TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-557g-r22w-9wvx
Summary: Incorrect Permission Assignment for Critical Resource in Singularity
Aliases: CVE-2019-11328
Severity: HIGH
CWE: CWE-269
Published: 2021-12-20T18:25:33Z

An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g. ssh) could exploit this vulnerability due to insecure permissions allowing a user to edit files within `/run/singularity/instances/sing/<user>/<instance>`. The manipulation of those files can change the behavior of the starter-suid program when instances are joined resulting in potential privilege escalation on the host.
Vulnerability: GHSA-vrxp-mg9f-hwf3
Summary: Improperly Implemented path matching for in-toto-golang
Aliases: CVE-2021-41087
Severity: MODERATE
CWE: CWE-345, CWE-22
Published: 2021-09-22T20:37:09Z

### Impact
Authenticated attackers posing as functionaries (i.e., within a trusted set of users for a layout) are able to create attestations that may bypass DISALLOW rules in the same layout. An attacker with access to trusted private keys, may issue an attestation that contains a disallowed artifact by including path traversal semantics (e.g., foo vs dir/../foo).

### Patches
The problem has been fixed in version 0.3.0.

### Workarounds
Exploiting this vulnerability is dependent on the specific policy applied.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [in-toto-golang](http://github.com/in-toto/in-toto-golang)
* Email us at [in-toto-public](mailto:in-toto-public@googlegroups.com)
* If this is a sensitive security-relevant disclosure, please send a PGP encrypted email to santiagotorres@purdue.edu or jcappos@nyu.edu
Vulnerability: GHSA-4g4p-42wc-9f3m
Summary: Git LFS can execute a Git binary from the current directory
Aliases: CVE-2020-27955
Severity: CRITICAL
CWE: CWE-427
Published: 2022-02-11T23:39:18Z

### Impact
On Windows, if Git LFS operates on a malicious repository with a `git.bat` or `git.exe` file in the current directory, that program would be executed, permitting the attacker to execute arbitrary code.  This does not affect Unix systems.

This occurs because on Windows, Go includes (and prefers) the current directory when the name of a command run does not contain a directory separator.

### Patches
This version should be patched in v2.12.1, which will be released in coordination with this security advisory.

### Workarounds
Other than avoiding untrusted repositories, there is no workaround.

### For more information
If you have any questions or comments about this advisory:
* Start a discussion in [the Git LFS discussion page](https://github.com/git-lfs/git-lfs/discussions).
* If you cannot open a discussion, please email the core team using their usernames at `github.com`.
Vulnerability: GHSA-q347-cg56-pcq4
Summary: SSRF in repository migration
Severity: MODERATE
CWE: CWE-918
Published: 2022-03-14T22:57:00Z

### Impact

The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected.

### Patches

Internal network CIDRs are prohibited to be used as repository migration targets. Users should upgrade to 0.12.5 or the latest 0.13.0+dev.

### Workarounds

Run Gogs in its own private network.

### References

https://www.huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531/

### For more information

If you have any questions or comments about this advisory, please post on #6754.
Vulnerability: GHSA-wmrx-57hm-mw7r
Summary: Arbitrary file reads in HashiCorp Nomad
Aliases: CVE-2022-24683
Severity: HIGH
CWE: CWE-22
Published: 2022-02-18T00:00:34Z

Nomad is an easy-to-use, flexible, and performant workload orchestrator that can deploy a mix of microservice, batch, containerized, and non-containerized applications. HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec (or job-submit) capabilities to read arbitrary files on the host filesystem as root. There are currently no known workarounds. Users are recommended to upgrade as soon as possible to avoid this issue.
Vulnerability: GHSA-q9mp-79cp-9g8j
Summary: Improper Authentication
Aliases: CVE-2019-20894
Severity: HIGH
CWE: CWE-287, CWE-295
Published: 2021-09-02T22:00:09Z

Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERR_BAD_SSL_CLIENT_AUTH_CERT should have occurred.
Vulnerability: GHSA-8wrg-m8vm-5fvj
Summary: Authentication Bypass by Primary Weakness in github.com/kongchuanhujiao/server
Aliases: CVE-2021-21403
Severity: HIGH
CWE: CWE-305
Published: 2022-02-15T01:57:18Z

### Impact

Authentication Bypass by Primary Weakness (CWE-305)

Commit:

https://github.com/kongchuanhujiao/server/commit/9a125624f219e496bdf4b07b404816d5a309bdc1

ALL Users  is impacted.

### Patches

Yes, PLEASE UPGRADE TO v1.3.21-beta.d0ffc0a6
Vulnerability: GHSA-m36x-mgfh-8g78
Summary: Subdomain Takeover in Interactsh server
Severity: HIGH
CWE: CWE-79
Published: 2022-01-27T15:15:25Z

A domain configured with interactsh server was vulnerable to subdomain takeover for specfic subdomain, i.e `app`, Interactsh server before `< 1.0.0` used to create cname entries for `app` pointing to `projectdiscovery.github.io` as default which intended to used for hosting interactsh [web client](https://github.com/projectdiscovery/interactsh-web) using GitHub pages. It turns out to be a security issue with a self-hosted interactsh server in which the user may not have configured a web client but still have a cname entry pointing to GitHub pages, making them vulnerable to subdomain takeover.

This issue was initially reported to us as a subdomain takeover for one of our domains that runs interactsh server by **Melih** at `security@projectdiscovery.io`, and after conducting an internal investigation, we determined that it was an issue with the default config of interactsh server affecting all the server running self-hosted instance of interactsh, as a result - cname entry has been removed in the latest release.

#### Impact
This allows one to host / run arbitrary client side code (XSS) in a user's browser when browsing the vulnerable subdomain, for more details on the impact, please read this [detailed blogpost](https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/) from Detectify.
#### Patches
Update to [Interactsh server v1.0.0 ](https://github.com/projectdiscovery/interactsh/releases/tag/v1.0.0)with `go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-server@latest`

#### References
https://github.com/projectdiscovery/interactsh/issues/136

#### For more information
If you have any questions or comments about this advisory:
* Email us at [security@projectdiscovery.io](mailto:security@projectdiscovery.io)
Vulnerability: GHSA-mqf3-28j7-3mj6
Summary: Information Exposure in Kubernetes
Aliases: CVE-2015-7528
Severity: MODERATE
CWE: CWE-200
Published: 2022-04-12T22:40:14Z

Kubernetes before 1.2.0-alpha.5 allows remote attackers to read arbitrary pod logs via a container name.
Vulnerability: GO-2021-0075
Aliases: CVE-2018-12018
Published: 2021-04-14T12:00:00Z

Due to improper argument validation in RPC messages, a maliciously crafted
message can cause a panic, leading to denial of service.
Vulnerability: GHSA-rmw5-xpg9-jr29
Summary: Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone
Aliases: CVE-2020-28924
Severity: HIGH
CWE: CWE-331, CWE-338
Published: 2021-06-10T17:23:21Z

An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limits the entropy of the passwords enormously. These passwords are often used in the crypt backend for encryption of data. It would be possible to make a dictionary of all possible passwords with about 38 million entries per password length. This would make decryption of secret material possible with a plausible amount of effort. NOTE: all passwords generated by affected versions should be changed.
Vulnerability: GHSA-6w7g-p4jh-rf92
Summary: "Verify All" Returns Success Despite Validation Failures in Singularity
Aliases: CVE-2020-13846
Severity: HIGH
Published: 2021-12-20T18:24:43Z

### Impact

The `--all / -a` option to `singularity verify` returns success even when some objects in a SIF container are not signed, or cannot be verified.

The SIF objects that are not verified are reported in `WARNING` log messages, but a `Container Verified` message and exit code of `0`  are returned.

Workflows that verify a container using `--all / -a` and use the exit code as an indicator of success are vulnerable to running SIF containers that have unsigned, or modified, objects that may be exploited to introduce malicious behavior.

```
$ singularity verify -a image.sif 
WARNING: Missing signature for SIF descriptor 2 (JSON.Generic)
WARNING: Missing signature for SIF descriptor 3 (FS)
Container is signed by 1 key(s):

Verifying partition: Def.FILE:
12045C8C0B1004D058DE4BEDA20C27EE7FF7BA84
[LOCAL]   Unit Test <unit@test.com>
[OK]      Data integrity verified

INFO:    Container verified: image.sif

$ echo $?
0
```


### Patches

Singularity 3.6.0 has a new implementation of sign/verify that fixes this issue.

All users are advised to upgrade to 3.6.0. Note that Singularity 3.6.0 uses a new signature format that is necessarily incompatible with Singularity < 3.6.0 - e.g. Singularity 3.5.3 cannot verify containers signed by 3.6.0.

Version 3.6.0 includes a `--legacy-insecure` flag for the `singularity verify` command, that will perform verification of the older, and insecure, legacy signatures for compatibility with existing containers. This does not guarantee that containers have not been modified since signing, due to other issues in the legacy signature format.

### Workarounds

If you are unable to update to 3.6.0 ensure that you do not rely on the return code of `singularity verify --all / -a` as an indicator of trust in a container.

Note that other issues in the sign/verify implementation in Singularity < 3.6.0 allow additional means to introduce malicious behavior to a signed container.


### For more information

General questions about the impact of the advisory / changes made in the 3.6.0 release can be asked in the:

* [Singularity Slack Channel](https://bit.ly/2m0g3lX)
* [Singularity Mailing List](https://groups.google.com/a/lbl.gov/forum/??sdf%7Csort:date#!forum/singularity)

Any sensitive security concerns should be directed to: security@sylabs.io

See our Security Policy here: https://sylabs.io/security-policy
Vulnerability: GHSA-wqv3-8cm6-h6wg
Summary: Improper Authentication in Kubernetes
Aliases: CVE-2020-8558
Severity: HIGH
CWE: CWE-420, CWE-287
Published: 2022-02-15T01:57:18Z

A security issue was discovered in kube-proxy which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. For example, if a cluster administrator runs a TCP service on a node that listens on 127.0.0.1:1234, because of this bug, that service would be potentially reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service. If the example service on port 1234 required no additional authentication (because it assumed that only other localhost processes could reach it), then it could be vulnerable to attacks that make use of this bug.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8558
https://www.openwall.com/lists/oss-security/2020/07/08/1
Vulnerability: GHSA-j9wf-vvm6-4r9w
Summary: Unverified Ownership in Kubernetes
Aliases: CVE-2020-8554
Severity: MODERATE
CWE: CWE-283, CWE-863
Published: 2022-02-08T21:50:34Z

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.
Vulnerability: GHSA-gjcg-vrxg-xmgv
Summary: Incorrect handling of H2 GOAWAY + SETTINGS frames
Aliases: CVE-2021-39162
Severity: HIGH
CWE: CWE-754
Published: 2021-09-10T17:54:01Z

Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event.  

### Impact
This can lead to a DoS in the presence of untrusted *upstream* servers.

### Patches
0.15.1 contains an upgraded envoy binary with this vulnerability patched.

### Workarounds
If only trusted upstreams are configured, there is not substantial risk of this condition being triggered.

### References
[envoy GSA](https://github.com/envoyproxy/envoy/security/advisories/GHSA-j374-mjrw-vvp8)
[envoy CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32780)
[envoy announcement](https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [pomerium/pomerium](https://github.com/pomerium/pomerium/issues)
* Email us at [security@pomerium.com](mailto:security@pomerium.com)
Vulnerability: GHSA-pf59-j7c2-rh6x
Summary: Exposure of Sensitive Information to an Unauthorized Actor and Insertion of Sensitive Information Into Sent Data in Calico
Aliases: CVE-2020-13597
Severity: LOW
CWE: CWE-200, CWE-201
Published: 2022-02-15T01:57:18Z

Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege is able to reconfigure the node’s IPv6 interface due to the node accepting route advertisement by default, allowing the attacker to redirect full or partial network traffic from the node to the compromised pod.
Vulnerability: GO-2020-0045
Published: 2021-04-14T12:00:00Z

CSRF tokens are generated using math/rand, which is not a cryptographically secure
rander number generation, making predicting their values relatively trivial and
allowing an attacker to bypass CSRF protections which relatively few requests.
Vulnerability: GO-2021-0059
Aliases: CVE-2020-35380
Published: 2021-04-14T12:00:00Z

Due to improper bounds checking, maliciously crafted JSON objects
can cause an out-of-bounds panic. If parsing user input, this may
be used as a denial of service vector.
Vulnerability: GHSA-g2qx-6ghw-67hm
Summary: Denial of Service in Gitea
Aliases: CVE-2020-13246
Severity: HIGH
CWE: CWE-667
Published: 2022-02-15T00:33:30Z

An issue was discovered in Gitea in which an attacker can trigger a deadlock by initiating a transfer of a repository's ownership from one organization to another.
Vulnerability: GHSA-rfq3-w54c-f9q5
Summary: OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses
Aliases: CVE-2020-15233
Severity: MODERATE
CWE: CWE-601, CWE-20
Published: 2021-05-24T17:00:12Z

### Impact

[fosite#400](https://github.com/ory/fosite/pull/400) (released as v0.30.2) introduced a new feature for handling redirect URLs pointing to loopback interfaces ([rfc8252#section-7.3](https://tools.ietf.org/html/rfc8252#section-7.3)). As part of that change new behavior was introduced which failed to respect the redirect URL's (only for loopback interfaces!) query parameters

1. Registering a client with allowed redirect URL `http://127.0.0.1/callback`
2. Performing OAuth2 flow and requesting redirect URL `http://127.0.0.1/callback?bar=foo`
3. Instead of an error, the browser is redirected to `http://127.0.0.1/callback?bar=foo` with a potentially successful OAuth2 response.

as well as the host parameter (as long as the host is a loopback interface):

1. Registering a client with allowed redirect URL `https://example.com/callback`
2. Performing OAuth2 flow and requesting redirect URL `http://127.0.0.1/callback`
3. Instead of an error, the browser is redirected to `http://127.0.0.1/callback` with a potentially successful OAuth2 response.

These bugs are only applicable in scenarios where the attacker has control over the loopback interface (`localhost`, `127.0.0.1`, `[::1]`) where the browser performing the OAuth2 flow is running.
Vulnerability: GHSA-rqjq-mrgx-85hp
Summary: Allocation of Resources Without Limits or Throttling in Hashicorp Consul
Aliases: CVE-2020-13250
Severity: HIGH
CWE: CWE-770
Published: 2021-05-18T18:21:35Z

HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service. Fixed in 1.6.6 and 1.7.4.
Vulnerability: GO-2020-0012
Aliases: CVE-2020-9283
Published: 2021-04-14T12:00:00Z

An attacker can craft an ssh-ed25519 or sk-ssh-ed25519@openssh.com public
key, such that the library will panic when trying to verify a signature
with it. If verifying signatures using user supplied public keys, this
may be used as a denial of service vector.
Vulnerability: GHSA-ch68-7cf4-35vr
Summary: Limited ability to spoof SAML authentication with missing audience verification in Fleet
Aliases: CVE-2022-23600
Severity: MODERATE
CWE: CWE-287, CWE-284
Published: 2022-02-07T21:57:38Z

### Impact

This impacts deployments using SAML SSO in two specific cases:

1. A malicious or compromised Service Provider (SP) could reuse the SAML response to log into Fleet as a user -- only if the user has an account with the same email in Fleet, _and_ the user signs into the malicious SP via SAML SSO from the same Identity Provider (IdP) configured with Fleet.
2. A user with an account in Fleet could reuse a SAML response intended for another SP to log into Fleet. This is only a concern if the user is blocked from Fleet in the IdP, but continues to have an account in Fleet. If the user is blocked from the IdP entirely, this cannot be exploited.

### Patches
Fleet 4.9.1 resolves this issue.

### Workarounds and good practices
* Reduce the length of sessions on your IdP to reduce the window for malicious re-use.
* Limit the amount of SAML Service Providers/Applications used by user accounts with access to Fleet.
* When removing access to Fleet in the IdP, delete the Fleet user from Fleet as well.

### For more information
If you have any questions or comments about this advisory:
* Join us in the #fleet channel of [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw).
* Email us at [security@fleetdm.com](mailto:security@fleetdm.com).
Vulnerability: GHSA-rffr-c932-cpxv
Summary: Cross-site Request Forgery (CSRF) in Cloud Native Computing Foundation Harbor
Aliases: CVE-2019-19025
Severity: MODERATE
CWE: CWE-352
Published: 2021-05-18T18:27:50Z

Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows CSRF in the VMware Harbor Container Registry for the Pivotal Platform.
Vulnerability: GHSA-2v6x-frw8-7r7f
Summary: Exposure of Sensitive Information to an Unauthorized Actor in kube-state-metrics
Aliases: CVE-2019-17110
Severity: MODERATE
CWE: CWE-200
Published: 2021-05-18T15:38:54Z

A security issue was discovered in kube-state-metrics 1.7.x before 1.7.2. An experimental feature was added to v1.7.0 and v1.7.1 that enabled annotations to be exposed as metrics. By default, kube-state-metrics metrics only expose metadata about Secrets. However, a combination of the default kubectl behavior and this new feature can cause the entire secret content to end up in metric labels, thus inadvertently exposing the secret content in metrics.
Vulnerability: GO-2020-0004
Published: 2021-04-14T12:00:00Z

If any of the `ListenAndServe` functions are called with an empty token,
token authentication is disabled globally for all listeners.

Also, a minor timing side channel was present allowing attackers with
very low latency and able to make a lot of requests to potentially
recover the token.
Vulnerability: GHSA-q8q8-93cv-v6h8
Summary: Lookup function information discolosure in helm
Aliases: CVE-2020-11013
Severity: HIGH
CWE: CWE-200
Published: 2021-05-27T18:44:56Z

The Helm core maintainers have identified an information disclosure vulnerability in Helm 3.0.0-3.1.2. 

### Impact

`lookup` is a Helm template function introduced in Helm v3. It is able to lookup resources in the cluster to check for the existence of specific resources and get details about them. This can be used as part of the process to render templates.

The documented behavior of `helm template` states that it does not attach to a remote cluster. However, as the recently added `lookup` template function circumvents this restriction and connects to the cluster even during `helm template` and `helm install|update|delete|rollback --dry-run`. The user is not notified of this behavior.

Running `helm template` should not make calls to a cluster. This is different from `install`, which is presumed to have access to a cluster in order to load resources into Kubernetes. Helm 2 is unaffected by this vulnerability.

A malicious chart author could inject a `lookup` into a chart that, when rendered through `helm template`, performs unannounced lookups against the cluster a user's `KUBECONFIG` file points to. This information can then be disclosed via the output of `helm template`.

### Patches

This issue has been fixed in Helm 3.2.0

### Workarounds

Due to another bug (also fixed in Helm 3.2.0), the command `helm lint` will fail with an error if the `lookup` function is used in a chart. Therefore, run `helm lint` on an untrusted chart before running `helm template`.

Alternately, setting the `KUBECONFIG` environment variable to point to an empty Kubernetes configuration file will prevent unintended network connections.

Finally, a chart may be manually analyzed for the presence of a `lookup` function in any file in the `templates/` directory.  

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the Helm repository](https://github.com/helm/helm/issues)
* For security-specific issues, email us at [cncf-helm-security@lists.cncf.io](mailto:cncf-helm-security@lists.cncf.io)
Vulnerability: GHSA-wp47-9r3h-xfgq
Summary: Server-Side Request Forgery in Apache Traffic Control
Aliases: CVE-2022-23206
Severity: HIGH
CWE: CWE-918
Published: 2022-02-07T00:00:23Z

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach.
Vulnerability: GHSA-c8xp-8mf3-62h9
Summary: OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values
Aliases: CVE-2021-3761
Severity: HIGH
CWE: CWE-787, CWE-295
Published: 2021-09-07T23:02:18Z

Any CA issuer in the RPKI can trick OctoRPKI prior to https://github.com/cloudflare/cfrpki/commit/a8db4e009ef217484598ba1fd1c595b54e0f6422 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. 

### Impact

An attacker can use this to disable RPKI Origin Validation in a victim network (for example AS 13335 - Cloudflare) prior to launching a BGP hijack which during normal operations would be rejected as "RPKI invalid". Additionally, in certain deployments RTR session flapping in and of itself also could cause BGP routing churn, causing availability issues.

### Patches
https://github.com/cloudflare/cfrpki/commit/a8db4e009ef217484598ba1fd1c595b54e0f6422

https://github.com/cloudflare/cfrpki/releases/tag/v1.3.0

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@cloudflare.com](security@cloudflare.com)
Vulnerability: GHSA-86f3-hf24-76q4
Summary: Use of Hard-coded Cryptographic Key in Netmaker
Aliases: CVE-2022-23650
Severity: HIGH
CWE: CWE-321, CWE-798
Published: 2022-02-22T19:40:23Z

### Impact
There is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server, if you know the address and username of the admin. This effects the server (netmaker) component, and not clients.

### Patches
This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. If you are running these versions, the fix is to perform the following:

1. docker-compose down
2. docker pull gravitl/netmaker:( version )
3. docker-compose up -d

#### Additional Information
If you are running **any other version**, you will need to upgrade to one of these three versions. If you have a special circumstance that requires running a different version, let us know and we may be able to build a custom patch.

### For more information
If you have any questions or comments about this advisory:
* Email us at [info@gravitl.com](mailto:info@gravitl.com)
Vulnerability: GHSA-99cg-575x-774p
Summary: Improper Input Validation in AKPublic.Verify with attacker-controlled TPM Quote
Aliases: CVE-2022-0317
Severity: MODERATE
CWE: CWE-20
Published: 2022-02-01T00:43:17Z

### Impact

An improper input validation vulnerability in go-attestation before 0.4.0 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing `AKPublic.Verify` to succeed despite the inconsistency. Subsequent use of the same set of PCR values in `Eventlog.Verify` lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in `Eventlog.Verify` to spoof events in the TCG log, hence defeating remotely-attested measured-boot.

### Patches
This issue is resolved in version 0.4.0. If your usage of this library verifies PCRs using multiple quotes, make sure to use the new method `AKPublic.VerifyAll()` instead of `AKPublic.Verify`.
Vulnerability: GHSA-gwj5-3vfq-q992
Summary: Import loops in account imports, nats-server DoS
Severity: LOW
CWE: CWE-400
Published: 2021-05-21T16:22:16Z

(This advisory is canonically <https://advisories.nats.io/CVE/CVE-2020-28466.txt>)

## Problem Description

An export/import cycle between accounts could crash the nats-server, after consuming CPU and memory.

This issue was fixed publicly in <https://github.com/nats-io/nats-server/pull/1731> in November 2020.

The need to call this out as a security issue was highlighted by `snyk.io` and we are grateful for their assistance in doing so.

Organizations which run a NATS service providing access to accounts run by untrusted third parties are affected.
See below for an important caveat if running such a service.


## Affected versions

#### NATS Server

 * Version 2 prior to 2.2.0
   + 2.0.0 through and including 2.1.9 are vulnerable.
 * fixed with nats-io/nats-server PR 1731, commit 2e3c226729


## Impact

The nats-server could be killed, after consuming resources.


## Workaround

The import cycle requires at least two accounts to work; if you have open account sign-up, then restricting new account sign-up might hinder an attacker.


## Solution

Upgrade the nats-server.


## Caveat on NATS with untrusted users

Running a NATS service which is exposed to untrusted users presents a heightened risk.

Any remote execution flaw or equivalent seriousness, or denial-of-service by unauthenticated users, will lead to prompt releases by the NATS maintainers.

Fixes for denial of service issues with no threat of remote execution, when limited to account holders, are likely to just be committed to the main development branch with no special attention.

Those who are running such services are encouraged to build regularly from git.
Vulnerability: GHSA-pw59-4qgf-jxr8
Summary: Cache Manipulation Attack in Apache Traffic Control
Aliases: CVE-2020-17522
Severity: MODERATE
CWE: CWE-525, CWE-732
Published: 2021-06-18T22:04:32Z

When ORT (now via atstccfg) generates ip_allow.config files in Apache Traffic Control 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0, those files include permissions that allow bad actors to push arbitrary content into and remove arbitrary content from CDN cache servers. Additionally, these permissions are potentially extended to IP addresses outside the desired range, resulting in them being granted to clients possibly outside the CDN arcitechture.
Vulnerability: GHSA-h3q4-vmw4-cpr5
Summary: Path Traversal in Gitea
Aliases: CVE-2021-29134
Severity: MODERATE
CWE: CWE-22
Published: 2022-03-16T00:00:38Z

The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL.
Vulnerability: GHSA-82mm-ffjr-h86c
Summary: Authorization bypass in Istio
Aliases: CVE-2020-16844
Severity: MODERATE
CWE: CWE-284
Published: 2022-02-15T01:57:18Z

"In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypassing the intended policy."
Vulnerability: GO-2020-0024
Published: 2021-04-14T12:00:00Z

The RemoteAddr and LocalAddr methods on the returned net.Conn may
call themselves, leading to an infinite loop which will crash the
program due to a stack overflow.
Vulnerability: GHSA-w73w-5m7g-f7qc
Summary: Authorization bypass in github.com/dgrijalva/jwt-go
Aliases: CVE-2020-26160
Severity: HIGH
CWE: CWE-287, CWE-755
Published: 2021-05-18T21:08:21Z

jwt-go allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check. There is no patch available and users of jwt-go are advised to migrate to [golang-jwt](https://github.com/golang-jwt/jwt) at version 3.2.1
Vulnerability: GHSA-93p5-8fqw-wjx3
Summary: Authentication bypass by capture-replay in github.com/cosmos/ethermint
Aliases: CVE-2021-25834
Severity: HIGH
CWE: CWE-294, CWE-287
Published: 2022-02-15T01:57:18Z

Cosmos Network Ethermint <= v0.4.0 is affected by a transaction replay vulnerability in the EVM module. If the victim sends a very large nonce transaction, the attacker can replay the transaction through the application.
Vulnerability: GHSA-6jm6-cmcp-fqjq
Summary: Nomad Spread Job Stanza May Trigger Panic in Servers
Aliases: CVE-2022-24684
Severity: MODERATE
CWE: CWE-400
Published: 2022-02-16T00:01:42Z

Nomad and Nomad Enterprise allows operators with job-submit capabilities to use the spread stanza in a way such that it can cause panic in Nomad servers. This vulnerability, CVE-2022-24684, was fixed in Nomad 1.0.18, 1.1.12, and 1.2.6.
Vulnerability: GHSA-6rrw-4fm9-rghv
Summary: Use of Hard-coded Cryptographic Key in Netmaker
Aliases: CVE-2022-0664
Severity: HIGH
CWE: CWE-321
Published: 2022-02-19T00:01:36Z

Netmaker prior to versions 0.8.5, 0.9.4, 0.10.0, and 0.10.1 uses a hard-coded cryptographic key.
Vulnerability: GHSA-rrp4-2xx3-mv29
Summary: Command injection in gh-ost
Aliases: CVE-2022-21687
Severity: MODERATE
CWE: CWE-20, CWE-74
Published: 2022-02-01T00:47:33Z

Gh-ost version <= 1.1.2 allows users to inject DSN strings via the `-database` parameter.

This is a low severity vulnerability as the attacker must have access to the target host or trick an administrator into executing a malicious `gh-ost` command on a host running `gh-ost`, plus network access from host running `gh-ost` to the attack's malicious MySQL server.

### Impact
This issue may lead to arbitrary local file read.

### Patches
Fixed in 1.1.3+.

### Workarounds
None

### References
- https://advisory.dw1.io/51

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [github/gh-ost](http://github.com/github/gh-ost)
Vulnerability: GHSA-5wmg-j84w-4jj4
Summary: Arbitrary File Write via Archive Extraction in mholt/archiver
Aliases: CVE-2018-1002207
Severity: MODERATE
CWE: CWE-22
Published: 2022-02-15T01:57:18Z

mholt/archiver golang package before e4ef56d48eb029648b0e895bb0b6a393ef0829c3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Vulnerability: GHSA-j756-f273-xhp4
Summary: Import token permissions checking not enforced
Severity: CRITICAL
CWE: CWE-863
Published: 2021-05-21T16:22:20Z

(This advisory is canonically <https://advisories.nats.io/CVE/CVE-2021-3127.txt>)

## Problem Description

The NATS server provides for Subjects which are namespaced by Account; all Subjects are supposed to be private to an account, with an Export/Import system used to grant cross-account access to some Subjects.  Some Exports are public, such that anyone can import the
relevant subjects, and some Exports are private, such that the Import requires a token JWT to prove permission.

The JWT library's validation of the bindings in the Import Token incorrectly warned on mismatches, instead of outright rejecting the token.

As a result, any account can take an Import token used by any other account and re-use it for themselves because the binding to the
importing account is not rejected, and use it to import *any* Subject from the Exporting account, not just the Subject referenced in the Import Token.

The NATS account-server system treats account JWTs as semi-public information, such that an attacker can easily enumerate all account JWTs and retrieve all Import Tokens from those account JWTs.

The CVE identifier should cover the JWT library repair and the nats-server containing the fixed JWT library, and any other application depending upon the fixed JWT library.


## Affected versions

#### JWT library

 * all versions prior to 2.0.1
 * fixed after nats-io/jwt#149 landed (2021-03-14)

#### NATS Server

 * Version 2 prior to 2.2.0
   + 2.0.0 through and including 2.1.9 are vulnerable
 * fixed with nats-io/nats-server@423b79440c (2021-03-14)


## Impact

In deployments with untrusted accounts able to update the Account Server with imports, a malicious account can access any Subject from an account which provides Exported Subjects.

Abuse of this facility requires the malicious actor to upload their tampered Account JWT to the Account Server, providing the service operator with a data-store which can be scanned for signs of abuse.


## Workaround

Deny access to clients to update their account JWT in the account server.


## Solution

Upgrade the JWT dependency in any application using it.

Upgrade the NATS server if using NATS Accounts (with private Exports; Account owners can create those at any time though).

Audit all accounts JWTs to scan for exploit attempts; a Python script to audit the accounts can be found at <https://gist.github.com/philpennock/09d49524ad98043ff11d8a40c2bb0d5a>.
Vulnerability: GHSA-579h-mv94-g4gp
Summary: Privilege Escalation in Kubernetes
Aliases: CVE-2018-1002105
Severity: CRITICAL
CWE: CWE-269
Published: 2022-02-15T01:57:18Z

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials used to establish the backend connection.
Vulnerability: GO-2020-0032
Published: 2021-04-14T12:00:00Z

Due to improper santization of user input, Controller.FileHandler allows
for directory traversal, allowing an attacker to read files outside of
the target directory that the server has permission to read.
Vulnerability: GO-2021-0096
Aliases: CVE-2020-8945
Published: 2021-04-14T12:00:00Z

Due to improper setting of finalizers, memory passed to C may be freed before it is used,
leading to crashes due to memory corruption or possible code execution.
Vulnerability: GHSA-vc3x-gx6c-g99f
Summary: Denial of Service in Bytom
Aliases: CVE-2018-18206
Severity: HIGH
CWE: CWE-190
Published: 2022-02-15T01:57:18Z

In the client in Bytom before 1.0.6, checkTopicRegister in p2p/discover/net.go does not prevent negative idx values, leading to a crash.
Vulnerability: GO-2021-0079
Aliases: CVE-2018-18206
Published: 2021-04-14T12:00:00Z

A malformed query can cause an out-of-bounds panic due to improper
validation of arguments. If processing queries from untrusted
parties, this may be used as a vector for denial of service
attacks.
Vulnerability: GHSA-qj26-7grj-whg3
Summary: Privilege Escalation in fscrypt
Aliases: CVE-2018-6558
Severity: MODERATE
Published: 2021-06-23T17:18:49Z

The pam_fscrypt module in fscrypt before 0.2.4 may incorrectly restore primary and supplementary group IDs to the values associated with the root user, which allows attackers to gain privileges via a successful login through certain applications that use Linux-PAM (aka pam).
Vulnerability: GHSA-3pqh-p72c-fj85
Summary: Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki
Aliases: CVE-2021-3978
Severity: MODERATE
CWE: CWE-281
Published: 2021-11-19T19:34:26Z

### Impact

When copying files with rsync, octorpki uses the "-a" flag 0, which forces rsync to copy binaries with the suid bit set as root. Since the provided service definition defaults to root (https://github.com/cloudflare/cfrpki/blob/master/package/octorpki.service) this could allow for a vector, when combined with another vulnerability that causes octorpki to process a malicious TAL file, for a local privilege escalation.  

## For more information

If you have any questions or comments about this advisory email us at security@cloudflare.com
Vulnerability: GO-2020-0049
Published: 2021-04-14T12:00:00Z

Due to improper validation of caller input, validation is silently disabled
if the provided expected token is malformed, causing any user supplied token
to be considered valid.
Vulnerability: GHSA-599h-8wpj-75xj
Summary: Authentication Bypass in tyk-identity-broker
Aliases: CVE-2021-23365
Severity: CRITICAL
CWE: CWE-287
Published: 2021-06-23T17:23:30Z

The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass. This is because the XML parser doesn’t guarantee integrity in the XML round-trip (encoding/decoding XML data).
Vulnerability: GHSA-8vwm-8vj8-rqjf
Summary: User login denial of service in github.com/google/fscrypt
Aliases: CVE-2022-25327
Severity: MODERATE
CWE: CWE-276
Published: 2022-02-26T00:00:44Z

The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt metadata file that prevents other users from logging into the system. We recommend upgrading to version 0.3.3 or above
Vulnerability: GHSA-33p6-fx42-7rf5
Summary: Harbor is vulnerable to a limited Server-Side Request Forgery (SSRF) (CVE-2020-13788)
Aliases: CVE-2020-13788
Severity: LOW
CWE: CWE-918
Published: 2022-02-11T23:17:02Z

# Impact
Matt Hamilton from Soluble has discovered a limited Server-Side Request Forgery (SSRF) that allowed Harbor project owners to scan the TCP ports of hosts on the Harbor server's internal network. 

The vulnerability was immediately fixed by the Harbor team.  

# Issue 
The “Test Endpoint” API, part of the functionality for ensuring a project Webhook is accessible and functional, is vulnerable to a limited SSRF attack. A malicious user that is also a project administrator can use this API for internal port scanning.

# Known Attack Vectors
Successful exploitation of this issue will lead to bad actors identifying open TCP ports on any network that is accessible by the Harbor core services

# Patches
If your product uses the affected releases of Harbor, update to version 2.0.1 to patch this issue immediately.

https://github.com/goharbor/harbor/releases/tag/v2.0.1

# Workarounds
Since only project administrators (the user that created the project) are allowed to test the webhook endpoints configured in Harbor, a Harbor system administrator can control who is a project admin. In addition, Harbor system administrators can enforce a setting where only an administrator is allowed to create new projects instead of the default Everyone. This further restricts who can be a project administrator in Harbor.

# For more information
If you have any questions or comments about this advisory, contact cncf-harbor-security@lists.cncf.io
View our security policy at https://github.com/goharbor/harbor/security/policy
https://nvd.nist.gov/vuln/detail/CVE-2020-13788
https://www.soluble.ai/blog/harbor-ssrf-cve-2020-13788
Vulnerability: GHSA-vj54-cjrx-x696
Summary: Observable Discrepancy in Argo
Aliases: CVE-2020-11576
Severity: MODERATE
CWE: CWE-203
Published: 2021-12-09T19:59:24Z

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid (non-SSO) accounts within Argo.
Vulnerability: GO-2021-0110
Aliases: CVE-2020-15222
Published: 2021-07-28T12:00:00Z

Uniqueness of JWT IDs (jti) are not checked, allowing the JWT to be
replayed.
Vulnerability: GHSA-h43v-26r7-7j4c
Summary: Allocation of Resources Without Limits or Throttling in HashiCorp Nomad
Aliases: CVE-2020-7218
Severity: HIGH
CWE: CWE-400, CWE-770
Published: 2021-05-18T18:20:19Z

HashiCorp Nomad and Nomad Enterprise before 0.10.3 allow unbounded resource usage.
Vulnerability: GHSA-25gf-8qrr-g78r
Summary: Missing SSL Certificate Validation in Hashicorp Consul
Aliases: CVE-2021-32574
Severity: HIGH
CWE: CWE-295
Published: 2021-07-19T21:21:03Z

HashiCorp Consul before 1.10.1 (and Consul Enterprise) has Missing SSL Certificate Validation. xds does not ensure that the Subject Alternative Name of an upstream is validated.
Vulnerability: GHSA-q3j5-32m5-58c2
Summary: Privilege Elevation in runc
Aliases: CVE-2016-3697
Severity: HIGH
Published: 2021-12-20T18:21:34Z

libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container.
Vulnerability: GHSA-h3p9-wrgx-82cm
Summary: Use of a Broken or Risky Cryptographic Algorithm in Terraform
Aliases: CVE-2019-19316
Severity: HIGH
CWE: CWE-327, CWE-20
Published: 2021-05-18T18:18:50Z

When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP.
Vulnerability: GO-2020-0008
Aliases: CVE-2019-19794
Published: 2021-04-14T12:00:00Z

DNS message transaction IDs are generated using [`math/rand`] which
makes them relatively predictable. This reduces the complexity
of response spoofing attacks against DNS clients.
Vulnerability: GHSA-6qfg-8799-r575
Summary: Symlink Attack
Aliases: CVE-2019-11251
Severity: MODERATE
CWE: CWE-59, CWE-61
Published: 2021-05-18T15:30:07Z

The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.
Vulnerability: GO-2021-0106
Published: 2021-07-28T12:00:00Z

Due to improper path santization, archives containing relative file
paths can cause files to be written (or overwritten) outside of the
target directory.
Vulnerability: GHSA-rrfw-hg9m-j47h
Summary: Signature Validation Bypass
Severity: CRITICAL
CWE: CWE-347
Published: 2021-05-24T16:59:42Z

### Impact

An authentication bypass exists in the [goxmldsig](https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7) this library uses to determine if SAML assertions are genuine. An attacker could craft a SAML response that would appear to be valid but would not have been genuinely issued by the IDP.

### Patches

Version 0.4.2 bumps the dependency which should fix the issue.

### For more information

Please see [the advisory in goxmldsig](https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7)

## Credits

The original vulnerability was discovered by @jupenur. Thanks to @russellhaering for the heads up.
Vulnerability: GSD-2022-1000127
Summary: net: fix information leakage in /proc/net/ptype
Published: 2022-02-18T21:44:08.303868Z

net: fix information leakage in /proc/net/ptype

This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven.
This ID is fixed in Linux Kernel version v4.19.228 by commit b67ad6170c0ea87391bb253f35d1f78857736e54, it was introduced in version v2.6.26 by commit 2feb27dbe00cbb4f7d31f90acf6bd0d751dd0a50. For more details please see the references link.
Vulnerability: GSD-2022-1000577
Summary: mm/kmemleak: avoid scanning potential huge holes
Published: 2022-02-27T03:25:56.627026Z

mm/kmemleak: avoid scanning potential huge holes

This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven.
This ID is fixed in Linux Kernel version v5.15.22 by commit a5389c80992f0001ee505838fe6a8b20897ce96e. For more details please see the references link.
Vulnerability: GSD-2022-1001736
Summary: ath11k: fix kernel panic during unload/load ath11k modules
Published: 2022-04-24T21:38:22.995962Z

ath11k: fix kernel panic during unload/load ath11k modules

This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven.
This ID is fixed in Linux Kernel version v5.15.34 by commit c4b7653af62a9a5efe2856183d1f987c5429758b. For more details please see the references link.
Vulnerability: GSD-2022-1000824
Summary: xen/xenbus: don't let xenbus_grant_ring() remove grants in error case
Published: 2022-03-18T00:21:34.736307Z

xen/xenbus: don't let xenbus_grant_ring() remove grants in error case

This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven.
This ID is fixed in Linux Kernel version v5.10.105 by commit 5c600371b8fd02cbbb0eb83a9f664e3f0b75c28e. For more details please see the references link.
Vulnerability: GSD-2021-1002266
Summary: ALSA: gus: fix null pointer dereference on pointer block
Published: 2021-11-29T02:36:06.886894Z

ALSA: gus: fix null pointer dereference on pointer block

This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven.
This ID is fixed in Linux Kernel version v5.4.162 by commit c6d2cefdd05c4810c416fb8d384b5c377bd977bc. For more details please see the references link.
Vulnerability: GSD-2022-1001366
Summary: net: sfc: add missing xdp queue reinitialization
Published: 2022-04-24T21:08:21.160842Z

net: sfc: add missing xdp queue reinitialization

This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven.
This ID is fixed in Linux Kernel version v5.16.20 by commit b8c46bc358d84701e7f7ffa054037db25f25da0e, it was introduced in version v5.5 by commit 3990a8fffbdad5765f47ea593f9de66c91762059. For more details please see the references link.
Vulnerability: GSD-2021-1002636
Summary: net/packet: rx_owner_map depends on pg_vec
Published: 2021-12-27T05:28:20.479872Z

net/packet: rx_owner_map depends on pg_vec

This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven.
This ID is fixed in Linux Kernel version v4.14.259 by commit a829ff7c8ec494eca028824628a964cde543dc76, it was introduced in version v4.14.175 by commit 2975472e042e0bbfeeabddc5023cb8c011ec5a07. For more details please see the references link.