Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2017-8890: Double Free (CWE-415)
value: The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel through 4.10.15 allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 7.8
Published: 2017-05-10T16:29Z
Repository: https://github.com/torvalds/linux
Language: C
Files changed: net/ipv4/inet_connection_sock.c
Commit date: 2017-05-09 15:17:49 -0400
Commit message: dccp/tcp: do not inherit mc_list from parent

syzkaller found a way to trigger double frees from ip_mc_drop_socket()

It turns out that leave a copy of parent mc_list at accept() time,
which is very bad.

Very similar to commit 8b485ce69876 ("tcp: do not inherit
fastopen_req from parent")

Initial report from Pray3r, completed by Andrey one.
Thanks a lot to them !

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Pray3r <pray3r.z@gmail.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Diff: diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 5e313c1ac94f..1054d330bf9d 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -792,10 +792,12 @@ struct sock *inet_csk_clone_lock(const struct sock *sk,
 		newsk->sk_write_space = sk_stream_write_space;
 
 		/* listeners have SOCK_RCU_FREE, not the children */
 		sock_reset_flag(newsk, SOCK_RCU_FREE);
 
+		inet_sk(newsk)->mc_list = NULL;
+
 		newsk->sk_mark = inet_rsk(req)->ir_mark;
 		atomic64_set(&newsk->sk_cookie,
 			     atomic64_read(&inet_rsk(req)->ir_cookie));
 
 		newicsk->icsk_retransmits = 0;

Fixed code: 		inet_sk(newsk)->mc_list = NULL;
CVE-2023-1855: Use After Free (CWE-416)
value: A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux Kernel Driver (xgene-hwmon). This flaw could allow a local attacker to crash the system due to a race problem. This vulnerability could even lead to a kernel information leak problem.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 6.3
Published: 2023-04-05T20:15Z
Repository: https://github.com/torvalds/linux
Language: C
Files changed: drivers/hwmon/xgene-hwmon.c
Commit date: 2023-03-12 11:13:25 -0700
Commit message: hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition

In xgene_hwmon_probe, &ctx->workq is bound with xgene_hwmon_evt_work.
Then it will be started.

If we remove the driver which will call xgene_hwmon_remove to clean up,
there may be unfinished work.

The possible sequence is as follows:

Fix it by finishing the work before cleanup in xgene_hwmon_remove.

CPU0                  CPU1

                    |xgene_hwmon_evt_work
xgene_hwmon_remove   |
kfifo_free(&ctx->async_msg_fifo);|
                    |
                    |kfifo_out_spinlocked
                    |//use &ctx->async_msg_fifo
Fixes: 2ca492e22cb7 ("hwmon: (xgene) Fix crash when alarm occurs before driver probe")
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Link: https://lore.kernel.org/r/20230310084007.1403388-1-zyytlz.wz@163.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>

Diff: diff --git a/drivers/hwmon/xgene-hwmon.c b/drivers/hwmon/xgene-hwmon.c
index 5cde837bfd09..d1abea49f01b 100644
--- a/drivers/hwmon/xgene-hwmon.c
+++ b/drivers/hwmon/xgene-hwmon.c
@@ -759,10 +759,11 @@ static int xgene_hwmon_probe(struct platform_device *pdev)
 
 static int xgene_hwmon_remove(struct platform_device *pdev)
 {
 	struct xgene_hwmon_dev *ctx = platform_get_drvdata(pdev);
 
+	cancel_work_sync(&ctx->workq);
 	hwmon_device_unregister(ctx->hwmon_dev);
 	kfifo_free(&ctx->async_msg_fifo);
 	if (acpi_disabled)
 		mbox_free_channel(ctx->mbox_chan);
 	else

Fixed code: 	cancel_work_sync(&ctx->workq);
CVE-2023-23004: NULL Pointer Dereference (CWE-476)
value: In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2023-03-01T20:15Z
Repository: https://github.com/torvalds/linux
Language: C
Files changed: drivers/gpu/drm/arm/malidp_planes.c
Commit date: 2022-04-28 16:08:19 +0100
Commit message: malidp: Fix NULL vs IS_ERR() checking

The get_sg_table() function does not return NULL.
It returns error pointers.

Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
Link: https://lore.kernel.org/dri-devel/20211213072115.18098-1-linmq006@gmail.com/

Diff: diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c
index 81d9f5004025..338cec4a3fff 100644
--- a/drivers/gpu/drm/arm/malidp_planes.c
+++ b/drivers/gpu/drm/arm/malidp_planes.c
@@ -342,11 +342,11 @@ static bool malidp_check_pages_threshold(struct malidp_plane_state *ms,
 		if (cma_obj->sgt)
 			sgt = cma_obj->sgt;
 		else
 			sgt = obj->funcs->get_sg_table(obj);
 
-		if (!sgt)
+		if (IS_ERR(sgt))
 			return false;
 
 		sgl = sgt->sgl;
 
 		while (sgl) {

Vulnerable code: 		if (!sgt)
Fixed code: 		if (IS_ERR(sgt))
CVE-2022-1263: NULL Pointer Dereference (CWE-476)
value: A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.5
Published: 2022-08-31T16:15Z
Repository: https://github.com/torvalds/linux
Language: C
Files changed: virt/kvm/kvm_main.c
Commit date: 2022-04-06 13:26:30 -0400
Commit message: KVM: avoid NULL pointer dereference in kvm_dirty_ring_push

kvm_vcpu_release() will call kvm_dirty_ring_free(), freeing
ring->dirty_gfns and setting it to NULL.  Afterwards, it calls
kvm_arch_vcpu_destroy().

However, if closing the file descriptor races with KVM_RUN in such away
that vcpu->arch.st.preempted == 0, the following call stack leads to a
NULL pointer dereference in kvm_dirty_run_push():

 mark_page_dirty_in_slot+0x192/0x270 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3171
 kvm_steal_time_set_preempted arch/x86/kvm/x86.c:4600 [inline]
 kvm_arch_vcpu_put+0x34e/0x5b0 arch/x86/kvm/x86.c:4618
 vcpu_put+0x1b/0x70 arch/x86/kvm/../../../virt/kvm/kvm_main.c:211
 vmx_free_vcpu+0xcb/0x130 arch/x86/kvm/vmx/vmx.c:6985
 kvm_arch_vcpu_destroy+0x76/0x290 arch/x86/kvm/x86.c:11219
 kvm_vcpu_destroy arch/x86/kvm/../../../virt/kvm/kvm_main.c:441 [inline]

The fix is to release the dirty page ring after kvm_arch_vcpu_destroy
has run.

Reported-by: Qiuhao Li <qiuhao@sysec.org>
Reported-by: Gaoning Pan <pgn@zju.edu.cn>
Reported-by: Yongkang Jia <kangel@zju.edu.cn>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Diff: diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 70e05af5ebea..b22f380e3347 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -432,12 +432,12 @@ static void kvm_vcpu_init(struct kvm_vcpu *vcpu, struct kvm *kvm, unsigned id)
 	vcpu->last_used_slot = NULL;
 }
 
 static void kvm_vcpu_destroy(struct kvm_vcpu *vcpu)
 {
-	kvm_dirty_ring_free(&vcpu->dirty_ring);
 	kvm_arch_vcpu_destroy(vcpu);
+	kvm_dirty_ring_free(&vcpu->dirty_ring);
 
 	/*
 	 * No need for rcu_read_lock as VCPU_RUN is the only place that changes
 	 * the vcpu->pid pointer, and at destruction time all file descriptors
 	 * are already gone.

Vulnerable code: 	kvm_dirty_ring_free(&vcpu->dirty_ring);
Fixed code: 	kvm_dirty_ring_free(&vcpu->dirty_ring);
CVE-2018-10940: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: The cdrom_ioctl_media_changed function in drivers/cdrom/cdrom.c in the Linux kernel before 4.16.6 allows local attackers to use a incorrect bounds check in the CDROM driver CDROM_MEDIA_CHANGED ioctl to read out kernel memory.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 5.5
Published: 2018-05-09T17:29Z
Repository: https://github.com/torvalds/linux
Language: C
Files changed: drivers/cdrom/cdrom.c
Commit date: 2018-04-18 08:21:32 -0600
Commit message: cdrom: information leak in cdrom_ioctl_media_changed()

This cast is wrong.  "cdi->capacity" is an int and "arg" is an unsigned
long.  The way the check is written now, if one of the high 32 bits is
set then we could read outside the info->slots[] array.

This bug is pretty old and it predates git.

Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

Diff: diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index 8327478effd0..bfc566d3f31a 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -2369,11 +2369,11 @@ static int cdrom_ioctl_media_changed(struct cdrom_device_info *cdi,
 
 	/* cannot select disc or select current disc */
 	if (!CDROM_CAN(CDC_SELECT_DISC) || arg == CDSL_CURRENT)
 		return media_changed(cdi, 1);
 
-	if ((unsigned int)arg >= cdi->capacity)
+	if (arg >= cdi->capacity)
 		return -EINVAL;
 
 	info = kmalloc(sizeof(*info), GFP_KERNEL);
 	if (!info)
 		return -ENOMEM;

Vulnerable code: 	if ((unsigned int)arg >= cdi->capacity)
Fixed code: 	if (arg >= cdi->capacity)
CVE-2019-19066: Missing Release of Memory after Effective Lifetime (CWE-401)
value: A memory leak in the bfad_im_get_stats() function in drivers/scsi/bfa/bfad_attr.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering bfa_port_get_stats() failures, aka CID-0e62395da2bd.
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 4.7
Published: 2019-11-18T06:15Z
Repository: https://github.com/torvalds/linux
Language: C
Files changed: drivers/scsi/bfa/bfad_attr.c
Commit date: 2019-09-30 22:54:15 -0400
Commit message: scsi: bfa: release allocated memory in case of error

In bfad_im_get_stats if bfa_port_get_stats fails, allocated memory needs to
be released.

Link: https://lore.kernel.org/r/20190910234417.22151-1-navid.emamdoost@gmail.com
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

Diff: diff --git a/drivers/scsi/bfa/bfad_attr.c b/drivers/scsi/bfa/bfad_attr.c
index 29ab81df75c0..fbfce02e5b93 100644
--- a/drivers/scsi/bfa/bfad_attr.c
+++ b/drivers/scsi/bfa/bfad_attr.c
@@ -273,12 +273,14 @@ bfad_im_get_stats(struct Scsi_Host *shost)
 	spin_lock_irqsave(&bfad->bfad_lock, flags);
 	memset(hstats, 0, sizeof(struct fc_host_statistics));
 	rc = bfa_port_get_stats(BFA_FCPORT(&bfad->bfa),
 				fcstats, bfad_hcb_comp, &fcomp);
 	spin_unlock_irqrestore(&bfad->bfad_lock, flags);
-	if (rc != BFA_STATUS_OK)
+	if (rc != BFA_STATUS_OK) {
+		kfree(fcstats);
 		return NULL;
+	}
 
 	wait_for_completion(&fcomp.comp);
 
 	/* Fill the fc_host_statistics structure */
 	hstats->seconds_since_last_reset = fcstats->fc.secs_reset;

Vulnerable code: 	if (rc != BFA_STATUS_OK)
Fixed code: 	if (rc != BFA_STATUS_OK) {
		kfree(fcstats);
	}
CVE-2023-3106: NULL Pointer Dereference (CWE-476)
value: A NULL pointer dereference vulnerability was found in netlink_dump. This issue can occur when the Netlink socket receives the message(sendmsg) for the XFRM_MSG_GETSA, XFRM_MSG_GETPOLICY type message, and the DUMP flag is set and can cause a denial of service or possibly another unspecified impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is unlikely.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.8
Published: 2023-07-12T09:15Z
Repository: https://github.com/torvalds/linux
Language: C
Files changed: net/xfrm/xfrm_user.c
Commit date: 2016-07-18 09:37:02 +0200
Commit message: xfrm: fix crash in XFRM_MSG_GETSA netlink handler

If we hit any of the error conditions inside xfrm_dump_sa(), then
xfrm_state_walk_init() never gets called. However, we still call
xfrm_state_walk_done() from xfrm_dump_sa_done(), which will crash
because the state walk was never initialized properly.

We can fix this by setting cb->args[0] only after we've processed the
first element and checking this before calling xfrm_state_walk_done().

Fixes: d3623099d3 ("ipsec: add support of limited SA dump")
Cc: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

Diff: diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index d516845e16e3..4fb04ced5867 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -894,11 +894,12 @@ static int xfrm_dump_sa_done(struct netlink_callback *cb)
 {
 	struct xfrm_state_walk *walk = (struct xfrm_state_walk *) &cb->args[1];
 	struct sock *sk = cb->skb->sk;
 	struct net *net = sock_net(sk);
 
-	xfrm_state_walk_done(walk, net);
+	if (cb->args[0])
+		xfrm_state_walk_done(walk, net);
 	return 0;
 }
 
 static const struct nla_policy xfrma_policy[XFRMA_MAX+1];
 static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
@@ -919,12 +920,10 @@ static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
 		struct nlattr *attrs[XFRMA_MAX+1];
 		struct xfrm_address_filter *filter = NULL;
 		u8 proto = 0;
 		int err;
 
-		cb->args[0] = 1;
-
 		err = nlmsg_parse(cb->nlh, 0, attrs, XFRMA_MAX,
 				  xfrma_policy);
 		if (err < 0)
 			return err;
 
@@ -937,10 +936,11 @@ static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
 
 		if (attrs[XFRMA_PROTO])
 			proto = nla_get_u8(attrs[XFRMA_PROTO]);
 
 		xfrm_state_walk_init(walk, proto, filter);
+		cb->args[0] = 1;
 	}
 
 	(void) xfrm_state_walk(net, walk, dump_one_state, &info);
 
 	return skb->len;

Vulnerable code: 	xfrm_state_walk_done(walk, net);
		cb->args[0] = 1;

Fixed code: 	if (cb->args[0])
		xfrm_state_walk_done(walk, net);
		cb->args[0] = 1;
CVE-2023-26545: Double Free (CWE-415)
value: In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 4.7
Published: 2023-02-25T04:15Z
Repository: https://github.com/torvalds/linux
Language: C
Files changed: net/mpls/af_mpls.c
Commit date: 2023-02-15 10:26:37 +0000
Commit message: net: mpls: fix stale pointer if allocation fails during device rename

lianhui reports that when MPLS fails to register the sysctl table
under new location (during device rename) the old pointers won't
get overwritten and may be freed again (double free).

Handle this gracefully. The best option would be unregistering
the MPLS from the device completely on failure, but unfortunately
mpls_ifdown() can fail. So failing fully is also unreliable.

Another option is to register the new table first then only
remove old one if the new one succeeds. That requires more
code, changes order of notifications and two tables may be
visible at the same time.

sysctl point is not used in the rest of the code - set to NULL
on failures and skip unregister if already NULL.

Reported-by: lianhui tang <bluetlh@gmail.com>
Fixes: 0fae3bf018d9 ("mpls: handle device renames for per-device sysctls")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Diff: diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
index 35b5f806fdda..dc5165d3eec4 100644
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -1426,19 +1426,23 @@ static int mpls_dev_sysctl_register(struct net_device *dev,
 	return 0;
 
 free:
 	kfree(table);
 out:
+	mdev->sysctl = NULL;
 	return -ENOBUFS;
 }
 
 static void mpls_dev_sysctl_unregister(struct net_device *dev,
 				       struct mpls_dev *mdev)
 {
 	struct net *net = dev_net(dev);
 	struct ctl_table *table;
 
+	if (!mdev->sysctl)
+		return;
+
 	table = mdev->sysctl->ctl_table_arg;
 	unregister_net_sysctl_table(mdev->sysctl);
 	kfree(table);
 
 	mpls_netconf_notify_devconf(net, RTM_DELNETCONF, 0, mdev);

Fixed code: 	mdev->sysctl = NULL;
	if (!mdev->sysctl)
		return;
CVE-2019-19070: Missing Release of Memory after Effective Lifetime (CWE-401)
value: A memory leak in the spi_gpio_probe() function in drivers/spi/spi-gpio.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering devm_add_action_or_reset() failures, aka CID-d3b0ffa1d75d. NOTE: third parties dispute the relevance of this because the system must have already been out of memory before the probe began
CWE description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CVSS v3 base score: 7.5
Published: 2019-11-18T06:15Z
Repository: https://github.com/torvalds/linux
Language: C
Files changed: drivers/spi/spi-gpio.c
Commit date: 2019-10-01 18:38:52 +0100
Commit message: spi: gpio: prevent memory leak in spi_gpio_probe

In spi_gpio_probe an SPI master is allocated via spi_alloc_master, but
this controller should be released if devm_add_action_or_reset fails,
otherwise memory leaks. In order to avoid leak spi_contriller_put must
be called in case of failure for devm_add_action_or_reset.

Fixes: 8b797490b4db ("spi: gpio: Make sure spi_master_put() is called in every error path")
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Link: https://lore.kernel.org/r/20190930205241.5483-1-navid.emamdoost@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>

Diff: diff --git a/drivers/spi/spi-gpio.c b/drivers/spi/spi-gpio.c
index 1d3e23ec20a6..f9c5bbb74714 100644
--- a/drivers/spi/spi-gpio.c
+++ b/drivers/spi/spi-gpio.c
@@ -369,12 +369,14 @@ static int spi_gpio_probe(struct platform_device *pdev)
 	master = spi_alloc_master(dev, sizeof(*spi_gpio));
 	if (!master)
 		return -ENOMEM;
 
 	status = devm_add_action_or_reset(&pdev->dev, spi_gpio_put, master);
-	if (status)
+	if (status) {
+		spi_master_put(master);
 		return status;
+	}
 
 	if (of_id)
 		status = spi_gpio_probe_dt(pdev, master);
 	else
 		status = spi_gpio_probe_pdata(pdev, master);

Vulnerable code: 	if (status)
Fixed code: 	if (status) {
		spi_master_put(master);
	}
CVE-2024-28851: Insufficient Information (NVD-CWE-noinfo)
value: The Snowflake Hive metastore connector provides an easy way to query Hive-managed data via Snowflake. Snowflake Hive MetaStore Connector has addressed a potential elevation of privilege vulnerability in a `helper script` for the Hive MetaStore Connector. A malicious insider without admin privileges could, in theory, use the script to download content from a Microsoft domain to the local system and replace the valid content with malicious code. If the attacker then also had local access to the same system where the maliciously modified script is run, they could attempt to manipulate users into executing the attacker-controlled helper script, potentially gaining elevated privileges to the local system. The vulnerability in the script was patched on February 09, 2024, without a version bump to the Connector. User who use the helper script are strongly advised to use the latest version as soon as possible. Users unable to upgrade should avoid using the helper script.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-15T19:15Z
Repository: https://github.com/snowflakedb/snowflake-hive-metastore-connector
Language: Shell
Files changed: scripts/add_snowflake_hive_metastore_connector_script_action.sh
Commit date: 2024-02-08 23:49:18 +0000
Commit message: Update the import command for custom script actions

Diff: diff --git a/scripts/add_snowflake_hive_metastore_connector_script_action.sh b/scripts/add_snowflake_hive_metastore_connector_script_action.sh
index e979f70..2d0b382 100644
--- a/scripts/add_snowflake_hive_metastore_connector_script_action.sh
+++ b/scripts/add_snowflake_hive_metastore_connector_script_action.sh
@@ -20,11 +20,11 @@ CUSTOMHIVELIBSDIR=/usr/hdp/2.6.5.3032-3/atlas/hook/hive
 # Where the snowflake-config.xml should go (WILL VARY BY USER -- please edit)
 SNOWFLAKECONFDIR=/usr/hdp/current/hive-server2/conf/conf.server
 
 echo "Importing helper module"
 # Import helper module
-wget -O /tmp/HDInsightUtilities-v01.sh -q https://hdiconfigactions.blob.core.windows.net/linuxconfigactionmodulev01/HDInsightUtilities-v01.sh && source /tmp/HDInsightUtilities-v01.sh && rm -f /tmp/HDInsightUtilities-v01.sh
+source <(wget -q -O - https://hdiconfigactions.blob.core.windows.net/linuxconfigactionmodulev01/HDInsightUtilities-v01.sh)
 
 # Check paths exist
 if [ -e $CUSTOMHIVELIBSDIR ]; then
   echo "$CUSTOMHIVELIBSDIR exists"
 else

Vulnerable code: wget -O /tmp/HDInsightUtilities-v01.sh -q https://hdiconfigactions.blob.core.windows.net/linuxconfigactionmodulev01/HDInsightUtilities-v01.sh && source /tmp/HDInsightUtilities-v01.sh && rm -f /tmp/HDInsightUtilities-v01.sh
Fixed code: source <(wget -q -O - https://hdiconfigactions.blob.core.windows.net/linuxconfigactionmodulev01/HDInsightUtilities-v01.sh)
CVE-2013-7491: Out-of-bounds Write (CWE-787)
value: An issue was discovered in the DBI module before 1.628 for Perl. Stack corruption occurs when a user-defined function requires a non-trivial amount of memory and the Perl stack gets reallocated.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.3
Published: 2020-09-11T19:15Z
Repository: https://github.com/perl5-dbi/dbi
Language: Other
Files changed: Changes, Driver.xst
Commit date: 2013-06-24 22:39:46 +0100
Commit message: Fixed stack corruption on callbacks RT#85562 RT#84974 [Aaron Schweiger]

Diff: diff --git a/Changes b/Changes
index 1c057f5..5622ba3 100644
--- a/Changes
+++ b/Changes
@@ -10,10 +10,11 @@ DBI::Changes - List of significant changes to the DBI
 
 =head2 Changes in DBI 1.628 - 24th June 2013
 
     Fixed missing fields on partial insert via DBI::DBD::SqlEngine
         engines (DBD::CSV, DBD::DBM etc.) [H.Merijn Brand, Jens Rehsack]
+    Fixed stack corruption on callbacks RT#85562 RT#84974 [Aaron Schweiger]
 
     Added support for finding tables in multiple directories
         via new DBD::File f_dir_search attribute [H.Merijn Brand]
     Enable compiling by C++ RT#84285 [Kurt Jaeger]
 
diff --git a/Driver.xst b/Driver.xst
index 2f91c6b..7a5040a 100644
--- a/Driver.xst
+++ b/Driver.xst
@@ -155,11 +155,13 @@ selectall_arrayref(...)
     if ( dbd_st_execute(sth, imp_sth) <= -2 ) { /* -2 == error */
         XSRETURN_UNDEF;
     }
     /* --- fetchall --- */
     maxrows_svp = DBD_ATTRIB_GET_SVP(attr, "MaxRows", 7);
-    ST(0) = dbdxst_fetchall_arrayref(sth, &PL_sv_undef, (maxrows_svp) ? *maxrows_svp : &PL_sv_undef);
+    SV *tmp = dbdxst_fetchall_arrayref(sth, &PL_sv_undef, (maxrows_svp) ? *maxrows_svp : &PL_sv_undef);
+    SPAGAIN;
+    ST(0) = tmp;
 
 
 void
 selectrow_arrayref(...)
     ALIAS:
@@ -658,11 +660,13 @@ fetchall_arrayref(sth, slice=&PL_sv_undef, batch_row_count=&PL_sv_undef)
         SV *tmp = dbixst_bounce_method("DBD::~DRIVER~::st::SUPER::fetchall_arrayref", 3);
         SPAGAIN;
         ST(0) = tmp;
     }
     else {
-        ST(0) = dbdxst_fetchall_arrayref(sth, slice, batch_row_count);
+        SV *tmp = dbdxst_fetchall_arrayref(sth, slice, batch_row_count);
+        SPAGAIN;
+        ST(0) = tmp;
     }
 
 
 void
 finish(sth)

Vulnerable code:     ST(0) = dbdxst_fetchall_arrayref(sth, &PL_sv_undef, (maxrows_svp) ? *maxrows_svp : &PL_sv_undef);
        ST(0) = dbdxst_fetchall_arrayref(sth, slice, batch_row_count);
Fixed code:     Fixed stack corruption on callbacks RT#85562 RT#84974 [Aaron Schweiger]
    SV *tmp = dbdxst_fetchall_arrayref(sth, &PL_sv_undef, (maxrows_svp) ? *maxrows_svp : &PL_sv_undef);
    SPAGAIN;
    ST(0) = tmp;
        SV *tmp = dbdxst_fetchall_arrayref(sth, slice, batch_row_count);
        SPAGAIN;
        ST(0) = tmp;
CVE-2019-20919: NULL Pointer Dereference (CWE-476)
value: An issue was discovered in the DBI module before 1.643 for Perl. The hv_fetch() documentation requires checking for NULL and the code does that. But, shortly thereafter, it calls SvOK(profile), causing a NULL pointer dereference.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 4.7
Published: 2020-09-17T18:15Z
Repository: https://github.com/perl5-dbi/dbi
Language: Other
Files changed: DBI.xs
Commit date: 2019-07-31 16:22:15 +0200
Commit message: Fix a NULL profile dereference in dbi_profile()

hv_fetch() documentation requires checking for NULL and the code does
that. But then calls SvOK(profile) uncoditionally two lines later.
This patch fixes it.

Diff: diff --git a/DBI.xs b/DBI.xs
index a96894ca..4825d1d0 100644
--- a/DBI.xs
+++ b/DBI.xs
@@ -2886,12 +2886,16 @@ dbi_profile(SV *h, imp_xxh_t *imp_xxh, SV *statement_sv, SV *method, NV t1, NV t
     profile = *hv_fetch(h_hv, "Profile", 7, 1);
     if (profile && SvMAGICAL(profile))
         mg_get(profile); /* FETCH */
     if (!profile || !SvROK(profile)) {
         DBIc_set(imp_xxh, DBIcf_Profile, 0); /* disable */
-        if (SvOK(profile) && !PL_dirty)
-            warn("Profile attribute isn't a hash ref (%s,%ld)", neatsvpv(profile,0), (long)SvTYPE(profile));
+        if (!PL_dirty) {
+            if (!profile)
+                warn("Profile attribute does not exist");
+            else if (SvOK(profile))
+                warn("Profile attribute isn't a hash ref (%s,%ld)", neatsvpv(profile,0), (long)SvTYPE(profile));
+        }
         return &PL_sv_undef;
     }
 
     /* statement_sv: undef = use $h->{Statement}, "" (&sv_no) = use empty string */
 

Vulnerable code:         if (SvOK(profile) && !PL_dirty)
            warn("Profile attribute isn't a hash ref (%s,%ld)", neatsvpv(profile,0), (long)SvTYPE(profile));
Fixed code:         if (!PL_dirty) {
            if (!profile)
                warn("Profile attribute does not exist");
            else if (SvOK(profile))
                warn("Profile attribute isn't a hash ref (%s,%ld)", neatsvpv(profile,0), (long)SvTYPE(profile));
        }
CVE-2022-28545: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: FUDforum 3.1.1 is vulnerable to Stored XSS.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-05-06T17:15Z
Repository: https://github.com/fudforum/FUDforum
Language: Other
Files changed: install/forum_data/src/attach.inc.t
Commit date: 2022-01-14 16:32:13 +0200
Commit message: Fix stored XSS vulnerability reported by ptsecurity.com

Diff: diff --git a/install/forum_data/src/attach.inc.t b/install/forum_data/src/attach.inc.t
index 521fa5cc2..801966924 100644
--- a/install/forum_data/src/attach.inc.t
+++ b/install/forum_data/src/attach.inc.t
@@ -1,8 +1,8 @@
 <?php
 /**
-* copyright            : (C) 2001-2013 Advanced Internet Designs Inc.
+* copyright            : (C) 2001-2022 Advanced Internet Designs Inc.
 * email                : forum@prohost.org
 * $Id$
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -24,12 +24,12 @@ function safe_attachment_copy($source, $id, $ext)
 	return $loc;
 }
 
 function attach_add($at, $owner, $attach_opt=0, $ext=0)
 {
-	$id = db_qid('INSERT INTO {SQL_TABLE_PREFIX}attach (location, message_id, original_name, owner, attach_opt, mime_type,fsize) '.
-		q_limit('SELECT null AS location, 0 AS message_id, '. _esc($at['name']) .' AS original_name, '. $owner .' AS owner, '. $attach_opt .' AS attach_opt, id AS mime_type, '. $at['size'] .' AS fsize 
+	$id = db_qid('INSERT INTO {SQL_TABLE_PREFIX}attach (location, message_id, original_name, owner, attach_opt, mime_type, fsize) '.
+		q_limit('SELECT null AS location, 0 AS message_id, '. _esc(htmlspecialchars($at['name'])) .' AS original_name, '. $owner .' AS owner, '. $attach_opt .' AS attach_opt, id AS mime_type, '. $at['size'] .' AS fsize 
 			FROM {SQL_TABLE_PREFIX}mime WHERE fl_ext IN(\'*\', '. _esc(strtolower(substr(strrchr($at['name'], '.'), 1))) .')
 			ORDER BY fl_ext DESC'
 		, 1)
 	);
 

Vulnerable code: * copyright            : (C) 2001-2013 Advanced Internet Designs Inc.
	$id = db_qid('INSERT INTO {SQL_TABLE_PREFIX}attach (location, message_id, original_name, owner, attach_opt, mime_type,fsize) '.
		q_limit('SELECT null AS location, 0 AS message_id, '. _esc($at['name']) .' AS original_name, '. $owner .' AS owner, '. $attach_opt .' AS attach_opt, id AS mime_type, '. $at['size'] .' AS fsize 
Fixed code: * copyright            : (C) 2001-2022 Advanced Internet Designs Inc.
	$id = db_qid('INSERT INTO {SQL_TABLE_PREFIX}attach (location, message_id, original_name, owner, attach_opt, mime_type, fsize) '.
		q_limit('SELECT null AS location, 0 AS message_id, '. _esc(htmlspecialchars($at['name'])) .' AS original_name, '. $owner .' AS owner, '. $attach_opt .' AS attach_opt, id AS mime_type, '. $at['size'] .' AS fsize
CVE-2023-31137: Integer Underflow (Wrap or Wraparound) (CWE-191)
value: MaraDNS is open-source software that implements the Domain Name System (DNS). In version 3.5.0024 and prior, a remotely exploitable integer underflow vulnerability in the DNS packet decompression function allows an attacker to cause a Denial of Service by triggering an abnormal program termination.

The vulnerability exists in the `decomp_get_rddata` function within the `Decompress.c` file. When handling a DNS packet with an Answer RR of qtype 16 (TXT record) and any qclass, if the `rdlength` is smaller than `rdata`, the result of the line `Decompress.c:886` is a negative number `len = rdlength - total;`. This value is then passed to the `decomp_append_bytes` function without proper validation, causing the program to attempt to allocate a massive chunk of memory that is impossible to allocate. Consequently, the program exits with an error code of 64, causing a Denial of Service.

One proposed fix for this vulnerability is to patch `Decompress.c:887` by breaking `if(len <= 0)`, which has been incorporated in version 3.5.0036 via commit bab062bde40b2ae8a91eecd522e84d8b993bab58.
CWE description: The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CVSS v3 base score: 7.5
Published: 2023-05-09T14:15Z
Repository: https://github.com/samboy/MaraDNS
Language: C
Files changed: dns/Decompress.c
Commit date: 2023-05-02 16:35:04 -0700
Commit message: Fix long standing issue in this code from 2002

Diff: diff --git a/dns/Decompress.c b/dns/Decompress.c
index 24d88d5..ae8aa2e 100644
--- a/dns/Decompress.c
+++ b/dns/Decompress.c
@@ -1,6 +1,6 @@
-/* Copyright (c) 2002-2006 Sam Trenholme
+/* Copyright (c) 2002-2023 Sam Trenholme
  *
  * TERMS
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -882,11 +882,11 @@ int decomp_get_rddata(js_string *compressed, js_string *out,
                 compressed_offset += len;
                 }
             /* Variable length data (length determined by rdlength) */
             else if(subtype == RRSUB_VARIABLE) {
                 len = rdlength - total;
-                if(len == 0) {
+                if(len <= 0) {
                     break;
                     }
                 if(decomp_append_bytes(compressed,out,
                                        compressed_offset,len) != JS_SUCCESS) {
                     return JS_ERROR;

Vulnerable code: /* Copyright (c) 2002-2006 Sam Trenholme
                if(len == 0) {
Fixed code: /* Copyright (c) 2002-2023 Sam Trenholme
                if(len <= 0) {
CVE-2023-29323: Insufficient Information (NVD-CWE-noinfo)
value: ascii_load_sockaddr in smtpd in OpenBSD before 7.1 errata 024 and 7.2 before errata 020, and OpenSMTPD Portable before 7.0.0-portable commit f748277, can abort upon a connection from a local, scoped IPv6 address.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.8
Published: 2023-04-04T23:15Z
Repository: https://github.com/OpenSMTPD/OpenSMTPD
Language: C
Files changed: usr.sbin/smtpd/smtpd.h
Commit date: 2021-10-05 21:49:43 +0200
Commit message: bump version to 7.0.0

Diff: diff --git a/usr.sbin/smtpd/smtpd.h b/usr.sbin/smtpd/smtpd.h
index b77c035c..ddc76b58 100644
--- a/usr.sbin/smtpd/smtpd.h
+++ b/usr.sbin/smtpd/smtpd.h
@@ -1,6 +1,6 @@
-/*	$OpenBSD: smtpd.h,v 1.670 2021/07/28 19:39:51 benno Exp $	*/
+/*	$OpenBSD: smtpd.h,v 1.671 2021/09/22 17:12:34 eric Exp $	*/
 
 /*
  * Copyright (c) 2008 Gilles Chehade <gilles@poolp.org>
  * Copyright (c) 2008 Pierre-Yves Ritschard <pyr@openbsd.org>
  * Copyright (c) 2012 Eric Faurot <eric@openbsd.org>
@@ -77,11 +77,11 @@
 #endif
 #define SMTPD_SOCKET		 SMTPD_SOCKDIR "/smtpd.sock"
 #ifndef SMTPD_NAME
 #define	SMTPD_NAME		 "OpenSMTPD"
 #endif
-#define	SMTPD_VERSION		 "6.9.0-portable"
+#define	SMTPD_VERSION		 "7.0.0-portable"
 #define SMTPD_SESSION_TIMEOUT	 300
 #define SMTPD_BACKLOG		 5
 
 #ifndef PATH_SMTPCTL
 #define	PATH_SMTPCTL		"/usr/sbin/smtpctl"

Vulnerable code: /*	$OpenBSD: smtpd.h,v 1.670 2021/07/28 19:39:51 benno Exp $	*/
#define	SMTPD_VERSION		 "6.9.0-portable"
Fixed code: /*	$OpenBSD: smtpd.h,v 1.671 2021/09/22 17:12:34 eric Exp $	*/
#define	SMTPD_VERSION		 "7.0.0-portable"
CVE-2014-9489: Improper Access Control (CWE-284)
value: The gollum-grit_adapter Ruby gem dependency in gollum before 3.1.1 and the gollum-lib gem dependency in gollum-lib before 4.0.1 when the string "master" is in any of the wiki documents, allows remote authenticated users to execute arbitrary code via the -O or --open-files-in-pager flags.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 8.8
Published: 2017-10-17T14:29Z
Repository: https://github.com/gollum/grit_adapter
Language: Ruby
Files changed: lib/grit_adapter/git_layer_grit.rb
Commit date: 2014-12-04 13:45:17 +0100
Commit message: Fix security issue with git grep -O

Diff: diff --git a/lib/grit_adapter/git_layer_grit.rb b/lib/grit_adapter/git_layer_grit.rb
index f607a7a..e677ca6 100644
--- a/lib/grit_adapter/git_layer_grit.rb
+++ b/lib/grit_adapter/git_layer_grit.rb
@@ -134,10 +134,12 @@ module Gollum
         @git.exist?
       end
       
       def grep(query, options={})
         ref = options[:ref] ? options[:ref] : "HEAD"
+        query = Shellwords.split(query).select {|q| !(q =~ /^(-O)|(--open-files-in-pager)/) }
+        query = Shellwords.join(query)
         args = [{}, '-I', '-i', '-c', query, ref, '--']
         args << options[:path] if options[:path]
         result = @git.grep(*args).split("\n")
         result.map do |line|
           branch_and_name, _, count = line.rpartition(":")
@@ -163,10 +165,11 @@ module Gollum
         raise Gollum::Git::NoSuchShaFound
       end
       
       def ls_files(query, options = {})
         options[:ref] = options[:ref] ? options[:ref] : "HEAD"
+        query = Shellwords.shellescape(query)
         @git.ls_files({}, "*#{query}*").split("\n")
       end
       
       def ls_tree(options={}, *args, &block)
         @git.native(:ls_tree, options, *args, &block)

Fixed code:         query = Shellwords.split(query).select {|q| !(q =~ /^(-O)|(--open-files-in-pager)/) }
        query = Shellwords.join(query)
        query = Shellwords.shellescape(query)
CVE-2022-34132: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Benjamin BALET Jorani v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at application/controllers/Leaves.php.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2022-06-28T00:15Z
Repository: https://github.com/bbalet/jorani
Language: PHP
Files changed: application/controllers/Leaves.php
Commit date: 2022-06-06 17:49:54 +0200
Commit message: BF:Prevent SQL injection fix #369

Diff: diff --git a/application/controllers/Leaves.php b/application/controllers/Leaves.php
index e5b0a901..687ed4fe 100644
--- a/application/controllers/Leaves.php
+++ b/application/controllers/Leaves.php
@@ -818,18 +818,18 @@ class Leaves extends CI_Controller {
      */
     public function validate() {
         header("Content-Type: application/json");
         $id = $this->input->post('id', TRUE);
         $type = $this->input->post('type', TRUE);
-        //The above parameters could cause an SQL injection vulnerability due to the non standard
-        //SQL query in leave_model::detectOverlappingLeaves
         $date = $this->input->post('startdate', TRUE);
         $d = DateTime::createFromFormat('Y-m-d', $date);
         $startdate = ($d && $d->format('Y-m-d') === $date)?$date:'1970-01-01';
+        $startdate = preg_replace("([^0-9-])", "", $startdate);
         $date = $this->input->post('enddate', TRUE);
         $d = DateTime::createFromFormat('Y-m-d', $date);
         $enddate = ($d && $d->format('Y-m-d') === $date)?$date:'1970-01-01';
+        $enddate = preg_replace("([^0-9-])", "", $enddate);
         $startdatetype = $this->input->post('startdatetype', TRUE);     //Mandatory field checked by frontend
         $enddatetype = $this->input->post('enddatetype', TRUE);       //Mandatory field checked by frontend
         $leave_id = $this->input->post('leave_id', TRUE);
         $leaveValidator = new stdClass;
         $deductDayOff = FALSE;

Vulnerable code:         //The above parameters could cause an SQL injection vulnerability due to the non standard
        //SQL query in leave_model::detectOverlappingLeaves
Fixed code:         $startdate = preg_replace("([^0-9-])", "", $startdate);
        $enddate = preg_replace("([^0-9-])", "", $enddate);
CVE-2022-34133: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Benjamin BALET Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Comment parameter at application/controllers/Leaves.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-06-28T00:15Z
Repository: https://github.com/bbalet/jorani
Language: PHP
Files changed: application/controllers/Leaves.php
Commit date: 2022-06-06 15:02:42 +0200
Commit message: BF:Persistent XSS fix #369

Diff: diff --git a/application/controllers/Leaves.php b/application/controllers/Leaves.php
index 95ba6c78..e5b0a901 100644
--- a/application/controllers/Leaves.php
+++ b/application/controllers/Leaves.php
@@ -180,11 +180,11 @@ class Leaves extends CI_Controller {
       $data = getUserContext($this);
       $oldComment = $this->leaves_model->getCommentsLeave($id);
       $newComment = new stdClass;
       $newComment->type = "comment";
       $newComment->author = $this->session->userdata('id');
-      $newComment->value = $this->input->post('comment');
+      $newComment->value = $this->input->post('comment', TRUE);
       $newComment->date = date("Y-n-j");
       if ($oldComment != NULL){
         array_push($oldComment->comments, $newComment);
       }else {
         $oldComment = new stdClass;

Vulnerable code:       $newComment->value = $this->input->post('comment');
Fixed code:       $newComment->value = $this->input->post('comment', TRUE);
CVE-2021-4279: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
value: A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.1 is able to address this issue. The name of the patch is 7ad6af41eabb2d799f698740a91284d762c955c9. It is recommended to upgrade the affected component. VDB-216778 is the identifier assigned to this vulnerability.
CWE description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVSS v3 base score: 9.8
Published: 2022-12-25T20:15Z
Repository: https://github.com/Starcounter-Jack/JSON-Patch
Language: Unknown
Commit date: 2021-08-13 12:10:25 +0200
Commit message: Merge pull request #262 from 418sec/1-npm-fast-json-patch

Security Fix for Prototype Pollution - huntr.dev
CVE-2024-29183: Insufficient Information (NVD-CWE-noinfo)
value: OpenRASP is a RASP solution that directly integrates its protection engine into the application server by instrumentation. There exists a reflected XSS in the /login page due to a reflection of the redirect parameter. This allows an attacker to execute arbitrary javascript with the permissions of a user after the user logins with their account.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-19T16:15Z
Repository: https://github.com/baidu/openrasp
Language: Other
Files changed: rasp-vue/src/components/Login.vue
Commit date: 2024-03-15 07:43:32 +0800
Commit message: fix open redirect issue in Login page

Diff: diff --git a/rasp-vue/src/components/Login.vue b/rasp-vue/src/components/Login.vue
index f3dcce22..5cbbc5cd 100644
--- a/rasp-vue/src/components/Login.vue
+++ b/rasp-vue/src/components/Login.vue
@@ -70,16 +70,20 @@ export default {
         }
       }).catch(function (error) {
         // ignored
       })
     },
+    validateRedirect(urlstring) {
+      let url = new URL(urlstring)
+      return url.protocol == location.protocol && url.host == location.host && url.port == location.port
+    },
     doLogin: function() {
       return request.post('v1/user/login', {
         username: this.username,
         password: this.password
       }).then(res => {
-        if (this.$route.query.redirect) {
+        if (this.$route.query.redirect && this.validateRedirect(this.$route.query.redirect)) {
           location.href = this.$route.query.redirect
         } else {
           this.$router.replace({
             name: 'dashboard'
           })

Vulnerable code:         if (this.$route.query.redirect) {
Fixed code:     validateRedirect(urlstring) {
      let url = new URL(urlstring)
      return url.protocol == location.protocol && url.host == location.host && url.port == location.port
    },
        if (this.$route.query.redirect && this.validateRedirect(this.$route.query.redirect)) {
CVE-2024-32474: Insufficient Information (NVD-CWE-noinfo)
value: Sentry is an error tracking and performance monitoring platform. Prior to 24.4.1, when authenticating as a superuser to Sentry with a username and password, the password is leaked as cleartext in logs under the _event_: `auth-index.validate_superuser`. An attacker with access to the log data could use these leaked credentials to login to the Sentry system as superuser. Self-hosted users on affected versions should upgrade to 24.4.1 or later. Users can configure the logging level to exclude logs of the `INFO` level and only generate logs for levels at `WARNING` or more.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-18T20:15Z
Repository: https://github.com/getsentry/sentry
Language: Python
Files changed: src/sentry/api/endpoints/auth_index.py
Commit date: 2024-04-17 21:56:56 +0000
Commit message: chore(auth): explicitly log challenge and response for debugging (#69148)


Diff: diff --git a/src/sentry/api/endpoints/auth_index.py b/src/sentry/api/endpoints/auth_index.py
index cbd830a8210..a2403102878 100644
--- a/src/sentry/api/endpoints/auth_index.py
+++ b/src/sentry/api/endpoints/auth_index.py
@@ -138,11 +138,10 @@ class AuthIndexEndpoint(BaseAuthIndexEndpoint):
 
         """
         logger.info(
             "auth-index.validate_superuser",
             extra={
-                "validator": validator,
                 "user": request.user.id,
                 "raise_exception": not DISABLE_SSO_CHECK_FOR_LOCAL_DEV,
                 "verify_authenticator": verify_authenticator,
             },
         )

Vulnerable code:                 "validator": validator,