TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-p6mc-m468-83gw
Summary: Prototype Pollution in lodash
Aliases: CVE-2020-8203
Severity: HIGH
CVSS score: 7.4
CWE: CWE-770, CWE-1321
Published: 2020-07-15T19:15:48Z

Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The function zipObjectDeep allows a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires zipping objects based on user-provided property arrays.

This vulnerability causes the addition or modification of an existing property that will exist on all objects and may lead to Denial of Service or Code Execution under specific circumstances.
Vulnerability: GHSA-cwx2-736x-mf6w
Summary: Prototype pollution in object-path
Aliases: CVE-2020-15256
Severity: HIGH
CVSS score: 7.7
CWE: CWE-20, CWE-471
Published: 2020-10-19T20:55:55Z

### Impact
A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInheritedProps` mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of `object-path` and setting the option `includeInheritedProps: true`, or by using the default `withInheritedProps` instance. The default operating mode is not affected by the vulnerability if version >= 0.11.0 is used. Any usage of `set()` in versions < 0.11.0 is vulnerable.
 
### Patches
Upgrade to version >= 0.11.5

### Workarounds
Don't use the `includeInheritedProps: true` options or the `withInheritedProps` instance if using a version >= 0.11.0.

### References
[Read more about the prototype pollution vulnerability](https://codeburst.io/what-is-prototype-pollution-49482fc4b638)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [object-path](https://github.com/mariocasciaro/object-path)
Vulnerability: GHSA-p9pm-55vp-2jqw
Summary: Downloads Resources over HTTP in soci
Aliases: CVE-2016-10669
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:44:32Z

Affected versions of `soci` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `soci`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-x949-7cm6-fm6p
Summary: Code Injection in md-to-pdf.
Aliases: CVE-2021-23639
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2021-12-16T14:34:40Z

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine.
Vulnerability: GHSA-x26f-26qw-hhhx
Summary: Path Traversal in hekto
Aliases: CVE-2018-3725
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-26T15:22:00Z

Versions of `hekto` before 0.2.3 are vulnerable to path traversal. This allows a remote attacker to read content of arbitrary files.


## Recommendation

Update to version 0.2.3 or later.
Vulnerability: GHSA-p59g-6cqr-m73w
Summary: Malicious Package in bmap
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T20:45:27Z

Version 1.0.3 of `bmap` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`


## Recommendation

If version 1.0.3 of this module is found installed you will want to replace it with a version before or after 1.0.3. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-6fcq-3cm2-j3j5
Summary: Kcapifony gem for Ruby places database user passwords on the command line
Aliases: CVE-2014-5001
Severity: HIGH
CVSS score: 7.8
CWE: CWE-200
Published: 2018-07-23T19:50:11Z

lib/ksymfony1.rb in the kcapifony gem 2.1.6 for Ruby places database user passwords on the (1) mysqldump, (2) pg_dump, (3) mysql, and (4) psql command lines, which allows local users to obtain sensitive information by listing the processes.
Vulnerability: GHSA-m42x-37p3-fv5w
Summary: Circumvention of file size limits in ActiveStorage
Aliases: CVE-2020-8162
Severity: LOW
CVSS score: 0
CWE: CWE-602
Published: 2020-05-26T15:09:48Z

There is a vulnerability in ActiveStorage's S3 adapter that allows the Content-Length of a
direct file upload to be modified by an end user.

Versions Affected:  rails < 5.2.4.2, rails < 6.0.3.1
Not affected:       Applications that do not use the direct upload functionality of the ActiveStorage S3 adapter.
Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1

Impact
------

Utilizing this vulnerability, an attacker can control the Content-Length of an S3 direct upload URL without receiving a
new signature from the server. This could be used to bypass controls in place on the server to limit upload size.

Workarounds
-----------

This is a low-severity security issue. As such, no workaround is necessarily
until such time as the application can be upgraded.
Vulnerability: GHSA-8xjv-v9xq-m5h9
Summary: Moderate severity vulnerability that affects Pillow
Aliases: CVE-2016-0775
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-119
Published: 2018-07-24T20:15:36Z

Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash) via a crafted FLI file.
Vulnerability: GHSA-pg36-wpm5-g57p
Summary: HTTP Request Smuggling: LF vs CRLF handling in Waitress
Aliases: CVE-2019-16785
Severity: HIGH
CVSS score: 7.1
CWE: CWE-444
Published: 2019-12-20T23:03:57Z

### Impact

Waitress implemented a &amp;quot;MAY&amp;quot; part of the RFC7230 (https://tools.ietf.org/html/rfc7230#section-3.5) which states:

      Although the line terminator for the start-line and header fields is
      the sequence CRLF, a recipient MAY recognize a single LF as a line
      terminator and ignore any preceding CR.

Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways. This can lead to a potential for HTTP request smuggling/splitting whereby Waitress may see two requests while the front-end server only sees a single HTTP message.

Example:

```
Content-Length: 100[CRLF]
X-Header: x[LF]Content-Length: 0[CRLF]
```

Would get treated by Waitress as if it were:

```
Content-Length: 100
X-Header: x
Content-Length: 0
```

This could potentially get used by attackers to split the HTTP request and smuggle a second request in the body of the first.


### Patches

This issue is fixed in Waitress 1.4.0. This brings a range of changes to harden Waitress against potential HTTP request confusions, and may change the behaviour of Waitress behind non-conformist proxies. 

Waitress no longer implements the MAY part of the specification and instead requires that all lines are terminated correctly with CRLF. If any lines are found with a bare CR or LF a 400 Bad Request is sent back to the requesting entity.

The Pylons Project recommends upgrading as soon as possible, while validating that the changes in Waitress don&amp;#39;t cause any changes in behavior.

### Workarounds

Various reverse proxies may have protections against sending potentially bad HTTP requests to the backend, and or hardening against potential issues like this. If the reverse proxy doesn&amp;#39;t use HTTP/1.1 for connecting to the backend issues are also somewhat mitigated, as HTTP pipelining does not exist in HTTP/1.0 and Waitress will close the connection after every single request (unless the Keep Alive header is explicitly sent... so this is not a fool proof security method)

### Issues/more security issues:

* open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related)
* email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)
Vulnerability: GHSA-9wgh-vjj7-7433
Summary: Mutable reference with immutable provenance in image
Aliases: CVE-2020-35916
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-400
Published: 2021-08-25T20:49:54Z

An issue was discovered in the image crate before 0.23.12 for Rust. A Mutable reference has immutable provenance. (In the case of LLVM, the IR may be always correct.)
Vulnerability: GHSA-pg97-ww7h-5mjr
Summary: XSS in dojox due to insufficient escape in dojox.xmpp.util.xmlEncode 
Aliases: CVE-2019-10785
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2020-02-13T22:21:06Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

Potential XSS vulnerability for users of `dojox/xmpp` and `dojox/dtl`.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Yes, patches are available for the 1.11 through 1.16 versions. Users should upgrade to one of these versions of Dojo:

* 1.16.1
* 1.15.2
* 1.14.5
* 1.13.6
* 1.12.7
* 1.11.9

Users of Dojo 1.10.x and earlier should review this change and determine if it impacts them, and backport the change as appropriate.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

The change applied in https://github.com/dojo/dojox/pull/315 could get added separately as a patch.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [dojo/dojox](https://github.com/dojo/dojox/)
Vulnerability: GHSA-246r-r2wf-frhx
Summary: Malicious password-reset in Akaunting
Aliases: CVE-2021-36804
Severity: HIGH
CVSS score: 8.1
CWE: CWE-640
Published: 2021-09-01T18:31:36Z

Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a running Akaunting instance, if that attacker knows the target's e-mail address. This issue was fixed in version 2.1.13 of the product. Please note that this issue is ultimately caused by the defaults provided by the Laravel framework, specifically how proxy headers are handled with respect to multi-tenant implementations. In other words, while this is not technically a vulnerability in Laravel, this default configuration is very likely to lead to practically identical identical vulnerabilities in Laravel projects that implement multi-tenant applications.
Vulnerability: GHSA-8qrh-h9m2-5fvf
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2009-3009
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2017-10-24T18:33:38Z

Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper.
Vulnerability: GHSA-hp4c-x6r7-6555
Summary: Floating point exception in `SparseDenseCwiseDiv`
Aliases: CVE-2021-37636
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-369
Published: 2021-08-25T14:44:14Z

### Impact
The implementation of `tf.raw_ops.SparseDenseCwiseDiv` is vulnerable to a division by 0 error:

```python
import tensorflow as tf
import numpy as np

tf.raw_ops.SparseDenseCwiseDiv( 
  sp_indices=np.array([[4]]),
  sp_values=np.array([-400]),
  sp_shape=np.array([647.]),
  dense=np.array([0]))
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/a1bc56203f21a5a4995311825ffaba7a670d7747/tensorflow/core/kernels/sparse_dense_binary_op_shared.cc#L56) uses a common class for all binary operations but fails to treat the division by 0 case separately.

### Patches
We have patched the issue in GitHub commit [d9204be9f49520cdaaeb2541d1dc5187b23f31d9](https://github.com/tensorflow/tensorflow/commit/d9204be9f49520cdaaeb2541d1dc5187b23f31d9).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-3949-f494-cm99
Summary: Cross-site Scripting in Prism
Aliases: CVE-2022-23647
Severity: HIGH
CVSS score: 7.5
CWE: CWE-79
Published: 2022-02-22T19:32:18Z

### Impact
Prism's [Command line plugin](https://prismjs.com/plugins/command-line/) can be used by attackers to achieve an XSS attack. The Command line plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML code.

Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are also not impacted.

### Patches
This bug has been fixed in v1.27.0.

### Workarounds
Do not use the Command line plugin on untrusted inputs, or sanitized all code blocks (remove all HTML code text) from all code blocks that use the Command line plugin.

### References
- https://github.com/PrismJS/prism/pull/3341
Vulnerability: GHSA-p92q-7fhh-mq35
Summary: Cross-Site Request Forgery in Jenkins
Aliases: CVE-2022-20612
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-352
Published: 2022-01-21T23:37:57Z

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.
Vulnerability: GHSA-rpj6-2q8r-98f8
Summary: Incorrect default pattern in Jenkins Audit Trail Plugin 
Aliases: CVE-2020-2287
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-435
Published: 2022-02-10T20:29:39Z

Jenkins Audit Trail Plugin 3.6 and earlier applies pattern matching to a different representation of request URL paths than the Stapler web framework uses for dispatching requests, which allows attackers to craft URLs that bypass request logging of any target URL.
Vulnerability: GHSA-347x-877p-hcwx
Summary: Information Disclosure in Password Reset
Aliases: CVE-2020-11063
Severity: LOW
CVSS score: 3.7
CWE: CWE-204
Published: 2020-05-13T22:19:21Z

In TYPO3 CMS 10.4.0 through 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts.

This has been fixed in 10.4.2.

### References
* https://typo3.org/security/advisory/typo3-core-sa-2020-001
Vulnerability: GHSA-w5cr-frph-hw7f
Summary: Use of uninitialized buffer in rkyv
Aliases: CVE-2021-31919
Severity: HIGH
CVSS score: 7.5
CWE: CWE-908
Published: 2021-08-25T21:01:50Z

An issue was discovered in the rkyv crate before 0.6.0 for Rust. When an archive is created via serialization, the archive content may contain uninitialized values of certain parts of a struct.
Vulnerability: GHSA-fmr4-7g9q-7hc7
Summary: Moderate severity vulnerability that affects handlebars
Severity: MODERATE
CVSS score: 0
Published: 2017-10-24T18:33:36Z

**Withdrawn:** Duplicate of GHSA-9prh-257w-9277
Vulnerability: GHSA-7289-chwj-7h86
Summary: Path traversal in librenms/librenms
Aliases: CVE-2021-44278
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-22
Published: 2021-12-10T20:18:30Z

Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php.
Vulnerability: GHSA-rph7-j9qr-h8q8
Summary: Potential Command Injection in codem-transcode
Aliases: CVE-2013-7377
Severity: HIGH
CVSS score: 8.1
CWE: CWE-77
Published: 2017-11-28T22:20:17Z

When the ffprobe functionality is enabled on the server, HTTP POST requests can be made to /probe. These requests are passed to the ffprobe binary on the server. Through this HTTP endpoint it is possible to send a malformed source file name to ffprobe that results in arbitrary command execution.

### Mitigating Factors:
The ffprobe functionality is not enabled by default. In addition, exploitation opportunities are limited in a standard configuration because the server binds to the local interface by default.


## Recommendation

An updated and patched version of the module (version 0.5.0) is available via npm. Users who have enabled the ffprobe functionality are especially encouraged to upgrade..
Vulnerability: GHSA-g92x-8m54-p89v
Summary: Cross-Site Request Forgery in snipe-it
Aliases: CVE-2021-3858
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-352
Published: 2021-10-21T17:48:55Z

snipe-it is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-756h-r2c9-qp5j
Summary: An authenticated user can execute arbitrary command in Gerapy
Aliases: CVE-2021-32849
Severity: HIGH
CVSS score: 8.8
CWE: CWE-77, CWE-78
Published: 2022-01-06T23:48:50Z

### Impact

An authenticated user can execute arbitrary command, see more in https://github.com/Gerapy/Gerapy/issues/211.

### Patches

Fixed in 0.9.9
Vulnerability: GHSA-jx5q-g37m-h5hj
Summary: Client-Side JavaScript Prototype Pollution in oro/platform
Aliases: CVE-2021-43852
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-74, CWE-1321
Published: 2022-01-06T18:29:51Z

### Summary

By sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are vulnerable to Prototype Pollution.

### Workarounds

Configure WAF to drop requests containing next strings: `__proto__` , `constructor[prototype]`, `constructor.prototype`
Vulnerability: GHSA-xx4c-jj58-r7x6
Summary:  Inefficient Regular Expression Complexity in Validator.js
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-1333
Published: 2021-11-19T20:14:23Z

### Impact
Versions of `validator` prior to 13.7.0 are affected by an inefficient Regular Expression complexity  when using the `rtrim` and `trim` sanitizers.

### Patches
The problem has been patched in validator 13.7.0
Vulnerability: GHSA-rgvq-pcvf-hx75
Summary: Heap OOB and null pointer dereference in `RaggedTensorToTensor`
Aliases: CVE-2021-29608
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-131
Published: 2021-05-21T14:28:27Z

### Impact
Due to lack of validation in `tf.raw_ops.RaggedTensorToTensor`, an attacker can exploit an undefined behavior if input arguments are empty:

```python
import tensorflow as tf

shape = tf.constant([-1, -1], shape=[2], dtype=tf.int64)
values = tf.constant([], shape=[0], dtype=tf.int64)
default_value = tf.constant(404, dtype=tf.int64)
row = tf.constant([269, 404, 0, 0, 0, 0, 0], shape=[7], dtype=tf.int64)
rows = [row]
types = ['ROW_SPLITS']

tf.raw_ops.RaggedTensorToTensor(
  shape=shape, values=values, default_value=default_value, 
  row_partition_tensors=rows, row_partition_types=types)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/656e7673b14acd7835dc778867f84916c6d1cac2/tensorflow/core/kernels/ragged_tensor_to_tensor_op.cc#L356-L360) only checks that one of the tensors is not empty, but does not check for the other ones.

There are multiple `DCHECK` validations to prevent heap OOB, but these are no-op in release builds, hence they don't prevent anything.

### Patches
We have patched the issue in GitHub commit [b761c9b652af2107cfbc33efd19be0ce41daa33e](https://github.com/tensorflow/tensorflow/commit/b761c9b652af2107cfbc33efd19be0ce41daa33e) followed by GitHub commit [f94ef358bb3e91d517446454edff6535bcfe8e4a](https://github.com/tensorflow/tensorflow/commit/f94ef358bb3e91d517446454edff6535bcfe8e4a) and GitHub commit [c4d7afb6a5986b04505aca4466ae1951686c80f6](https://github.com/tensorflow/tensorflow/commit/c4d7afb6a5986b04505aca4466ae1951686c80f6).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick these commits on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-g485-29gq-6h2h
Summary: Sensitive Data Exposure in miniorange_saml
Aliases: CVE-2021-36786
Severity: HIGH
CVSS score: 7.5
CWE: CWE-922
Published: 2021-09-01T18:36:24Z

The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys.
Vulnerability: GHSA-77gp-3h4r-6428
Summary: Out of bounds read and write in Tensorflow
Aliases: CVE-2022-23574
Severity: HIGH
CVSS score: 8.8
CWE: CWE-787, CWE-125
Published: 2022-02-09T23:25:40Z

### Impact
There is a typo in TensorFlow's [`SpecializeType`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/full_type_util.cc#L81-L102) which results in heap OOB read/write:

```cc
for (int i = 0; i < op_def.output_arg_size(); i++) {
  // ...
  for (int j = 0; j < t->args_size(); j++) {
    auto* arg = t->mutable_args(i);
    // ...
  }
} 
```

Due to a typo, `arg` is initialized to the `i`th mutable argument in a loop where the loop index is `j`. Hence it is possible to assign to `arg` from outside the vector of arguments. Since this is a mutable proto value, it allows both read and write to outside of bounds data.

### Patches
We have patched the issue in GitHub commit [0657c83d08845cc434175934c642299de2c0f042](https://github.com/tensorflow/tensorflow/commit/0657c83d08845cc434175934c642299de2c0f042).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-7322-jrq4-x5hf
Summary: File reference keys leads to incorrect hashes on HMAC algorithms
Aliases: CVE-2021-41106
Severity: MODERATE
CVSS score: 4.4
CWE: CWE-345
Published: 2021-09-29T17:09:40Z

### Impact

Users of HMAC-based algorithms (HS256, HS384, and HS512) combined with `Lcobucci\JWT\Signer\Key\LocalFileReference` as key are having their tokens issued/validated using the file path as hashing key - instead of the contents.

The HMAC hashing functions take any string as input and, since users can issue and validate tokens, people are lead to believe that everything works properly.

### Patches

All versions have been patched to always load the file contents, deprecated the `Lcobucci\JWT\Signer\Key\LocalFileReference`, and suggest `Lcobucci\JWT\Signer\Key\InMemory` as the alternative.

### Workarounds

Use `Lcobucci\JWT\Signer\Key\InMemory` instead of `Lcobucci\JWT\Signer\Key\LocalFileReference` to create the instances of your keys:

```diff
-use Lcobucci\JWT\Signer\Key\LocalFileReference;
+use Lcobucci\JWT\Signer\Key\InMemory;

-$key = LocalFileReference::file(__DIR__ . '/public-key.pem');
+$key = InMemory::file(__DIR__ . '/public-key.pem');
```
Vulnerability: GHSA-8fp4-rp6c-5gcv
Summary: Path Traversal in com.linecorp.armeria:armeria
Aliases: CVE-2021-43795
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2021-12-02T22:25:54Z

### Impact

An attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains `%2F` (encoded `/`), such as `/files/..%2Fsecrets.txt`, bypassing Armeria's path validation logic.

### Patches

Armeria 1.13.4 or above contains the hardened path validation logic that handles `%2F` properly. 

### Workarounds

This vulnerability can be worked around by inserting a decorator that performs an additional validation on the request path, e.g.

```java
Server
  .builder()
  .serviceUnder(
    "/files",
    FileService
      .of(...)
      .decorate((delegate, ctx, req) -> {
        String path = req.headers().path();
        if (path.contains("%2f") || path.contains("%2F")) {
          return HttpResponse.of(HttpStatus.BAD_REQUEST);
        }
        return delegate.serve(ctx, req);
      })
  )
  .build()
```

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [line/armeria](https://github.com/line/armeria)
* Chat with us at [Slack](https://armeria.dev/s/slack)

### Credits

This vulnerability was originally reported by Abdallah Zaher ([elcayser-0x0a](https://hackerone.com/elcayser-0x0a?type=user)).
Vulnerability: GHSA-2rvv-w9r2-rg7m
Summary: Information Disclosure in Apache Tomcat
Aliases: CVE-2021-24122
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-200
Published: 2021-05-13T22:30:02Z

When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.
Vulnerability: GHSA-v4x4-98cg-wr4g
Summary: Code injection in definitions
Aliases: CVE-2018-20325
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2018-12-26T17:45:19Z

There is a vulnerability in load() method in definitions/parser.py in the Danijar Hafner definitions package for Python. It can execute arbitrary python commands resulting in command execution.
Vulnerability: GHSA-9vwf-54m9-gc4f
Summary: snipe-it is vulnerable to Improper Access Control
Aliases: CVE-2021-4089
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-863, CWE-284
Published: 2021-12-16T14:32:39Z

snipe-it is vulnerable to Improper Access Control
Vulnerability: GHSA-8w9j-6wg6-qv4f
Summary: Malicious Package in axioss
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T19:41:17Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-rphc-h572-2x9f
Summary: Cross-site Scripting in showdoc/showdoc
Aliases: CVE-2022-0960
Severity: CRITICAL
CVSS score: 9
CWE: CWE-434, CWE-79
Published: 2022-03-15T00:00:55Z

ShowDoc is a tool greatly applicable for an IT team to share documents online. showdoc/showdoc allows .properties files to upload which lead to stored XSS in versions prior to 2.10.4. This allows attackers to execute malicious scripts in the user's browser. This issue was patched in version 2.10.4. There is currently no known workaround.
Vulnerability: GHSA-m273-wwfv-h6jp
Summary: Directory Traversal in fancy-server
Aliases: CVE-2014-10066
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-08-31T22:44:33Z

Versions 0.1.4 and earlier of fancy-server are vulnerable to a directory traversal attack. 

Standard attack vectors such as `../` will allow an attacker to read files outside of the served directory.


## Recommendation

Upgrade to version 0.1.4 or greater.
Vulnerability: GHSA-wwgq-9jhf-qgw6
Summary: Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys
Aliases: CVE-2021-41273
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-352
Published: 2021-11-18T15:46:57Z

### Impact
Due to improperly configured CSRF protections on two routes, a malicious user could execute a CSRF-based attack against the following endpoints:

* Sending a test email.
* Generating a node auto-deployment token.

At no point would any data be exposed to the malicious user, this would simply trigger email spam to an administrative user, or generate a single auto-deployment token unexpectedly. This token is not revealed to the malicious user, it is simply created unexpectedly in the system.

### Patches
This has been addressed in https://github.com/pterodactyl/panel/commit/bf9cbe2c6d5266c6914223e067c56175de7fc3a5 which will be released as `1.6.6`.

### Workarounds
Users may optionally manually apply the fixes released in v1.6.6 to patch their own systems.
Vulnerability: GHSA-58r4-h6v8-jcvm
Summary: Regression in JWT Signature Validation
Aliases: CVE-2020-15240
Severity: HIGH
CVSS score: 7.4
CWE: CWE-287, CWE-347
Published: 2020-11-03T02:31:38Z

### Overview
Versions after and including `2.3.0` are improperly validating the JWT token signature when using the `JWTValidator.verify` method.  Improper validation of the JWT token signature when not using the default Authorization Code Flow can allow an attacker to bypass authentication and authorization.

### Am I affected?
You are affected by this vulnerability if all of the following conditions apply:

- You are using `omniauth-auth0`.
- You are using `JWTValidator.verify` method directly OR you are not authenticating using the SDK’s default Authorization Code Flow.

### How to fix that?
Upgrade to version `2.4.1`.

### Will this update impact my users?
The fix provided in this version will not affect your users.
Vulnerability: GHSA-5hp8-35wj-m525
Summary: Uncontrolled recursion in ammonia
Aliases: CVE-2019-15542
Severity: HIGH
CVSS score: 7.5
CWE: CWE-674
Published: 2021-08-25T20:44:03Z

An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.
Vulnerability: GHSA-7r28-3m3f-r2pr
Summary: Regular Expression Denial of Service (ReDoS)
Aliases: CVE-2021-28092
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-03-19T21:25:50Z

The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). If an attacker provides a malicious string, is-svg will get stuck processing the input for a very long time.
Vulnerability: GHSA-jxjr-5h69-qw3w
Summary: Moderate severity vulnerability that affects nokogiri
Aliases: CVE-2015-7499
Severity: MODERATE
CVSS score: 0
CWE: CWE-119
Published: 2018-09-17T21:57:38Z

Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors.
Vulnerability: GHSA-563h-49v8-g7x4
Summary: Malicious Package in ks-sha3
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T23:17:01Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-9hqj-38j2-5jgm
Summary: Command Injection in ascii-art
Severity: LOW
CVSS score: 0
CWE: CWE-77
Published: 2020-09-01T21:19:23Z

Versions of `ascii-art` before 1.4.4 are vulnerable to command injection. This is exploitable when user input is passed into the argument of the `ascii-art preview` command. 


Example Proof of concept:
`ascii-art preview 'doom"; touch /tmp/malicious; echo "'`

Given that the input is passed on the command line and none of the api methods are vulnerable to this,  the likely exploitation vector is when the ascii-art comment is being called programmatically using something like `execFile`.


## Recommendation

Update to version 1.4.4 or later.
Vulnerability: GHSA-4x6x-782q-jfc4
Summary: Command Injection in node-wifi
Severity: CRITICAL
CVSS score: 0
CWE: CWE-77
Published: 2020-09-03T02:38:47Z

Versions of `node-wifi` prior to 2.0.12 are vulnerable to Command Injection. The package fails to sanitize user input, allowing attackers to inject commands through the `ssid` variable and possibly achieving Remote Code Execution on the system.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-56p8-3fh9-4cvq
Summary: XStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos)
Aliases: CVE-2021-21348
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400, CWE-502
Published: 2021-03-22T23:29:09Z

### Impact
The vulnerability may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-21348](https://x-stream.github.io/CVE-2021-21348.html).

### Credits
The vulnerability was discovered and reported by threedr3am.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-8727-m6gj-mc37
Summary: Possible Strong Parameters Bypass in ActionPack
Aliases: CVE-2020-8164
Severity: MODERATE
CVSS score: 0
CWE: CWE-502
Published: 2020-05-26T15:09:16Z

There is a strong parameters bypass vector in ActionPack.

Versions Affected:  rails <= 6.0.3
Not affected:       rails < 4.0.0
Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1

Impact
------
In some cases user supplied information can be inadvertently leaked from
Strong Parameters.  Specifically the return value of `each`, or `each_value`,
or `each_pair` will return the underlying "untrusted" hash of data that was
read from the parameters.  Applications that use this return value may be
inadvertently use untrusted user input.

Impacted code will look something like this:

```
def update
  # Attacker has included the parameter: `{ is_admin: true }`
  User.update(clean_up_params)
end

def clean_up_params
   params.each { |k, v|  SomeModel.check(v) if k == :name }
end
```

Note the mistaken use of `each` in the `clean_up_params` method in the above
example.

Workarounds
-----------
Do not use the return values of `each`, `each_value`, or `each_pair` in your
application.
Vulnerability: GHSA-pp7m-6j83-m7r6
Summary: Cross-site Scripting in video.js
Aliases: CVE-2021-23414
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-79
Published: 2021-08-10T16:09:36Z

This affects the package video.js before 7.14.3.
 The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.
Vulnerability: GHSA-cvm9-fjm9-3572
Summary: Unsafe Deserialization in jackson-databind
Aliases: CVE-2020-36181
Severity: HIGH
CVSS score: 8.1
CWE: CWE-502
Published: 2021-12-09T19:16:10Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS.
Vulnerability: GHSA-vfr4-x8j2-3rf9
Summary: Division by zero in TFLite's implementation of `TransposeConv`
Aliases: CVE-2021-29588
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:26:48Z

### Impact
The optimized implementation of the `TransposeConv` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/0d45ea1ca641b21b73bcf9c00e0179cda284e7e7/tensorflow/lite/kernels/internal/optimized/optimized_ops.h#L5221-L5222):

```cc 
int height_col = (height + pad_t + pad_b - filter_h) / stride_h + 1;
int width_col = (width + pad_l + pad_r - filter_w) / stride_w + 1;
```

An attacker can craft a model such that `stride_{h,w}` values are 0. Code calling this function must validate these arguments.

### Patches
We have patched the issue in GitHub commit [801c1c6be5324219689c98e1bd3e0ca365ee834d](https://github.com/tensorflow/tensorflow/commit/801c1c6be5324219689c98e1bd3e0ca365ee834d).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-pjxv-w3qj-j8m3
Summary: Directory Traversal in elFinder.AspNet
Aliases: CVE-2021-23415
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2021-08-09T20:42:13Z

This affects the package elFinder.AspNet before 1.1.1.
 The user-controlled file name is not properly sanitized before it is used to create a file system path.
Vulnerability: GHSA-8m49-2xj8-67v9
Summary: Data Loss/Denial of Service in SWHKD
Aliases: CVE-2022-27816
Severity: HIGH
CVSS score: 7.1
CWE: CWE-59
Published: 2022-03-31T00:00:24Z

SWHKD 1.1.5 unsafely uses the /tmp/swhks.pid pathname. There can be data loss or a denial of service. A patch is available on the `1.1.0` branch of the repository.
Vulnerability: GHSA-fcqf-h4h4-695m
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2011-3186
Severity: MODERATE
CVSS score: 0
CWE: CWE-94
Published: 2017-10-24T18:33:38Z

CRLF injection vulnerability in actionpack/lib/action_controller/response.rb in Ruby on Rails 2.3.x before 2.3.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the Content-Type header.
Vulnerability: GHSA-89qr-369f-5m5x
Summary: Unsafe Deserialization in jackson-databind
Aliases: CVE-2020-36182
Severity: HIGH
CVSS score: 8.1
CWE: CWE-502
Published: 2021-12-09T19:15:46Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS.
Vulnerability: GHSA-q9q6-f556-gpm7
Summary: Improper Verification of Cryptographic Signature in starkbank-ecdsa
Aliases: CVE-2021-43571
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-347
Published: 2021-11-10T20:58:42Z

The verify function in the Stark Bank Node.js ECDSA library (ecdsa-node) 1.1.2 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.
Vulnerability: GHSA-cfhg-9x44-78h2
Summary: Command Injection in ps
Aliases: CVE-2018-16460
Severity: MODERATE
CVSS score: 0
CWE: CWE-77
Published: 2018-09-17T20:43:59Z

Versions of `ps` before 1.0.0 are vulnerable to command injection.

Proof of concept:

```
var ps = require('ps');

ps.lookup({ pid: "$(touch success.txt)" }, function(err, proc) { // this method is vulnerable to command injection
    if (err) {throw err;}
    if (proc) {
        console.log(proc);  // Process name, something like "node" or "bash"
    } else {
        console.log('No such process');
    }
});

// Result: The file success.txt will exist on the filesystem if the touch command was executed
```


## Recommendation

Update to version 1.0.0 or later.
Vulnerability: GHSA-w9p3-5cr8-m3jj
Summary: Deserialization of Untrusted Data in Log4j 1.x
Aliases: CVE-2022-23302
Severity: HIGH
CVSS score: 8.8
CWE: CWE-502
Published: 2022-01-21T23:27:14Z

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
Vulnerability: GHSA-m744-2jj8-vpfv
Summary: Command injection in git-parse
Aliases: CVE-2021-26543
Severity: HIGH
CVSS score: 8.8
CWE: CWE-74
Published: 2022-02-10T23:51:16Z

The "gitDiff" function in Wayfair git-parse <=1.0.4 has a command injection vulnerability. Clients of the git-parse library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.
Vulnerability: GHSA-ph62-8768-r87v
Summary: Arbitrary file delete in ectouch/ectouch
Aliases: CVE-2022-25098
Severity: CRITICAL
CVSS score: 9.1
Published: 2022-02-25T00:01:04Z

ECTouch v2 suffers from arbitrary file deletion due to insufficient filtering of the filename parameter.
Vulnerability: GHSA-gvj8-4cj4-h776
Summary: Object state limitation has no effect
Severity: CRITICAL
CVSS score: 0
CWE: CWE-281
Published: 2022-04-29T15:40:48Z

Object state limitation is a policy you can use in your roles to limit access to content based on specific object state values. Due to a flawed earlier update, these limitations were ineffective in releases made since February 16th 2022. They would grant access to the given content regardless of the object state. Depending on how your frontent is designed, knowing the URL to the content may or may not be required to access it. If you are using object state limitations in your roles, this issue is critical. Please apply the fix as soon as possible.
Vulnerability: GHSA-q6cw-2553-7837
Summary: Moderate severity vulnerability that affects newrelic_rpm
Aliases: CVE-2013-0284
Severity: MODERATE
CVSS score: 0
CWE: CWE-200
Published: 2017-10-24T18:33:37Z

Ruby agent 3.2.0 through 3.5.2 serializes sensitive data when communicating with servers operated by New Relic, which allows remote attackers to obtain sensitive information (database credentials and SQL statements) by sniffing the network and deserializing the data.
Vulnerability: GHSA-48p3-xfvw-g59c
Summary: Incorrect Access Control in ImpressCMS
Aliases: CVE-2021-26598
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-287
Published: 2022-03-29T00:01:16Z

ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by design, able to have a security token).
Vulnerability: GHSA-c8hq-x4mm-p6q6
Summary: Memory handling issues in xcb
Aliases: CVE-2020-36205
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-415, CWE-416
Published: 2021-08-25T20:50:54Z

An issue was discovered in the xcb crate through 2020-12-10 for Rust. base::Error does not have soundness. Because of the public ptr field, a use-after-free or double-free can occur.
Vulnerability: GHSA-4fgq-gq9g-3rw7
Summary: Improper Verification of Cryptographic Signature in keycloak
Aliases: CVE-2019-10201
Severity: MODERATE
CVSS score: 8.1
CWE: CWE-347
Published: 2019-09-23T18:32:16Z

It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.
Vulnerability: GHSA-6xvq-2gj8-4276
Summary: Cross site scripting in valine
Aliases: CVE-2020-28847
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-04-06T00:01:29Z

valine is a fast, simple & powerful comment system. Cross Site Scripting (XSS) vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment. A fix was released in version 1.4.15.
Vulnerability: GHSA-rf54-44jr-q5vf
Summary: Improper Input Validation in url-js
Aliases: CVE-2022-25839
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-20
Published: 2022-03-12T00:00:26Z

The package url-js before 2.1.0 is vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is reflected as it is.
Vulnerability: GHSA-r8pr-83cc-ccv7
Summary: Umbraco Persistent Password Reset Poison
Aliases: CVE-2022-22691
Severity: HIGH
CVSS score: 7.4
CWE: CWE-640, CWE-444
Published: 2022-01-21T23:34:27Z

The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to Umbraco users when so that it points to the attackers server thereby disclosing the password reset token if/when the link is followed. A related vulnerability (CVE-2022-22690) could allow this flaw to become persistent so that all password reset URLs are affected persistently following a successful attack. See the AppCheck advisory for further information and associated caveats.
Vulnerability: GHSA-758m-v56v-grj4
Summary: jackson-databind mishandles the interaction between serialization gadgets and typing
Aliases: CVE-2020-10969
Severity: HIGH
CVSS score: 8.8
CWE: CWE-502
Published: 2020-04-23T21:36:03Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.
Vulnerability: GHSA-gpfh-jvf9-7wg5
Summary: Use after free / memory leak in `CollectiveReduceV2`
Aliases: CVE-2021-41220
Severity: HIGH
CVSS score: 7.8
CWE: CWE-416
Published: 2021-11-10T18:51:21Z

### Impact
The [async implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/collective_ops.cc#L604-L615) of `CollectiveReduceV2` suffers from a memory leak and a use after free:

```python
import tensorflow as tf
  
tf.raw_ops.CollectiveReduceV2(
  input=[],
  group_size=[-10, -10, -10],
  group_key=[-10, -10],
  instance_key=[-10],
  ordering_token=[],
  merge_op='Mul',
  final_op='Div')
``` 

This occurs due to the asynchronous computation and the fact that objects that have been `std::move()`d from are still accessed:

```cc
auto done_with_cleanup = [col_params, done = std::move(done)]() {
  done();
  col_params->Unref();
};
OP_REQUIRES_OK_ASYNC(c,
                     FillCollectiveParams(col_params, REDUCTION_COLLECTIVE,
                                          /*group_size*/ c->input(1),
                                          /*group_key*/ c->input(2),
                                          /*instance_key*/ c->input(3)),
                     done);
```

Here, `done` is already moved from by the time `OP_REQUIRES_OK_ASYNC` macro needs to invoke it in case of errors. In this case, we get an undefined behavior, which can manifest via crashes, `std::bad_alloc` throws or just memory leaks.

### Patches
We have patched the issue in GitHub commit [ca38dab9d3ee66c5de06f11af9a4b1200da5ef75](https://github.com/tensorflow/tensorflow/commit/ca38dab9d3ee66c5de06f11af9a4b1200da5ef75).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-c597-f74m-jgc2
Summary: Improper Certificate Validation and Improper Validation of Certificate with Host Mismatch in Keycloak
Aliases: CVE-2020-1758
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-297, CWE-295
Published: 2022-02-09T00:56:26Z

A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack.