TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-72wf-hwcq-65h9
Summary: Cross-Site Request Forgery in Filebrowser
Aliases: CVE-2021-46398
Severity: HIGH
CWE: CWE-352
Published: 2022-02-05T00:00:31Z

A Cross-Site Request Forgery (CSRF) vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim.
Vulnerability: GHSA-gq5r-cc4w-g8xf
Summary: Denial of Service (DoS)
Aliases: CVE-2020-7731
Severity: HIGH
CWE: CWE-476
Published: 2021-06-23T17:25:08Z

This affects all versions up to and including 0.6.0 of package github.com/russellhaering/gosaml2. There is a crash on nil-pointer dereference caused by sending malformed XML signatures.
Vulnerability: GHSA-25xm-hr59-7c27
Summary: Release v0.5.8 of github.com/ulikunitz/xz fixes readUvarint denial of service
Aliases: CVE-2021-29482
Severity: HIGH
CWE: CWE-835
Published: 2021-05-25T18:39:37Z

### Impact

The function readUvarint used to read the xz container format may not terminate a loop provide malicous input.

### Patches

The problem has been fixed in release v0.5.8.

### Workarounds

Limit the size of the compressed file input to a reasonable size for your use case.

### References

The standard library had recently the same issue and got the [CVE-2020-16845](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16845) allocated.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [xz](https://github.com/ulikunitz/xz/issues).
Vulnerability: GHSA-25xj-89g5-fm6h
Summary: Information Disclosure in HashiCorp Vault
Aliases: CVE-2020-13223
Severity: HIGH
CWE: CWE-532, CWE-200
Published: 2021-05-18T18:21:09Z

HashiCorp Vault and Vault Enterprise before 1.3.6, and 1.4.2 before 1.4.2, insert Sensitive Information into a Log File.
Vulnerability: GHSA-rc7p-gmvh-xfx2
Summary: Attack on Kubernetes via Misconfigured Argo Workflows
Severity: MODERATE
Published: 2021-08-02T17:19:52Z

### Impact

Users running using the Argo Server with `--auth-mode=server` (which is the default < v3.0.0) AND have exposed their UI to the Internet may allow remote users to execute arbitrary code on their cluster, e.g. crypto-mining.

### Resolution

* Do not expose your user interface to the Internet. 
* Change configuration. `--auth-mode=client`. 

For users using an older 2.x version of Argo Server, consider upgrading to Argo Server version 3.x or later.
Vulnerability: GHSA-jqmc-79gx-7g8p
Summary: Incorrect Permission Assignment for Critical Resource in CRI-O
Aliases: CVE-2022-0532
Severity: MODERATE
CWE: CWE-732
Published: 2022-02-11T00:00:54Z

An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.
Vulnerability: GO-2021-0070
Aliases: CVE-2016-3697
Published: 2021-04-14T12:00:00Z

GetExecUser in the github.com/opencontainers/runc/libcontainer/user package will
improperly interpred numeric UIDs as usernames. If the method is used without
verify usernames are formatted as expected, it may allow a user to gain unexpected
privileges.
Vulnerability: GHSA-x6mj-w4jf-jmgw
Summary: Server Side Request Forgery (SSRF) in Kubernetes
Aliases: CVE-2020-8555
Severity: LOW
CWE: CWE-918
Published: 2022-02-15T01:57:18Z

The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).
Vulnerability: GHSA-m9hp-7r99-94h5
Summary: Critical security issues in XML encoding in github.com/dexidp/dex
Aliases: CVE-2020-26290
Severity: CRITICAL
CWE: CWE-347
Published: 2021-12-20T17:53:53Z

### Impact

The following vulnerabilities have been disclosed, which impact users leveraging the SAML connector:

Signature Validation Bypass (CVE-2020-15216): https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7

`encoding/xml` instabilities:
 - [Element namespace prefix instability (CVE-2020-29511)](https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-elements.md)
 - [Attribute namespace prefix instability (CVE-2020-29509)](https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-attributes.md)
 - [Directive comment instability (CVE-2020-29510)](https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.md)

### Patches

Immediately update to [Dex v2.27.0](https://github.com/dexidp/dex/releases/tag/v2.27.0).

### Workarounds

There are no known workarounds.
Vulnerability: GHSA-mj9r-wwm8-7q52
Summary: Open Redirect in github.com/AndrewBurian/powermux
Aliases: CVE-2021-32721
Severity: MODERATE
CWE: CWE-601
Published: 2021-07-01T17:00:32Z

### Impact
Attackers may be able to craft phishing links and other open redirects by exploiting the trailing slash redirection feature. This may lead to users being redirected to untrusted sites after following an attacker crafted link.

### Patches
The issue is resolved in v1.1.1

### Workarounds
There are no existing workarounds.
You may detect attempts to craft urls that exploit this feature by looking for request paths containing pairs of forward slashes in sequence combined with a trailing slash e.g. `https://example.com//foo/`
Vulnerability: GHSA-r9cr-hvjj-496v
Summary: Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server
Aliases: CVE-2022-24730
Severity: HIGH
CWE: CWE-22, CWE-284
Published: 2022-03-24T00:04:03Z

### Impact

All unpatched versions of Argo CD starting with v1.3.0 are vulnerable to a path traversal bug, compounded by an improper access control bug, allowing a malicious user with read-only repository access to leak sensitive files from Argo CD's repo-server.

A malicious Argo CD user who has been granted [`get` access for a repository](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#rbac-resources-and-actions) containing a Helm chart can craft an API request to the `/api/v1/repositories/{repo_url}/appdetails` endpoint to leak the contents of out-of-bounds files from the repo-server.

The malicious payload would reference an out-of-bounds file, and the contents of that file would be returned as part of the response. Contents from a non-YAML file may be returned as part of an error message. The attacker would have to know or guess the location of the target file.

Sensitive files which could be leaked include files from other Applications' source repositories (potentially decrypted files, if you are using a decryption plugin) or any secrets which have been mounted as files on the repo-server.

### Patches

A patch for this vulnerability has been released in the following Argo CD versions:

* v2.3.0
* v2.2.6
* v2.1.11

The patches do two things:
 1) prevent path traversal
 2) limit `/api/v1/repositories/{repo_url}/appdetails` access to users who either A) have been granted Application `create` privileges or B) have been granted Application `get` privileges _and_ are requesting details for a `repo_url` that has already been used for the given Application

### Workarounds

The only certain way to avoid the vulnerability is to upgrade. 

To mitigate the problem, you can 
* avoid storing secrets in git
* avoid mounting secrets as files on the repo-server
* avoid decrypting secrets into files on the repo-server
* carefully [limit who has `get` access for repositories](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#rbac-resources-and-actions)

### References

* [Security documentation for the repo-server component](https://argo-cd.readthedocs.io/en/stable/operator-manual/security/#git-helm-repositories)
* [Argo CD RBAC configuration documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#)

### For more information

Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)
Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd
Vulnerability: GHSA-qrrc-ww9x-r43g
Summary: Improper Input Validation in Docker Engine
Aliases: CVE-2020-13401
Severity: HIGH
CWE: CWE-20
Published: 2022-02-15T01:57:18Z

An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain sensitive information, or cause a denial of service.
Vulnerability: GHSA-w3jx-wv97-67ph
Summary: Cross-site scripting in Dutchcoders transfer.sh
Aliases: CVE-2021-33496
Severity: MODERATE
CWE: CWE-79
Published: 2021-06-29T21:25:27Z

Dutchcoders transfer.sh before 1.2.4 allows XSS via an inline view.
Vulnerability: GO-2020-0040
Published: 2021-04-14T12:00:00Z

Due to unchecked type assertions, maliciously crafted messages can
cause panics, which may be used as a denial of service vector.
Vulnerability: GHSA-jpj5-hg26-6jgc
Summary: Cross-site Scripting in Alist
Aliases: CVE-2022-26533
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-13T00:00:54Z

Alist versions 2.0.10 through 2.1.0 were discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist. This issue was fixed in version 2.1.1.
Vulnerability: GHSA-5r5w-h76p-m726
Summary: Use of a Broken or Risky Cryptographic Algorithm in Max Mazurov Maddy
Aliases: CVE-2021-42583
Severity: HIGH
CWE: CWE-327
Published: 2022-01-06T22:20:53Z

A Broken or Risky Cryptographic Algorithm exists in Max Mazurov Maddy before 0.5.2, which is an unnecessary risk that may result in the exposure of sensitive information.
Vulnerability: GO-2020-0017
Aliases: CVE-2020-26160
Published: 2021-04-14T12:00:00Z

If a JWT contains an audience claim with an array of strings, rather
than a single string, and `MapClaims.VerifyAudience` is called with
`req` set to `false`, then audience verification will be bypassed,
allowing an invalid set of audiences to be provided.
Vulnerability: GHSA-5cgx-vhfp-6cf9
Summary: Directory traversal in Kubernetes Secrets Store CSI Driver
Aliases: CVE-2020-8568
Severity: MODERATE
CWE: CWE-20, CWE-22, CWE-24
Published: 2022-02-15T01:57:18Z

Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that contain other Kubernetes Secrets.
Vulnerability: GHSA-gwmc-6795-qghj
Summary: HashiCorp Nomad Artifact Download Race Condition
Aliases: CVE-2022-24686
Severity: MODERATE
CWE: CWE-362
Published: 2022-02-15T00:02:46Z

HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such that the Nomad client agent could download the wrong artifact into the wrong destination. This issue is fixed in 1.0.18, 1.1.12, and 1.2.6.
Vulnerability: GHSA-g5v4-5x39-vwhx
Summary: Zip slip directory exploit in github.com/deislabs/oras
Aliases: CVE-2021-21272
Severity: HIGH
CWE: CWE-29, CWE-22
Published: 2022-02-15T00:32:04Z

### Impact
The directory support (#55) allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links.

A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`. 

Precisely, the following users of the affected versions are impacted
- `oras` CLI users who runs `oras pull`.
- Go programs, which invokes `github.com/deislabs/oras/pkg/content.FileStore`.

### Patches
The problem has been patched by the PR linked with this advisory. Users should upgrade their `oras` CLI and packages to `0.9.0`.

### Workarounds
For `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider.

For `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider.

### References
- [Zip Slip](https://github.com/snyk/zip-slip-vulnerability)

### For more information
If you have any questions or comments about this advisory:
* Open an issue on the [GitHub repo](https://github.com/deislabs/oras)
* Email the [list of maintainers](https://github.com/deislabs/oras/blob/main/MAINTAINERS)
Vulnerability: GO-2020-0001
Published: 2021-04-14T12:00:00Z

The default [`Formatter`][LoggerConfig.Formatter] for the [`Logger`][] middleware
(included in the [`Default`][] engine) allows attackers to inject arbitrary log
entries by manipulating the request path.
Vulnerability: GHSA-433w-mm6h-rv9p
Summary: Auth bypass in SAML provider
Severity: CRITICAL
Published: 2021-06-23T17:29:06Z

### Impact

The following vulnerabilities have been disclosed, which impact users leveraging the SAML auth provider:

- [`goxmldsig` - Signature Validation Bypass](https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7)
- [`gosaml2` - Authentication Bypass](https://github.com/russellhaering/gosaml2/security/advisories/GHSA-xhqq-x44f-9fgg)

### Patches

[Patch available](https://github.com/netlify/gotrue/pull/274)

Please upgrade to v1.0.0 or commit hash `a2b4dd6bc4ef7562d1df044098b303f564eefa90`

### Workarounds

No known workarounds.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [gotrue](https://github.com/netlify/gotrue/issues)
* Email us at [security@netlify.com](mailto:security@netlify.com)
Vulnerability: GHSA-2hfj-cxw7-g45p
Summary: Unsafe inline XSS in pasting DOM element into chat
Aliases: CVE-2021-39183
Severity: HIGH
CWE: CWE-79
Published: 2021-12-14T21:48:16Z

### Impact

Inline scripts are executed when Javascript is parsed via a paste action.

1. Open https://watch.owncast.online/
2. Copy and then paste `<img src=null onerror=alert('hello')>` into the
chat field.
3. An alert should pop up.

### Patches
```
    ⋮ 13 │    // Content security policy
    ⋮ 14 │    csp := []string{
    ⋮ 15 │        "script-src 'self' 'sha256-2HPCfJIJHnY0NrRDPTOdC7AOSJIcQyNxzUuut3TsYRY='",
    ⋮ 16 │        "worker-src 'self' blob:", // No single quotes around blob:
    ⋮ 17 │    }
```

Will be patched in 0.0.9 by blocking `unsafe-inline` Content Security Policy and specifying the `script-src`.  The `worker-src` is required to be set to `blob` for the video player.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [owncast/owncast](https://github.com/owncast/owncast/issues)
* Email us at [gabek@real-ity.com](mailto:gabek@real-ity.com)
Vulnerability: GHSA-grh6-q6m2-rh72
Summary: Origin Validation Error
Aliases: CVE-2021-20199
Severity: MODERATE
CWE: CWE-200, CWE-346
Published: 2021-05-18T21:07:49Z

Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman versions from 1.8.0 to 3.0.0.
Vulnerability: GHSA-9vh5-r4qw-v3vv
Summary: Improper Resource Shutdown or Release in HashiCorp Vault
Aliases: CVE-2020-7220
Severity: HIGH
CWE: CWE-404
Published: 2021-07-28T17:57:46Z

HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace. Fixed in 1.3.2.
Vulnerability: GO-2020-0021
Aliases: CVE-2014-8681
Published: 2021-04-14T12:00:00Z

Due to improper santization of user input, a number of methods are
vulnerable to SQL injection if used with user input that has not
been santized by the caller.
Vulnerability: GHSA-c3g4-w6cv-6v7h
Summary: Non-empty default inheritable capabilities for linux container in Buildah
Aliases: CVE-2022-27651
Severity: MODERATE
CWE: CWE-276
Published: 2022-04-01T13:56:42Z

A bug was found in Buildah where containers were created with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2).

This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set.
Vulnerability: GHSA-chxf-fjcf-7fwp
Summary: Possible filesystem space exhaustion by local users
Severity: MODERATE
Published: 2022-03-01T21:04:07Z

`fscrypt` through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We recommend upgrading to `fscrypt` v0.3.3 or above and adjusting the permissions on existing `fscrypt` metadata directories where applicable.

For more details, see [CVE-2022-25326](https://www.cve.org/CVERecord?id=CVE-2022-25326) and https://github.com/google/fscrypt#setting-up-fscrypt-on-a-filesystem.
Vulnerability: GHSA-ffjp-66mx-3qpj
Summary: Privilege escalation in beego
Aliases: CVE-2021-27116
Severity: HIGH
CWE: CWE-59
Published: 2022-04-06T00:01:30Z

An issue was discovered in file profile.go. The MemProf and GetCPUProfile functions do not correctly check whether the created file exists. As a result attackers can launch attacks symlink attacks locally. Attackers can use this vulnerability to escalate privileges.
Vulnerability: GO-2021-0085
Aliases: CVE-2019-16884
Published: 2021-04-14T12:00:00Z

AppArmor restrictions may be bypassed due to improper validation of mount
targets, allowing a malicious image to mount volumes over e.g. /proc.
Vulnerability: GHSA-9689-rx4v-cqgc
Summary: Open Redirect
Aliases: CVE-2018-15798
Severity: MODERATE
CWE: CWE-601
Published: 2022-02-15T01:57:18Z

Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites. A remote unauthenticated attacker could convince a user to click on a link using the oAuth redirect link with an untrusted website and gain access to that user's access token in Concourse.
Vulnerability: GHSA-5mxh-2qfv-4g7j
Summary: NUL character in ROA causes OctoRPKI to crash
Aliases: CVE-2021-3910
Severity: HIGH
CWE: CWE-20
Published: 2021-11-10T20:15:06Z

OctoRPKI crashes when encountering a repository that returns an invalid ROA (just an encoded `NUL` (`\0`) character).

## Patches

## For more information
If you have any questions or comments about this advisory email us at security@cloudflare.com
Vulnerability: GHSA-5gjh-5j4f-cpwv
Summary: Unrestricted Upload of File with Dangerous Type in Gogs
Aliases: CVE-2022-0415
Severity: HIGH
CWE: CWE-434, CWE-20
Published: 2022-03-28T16:46:41Z

### Impact

The malicious user is able to upload a crafted `config` file into repository's `.git` directory with to gain SSH access to the server. All installations with [repository upload enabled (default)](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129) are affected.

### Patches

Repository file uploads are prohibited to its `.git` directory. Users should upgrade to 0.12.6 or the latest 0.13.0+dev.

### Workarounds

[Disable repository files upload](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L128-L129).

### References

https://huntr.dev/bounties/b4928cfe-4110-462f-a180-6d5673797902/

### For more information

If you have any questions or comments about this advisory, please post on #6833.
Vulnerability: GHSA-62mh-w5cv-p88c
Summary: Import token permissions checking not enforced
Severity: CRITICAL
CWE: CWE-863
Published: 2022-02-15T00:42:28Z

(This advisory is canonically <https://advisories.nats.io/CVE/CVE-2021-3127.txt>)

## Problem Description

The NATS server provides for Subjects which are namespaced by Account; all Subjects are supposed to be private to an account, with an Export/Import system used to grant cross-account access to some Subjects.  Some Exports are public, such that anyone can import the
relevant subjects, and some Exports are private, such that the Import requires a token JWT to prove permission.

The JWT library's validation of the bindings in the Import Token incorrectly warned on mismatches, instead of outright rejecting the token.

As a result, any account can take an Import token used by any other account and re-use it for themselves because the binding to the
importing account is not rejected, and use it to import *any* Subject from the Exporting account, not just the Subject referenced in the Import Token.

The NATS account-server system treats account JWTs as semi-public information, such that an attacker can easily enumerate all account JWTs and retrieve all Import Tokens from those account JWTs.

The CVE identifier should cover the JWT library repair and the nats-server containing the fixed JWT library, and any other application depending upon the fixed JWT library.


## Affected versions

#### JWT library

 * all versions prior to 2.0.1
 * fixed after nats-io/jwt#149 landed (2021-03-14)

#### NATS Server

 * Version 2 prior to 2.2.0
   + 2.0.0 through and including 2.1.9 are vulnerable
 * fixed with nats-io/nats-server@423b79440c (2021-03-14)


## Impact

In deployments with untrusted accounts able to update the Account Server with imports, a malicious account can access any Subject from an account which provides Exported Subjects.

Abuse of this facility requires the malicious actor to upload their tampered Account JWT to the Account Server, providing the service operator with a data-store which can be scanned for signs of abuse.


## Workaround

Deny access to clients to update their account JWT in the account server.


## Solution

Upgrade the JWT dependency in any application using it.

Upgrade the NATS server if using NATS Accounts (with private Exports; Account owners can create those at any time though).

Audit all accounts JWTs to scan for exploit attempts; a Python script to audit the accounts can be found at <https://gist.github.com/philpennock/09d49524ad98043ff11d8a40c2bb0d5a>.
Vulnerability: GHSA-fgv8-vj5c-2ppq
Summary: Incorrect Authorization in runc
Aliases: CVE-2019-16884
Severity: HIGH
CWE: CWE-863
Published: 2022-02-22T15:38:08Z

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.
Vulnerability: GHSA-qvf8-p83w-v58j
Summary: Podman's default inheritable capabilities for linux container not empty
Aliases: CVE-2022-27649
Severity: HIGH
CWE: CWE-276
Published: 2022-04-01T20:52:29Z

A bug was found in Podman where containers were created with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2).

This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set.
Vulnerability: GHSA-hrhx-6h34-j5hc
Summary: Skip the router TLS configuration when the host header is an FQDN
Aliases: CVE-2022-23632
Severity: HIGH
CWE: CWE-295
Published: 2022-02-16T22:30:57Z

### Impact

People that configure mTLS between Traefik and clients.

For a request, the TLS configuration choice can be different than the router choice, which implies the use of a wrong TLS configuration.

- When sending a request using FQDN handled by a router configured with a dedicated TLS configuration, the TLS configuration falls back to the default configuration that might not correspond to the configured one.

- If the CNAME flattening is enabled, the selected TLS configuration is the SNI one and the routing uses the CNAME value, so this can skip the expected TLS configuration.

### Patches

Traefik v2.6.x: https://github.com/traefik/traefik/releases/tag/v2.6.1

### Workarounds

Add the FDQN to the host rule:

Example:

```yml
  whoami:
    image: traefik/whoami:v1.7.1
    labels:
      traefik.http.routers.whoami.rule: Host(`whoami.example.com`, `whoami.example.com.`)
      traefik.http.routers.whoami.tls: true
      traefik.http.routers.whoami.tls.options: mtls@file
```

There is no workaround if the CNAME flattening is enabled.

### For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).
Vulnerability: GHSA-5m8f-chrv-7rw5
Summary: Denial of Service in Go-Ethereum
Aliases: CVE-2021-43668
Severity: MODERATE
CWE: CWE-476
Published: 2021-11-23T18:04:47Z

Go-Ethereum 1.10.9 nodes crash (denial of service) after receiving a serial of messages and cannot be recovered. They will crash with "runtime error: invalid memory address or nil pointer dereference" and arise a SEGV signal.
Vulnerability: GHSA-pmqp-h87c-mr78
Summary: XML Entity Expansion and Improper Input Validation in Kubernetes API server
Aliases: CVE-2019-11253
Severity: HIGH
CWE: CWE-776, CWE-20
Published: 2021-05-18T15:38:48Z

Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.
Vulnerability: GHSA-74xm-qj29-cq8p
Summary: Failed DTLS certificate verification doesn't stop data channel communication
Aliases: CVE-2021-28681
Severity: MODERATE
CWE: CWE-863
Published: 2021-05-25T18:42:42Z

### Impact
Data channel communication was incorrectly allowed with users who have failed DTLS certificate verification.

This attack requires 
* Attacker knows the ICE password. 
* Only take place during PeerConnection handshake.

This attack can be detected by monitoring `PeerConnectionState` in all versions of Pion WebRTC.

### Patches
Users should upgrade to v3.0.15. 

The exact patch is https://github.com/pion/webrtc/commit/545613dcdeb5dedb01cce94175f40bcbe045df2e

### Workarounds
Users should listen for when `PeerConnectionState` changes to `PeerConnectionStateFailed`. When it enters this state users should not continue using the PeerConnection.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/pion/webrtc
* Email us at [team@pion.ly](mailto:team@pion.ly)

Thank you to https://github.com/Gaukas for discovering this.
Vulnerability: GHSA-fxwj-v664-wv5g
Summary: Improper Control of a Resource Through its Lifetime in Mattermost
Aliases: CVE-2022-1385
Severity: MODERATE
CWE: CWE-664, CWE-668
Published: 2022-04-20T00:00:30Z

Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels.
Vulnerability: GHSA-v4h8-794j-g8mm
Summary: Arbitrary File Override in Docker Engine
Aliases: CVE-2015-3631
Severity: MODERATE
CWE: CWE-285
Published: 2022-02-15T01:57:18Z

Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc.
Vulnerability: GO-2020-0037
Published: 2021-04-14T12:00:00Z

Due to support of Gzip compression in request bodies, as well
as a lack of limiting response body sizes, a malicious server
can cause a client to consume a significant amount of system
resources, which may be used as a denial of service vector.
Vulnerability: GHSA-m7vp-hqwv-7m5x
Summary: Unbounded memory usage on exposed HTTP/2 (non-gRPC) endpoints
Severity: HIGH
Published: 2022-01-12T22:33:04Z

### Impact
The net/http Go package has a reported vulnerability tracked under CVE-2021-44716 which allows attacker controlled HTTP/2 requests to trigger unbounded memory usage in HTTP/2 endpoints. gRPC endpoints are not vulnerable as they rely on their own HTTP/2 implementation instead of the net/http package. HTTP/2 endpoints consuming the net/http package within SPIRE server and agent (or other components in this repository) that are _on by default_ include the following:
- OIDC Discovery Provider
- K8s Workload Registrar in webhook mode

The following endpoints are vulnerable _when enabled_:
- SPIRE server bundle endpoint (i.e. Federation API)

The following endpoints are _NOT_ vulnerable, since HTTP/2 support in go is not enabled on non-TLS protected endpoints:
- SPIRE server/agent metrics endpoint when configured for Prometheus
- SPIRE server/agent health endpoints
- SPIRE server/agent profiling endpoints

### Patches
SPIRE 1.0.3 and 1.1.3 have been released with an upgraded Go toolchain which patches the vulnerability

### Workarounds
The vulnerability can be worked around entirely by including the `http2server=0` value in the `GODEBUG` environment variable (see https://github.com/golang/go/issues/50058). This turns off HTTP/2 support on all non-gRPC endpoints. They will still function with HTTP/1.1.

The risk associated with this vulnerability can be somewhat mitigated by limiting the exposure of the endpoints in question. If necessary, vulnerable components or endpoints that are optionally configured can be disabled temporarily.

### References
- https://github.com/golang/go/issues/50058
- https://go-review.googlesource.com/c/go/+/370574/
- https://nvd.nist.gov/vuln/detail/CVE-2021-44716
Vulnerability: GHSA-r3gq-wxqf-q4gh
Summary: Cross-site Scripting in Gitea
Aliases: CVE-2021-45329
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-10T00:00:32Z

Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL field.
Vulnerability: GHSA-26cm-qrc6-mfgj
Summary: Improper Neutralization of Special Elements used in an LDAP Query in stevenweathers/thunderdome-planning-poker
Aliases: CVE-2021-41232
Severity: HIGH
CWE: CWE-90, CWE-74
Published: 2021-11-08T18:16:21Z

### Impact
LDAP injection vulnerability, only affects instances with LDAP authentication enabled.

### Patches
Patch for vulnerability released with v1.16.3.

### Workarounds
Disable LDAP feature if in use

### References
[OWASP LDAP Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html
)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Thunderdome Github Repository](https://github.com/StevenWeathers/thunderdome-planning-poker)
* Email us at [steven@weathers.me](mailto:steven@weathers.me)
Vulnerability: GHSA-q2qr-3c2p-9235
Summary: Denial of Service (DoS) in HashiCorp Consul
Aliases: CVE-2020-12758
Severity: MODERATE
CWE: CWE-400
Published: 2022-02-15T01:57:18Z

HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry. Introduced in 1.6.0, fixed in 1.6.6 and 1.7.4.
Vulnerability: GHSA-7774-7vr3-cc8j
Summary: Authorization Policy Bypass Due to Case Insensitive Host Comparison
Aliases: CVE-2021-39155
Severity: HIGH
CWE: CWE-178
Published: 2021-08-30T16:15:56Z

### Impact
According to [RFC 4343](https://datatracker.ietf.org/doc/html/rfc4343), Istio authorization policy should compare the hostname in the HTTP Host header in a case insensitive way, but currently the comparison is case sensitive.  The Envoy proxy will route the request hostname in a case-insensitive way which means the authorization policy could be bypassed.
 
As an example, the user may have an authorization policy that rejects request with hostname "httpbin.foo" for some source IPs, but the attacker can bypass this by sending the request with hostname "Httpbin.Foo".

### Patches
* Istio 1.11.1 and above
* Istio 1.10.4 and above
* Istio 1.9.8 and above

### Workarounds
A Lua filter may be written to normalize Host header before the authorization check.  This is similar to the Path normalization presented in the [Security Best Practices](https://istio.io/latest/docs/ops/best-practices/security/#case-normalization) guide.

### References
More details can be found in the [Istio Security Bulletin](https://istio.io/latest/news/security/istio-security-2021-008).

### For more information
If you have any questions or comments about this advisory, please email us at istio-security-vulnerability-reports@googlegroups.com
Vulnerability: GHSA-jm5c-rv3w-w83m
Summary: Denial of service in geth
Aliases: CVE-2020-26242
Severity: MODERATE
CWE: CWE-125, CWE-400, CWE-191
Published: 2021-06-29T21:13:20Z

### Impact
Denial-of-service (crash) during block processing

### Details

Affected versions suffer from a vulnerability which can be exploited through the `MULMOD` operation, by specifying a modulo of `0`: `mulmod(a,b,0)`, causing a `panic` in the underlying library. 
The crash was in the `uint256` library, where a buffer [underflowed](https://github.com/holiman/uint256/blob/4ce82e695c10ddad57215bdbeafb68b8c5df2c30/uint256.go#L442).

	if `d == 0`, `dLen` remains `0`

and https://github.com/holiman/uint256/blob/4ce82e695c10ddad57215bdbeafb68b8c5df2c30/uint256.go#L451 will try to access index `[-1]`.

The `uint256` library was first merged in this [commit](https://github.com/ethereum/go-ethereum/commit/cf6674539c589f80031f3371a71c6a80addbe454), on 2020-06-08. 
Exploiting this vulnerabilty would cause all vulnerable nodes to drop off the network. 

The issue was brought to our attention through a [bug report](https://github.com/ethereum/go-ethereum/issues/21367), showing a `panic` occurring on sync from genesis on the Ropsten network.
 
It was estimated that the least obvious way to fix this would be to merge the fix into `uint256`, make a new release of that library and then update the geth-dependency.

- https://github.com/holiman/uint256/releases/tag/v1.1.1 was made the same day, 
- PR to address the issue: https://github.com/holiman/uint256/pull/80 
- PR to update geth deps: https://github.com/ethereum/go-ethereum/pull/21368 


### Patches
Upgrade to v1.9.18 or higher

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)
* Email us at [security@ethereum.org](mailto:security@ethereum.org)
Vulnerability: GHSA-34jx-wx69-9x8v
Summary: Symlink Attack in kubectl cp
Aliases: CVE-2019-1002101
Severity: MODERATE
CWE: CWE-59
Published: 2022-02-15T01:57:18Z

The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when kubectl cp is called, limited only by the system permissions of the local user. The untar function can both create and follow symbolic links. The issue is resolved in kubectl v1.11.9, v1.12.7, v1.13.5, and v1.14.0.
Vulnerability: GHSA-qh54-9vc5-m9fg
Summary: MD5 hash support in github.com/foxcpp/maddy
Severity: LOW
CWE: CWE-261
Published: 2021-10-12T16:06:30Z

### Impact

This vulnerability affects maddy 0.5.1, 0.5.0 users using auth.shadow module
and an extremely outdated system that still allows MD5 hashes in 
/etc/shadows.

### Patches

Patch is available as part of the 0.5.2 release.

### Workarounds

Ensure MD5 hashes are not present in /etc/shadow.
Vulnerability: GO-2021-0103
Aliases: CVE-2020-26242
Published: 2021-07-28T12:00:00Z

Due to improper bounds checking, certain mathmatical operations can cause a panic, due to an
out of bounds read. If this package is used to process untrusted user inputs, this may be used
as a vector for a denial of service attack.
Vulnerability: GHSA-rgjg-66cx-5x9m
Summary: Authentication Bypass
Aliases: CVE-2018-15727
Severity: CRITICAL
CWE: CWE-287
Published: 2022-02-15T01:57:18Z

Grafana before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.
Vulnerability: GHSA-j7px-6hwj-hpjg
Summary: Open Redirect in OAuth2 Proxy
Aliases: CVE-2020-11053
Severity: HIGH
CWE: CWE-601
Published: 2021-12-20T17:59:10Z

### Impact
As users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access.
This redirect URL is checked within the proxy and validated before redirecting the user to prevent malicious actors providing redirects to potentially harmful sites.

However, by crafting a redirect URL with HTML encoded whitespace characters (eg. `%0a`, `%0b`,`%09`,`%0d`) the validation could be bypassed and allow a redirect to any URL provided.

### Patches
@rootxharsh and @iamnoooob provided this patch as potential solution:
```
From 4b941f56eda310b5c4dc8080b7635a6bfabccad4 Mon Sep 17 00:00:00 2001
From: Harsh Jaiswal <harsh@pop-os.localdomain>
Date: Fri, 1 May 2020 20:38:31 +0530
Subject: [PATCH] Fixes redirect issue

---
 oauthproxy.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/oauthproxy.go b/oauthproxy.go
index 1e9bb7c..f8beb4d 100644
--- a/oauthproxy.go
+++ b/oauthproxy.go
@@ -577,8 +577,9 @@ func validOptionalPort(port string) bool {

 // IsValidRedirect checks whether the redirect URL is whitelisted
 func (p *OAuthProxy) IsValidRedirect(redirect string) bool {
+       matched, _ := regexp.MatchString(`^/\s+/|\\`, redirect)
        switch {
-       case strings.HasPrefix(redirect, "/") && !strings.HasPrefix(redirect, "//") && !strings.HasPrefix(redirect, "/\\"):
+       case strings.HasPrefix(redirect, "/") && !strings.HasPrefix(redirect, "//") && !matched:
                return true
        case strings.HasPrefix(redirect, "http://") || strings.HasPrefix(redirect, "https://"):
                redirectURL, err := url.Parse(redirect)
--
2.17.1
```

This issue was also reported to us separately by @mik317 several hours later

The fix was implemented in [#xxx]() and released as version 5.1.1
Vulnerability: GHSA-jr34-mff8-pc6f
Summary: SQL Injection in Cloud Native Computing Foundation Harbor
Aliases: CVE-2019-19029
Severity: MODERATE
CWE: CWE-89
Published: 2021-05-18T18:27:36Z

Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Registry for the Pivotal Platform.
Vulnerability: GHSA-h289-x5wc-xcv8
Summary: Improper Validation of Certificate with Host Mismatch in mellium.im/xmpp/websocket
Severity: MODERATE
CWE: CWE-295
Published: 2022-02-16T22:56:21Z

### Impact

If no TLS configuration is provided by the user, the websocket package constructs its own TLS configuration using recommended defaults. When looking up a WSS endpoint using the DNS TXT record method described in [XEP-0156: Discovering Alternative XMPP Connection Methods](https://xmpp.org/extensions/xep-0156.html) the ServerName field was incorrectly being set to the name of the server returned by the TXT record request, not the name of the initial server we were attempting to connect to. This means that any attacker that can spoof a DNS record (ie. in the absence of DNSSEC, DNS-over-TLS, DNS-over-HTTPS, or similar technologies) could redirect the user to a server of their choosing and as long as it had a valid TLS certificate for itself the connection would succeed, resulting in a MITM situation.

### Patches

All users should upgrade to v0.21.1.

### Workarounds

To work around the issue, manually specify a TLS configuration with the correct hostname.

### References

- https://mellium.im/cve/cve-2022-24968/
- https://nvd.nist.gov/vuln/detail/CVE-2022-24968

### For more information

If you have any questions or comments about this advisory:
* Reach out on XMPP to [sam@samwhited.com](xmpp:sam@samwhited.com?msg)
* Email us at [sam@samwhited.com](mailto:sam@samwhited.com)
Vulnerability: GO-2021-0102
Aliases: CVE-2019-11289
Published: 2021-07-28T12:00:00Z

Due to improper input validation, a maliciously crafted input can cause a panic, due to incorrect
nonce size. If this package is used to decrypt user supplied messages without checking the size of
supplied nonces, this may be used as a vector for a denial of service attack.
Vulnerability: GHSA-6rg3-8h8x-5xfv
Summary: Unchecked hostname resolution could allow access to local network resources by users outside the local network
Severity: MODERATE
CWE: CWE-441, CWE-284
Published: 2021-06-23T18:04:50Z

### Impact
A newly implemented route allowing users to download files from remote endpoints was not properly verifying the destination hostname for user provided URLs. This would allow malicious users to potentially access resources on local networks that would otherwise be inaccessible.

This vulnerability requires valid authentication credentials and is therefore **not exploitable by unauthenticated users**. If you are running an instance for yourself or other trusted individuals this impact is unlikely to be of major concern to you. However, you should still upgrade for security sake.

### Patches
Users should upgrade to the latest version of Wings.

### Workarounds
There is no workaround available that does not involve modifying Panel or Wings code.
Vulnerability: GHSA-cpgw-2wxr-pww3
Summary: Open Redirect
Aliases: CVE-2018-15178
Severity: MODERATE
CWE: CWE-601
Published: 2021-06-29T18:32:39Z

Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via an initial /\ substring in the user/login redirect_to parameter, related to the function isValidRedirect in routes/user/auth.go.
Vulnerability: GHSA-7h6j-2268-fhcm
Summary: Improper Certificate Handling
Aliases: CVE-2020-9321
Severity: MODERATE
CWE: CWE-200, CWE-295
Published: 2021-09-02T22:00:01Z

configurationwatcher.go in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0 mishandles the purging of certificate contents from providers before logging.
Vulnerability: GHSA-p2j5-3f4c-224r
Summary: Improper Input Validation	in HashiCorp Consul
Aliases: CVE-2020-13170
Severity: MODERATE
CWE: CWE-20
Published: 2021-05-18T18:21:21Z

HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center, where replication to a secondary data center was not enabled. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4.
Vulnerability: GHSA-wxjg-p59j-6c92
Summary: Command injection in github.com/google/fscrypt
Aliases: CVE-2022-25328
Severity: MODERATE
CWE: CWE-78
Published: 2022-02-26T00:00:44Z

The bash_completion script for fscrypt allows injection of commands via crafted mountpoint paths, allowing privilege escalation under a specific set of circumstances. A local user who has control over mountpoint paths could potentially escalate their privileges if they create a malicious mountpoint path and if the system administrator happens to be using the fscrypt bash completion script to complete mountpoint paths. We recommend upgrading to version 0.3.3 or above
Vulnerability: GHSA-jwvr-vv7p-gpwq
Summary: Privilege escalation for users with create/update permissions in Global Roles in Rancher
Aliases: CVE-2021-36784
Severity: MODERATE
CWE: CWE-285, CWE-269
Published: 2022-05-02T19:39:35Z

### Impact
This vulnerability affects customers who utilize non-admin users that are able to create or edit [Global Roles](https://rancher.com/docs/rancher/v2.6/en/admin-settings/rbac/). The most common use case for this scenario is the [`restricted-admin`](https://rancher.com/docs/rancher/v2.6/en/admin-settings/rbac/global-permissions/#restricted-admin) role.

A flaw was discovered in Rancher versions from 2.5.0 up to and including 2.5.12 and from 2.6.0 up to and including 2.6.3 which allows users who have create or update permissions on Global Roles to escalate their permissions, or those of another user, to admin-level permissions. Global Roles grant users Rancher-wide permissions, such as the ability to create clusters. In the identified versions of Rancher, when users are given permission to edit or create Global Roles, they are not restricted to only granting permissions which they already posses.

The privilege escalation can be taken advantage of in two ways by users with create or update permissions on Global Roles (including the `restricted-admin`):

1. Editing the global `admin` role to make it the default for new users, then creating a new user that will be elevated to the global `admin` role.
2. Creating a new global role with permissions already possessed by the `restricted-admin`, assigning this new role to a user, then modifying the global role to grant additional administrive like permissions (`'*'`) to the elevated user.

### Patches
Patched versions include releases 2.5.13, 2.6.4 and later versions.

### Workarounds
Limit access in Rancher to trusted users. There is not a direct mitigation besides upgrading to the patched Rancher versions.

**Note:** If you have users who have create or edit permissions on Global Roles but are not admin users (for example, the `restricted-admin`), it is highly advised to review the roles and users created by those users for possible privilege escalations.

### For more information
If you have any questions or comments about this advisory:
* Reach out to [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.
* Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.
* Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).
Vulnerability: GHSA-9r5x-fjv3-q6h4
Summary: Incorrect Access Control in github.com/nats-io/jwt and github.com/nats-io/nats-server/v2
Aliases: CVE-2021-3127
Severity: HIGH
CWE: CWE-863, CWE-284
Published: 2022-02-15T01:57:18Z

NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled.
Vulnerability: GO-2021-0051
Published: 2021-04-14T12:00:00Z

Due to improper santization of user input on Windows, the static file handler
allows for directory traversal, allowing an attacker to read files outside of
the target directory that the server has permission to read.