TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-wf5p-f5xr-c4jj
Summary: SQL Injection in rosariosis
Aliases: CVE-2021-44427
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2021-12-02T17:48:53Z

An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, and DELETE) through /Side.php via the syear parameter.
Vulnerability: GHSA-hmw2-mvvh-jf5j
Summary: OS Command Injection in enpeem
Aliases: CVE-2019-10801
Severity: HIGH
CVSS score: 9.8
CWE: CWE-78
Published: 2021-04-13T15:22:47Z

enpeem through 2.2.0 allows execution of arbitrary commands. The &quot;options.dir&quot; argument is provided to the &quot;exec&quot; function without any sanitization.
Vulnerability: GHSA-hqw4-8893-j4h7
Summary: Directory Traversal in simple-npm-registry
Aliases: CVE-2017-16132
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:49:28Z

Affected versions of `simple-npm-registry` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-2x54-j4m3-r6wx
Summary: High severity vulnerability that affects sqla-yaml-fixtures
Aliases: CVE-2019-3575
Severity: HIGH
CVSS score: 7.8
CWE: CWE-94
Published: 2019-01-04T17:44:48Z

Sqla_yaml_fixtures 0.9.1 allows local users to execute arbitrary python code via the fixture_text argument in sqla_yaml_fixtures.load.
Vulnerability: GHSA-fjqg-w8g6-hhq8
Summary: Improper Authentication and Improper Access Control in Dolibarr
Aliases: CVE-2021-25956
Severity: HIGH
CVSS score: 7.2
CWE: CWE-287, CWE-284
Published: 2021-09-02T17:16:28Z

In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 have “Modify” access for admin level users to change other user’s details but fails to validate already existing “Login” name, while renaming the user “Login”. This leads to complete account takeover of the victim user. This happens since the password gets overwritten for the victim user having a similar login name.
Vulnerability: GHSA-22h7-7wwg-qmgg
Summary: Prototype Pollution in @hapi/hoek
Severity: LOW
CVSS score: 0
CWE: CWE-1321
Published: 2020-09-04T17:56:39Z

Versions of `@hapi/hoek` prior to 8.5.1 and 9.0.3 are vulnerable to Prototype Pollution. The `clone` function fails to prevent the modification of the Object prototype when passed specially-crafted input. Attackers may use this to change existing properties that exist in all objects, which may lead to Denial of Service or Remote Code Execution in specific circumstances.  
This issue __does not__ affect hapi applications since the framework protects against such malicious inputs. Applications that use `@hapi/hoek` outside of the hapi ecosystem may be vulnerable.


## Recommendation

Update to version 8.5.1, 9.0.3 or later.
Vulnerability: GHSA-pgww-xf46-h92r
Summary: XSS in lxml
Aliases: CVE-2020-27783
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-01-07T21:54:01Z

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.
Vulnerability: GHSA-w4hp-pcp8-qhf3
Summary: Cross-site Scripting in livehelperchat
Aliases: CVE-2022-0387
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-01-28T23:06:32Z

Stored XSS is found in Settings>Live help configuration>Departments->Departments groups->edit When a user creates a new webhook under the NAME field and puts a payload {{constructor.constructor('alert(1)')()}}, the input gets stored, at user edit groupname , the payload gets executed.
Vulnerability: GHSA-rgg3-3wh7-w935
Summary: Unrestricted Upload of File with Dangerous Type in Zenario CMS
Aliases: CVE-2021-42171
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-434
Published: 2022-03-15T00:00:58Z

Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth.
Vulnerability: GHSA-p426-qw2p-v95v
Summary: Argument Injection in Apache Geode server
Aliases: CVE-2017-15694
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-88
Published: 2019-06-26T01:09:35Z

When an Apache Geode server versions 1.0.0 to 1.8.0 is operating in secure mode, a user with write permissions for specific data regions can modify internal cluster metadata. A malicious user could modify this data in a way that affects the operation of the cluster.
Vulnerability: GHSA-rqj9-cq6j-958r
Summary: Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main
Aliases: CVE-2018-11766
Severity: HIGH
CVSS score: 8.8
Published: 2018-12-21T17:50:26Z

In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete. A user who can escalate to yarn user can possibly run arbitrary commands as root user.
Vulnerability: GHSA-4r9c-jghc-cx5m
Summary: Cross-site Scripting in apostrophe
Aliases: CVE-2021-25978
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-11-10T16:45:34Z

Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once viewed.
Vulnerability: GHSA-r3gr-cxrf-hg25
Summary: Serialization gadgets exploit in jackson-databind
Aliases: CVE-2020-35491
Severity: HIGH
CVSS score: 8.1
CWE: CWE-913, CWE-502
Published: 2021-12-09T19:15:11Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.
Vulnerability: GHSA-m9cj-v55f-8x26
Summary: Authentication Bypass in keycloak
Aliases: CVE-2020-27826
Severity: HIGH
CVSS score: 8.8
CWE: CWE-250
Published: 2022-03-18T17:55:26Z

A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application.
Vulnerability: GHSA-xrr4-74mc-rpjc
Summary: Pyro mishandles pid files in temporary directory locations and opening the pid file as root
Aliases: CVE-2011-2765
Severity: HIGH
CVSS score: 7.5
CWE: CWE-59
Published: 2018-08-21T17:01:29Z

pyro before 3.15 unsafely handles pid files in temporary directory locations and opening the pid file as root. An attacker can use this flaw to overwrite arbitrary files via symlinks.
Vulnerability: GHSA-xm9f-vxmx-4m58
Summary: Data Flow Sanitation Issue Fix 
Aliases: CVE-2021-32759
Severity: HIGH
CVSS score: 0
CWE: CWE-20
Published: 2021-08-30T17:20:41Z

### Impact
Due to missing sanitation in data flow it was possible for admin users to upload arbitrary executable files to the server.
Vulnerability: GHSA-cvp7-c586-cmf4
Summary: Withdrawn: Code Injection in loguru
Aliases: CVE-2022-0329
Severity: LOW
CVSS score: 0
CWE: CWE-94
Published: 2022-01-28T22:01:45Z

# Withdrawn

This advisory has been withdrawn after the maintainers of loguru noted this issue is not a security vulnerability and the CVE has been revoked. We have [stopped](https://github.com/Delgan/loguru/issues/563#issuecomment-1025223732) Dependabot alerts regarding this issue.

## Original Description

In versions of loguru up to and including 0.5.3 a lack of sanitization on log serialization can lead to arbitrary code execution. The maintainer disputes the issue, but has altered behavior of the library in commit 4b0070a4f30cbf6d5e12e6274b242b62ea11c81b. See https://github.com/Delgan/loguru/issues/563 for further discussion of the issue. The function in question is intended for internal use only, but is not restricted. This has been patched in version 0.6.0.
Vulnerability: GHSA-vwfx-hh3w-fj99
Summary: Potential XSS injection in the newsletter conditions field
Aliases: CVE-2021-21418
Severity: MODERATE
CVSS score: 4.6
CWE: CWE-79
Published: 2021-04-06T17:24:14Z

### Impact
An employee can inject javascript in the newsletter condition field that will then be executed on the front office

### Patches
The issue has been fixed in 2.6.1
Vulnerability: GHSA-r9ch-m4fh-fc7q
Summary: Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15
Aliases: CVE-2016-1000341
Severity: MODERATE
CVSS score: 5.9
Published: 2018-10-17T16:24:00Z

In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well.
Vulnerability: GHSA-3v6h-hqm4-2rg6
Summary: Arbitrary File Write in adm-zip
Aliases: CVE-2018-1002204
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-27T17:07:14Z

Versions of `adm-zip` before 0.4.9 are vulnerable to arbitrary file write when used to extract a specifically crafted archive that contains path traversal filenames (`../../file.txt` for example).


## Recommendation

Update to version 0.4.9 or later.
Vulnerability: GHSA-f62v-xpxf-3v68
Summary: Code injection in Apache Ant
Aliases: CVE-2020-11979
Severity: HIGH
CVSS score: 7.5
CWE: CWE-94, CWE-74
Published: 2021-02-03T19:16:35Z

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
Vulnerability: GHSA-5vr6-hm68-5j9p
Summary: Cross-site Scripting in LibreNMS
Aliases: CVE-2021-44279
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-12-03T20:49:16Z

LibreNMS 21.11.0 is affected by is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/forms/poller-groups.inc.php.
Vulnerability: GHSA-mjjq-c88q-qhr6
Summary: Cross-Site Scripting in dompurify
Severity: CRITICAL
CVSS score: 0
CWE: CWE-79
Published: 2020-09-03T21:22:00Z

Versions of `dompurify` prior to 2.0.7 are vulnerable to Cross-Site Scripting (XSS). It is possible to bypass the package sanitization through Mutation XSS, which may allow an attacker to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 2.0.7 or later.
Vulnerability: GHSA-4hq8-v42x-9wx3
Summary: Malicious Package in bs85check
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T16:51:52Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-v936-j8gp-9q3p
Summary: Open redirects on some federation and push requests
Aliases: CVE-2021-21273
Severity: LOW
CVSS score: 3.1
CWE: CWE-601
Published: 2021-02-26T17:28:34Z

### Impact
Requests to user provided domains were not restricted to external IP addresses when calculating the key validity for third-party invite events and sending push notifications. This could cause Synapse to make requests to internal infrastructure. The type of request was not controlled by the user, although limited modification of request bodies was possible.

For the most thorough protection server administrators should remove the deprecated `federation_ip_range_blacklist` from their settings after upgrading to Synapse v1.25.0 which will result in Synapse using the improved default IP address restrictions. See the new `ip_range_blacklist` and `ip_range_whitelist` settings if more specific control is necessary.

### Patches
Issue is resolved by #8821. Further improvements to protect homeservers by default were made in #8870 and #8954.

### Workarounds
Requests to internal IP addresses could be blocked at the system or network level.
Vulnerability: GHSA-4f26-v6fr-9hmp
Summary: Improper Input Validation in Centreon Web
Aliases: CVE-2019-16405
Severity: HIGH
CVSS score: 7.2
CWE: CWE-20
Published: 2021-07-28T17:52:45Z

Centreon Web 19.04.4 allows Remote Code Execution by an administrator who can modify Macro Expression location settings.
Vulnerability: GHSA-wc43-7wj6-4ggr
Summary: Remote code execution in ChakraCore
Aliases: CVE-2020-1180
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-08-02T17:29:09Z

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-1057, CVE-2020-1172.
Vulnerability: GHSA-jv6v-fvvx-4932
Summary: Arbitrary File Deletion vulnerability in OctoberCMS
Aliases: CVE-2020-5296
Severity: MODERATE
CVSS score: 6.2
CWE: CWE-73
Published: 2020-06-03T21:58:21Z

### Impact
An attacker can exploit this vulnerability to delete arbitrary local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission.

### Patches
Issue has been patched in Build 466 (v1.0.466).

### Workarounds
Apply https://github.com/octobercms/october/commit/2b8939cc8b5b6fe81e093fe2c9f883ada4e3c8cc to your installation manually if unable to upgrade to Build 466.

### References
Reported by [Sivanesh Ashok](https://stazot.com/)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1241" alt="Screen Shot 2020-03-31 at 12 16 53 PM" src="https://user-images.githubusercontent.com/7253840/78060872-89354d00-7349-11ea-8c2b-5881b0a50736.png">
Vulnerability: GHSA-3393-hvrj-w7v3
Summary: Denial of Service in Elasticsearch
Aliases: CVE-2021-22144
Severity: MODERATE
CVSS score: 5.7
CWE: CWE-674
Published: 2021-08-09T20:41:17Z

In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch could create a malicious Grok query that will crash the Elasticsearch node.
Vulnerability: GHSA-qmhf-qg6f-pc4v
Summary: Directory Traversal in fbr-client
Aliases: CVE-2017-16217
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:39:51Z

Affected versions of `fbr-client` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-4x25-pvhw-5224
Summary: Algorithms compute incorrect results in blake2
Aliases: CVE-2019-16143
Severity: HIGH
CVSS score: 9.8
CWE: CWE-327
Published: 2021-08-25T20:44:20Z

An issue was discovered in the blake2 crate before 0.8.1 for Rust. The BLAKE2b and BLAKE2s algorithms, when used with HMAC, produce incorrect results because the block sizes are half of the required sizes.
Vulnerability: GHSA-26p8-xrj2-mv53
Summary: Apache NiFi process group information disclosure
Aliases: CVE-2019-10083
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200
Published: 2019-12-02T18:18:37Z

When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the top most level, not recursively). The response included details about processors and controller services which the user may not have had read access to.
Vulnerability: GHSA-9jhm-8m8c-c3f4
Summary: SSRF in Sydent due to missing validation of hostnames
Aliases: CVE-2021-29431
Severity: HIGH
CVSS score: 7.7
CWE: CWE-20, CWE-918
Published: 2021-04-19T14:54:15Z

### Impact

Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP address blacklisting.

It is not possible to exfiltrate data or control request headers, but it might be possible to use the attack to perform an internal port enumeration.

### Patches

Fixed in 9e57334, 8936925, 3d531ed, 0f00412

### Workarounds

A potential workaround would be to use a firewall to ensure that Sydent cannot reach internal HTTP resources.

### For more information

If you have any questions or comments about this advisory, email us at security@matrix.org.
Vulnerability: GHSA-662x-fhqg-9p8v
Summary: Regular Expression Denial of Service in ua-parser-js
Aliases: CVE-2020-7733
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-05-07T16:18:19Z

The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.
Vulnerability: GHSA-v3mr-gp7j-pw5w
Summary: Possible SQL injection in tablelookupwizard Contao Extension
Severity: HIGH
CVSS score: 0
CWE: CWE-89
Published: 2022-02-10T22:33:46Z

### Impact
The currently selected widget values were not correctly sanitized before passing it to the database, leading to an SQL injection possibility.

### Patches
The issue has been patched in `tablelookupwizard` version 3.3.5 and version 4.0.0.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/terminal42/contao-tablelookupwizard
* Email us at [info@terminal42.ch](mailto:info@terminal42.ch)
Vulnerability: GHSA-h77r-rp97-7rv4
Summary: Privilage Escalation in moodle
Aliases: CVE-2020-25699
Severity: HIGH
CVSS score: 7.5
CWE: CWE-863, CWE-269
Published: 2021-03-29T20:43:01Z

In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles within that course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.
Vulnerability: GHSA-5jqp-qgf6-3pvh
Summary: Use of "infinity" as an input to datetime and date fields causes infinite loop in pydantic
Aliases: CVE-2021-29510
Severity: LOW
CVSS score: 3.3
CWE: CWE-835
Published: 2021-05-13T20:23:17Z


Impact

Passing either 'infinity', 'inf' or float('inf') (or their negatives) to datetime or date fields causes validation to run forever with 100% CPU usage (on one CPU).
Patches

Pydantic is be patched with fixes available in the following versions:

    v1.8.2
    v1.7.4
    v1.6.2

All these versions are available on pypi, and will be available on conda-forge soon.

See the changelog for details.
Workarounds

If you absolutely can't upgrade, you can work around this risk using a validator to catch these values, brief demo:

from datetime import date
from pydantic import BaseModel, validator

class DemoModel(BaseModel):
    date_of_birth: date

    @validator('date_of_birth', pre=True)
    def skip_infinite_values(cls, v):
        try:
            seconds = float(v)
        except (ValueError, TypeError):
            return v
        else:
            if seconds == float('inf'):
                return date.max
            elif seconds == float('-inf'):
                return date.min
            else:
                return seconds

Note: this is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic.

If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
References

This was fixed in commit 7e83fdd.
Vulnerability: GHSA-xfrw-hxr5-ghqf
Summary: Cross-site Scripting in wagtail
Aliases: CVE-2021-32681
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-06-17T20:10:42Z

### Impact
When the `{% include_block %}` template tag is used to output the value of a plain-text StreamField block (`CharBlock`, `TextBlock` or a similar user-defined block derived from `FieldBlock`), and that block does not specify a template for rendering, the tag output is not properly escaped as HTML. This could allow users to insert arbitrary HTML or scripting. This vulnerability is only exploitable by users with the ability to author StreamField content (i.e. users with 'editor' access to the Wagtail admin).

### Patches
Patched versions have been released as Wagtail 2.11.8 (for the LTS 2.11 branch), Wagtail 2.12.5, and Wagtail 2.13.2 (for the current 2.13 branch).

Site implementors who wish to retain the existing behaviour of allowing editors to insert HTML content in these blocks (and are willing to accept the risk of untrusted editors inserting arbitrary code) may disable the escaping by surrounding the relevant `{% include_block %}` tag in `{% autoescape off %}...{% endautoescape %}`.

### Workarounds
Site implementors who are unable to upgrade to a current supported version should audit their use of `{% include_block %}` to ensure it is not used to output `CharBlock` / `TextBlock` values with no associated template. Note that this only applies where `{% include_block %}` is used directly on that block (uses of `include_block` on a block _containing_ a CharBlock / TextBlock, such as a StructBlock, are unaffected). In these cases, the tag can be replaced with Django's `{{ ... }}` syntax - e.g. `{% include_block my_title_block %}` becomes `{{ my_title_block }}`.

### Acknowledgements
Many thanks to Karen Tracey for reporting this issue.

### For more information
If you have any questions or comments about this advisory:

* Visit Wagtail's [support channels](https://docs.wagtail.io/en/stable/support.html)
* Email us at security@wagtail.io (if you wish to send encrypted email, the public key ID is `0x6ba1e1a86e0f8ce8`)
Vulnerability: GHSA-wxjf-9f4g-3v44
Summary: Data races in noise_search
Aliases: CVE-2020-36461
Severity: MODERATE
CVSS score: 8.1
CWE: CWE-362, CWE-77
Published: 2021-08-25T20:56:05Z

Affected versions of the `noise_search` crate unconditionally implement Send/Sync for `MvccRwLock`.
This can lead to data races when types that are either `!Send` or `!Sync` (e.g. `Rc<T>`, `Arc<Cell<_>>`) are contained inside `MvccRwLock` and sent across thread boundaries. The data races can potentially lead to memory corruption (as demonstrated in the PoC from the original report issue).

Also, safe APIs of `MvccRwLock` allow aliasing violations by allowing `&T` and `LockResult<MutexGuard<Box<T>>>` to co-exist in conflicting lifetime regions. The APIs of `MvccRwLock` should either be marked as `unsafe` or `MbccRwLock` should be changed to private or pub(crate).
Vulnerability: GHSA-r57r-j98g-587f
Summary: Pointer dereference in nanorand
Aliases: CVE-2021-45705
Severity: CRITICAL
CVSS score: 9.8
Published: 2022-01-06T22:08:56Z

An issue was discovered in the nanorand crate before 0.6.1 for Rust. There can be multiple mutable references to the same object because the TlsWyRand Deref implementation dereferences a raw pointer.
Vulnerability: GHSA-7hx8-2rxv-66xv
Summary: Denial of Service in hapi
Severity: HIGH
CVSS score: 0
Published: 2020-09-03T15:48:00Z

All Versions of `hapi` are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

This package is deprecated and is now maintained as `@hapi/hapi`. Please update your dependencies to use `@hapi/hapi`.
Vulnerability: GHSA-9px9-f7jw-fwhj
Summary: Command Injection in priest-runner
Severity: CRITICAL
CVSS score: 0
CWE: CWE-77
Published: 2020-09-03T15:49:37Z

All versions of `priest-runner` are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to a `spawn` call, which may allow attackers to execute arbitrary code in the system. The `PriestController.prototype.createChild ` function is vulnerable since the `spawn` parameters come from a POST request body.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-vvff-6wrr-4g7q
Summary: Missing Authentication for Critical Function in Foreman Ansible
Aliases: CVE-2021-3589
Severity: CRITICAL
CVSS score: 9.9
CWE: CWE-306
Published: 2022-03-24T00:00:17Z

An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts through job templates. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Vulnerability: GHSA-67f6-c8mx-4q2m
Summary: Uncontrolled Resource Consumption in JPA Server in HAPI FHIR
Aliases: CVE-2021-32053
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2021-06-16T17:21:11Z

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service (e.g., disable access to the database after the attack stops) via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are many simultaneous history requests.
Vulnerability: GHSA-vvf2-ppj9-pp49
Summary: Inefficient Regular Expression Complexity in vuelidate
Aliases: CVE-2021-3794
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400, CWE-697
Published: 2021-09-20T20:42:06Z

vuelidate is a simple, lightweight model-based validation for Vue.js 2.x & 3.0. A ReDoS (regular expression denial of service) flaw was found in the `@vuelidate/validators` package. An attacker that is able to provide crafted input to the url(input) function may cause an application to consume an excessive amount of CPU.
Vulnerability: GHSA-69r7-cw26-px6h
Summary: Downloads Resources over HTTP in google-closure-tools-latest
Aliases: CVE-2016-10677
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:42:14Z

Affected versions of `google-closure-tools-latest` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `google-closure-tools-latest`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, and instead install the [closure compiler](https://github.com/google/closure-compiler) manually.

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-rcrv-228c-gprj
Summary: Invalid URL generation in bitlyshortener
Severity: MODERATE
CVSS score: 0
Published: 2022-01-21T18:39:40Z

### Impact
Due to a sudden upstream breaking change by Bitly, versions of `bitlyshortener` <0.6.0 generate invalid short URLs. All users are affected and must update immediately.

### Patches
Upgrading `bitlyshortener` to 0.6.0 or newer will prevent the generation such invalid short URLs.

### Workarounds
A workaround is to replace "https://j.mp/" in each generated short URL with "https://bit.ly/".

### References
* [Release notes](https://github.com/impredicative/bitlyshortener/releases)
Vulnerability: GHSA-49x3-8228-3w3m
Summary: Inefficient Regular Expression Complexity in code-server
Aliases: CVE-2021-3810
Severity: HIGH
CVSS score: 7.5
CWE: CWE-1333
Published: 2021-09-20T20:18:39Z

code-server is vulnerable to Inefficient Regular Expression Complexity
Vulnerability: GHSA-frxq-v7fm-m4pv
Summary: Malicious Package in requuest
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T20:27:53Z

All versions of `requuest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-hrhx-6h34-j5hc
Summary: Skip the router TLS configuration when the host header is an FQDN
Aliases: CVE-2022-23632
Severity: HIGH
CVSS score: 7.4
CWE: CWE-295
Published: 2022-02-16T22:30:57Z

### Impact

People that configure mTLS between Traefik and clients.

For a request, the TLS configuration choice can be different than the router choice, which implies the use of a wrong TLS configuration.

- When sending a request using FQDN handled by a router configured with a dedicated TLS configuration, the TLS configuration falls back to the default configuration that might not correspond to the configured one.

- If the CNAME flattening is enabled, the selected TLS configuration is the SNI one and the routing uses the CNAME value, so this can skip the expected TLS configuration.

### Patches

Traefik v2.6.x: https://github.com/traefik/traefik/releases/tag/v2.6.1

### Workarounds

Add the FDQN to the host rule:

Example:

```yml
  whoami:
    image: traefik/whoami:v1.7.1
    labels:
      traefik.http.routers.whoami.rule: Host(`whoami.example.com`, `whoami.example.com.`)
      traefik.http.routers.whoami.tls: true
      traefik.http.routers.whoami.tls.options: mtls@file
```

There is no workaround if the CNAME flattening is enabled.

### For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).
Vulnerability: GHSA-qrmc-fj45-qfc2
Summary: Prototype Pollution in extend
Aliases: CVE-2018-16492
Severity: MODERATE
CVSS score: 0
CWE: CWE-400
Published: 2019-02-07T18:03:28Z

Versions of `extend` prior to 3.0.2 (for 3.x) and 2.0.2 (for 2.x) are vulnerable to Prototype Pollution. The `extend()` function allows attackers to modify the prototype of Object causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

If you're using `extend` 3.x upgrade to 3.0.2 or later.
If you're using `extend` 2.x upgrade to 2.0.2 or later.
Vulnerability: GHSA-7r8m-45gc-m2c8
Summary: Downloads Resources over HTTP in mongodb-instance
Aliases: CVE-2016-10572
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:52:14Z

Affected versions of `mongodb-instance` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `mongodb-instance`.


## Recommendation

Update to version 0.0.3 or later.
Vulnerability: GHSA-85rf-xh54-whp3
Summary: Malicious URL drafting attack against iodines static file server may allow path traversal
Severity: LOW
CVSS score: 0
CWE: CWE-22
Published: 2019-10-07T16:52:13Z

### Impact

A path traversal vulnerability was detected in iodine's static file service. This vulnerability effects any application running iodine's static file server on an effected iodine version.

Malicious URL drafting may cause the static file server to attempt a response containing data from files that shouldn't be normally accessible from the public folder.

### Patches

The vulnerability was patched in version 0.7.34. Please upgrade to the latest version.

### Workarounds

A possible workaround would be to disable the static file service and it's `X-Sendfile` support, sending static files using nginx or a source code solution (sending the data dynamically).

However, it would be better to upgrade iodine to the latest version, as it also contains non-security related fixes.

### For more information
If you have any questions or comments about this advisory:
* Email [Boaz Segev](https://github.com/boazsegev)
Vulnerability: GHSA-5m8f-chrv-7rw5
Summary: Denial of Service in Go-Ethereum
Aliases: CVE-2021-43668
Severity: MODERATE
CVSS score: 0
CWE: CWE-476
Published: 2021-11-23T18:04:47Z

Go-Ethereum 1.10.9 nodes crash (denial of service) after receiving a serial of messages and cannot be recovered. They will crash with "runtime error: invalid memory address or nil pointer dereference" and arise a SEGV signal.
Vulnerability: GHSA-8hq2-fcqm-39hq
Summary: Malicious Package in rimrafall
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T21:46:05Z

Version 1.0.0 of `rimrafall` contains malicious code as a preinstall script. The package attempts to remove all files in the system's root folder.


## Recommendation

If you installed this package it is likely your machine was erased. If not, remove the package from your system and verify if any files were deleted.
Vulnerability: GHSA-m53f-rhq8-q6hf
Summary: Moderate severity vulnerability that affects actionpack
Severity: MODERATE
CVSS score: 0
Published: 2018-09-17T21:55:03Z

Withdrawn, accidental duplicate publish.

actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.
Vulnerability: GHSA-gh38-x2wm-xmc8
Summary: Code injection in ShenYu
Aliases: CVE-2021-45029
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2022-01-28T22:13:27Z

Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
Vulnerability: GHSA-pmqp-h87c-mr78
Summary: XML Entity Expansion and Improper Input Validation in Kubernetes API server
Aliases: CVE-2019-11253
Severity: HIGH
CVSS score: 7.5
CWE: CWE-776, CWE-20
Published: 2021-05-18T15:38:48Z

Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.
Vulnerability: GHSA-x83m-p7pv-ch8v
Summary: Division by 0 in `QuantizedAdd`
Aliases: CVE-2021-29549
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:23:38Z

### Impact
An attacker can cause a runtime division by zero error and denial of service in `tf.raw_ops.QuantizedAdd`:

```python
import tensorflow as tf

x = tf.constant([68, 228], shape=[2, 1], dtype=tf.quint8)
y = tf.constant([], shape=[2, 0], dtype=tf.quint8)

min_x = tf.constant(10.723421015884028)
max_x = tf.constant(15.19578006631113)
min_y = tf.constant(-5.539003866682977)
max_y = tf.constant(42.18819949559947)

tf.raw_ops.QuantizedAdd(x=x, y=y, min_x=min_x, max_x=max_x, min_y=min_y, max_y=max_y)
```

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/6f26b3f3418201479c264f2a02000880d8df151c/tensorflow/core/kernels/quantized_add_op.cc#L289-L295) computes a modulo operation without validating that the divisor is not zero.

```cc
void VectorTensorAddition(const T* vector_data, float min_vector,
                          float max_vector, int64 vector_num_elements,
                          const T* tensor_data, float min_tensor,
                          float max_tensor, int64 tensor_num_elements,
                          float output_min, float output_max, Toutput* output) {
  for (int i = 0; i < tensor_num_elements; ++i) {
    const int64 vector_i = i % vector_num_elements;
    ...
  }
}
```

Since `vector_num_elements` is [determined based on input shapes](https://github.com/tensorflow/tensorflow/blob/6f26b3f3418201479c264f2a02000880d8df151c/tensorflow/core/kernels/quantized_add_op.cc#L522-L544), a user can trigger scenarios where this quantity is 0.

### Patches
We have patched the issue in GitHub commit [744009c9e5cc5d0447f0dc39d055f917e1fd9e16](https://github.com/tensorflow/tensorflow/commit/744009c9e5cc5d0447f0dc39d055f917e1fd9e16).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-hxj6-v58r-cqv3
Summary: Cross Site Scripting in Subrion CMS
Aliases: CVE-2020-22392
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-09-01T18:31:45Z

Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file.
Vulnerability: GHSA-r3xc-47qg-h929
Summary: Cross-Site Scripting in @ionic/core
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-03T17:06:09Z

Versions of  `@ionic/core` prior to 4.0.3, 4.1.3, 4.2.1 or 4.3.1 are vulnerable to Cross-Site Scripting (XSS). The package uses the unsafe `innerHTML` function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's browser. This issue affects the components:
- `<ion-alert>.message`
- `<ion-searchbar>.placeholder`
- `<ion-infinite-scroll-content>.loadingText`
- `<ion-refresher-content>.pullingText`
- `<ion-refresher-content>.refershingText`


## Recommendation

- If you are using @ionic/core 4.0.x, upgrade to 4.0.3 or later.
- If you are using @ionic/core 4.1.x, upgrade to 4.1.3 or later.
- If you are using @ionic/core 4.2.x, upgrade to 4.2.1 or later.
- If you are using @ionic/core 4.3.x, upgrade to 4.3.1 or later.
Vulnerability: GHSA-pj97-j597-ppm7
Summary: Malicious Package in rqeuest
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T21:15:22Z

All versions of `rqeuest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-r2pp-x4mm-4999
Summary: Moderate severity vulnerability that affects org.neo4j.procedure:apoc
Aliases: CVE-2018-1000820
Severity: CRITICAL
CVSS score: 10
CWE: CWE-611
Published: 2018-12-20T22:02:02Z

neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This vulnerability appears to have been fixed in after commit 45bc09c.
Vulnerability: GHSA-74xm-qj29-cq8p
Summary: Failed DTLS certificate verification doesn't stop data channel communication
Aliases: CVE-2021-28681
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-863
Published: 2021-05-25T18:42:42Z

### Impact
Data channel communication was incorrectly allowed with users who have failed DTLS certificate verification.

This attack requires 
* Attacker knows the ICE password. 
* Only take place during PeerConnection handshake.

This attack can be detected by monitoring `PeerConnectionState` in all versions of Pion WebRTC.

### Patches
Users should upgrade to v3.0.15. 

The exact patch is https://github.com/pion/webrtc/commit/545613dcdeb5dedb01cce94175f40bcbe045df2e

### Workarounds
Users should listen for when `PeerConnectionState` changes to `PeerConnectionStateFailed`. When it enters this state users should not continue using the PeerConnection.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/pion/webrtc
* Email us at [team@pion.ly](mailto:team@pion.ly)

Thank you to https://github.com/Gaukas for discovering this.
Vulnerability: GHSA-wq5h-f9p5-q7fx
Summary: Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields
Aliases: CVE-2021-29434
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-04-20T14:02:30Z

### Impact
When saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs use a valid protocol. A malicious user with access to the admin interface could thus craft a POST request to publish content with `javascript:` URLs containing arbitrary code. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

### Patches
Patched versions have been released as Wagtail 2.11.7 (for the LTS 2.11 branch) and Wagtail 2.12.4 (for the current 2.12 branch).

### Workarounds
For sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to a `wagtail_hooks.py` module in any installed app:

```python
from draftjs_exporter.dom import DOM
from wagtail.admin.rich_text.converters.html_to_contentstate import ExternalLinkElementHandler, PageLinkElementHandler
from wagtail.core import hooks
from wagtail.core.whitelist import check_url


def link_entity(props):
    id_ = props.get('id')
    link_props = {}

    if id_ is not None:
        link_props['linktype'] = 'page'
        link_props['id'] = id_
    else:
        link_props['href'] = check_url(props.get('url'))

    return DOM.create_element('a', link_props, props['children'])


@hooks.register('register_rich_text_features', order=1)
def register_link(features):
    features.register_converter_rule('contentstate', 'link', {
        'from_database_format': {
            'a[href]': ExternalLinkElementHandler('LINK'),
            'a[linktype="page"]': PageLinkElementHandler('LINK'),
        },
        'to_database_format': {
            'entity_decorators': {'LINK': link_entity}
        }
    })
```

### Acknowledgements
Many thanks to Kevin Breen for reporting this issue.

### For more information
If you have any questions or comments about this advisory:

* Visit Wagtail's [support channels](https://docs.wagtail.io/en/stable/support.html)
* Email us at security@wagtail.io (if you wish to send encrypted email, the public key ID is `0x6ba1e1a86e0f8ce8`)
Vulnerability: GHSA-fxwj-v664-wv5g
Summary: Improper Control of a Resource Through its Lifetime in Mattermost
Aliases: CVE-2022-1385
Severity: MODERATE
CVSS score: 4.6
CWE: CWE-668, CWE-664
Published: 2022-04-20T00:00:30Z

Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels.
Vulnerability: GHSA-v4h8-794j-g8mm
Summary: Arbitrary File Override in Docker Engine
Aliases: CVE-2015-3631
Severity: MODERATE
CVSS score: 5.1
CWE: CWE-285
Published: 2022-02-15T01:57:18Z

Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc.
Vulnerability: GHSA-vpf5-82c8-9v36
Summary: Prototype Pollution in algoliasearch-helper
Aliases: CVE-2021-23433
Severity: MODERATE
CVSS score: 0
CWE: CWE-1321, CWE-915
Published: 2021-11-23T21:15:35Z

The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters._parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the implementation allows users to define arbitrary search patterns.
Vulnerability: GHSA-j35p-q24r-5367
Summary: Dep Group Remote Memory Exhaustion (Denial of Service) in ckb
Severity: HIGH
CVSS score: 0
Published: 2022-04-22T20:23:04Z

### Impact
A remote attacker could exploit this vulnerability to exhaust ckb process memory of an affected node.

### Patches
Upgrade to 0.43.1 or later.

### References
After resolving the outpoints of one dep group, we put the corresponding content into a vec ( https://github.com/nervosnetwork/ckb/blob/v0.42.0/util/types/src/core/cell.rs#L600-L617 ), there is a vulnerability to a memory dos attack because there is no determination of whether the outpoints is duplicated.

PoC:
```
before send dos tx rss:
105700

after rss:
2306932
```

DoS cost: 25.6 KB * 150 + dep_tx out_points capacity ( 36 * 150 * 100 = 540000 ) = 4380000 CKB
Send 50 dos_tx, memory exhausted: (25.6 KB * 150  * 100) * 50 = 19.2 GB
Vulnerability: GHSA-fmrr-mx6j-h3h5
Summary: Prototype Pollution in confucious
Aliases: CVE-2020-7714
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-05-06T18:12:09Z

All versions of package confucious up to and including version 0.0.12 are vulnerable to Prototype Pollution via the set function.
Vulnerability: GHSA-m7vp-hqwv-7m5x
Summary: Unbounded memory usage on exposed HTTP/2 (non-gRPC) endpoints
Severity: HIGH
CVSS score: 0
Published: 2022-01-12T22:33:04Z

### Impact
The net/http Go package has a reported vulnerability tracked under CVE-2021-44716 which allows attacker controlled HTTP/2 requests to trigger unbounded memory usage in HTTP/2 endpoints. gRPC endpoints are not vulnerable as they rely on their own HTTP/2 implementation instead of the net/http package. HTTP/2 endpoints consuming the net/http package within SPIRE server and agent (or other components in this repository) that are _on by default_ include the following:
- OIDC Discovery Provider
- K8s Workload Registrar in webhook mode

The following endpoints are vulnerable _when enabled_:
- SPIRE server bundle endpoint (i.e. Federation API)

The following endpoints are _NOT_ vulnerable, since HTTP/2 support in go is not enabled on non-TLS protected endpoints:
- SPIRE server/agent metrics endpoint when configured for Prometheus
- SPIRE server/agent health endpoints
- SPIRE server/agent profiling endpoints

### Patches
SPIRE 1.0.3 and 1.1.3 have been released with an upgraded Go toolchain which patches the vulnerability

### Workarounds
The vulnerability can be worked around entirely by including the `http2server=0` value in the `GODEBUG` environment variable (see https://github.com/golang/go/issues/50058). This turns off HTTP/2 support on all non-gRPC endpoints. They will still function with HTTP/1.1.

The risk associated with this vulnerability can be somewhat mitigated by limiting the exposure of the endpoints in question. If necessary, vulnerable components or endpoints that are optionally configured can be disabled temporarily.

### References
- https://github.com/golang/go/issues/50058
- https://go-review.googlesource.com/c/go/+/370574/
- https://nvd.nist.gov/vuln/detail/CVE-2021-44716