12-22 15:13:59 -0500
Commit message: Merge branch 'release-0.12.1' into support-0.12.x
CVE-2024-22194: Predictable Seed in Pseudo-Random Number Generator (PRNG) (CWE-337)
value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
CWE description: A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
CVSS v3 base score: 2.8
Published: 2024-01-11T03:15Z
Repository: https://github.com/casework/CASE-Utilities-Python
Language: Unknown
Commit date: 2023-12-22 15:13:59 -0500
Commit message: Merge branch 'release-0.12.1' into support-0.12.x
CVE-2024-22194: Insertion of Sensitive Information Into Debugging Code (CWE-215)
value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
CWE description: The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
CVSS v3 base score: 2.8
Published: 2024-01-11T03:15Z
Repository: https://github.com/casework/CASE-Utilities-Python
Language: Unknown
Commit date: 2023-12-22 15:26:12 -0500
Commit message: Merge branch 'release-0.13.1' into support-0.13.x
CVE-2024-22194: Predictable Seed in Pseudo-Random Number Generator (PRNG) (CWE-337)
value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
CWE description: A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
CVSS v3 base score: 2.8
Published: 2024-01-11T03:15Z
Repository: https://github.com/casework/CASE-Utilities-Python
Language: Unknown
Commit date: 2023-12-22 15:26:12 -0500
Commit message: Merge branch 'release-0.13.1' into support-0.13.x
CVE-2024-22194: Insertion of Sensitive Information Into Debugging Code (CWE-215)
value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
CWE description: The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
CVSS v3 base score: 2.8
Published: 2024-01-11T03:15Z
Repository: https://github.com/casework/CASE-Utilities-Python
Language: Unknown
Commit date: 2023-12-22 14:43:22 -0500
Commit message: Merge branch 'release-0.10.1' into support-0.10.x
CVE-2024-22194: Predictable Seed in Pseudo-Random Number Generator (PRNG) (CWE-337)
value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
CWE description: A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
CVSS v3 base score: 2.8
Published: 2024-01-11T03:15Z
Repository: https://github.com/casework/CASE-Utilities-Python
Language: Unknown
Commit date: 2023-12-22 14:43:22 -0500
Commit message: Merge branch 'release-0.10.1' into support-0.10.x
CVE-2024-22194: Insertion of Sensitive Information Into Debugging Code (CWE-215)
value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
CWE description: The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
CVSS v3 base score: 2.8
Published: 2024-01-11T03:15Z
Repository: https://github.com/casework/CASE-Utilities-Python
Language: Other
Files changed: setup.cfg
Commit date: 2023-12-22 14:13:18 -0500
Commit message: Merge branches 'HotFix-0.9.1-refresh_pre_commit', 'HotFix-0.9.1-set_pandas_ceiling' and 'support-0.8.x' into release-0.9.1

Diff: diff --cc setup.cfg
index fa9b6e5,80c6c98,06ba2b5..2c4603c
--- a/setup.cfg
+++ b/setup.cfg
@@@@ -17,17 -17,17 -17,17 +17,17 @@@@ license_files 
       THIRD_PARTY_LICENSES.md
   
   [options]
   include_package_data = true
   install_requires =
- -    pandas
+ +    pandas < 2.1.0
       pyshacl
--     rdflib >= 6.2.0
++     rdflib >= 6.2.0, < 6.3.0
       requests
       tabulate
   packages = find:
-- python_requires = >=3.7
++ python_requires = >=3.8
   
   [options.entry_points]
   console_scripts =
       case_file = case_utils.case_file:main
       case_sparql_construct = case_utils.case_sparql_construct:main

Vulnerable code:  -    pandas
-     rdflib >= 6.2.0
Fixed code:  +    pandas < 2.1.0
+     rdflib >= 6.2.0, < 6.3.0
CVE-2024-22194: Predictable Seed in Pseudo-Random Number Generator (PRNG) (CWE-337)
value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
CWE description: A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
CVSS v3 base score: 2.8
Published: 2024-01-11T03:15Z
Repository: https://github.com/casework/CASE-Utilities-Python
Language: Other
Files changed: setup.cfg
Commit date: 2023-12-22 14:13:18 -0500
Commit message: Merge branches 'HotFix-0.9.1-refresh_pre_commit', 'HotFix-0.9.1-set_pandas_ceiling' and 'support-0.8.x' into release-0.9.1

Diff: diff --cc setup.cfg
index fa9b6e5,80c6c98,06ba2b5..2c4603c
--- a/setup.cfg
+++ b/setup.cfg
@@@@ -17,17 -17,17 -17,17 +17,17 @@@@ license_files 
       THIRD_PARTY_LICENSES.md
   
   [options]
   include_package_data = true
   install_requires =
- -    pandas
+ +    pandas < 2.1.0
       pyshacl
--     rdflib >= 6.2.0
++     rdflib >= 6.2.0, < 6.3.0
       requests
       tabulate
   packages = find:
-- python_requires = >=3.7
++ python_requires = >=3.8
   
   [options.entry_points]
   console_scripts =
       case_file = case_utils.case_file:main
       case_sparql_construct = case_utils.case_sparql_construct:main

Vulnerable code:  -    pandas
-     rdflib >= 6.2.0
Fixed code:  +    pandas < 2.1.0
+     rdflib >= 6.2.0, < 6.3.0
CVE-2024-22194: Insertion of Sensitive Information Into Debugging Code (CWE-215)
value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
CWE description: The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
CVSS v3 base score: 2.8
Published: 2024-01-11T03:15Z
Repository: https://github.com/casework/CASE-Utilities-Python
Language: Unknown
Commit date: 2023-12-22 16:20:49 -0500
Commit message: Merge pull request #145 from casework/release-0.14.1

Release 0.14.1
CVE-2024-22194: Predictable Seed in Pseudo-Random Number Generator (PRNG) (CWE-337)
value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
CWE description: A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
CVSS v3 base score: 2.8
Published: 2024-01-11T03:15Z
Repository: https://github.com/casework/CASE-Utilities-Python
Language: Unknown
Commit date: 2023-12-22 16:20:49 -0500
Commit message: Merge pull request #145 from casework/release-0.14.1

Release 0.14.1
CVE-2024-22194: Insertion of Sensitive Information Into Debugging Code (CWE-215)
value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
CWE description: The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
CVSS v3 base score: 2.8
Published: 2024-01-11T03:15Z
Repository: https://github.com/casework/CASE-Utilities-Python
Language: Unknown
Commit date: 2023-12-20 18:03:56 -0500
Commit message: Merge pull request #146 from casework/release-0.5.1

Release 0.5.1
CVE-2024-22194: Predictable Seed in Pseudo-Random Number Generator (PRNG) (CWE-337)
value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
CWE description: A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
CVSS v3 base score: 2.8
Published: 2024-01-11T03:15Z
Repository: https://github.com/casework/CASE-Utilities-Python
Language: Unknown
Commit date: 2023-12-20 18:03:56 -0500
Commit message: Merge pull request #146 from casework/release-0.5.1

Release 0.5.1
CVE-2024-22194: Insertion of Sensitive Information Into Debugging Code (CWE-215)
value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
CWE description: The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
CVSS v3 base score: 2.8
Published: 2024-01-11T03:15Z
Repository: https://github.com/casework/CASE-Utilities-Python
Language: YAML
Files changed: .github/workflows/cicd.yml
Commit date: 2023-12-22 13:12:57 -0500
Commit message: Merge branches 'HotFix-0.8.1-refresh_pre_commit' and 'support-0.7.x' into release-0.8.1

Diff: diff --cc .github/workflows/cicd.yml
index ded9ba3,383e214..074471b
--- a/.github/workflows/cicd.yml
+++ b/.github/workflows/cicd.yml
@@@ -28,13 -30,13 +30,13 @@@ jobs
    build:
  
      runs-on: ubuntu-latest
      strategy:
        matrix:
-         python-version: 
-           - '3.7'
+         python-version:
+           - '3.8'
 -          - '3.10'
 +          - '3.11'
  
      steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-java@v3
        with:
diff --cc case_utils/local_uuid.py
index fd27fd2,3259214..5db3c00
--- a/case_utils/local_uuid.py
+++ b/case_utils/local_uuid.py
@@@ -30,17 -30,33 +30,33 @@@ DEMO_UUID_BASE: typing.Optional[str] = 
  DEMO_UUID_COUNTER: int = 0
  
  _logger = logging.getLogger(pathlib.Path(__file__).name)
  
  
+ def _is_relative_to(p1: pathlib.Path, p2: pathlib.Path) -> bool:
+     """
+     This function provides pathlib.is_relative_to to Pythons before 3.9.  After the End of Life of Python 3.8, this function can be removed.
+     """
+     if sys.version_info < (3, 9):
+         try:
+             _ = p1.relative_to(p2)
+             return True
+         except ValueError:
+             return False
+     else:
+         return p1.is_relative_to(p2)
+ 
+ 
  def configure() -> None:
      global DEMO_UUID_BASE
  
+     # _logger.debug("sys.argv = %r.", sys.argv)
+ 
      if os.getenv("DEMO_UUID_REQUESTING_NONRANDOM") == "NONRANDOM_REQUESTED":
          warnings.warn(
              "Environment variable DEMO_UUID_REQUESTING_NONRANDOM is deprecated.  See case_utils.local_uuid.demo_uuid for usage notes on its replacement, CASE_DEMO_NONRANDOM_UUID_BASE.  Proceeding with random UUIDs.",
 -            DeprecationWarning,
 +            FutureWarning,
          )
          return
  
      env_base_dir_name = os.getenv("CASE_DEMO_NONRANDOM_UUID_BASE")
      if env_base_dir_name is None:

Vulnerable code:          python-version: 
           - '3.7'
Fixed code:          python-version:
           - '3.8'