TQRG/raw-osv-data huggingface dataset:
Vulnerability: GO-2021-0054
Aliases: CVE-2020-36067
Published: 2021-04-14T12:00:00Z

Due to improper bounds checking, maliciously crafted JSON objects
can cause an out-of-bounds panic. If parsing user input, this may
be used as a denial of service vector.
Vulnerability: GO-2021-0111
Aliases: CVE-2021-20329
Published: 2021-07-28T12:00:00Z

Due to improper input sanitization when marshalling Go objects into BSON, a maliciously constructed
Go structure could allow an attacker to inject additional fields into a MongoDB document. Users are
affected if they use this package to handle untrusted user input.
Vulnerability: GHSA-66vw-v2x9-hw75
Summary: Podman publishes a malicious image to public registries
Aliases: CVE-2022-1227
Severity: HIGH
Published: 2022-04-30T00:00:35Z

Podman is a tool for managing OCI containers and pods. A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.
Vulnerability: GHSA-wqwf-x5cj-rg56
Summary: Arbitrary Command Injection
Aliases: CVE-2018-1002101
Severity: MODERATE
CWE: CWE-78
Published: 2022-02-15T01:57:18Z

In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Windows nodes, which could lead to command line argument injection.
Vulnerability: GHSA-6w87-g839-9wv7
Summary: Helm OCI credentials leaked into Argo CD logs
Severity: MODERATE
CWE: CWE-532
Published: 2021-05-21T14:31:28Z

### Impact

When Argo CD was connected to a Helm OCI repository with authentication enabled, the credentials used for accessing the remote repository were logged.

Anyone with access to the pod logs - either via access with appropriate permissions to the Kubernetes control plane or a third party log management system where the logs from Argo CD were aggregated - could have potentially obtained the credentials to the Helm OCI repository.

If you are using Helm OCI repositories with Argo CD, it is strongly recommended to upgrade Argo CD to the latest patch version and to change the credentials used to access the repositories.

### Patches

A patch for this vulnerability is available with the v1.8.7 and v1.7.14 releases of Argo CD.

### Workarounds

No workaround available

### References

N/A

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)
* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel `#argo-cd`

### Credits

This vulnerability was found and reported by a third-party who wishes to stay anonymous. We want to thank this third-party for disclosing this vulnerability to us in a responsible manner.
Vulnerability: GHSA-x5f3-qmwj-4f84
Summary: Authentication bypass by capture-replay in github.com/cosmos/ethermint
Aliases: CVE-2021-25835
Severity: HIGH
CWE: CWE-294, CWE-295
Published: 2022-02-15T01:57:18Z

Cosmos Network Ethermint <= v0.4.0 is affected by a cross-chain transaction replay vulnerability in the EVM module. Since ethermint uses the same chainIDEpoch and signature schemes with ethereum for compatibility, a verified signature in ethereum is still valid in ethermint with the same msg content and chainIDEpoch, which enables "cross-chain transaction replay" attack.
Vulnerability: GHSA-9hx4-qm7h-x84j
Summary: Cross-site Scripting in Gogs
Aliases: CVE-2014-8683
Severity: MODERATE
CWE: CWE-79
Published: 2021-06-29T18:32:53Z

Cross-site scripting (XSS) vulnerability in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script or HTML via the text parameter to api/v1/markdown.
Vulnerability: GO-2020-0048
Aliases: CVE-2020-25614
Published: 2021-04-14T12:00:00Z

[`LoadURL`] does not check the Content-Type of loaded resources,
which can cause a panic due to nil pointer deference if the loaded
resource is not XML. If user supplied URLs are loaded, this may be
used as a denial of service vector.
Vulnerability: GO-2021-0097
Aliases: CVE-2020-29242
Published: 2021-04-14T12:00:00Z

Due to improper bounds checking a number of methods can trigger a panic due to attempted
out-of-bounds reads. If the package is used to parse user supplied input this may be
used as a vector for a denial of service attack.
Vulnerability: GHSA-2rmp-fw5r-j5qv
Summary: Improper Authentication in InfluxDB
Aliases: CVE-2019-20933
Severity: CRITICAL
CWE: CWE-287
Published: 2021-05-18T18:22:05Z

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).
Vulnerability: GHSA-m45g-f45x-vv22
Summary: Improper input validation in CNCF Cortex
Aliases: CVE-2021-31232
Severity: MODERATE
CWE: CWE-20
Published: 2021-06-23T17:20:38Z

The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack vector to send any file content because the alertmanager can load any text file specified in the templates list.
Vulnerability: GO-2021-0078
Aliases: CVE-2018-17075
Published: 2021-04-14T12:00:00Z

The HTML parser does not properly handle "in frameset" insertion mode, and can be made
to panic when operating on malformed HTML that contains <template> tags. If operating
on user input, this may be a vector for a denial of service attack.
Vulnerability: GHSA-qvp4-rpmr-xwrr
Summary: Possible bypass of token claim validation when OAuth2 Introspection caching is enabled
Severity: HIGH
CWE: CWE-863
Published: 2021-06-23T18:00:20Z

### Impact

When you make a request to an endpoint that requires the scope `foo` using an access token granted with that `foo` scope, introspection will be valid and that token will be cached. The problem comes when a second requests to an endpoint that requires the scope `bar` is made before the cache has expired. Whether the token is granted or not to the `bar` scope, introspection will be valid.

### Patches

A patch will be released with `v0.38.12-beta.1`.

### Workarounds

Per default, caching is disabled for the `oauth2_introspection` authenticator. When caching is disabled, this vulnerability does not exist.

### Trace

The cache is checked in [`func (a *AuthenticatorOAuth2Introspection) Authenticate(...)`](https://github.com/ory/oathkeeper/blob/6a31df1c3779425e05db1c2a381166b087cb29a4/pipeline/authn/authenticator_oauth2_introspection.go#L152). From [`tokenFromCache()`](https://github.com/ory/oathkeeper/blob/6a31df1c3779425e05db1c2a381166b087cb29a4/pipeline/authn/authenticator_oauth2_introspection.go#L97) it seems that it only validates the token expiration date, but ignores whether the token has or not the proper scopes.

### Post-Mortem

The vulnerability was introduced in PR #424. During review, we failed to require appropriate test coverage by the submitter which is the primary reason that the vulnerability passed the review process.

To avoid this from happening again we enabled codecov with a strict policy on the Ory Oathkeeper repository: Without an increase in code coverage the PR can not be merged.

To address this issue and any regressions we have added a test suite ensuring that the cache behaviour is correct in the different scenarios:

- Scope strategy is `none`, cache is enabled, and `requested_scope` is not empty -> cache will not be used;
- Scope strategy is `none`, cache is enabled, and `requested_scope` is empty -> cache will be used;
- Scope strategy is not `none`, cache is enabled, and `requested_scope` is not empty -> cache will be used;

as well as validating if `iss`, `aud`, `exp`, `token_use`, and scope are validated.

Additionally, we added [CodeQL scanning](https://github.com/ory/oathkeeper/commit/64ac7562669287d391cd72dfd43c5d71ff9f89a1) to the CI.
Vulnerability: GO-2020-0033
Published: 2021-04-14T12:00:00Z

Due to improper santization of user input, HTTPEngine.Handle allows
for directory traversal, allowing an attacker to read files outside of
the target directory that the server has permission to read.
Vulnerability: GHSA-qv95-g3gm-x542
Summary: Privilege Escalation in Hashicorp Vault
Aliases: CVE-2021-41802
Severity: MODERATE
CWE: CWE-732, CWE-269
Published: 2021-10-12T16:39:01Z

HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4.
Vulnerability: GHSA-2p6r-37p9-89p2
Summary: Authz Module Non-Determinism
Aliases: CVE-2021-41135
Severity: MODERATE
CWE: CWE-754
Published: 2021-10-21T17:46:57Z

### Impact

Consensus failure for 0.43.x and 0.44.{0,1} users. 
Funds and balances are safe.

### Patches

0.44.2

### Workarounds

Manually patch the code.

---

Full details posted in https://forum.cosmos.network/t/cosmos-sdk-vulnerability-retrospective-security-advisory-jackfruit-october-12-2021/5349.
Vulnerability: GHSA-64rh-r86q-75ff
Summary: Hard coded cryptographic key in Kiali
Aliases: CVE-2020-1764
Severity: HIGH
CWE: CWE-321, CWE-798
Published: 2021-05-18T18:28:59Z

A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alter the Istio configuration.
Vulnerability: GHSA-9h4h-8w5p-f28w
Summary: Denial of Service in geth
Aliases: CVE-2018-19184
Severity: HIGH
CWE: CWE-476
Published: 2021-06-29T21:23:15Z

cmd/evm/runner.go in Go Ethereum (aka geth) allows attackers to cause a denial of service (SEGV) via crafted bytecode.
Vulnerability: GHSA-h563-xh25-x54q
Summary: Workflow re-write vulnerability using input parameter
Aliases: CVE-2021-37914
Severity: MODERATE
CWE: CWE-20
Published: 2021-08-09T20:37:50Z

### Impact

* Allow end-users to set input parameters, but otherwise expect workflows to be secure.

### Patches

Not yet.

### Workarounds

* Set `EXPRESSION_TEMPLATES=false` for the workflow controller


### References

* https://github.com/argoproj/argo-workflows/issues/6441

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [example link to repo](http://example.com)
* Email us at [example email address](mailto:example@example.com)
Vulnerability: GHSA-6hv3-7c34-4hx8
Summary: Information Exposure Through Environmental Variables
Aliases: CVE-2019-14802
Severity: HIGH
CWE: CWE-526
Published: 2022-02-15T01:57:18Z

In Nomad before version 0.9.5, when rendering a task template, all environment variables were available to the rendering task.  As a fix, only task environment variables are used.
Vulnerability: GHSA-xg2h-wx96-xgxr
Summary: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be
Severity: LOW
Published: 2021-05-21T16:26:06Z

### Impact

A security-sensitive bug was discovered by Open Source Developer *Erik Sundell of Sundell Open Source Consulting AB*.

The functions `RandomAlphaNumeric(int)` and `CryptoRandomAlphaNumeric(int)` are not as random as they should be. Small values of `int` in the functions above will return a smaller subset of results than they should. For example, `RandomAlphaNumeric(1)` will always return a digit in the 0-9 range, while `RandomAlphaNumeric(4)` will return around ~7 million of the ~13M possible permutations.

This is considered a security release because programs that rely upon random generators for passwords are at an increased risk of brute force-style password guessing. There is also a higher probability of collision.

The problem was the result of a mistaken regular expression that only accepted random strings if they contained a digit from `[0-9]`. That restriction has been removed.

### Patches

This issue has been corrected in v1.0.2.

### Workarounds

If you cannot upgrade to v1.0.2, you can work around the issue by calling `RandomAlphaNumericCustom(N, true, true)`|`CryptoRandomAlphaNumericCustom(N, true, true)`  instead. (Where `N` is the desired length, and `true` is the literal boolean `true`.)
Vulnerability: GHSA-36xw-fx78-c5r4
Summary: containerd-shim API Exposed to Host Network Containers
Aliases: CVE-2020-15257
Severity: MODERATE
CWE: CWE-669
Published: 2021-05-24T17:00:22Z

## Impact

Access controls for the shim’s API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges.

## Patches

This vulnerability has been fixed in containerd 1.3.9 and 1.4.3.  Users should update to these versions as soon as they are released.  It should be noted that containers started with an old version of containerd-shim should be stopped and restarted, as running containers will continue to be vulnerable even after an upgrade.

## Workarounds

If you are not providing the ability for untrusted users to start containers in the same network namespace as the shim (typically the "host" network namespace, for example with `docker run --net=host` or `hostNetwork: true` in a Kubernetes pod) and run with an effective UID of 0, you are not vulnerable to this issue.

If you are running containers with a vulnerable configuration, you can deny access to all abstract sockets with AppArmor by adding a line similar to `deny unix addr=@**,` to your policy.

It is best practice to run containers with a reduced set of privileges, with a non-zero UID, and with isolated namespaces.  The containerd maintainers strongly advise against sharing namespaces with the host. Reducing the set of isolation mechanisms used for a container necessarily increases that container's privilege, regardless of what container runtime is used for running that container.

## Credits

The containerd maintainers would like to thank Jeff Dileo of NCC Group for responsibly disclosing this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/master/SECURITY.md) and for reviewing the patch.

## For more information

If you have any questions or comments about this advisory:


* [Open an issue](https://github.com/containerd/containerd/issues/new/choose)
* Email us at security@containerd.io if you think you’ve found a security bug.
Vulnerability: GHSA-m6wg-2mwg-4rfq
Summary: Use After Free
Aliases: CVE-2020-8945
Severity: HIGH
CWE: CWE-416
Published: 2021-05-18T15:29:42Z

The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.
Vulnerability: GHSA-9c4x-5hgq-q3wh
Summary: Instance config inline secret exposure in Grafana
Aliases: CVE-2021-41090
Severity: MODERATE
CWE: CWE-312, CWE-200
Published: 2021-12-08T19:52:40Z

### Impact
Some inline secrets are exposed in plaintext over the Grafana Agent HTTP server:

* Inline secrets for metrics instance configs in the base YAML file are exposed at `/-/config` 
* Inline secrets for integrations are exposed at `/-/config`
* Inline secrets for Consul ACL tokens and ETCD basic auth when configured for the scraping service at `/-/config`.
* Inline secrets for the Kafka receiver for OpenTelemetry-Collector tracing at `/-/config`.
* Inline secrets for metrics instance configs loaded from the scraping service are exposed at `/agent/api/v1/configs/{name}`.

Inline secrets will be exposed to anyone being able to reach these endpoints.

Secrets found in these sections are used for:

* Delivering metrics to a Prometheus Remote Write system 
* Authenticating against a system for discovering Prometheus targets 
* Authenticating against a system for collecting metrics (scrape_configs and integrations)
* Authenticating against a Consul or ETCD for storing configurations to distribute in scraping service mode 
* Authenticating against Kafka for receiving traces

Non-inlined secrets, such as `*_file`-based secrets, are not impacted by this vulnerability. 

### Patches

Download [v0.20.1](https://github.com/grafana/agent/releases/tag/v0.20.1) or any version past [v0.21.2](https://github.com/grafana/agent/releases/tag/v0.21.2) to patch Grafana Agent. These patches obfuscate the listed impacted secrets from the vulnerable endpoints.

The patches also disable the endpoints by default. Pass the command-line flag `--config.enable-read-api` to opt-in and re-enable the endpoints.  
 
### Workarounds
If for some reason you cannot upgrade, use non-inline secrets where possible. Not all configuration options may have a non-inline equivalent.

You also may desire to restrict API access to Grafana Agent, with some combination of:

* Restrict network interfaces Grafana Agent listens on through `http_listen_address` in the `server` block. `127.0.0.1` is the most restrictive, `0.0.0.0` is the default. 
* Configure Grafana Agent to use HTTPS with client authentication. 
* Use firewall rules to restrict external access to Grafana Agent's API.
Vulnerability: GHSA-7mqr-2v3q-v2wm
Summary: Ignored errors on token revokation in github.com/ory/fosite
Aliases: CVE-2020-15223
Severity: HIGH
CWE: CWE-755
Published: 2021-05-24T16:57:39Z

### Impact
The `TokenRevocationHandler` ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful revocation while the token is still valid. Whether an attacker can use this for her advantage depends on the ability to trigger errors in the store.

### References
[RFC 7009](https://tools.ietf.org/html/rfc7009#section-2.2.1) states that a 503 HTTP code must be returned when the server has a problem.
Vulnerability: GO-2021-0081
Aliases: CVE-2019-10214
Published: 2021-04-14T12:00:00Z

The HTTP client used to connect to the container registry authorization
service explicitly disables TLS verification, allowing an attacker that
is able to MITM the connection to steal credentials.
Vulnerability: GHSA-wpfr-6297-9v57
Summary: User object created with invalid provider data in GoTrue
Severity: MODERATE
Published: 2022-02-09T22:29:01Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

Under certain circumstances a valid user object would have been created with invalid provider metadata.

This vulnerability affects everyone running an instance of GoTrue as a service. We advise you to update especially if you are using the provider metadata from the user object to secure other resources.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

A patch is available with the release of version [1.0.1 on Github](https://github.com/netlify/gotrue/releases/tag/v1.0.1).

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

If you don't rely on the provider metadata in the user object, you might not be affected. We still strongly recommend upgrading.

### References
_Are there any links users can visit to find out more?_

This problem was initially found and reported by the team at Supabase: https://github.com/supabase/gotrue/security/advisories/GHSA-5hvv-9cqv-894r. We want to thank them for the cooperation around this report.

In contrast to their advisory, we decided to set the severity to "Moderate" since the provider metadata is not an inherent security feature of this GoTrue codebase or the Netlify ecosystem.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@netlify.com](mailto:security@netlify.com)
Vulnerability: GHSA-32rp-q37p-jg6w
Summary: Insecure plugin handling in Mattermost
Aliases: CVE-2022-1384
Severity: HIGH
CWE: CWE-862
Published: 2022-04-20T00:00:30Z

Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated and an authorized user to install and exploit an old plugin version from the Marketplace which might have known vulnerabilities.
Vulnerability: GO-2020-0025
Published: 2021-04-14T12:00:00Z

Due to improper path santization, archives containing relative file
paths can cause files to be written (or overwritten) outside of the
target directory.
Vulnerability: GHSA-wxc4-f4m6-wwqv
Summary: Excessive Platform Resource Consumption within a Loop in Kubernetes
Aliases: CVE-2019-11254
Severity: MODERATE
CWE: CWE-1050
Published: 2021-12-20T16:55:06Z

The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.
Vulnerability: GHSA-jq42-hfch-42f3
Summary: Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint
Severity: MODERATE
CWE: CWE-20
Published: 2021-06-01T21:20:53Z

# Impact
Due to incorrect use of a default URL, `singularity` action commands (`run`/`shell`/`exec`) specifying a container using a `library://` URI will always attempt to retrieve the container from the default remote endpoint (`cloud.sylabs.io`) rather than the configured remote endpoint.

An attacker may be able to push a malicious container to the default remote endpoint with a URI that is identical to the URI used by a victim with a non-default remote endpoint, thus executing the malicious container.

Only action commands (`run`/`shell`/`exec`) against `library://` URIs are affected. Other commands such as `pull` / `push` respect the configured remote endpoint.

# Patches
All users should upgrade to Singularity 3.7.4 or later.

# Workarounds
Users who only interact with the default remote endpoint or do not use the library:// url are not affected.

Installations with an execution control list configured to restrict execution to containers signed with specific secure keys are not affected.

# Acknowledgements
This issue was found by Mike Frisch and brought to our attention by Sylabs.  Sylabs is making a [coordinated disclosure](https://github.com/sylabs/singularity/security/advisories/GHSA-5mv9-q7fq-9394).

# For more information
General questions about the impact of the advisory can be asked in the:

[Singularity Slack Channel](https://join.slack.com/t/hpcng/shared_invite/zt-qda4h1ls-OP0Uouq6sSmVE6i_0NrWdw)
[Singularity Mailing List](https://groups.google.com/a/lbl.gov/g/singularity)
Any sensitive security concerns should be directed to: [singularity-security@hpcng.org](mailto:singularity-security@hpcng.org)
Vulnerability: GHSA-9q3g-m353-cp4p
Summary: Denial of Service in Packetbeat
Aliases: CVE-2017-11480
Severity: HIGH
CWE: CWE-404
Published: 2022-02-15T01:57:18Z

Packetbeat versions prior to 5.6.4 are affected by a denial of service flaw in the PostgreSQL protocol handler. If Packetbeat is listening for PostgreSQL traffic and a user is able to send arbitrary network traffic to the monitored port, the attacker could prevent Packetbeat from properly logging other PostgreSQL traffic.
Vulnerability: GHSA-gv9j-4w24-q7vx
Summary: Improper random number generation in github.com/coredns/coredns
Severity: MODERATE
CWE: CWE-330
Published: 2022-03-01T21:03:11Z

### Impact

CoreDNS before 1.6.6 (using go DNS package < 1.1.25) improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.

### Patches
The problem has been fixed in 1.6.6+.

### References
- [CVE-2019-19794](https://nvd.nist.gov/vuln/detail/CVE-2019-19794)

### For more information
Please consult [our security guide](https://github.com/coredns/coredns/blob/master/.github/SECURITY.md) for more information regarding our security process.
Vulnerability: GHSA-76j4-gggq-7rg9
Summary: SQLinjection in falcon-plus
Aliases: CVE-2022-26245
Severity: CRITICAL
CWE: CWE-89
Published: 2022-03-28T00:00:20Z

Falcon-plus v0.3 was discovered to contain a SQL injection vulnerability via the parameter grpName in /config/service/host.go.
Vulnerability: GO-2020-0005
Aliases: CVE-2020-15106
Published: 2021-04-14T12:00:00Z

Malformed WALs can be constructed such that [`WAL.ReadAll`][] can cause attempted
out of bounds reads, or creation of arbitarily sized slices, which may be used as
a DoS vector.
Vulnerability: GHSA-jcxc-rh6w-wf49
Summary: Link Following in Iris
Aliases: CVE-2021-23772
Severity: HIGH
CWE: CWE-59
Published: 2022-01-06T21:36:19Z

This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder.
Vulnerability: GHSA-hv5f-73mr-7vvj
Summary: Cross-site Scripting in Mattermost
Aliases: CVE-2021-37860
Severity: MODERATE
CWE: CWE-79
Published: 2021-09-23T23:11:06Z

Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP.
Vulnerability: GHSA-fp52-qw33-mfmw
Summary: Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault
Aliases: CVE-2020-16250
Severity: CRITICAL
CWE: CWE-345, CWE-290
Published: 2021-08-02T17:11:41Z

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..
Vulnerability: GHSA-57v4-m9jx-mh8r
Summary: Improper Input Validation
Aliases: CVE-2021-3499
Severity: MODERATE
CWE: CWE-863
Published: 2021-06-08T23:05:19Z

A vulnerability was found in OVN Kubernetes in versions up to and including 0.3.0 where the Egress Firewall does not reliably apply firewall rules when there is multiple DNS rules. It could lead to potentially lose of confidentiality, integrity or availability of a service.
Vulnerability: GHSA-7v5r-r995-q2x2
Summary: SSRF in repository migration
Aliases: CVE-2022-0870
Severity: MODERATE
CWE: CWE-918
Published: 2022-03-12T00:00:34Z

Gogs is a self-hosted Git service. The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected. Internal network CIDRs are prohibited to be used as repository migration targets. Users should upgrade to 0.12.5 or the latest 0.13.0+dev. Gogs should be ran in its own private network until users can update.
Vulnerability: GO-2020-0013
Aliases: CVE-2017-3204
Published: 2021-04-14T12:00:00Z

By default host key verification is disabled which allows for
man-in-the-middle attacks against SSH clients if
[`ClientConfig.HostKeyCallback`] is not set.
Vulnerability: GHSA-jq7p-26h5-w78r
Summary: Out-of-bounds read in Apache Thrift
Aliases: CVE-2019-0210
Severity: HIGH
CWE: CWE-125
Published: 2021-05-18T15:32:04Z

In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data.
Vulnerability: GHSA-6hw5-6gcx-phmw
Summary: HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic.
Aliases: CVE-2021-38698
Severity: MODERATE
CWE: CWE-863
Published: 2021-09-08T20:14:56Z

HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2.
Vulnerability: GO-2021-0058
Aliases: CVE-2020-27846
Published: 2021-04-14T12:00:00Z

Due to the behavior of encoding/xml, a crafted XML document may cause
XML Digital Signature validation to be entirely bypassed, causing an
unsigned document to appear signed.
Vulnerability: GHSA-xg75-q3q5-cqmv
Summary: Denial of Service in http-swagger
Aliases: CVE-2022-24863
Severity: HIGH
CWE: CWE-400, CWE-755
Published: 2022-04-22T20:55:52Z

### Impact
Allows an attacker to perform a DOS attack consisting of memory exhaustion on the host system.

### Patches
Yes. Please upgrade to v1.2.6.

### Workarounds
A workaround is to restrict the path prefix to the "GET" method. As shown below
```
func main() {
	r := mux.NewRouter()

	r.PathPrefix("/swagger/").Handler(httpSwagger.Handler(
		httpSwagger.URL("http://localhost:1323/swagger/doc.json"), //The url pointing to API definition
		httpSwagger.DeepLinking(true),
		httpSwagger.DocExpansion("none"),
		httpSwagger.DomID("#swagger-ui"),
	)).Methods(http.MethodGet)
```

### References
Reporter dongguangli from https://www.huoxian.cn/ company

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [http-swagger](https://github.com/swaggo/http-swagger/issues)
Vulnerability: GHSA-jp4j-47f9-2vc3
Summary: Integer Overflow or Wraparound in NATS Server
Aliases: CVE-2019-13126
Severity: HIGH
CWE: CWE-190
Published: 2021-05-18T18:14:55Z

An integer overflow in NATS Server 2.0.0 allows a remote attacker to crash the server by sending a crafted request.
Vulnerability: GHSA-f5fj-7265-jxhj
Summary: Information Exposure
Aliases: CVE-2018-1000803
Severity: MODERATE
CWE: CWE-200
Published: 2022-02-15T01:57:18Z

Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email set as private. This vulnerability appears to have been fixed in 1.5.1.
Vulnerability: GHSA-vx57-7f4q-fpc7
Summary: Arbitrary redirects under /new endpoint
Aliases: CVE-2021-29622
Severity: MODERATE
CWE: CWE-601
Published: 2022-02-15T01:57:18Z

### Impact

In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /.
Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint.

If a user visits a prometheus server with a specially crafted address (e.g.: `http://127.0.0.1:9090/new/new<url>`), they can be redirected to an arbitrary URL.

e.g. if a user visits http://127.0.0.1:9090/new/newhttp://www.google.com/, they will be redirected to http://google.com.

### Patches

The issue will be patched in 2.26.1 and 2.27.1 releases.
In 2.28.0, the /new endpoint will be removed completely.

### Workarounds

The workaround is to disable access to /new via a reverse proxy in front of Prometheus.

Note: Users who use a `--web.external-url=` flag _with a path_ (e.g.  `--web.external-url=http://example.com/prometheus`) are not affected.

### For more information

If you have any questions or comments about this advisory, please use our community channels (https://prometheus.io/community).
Our security policy is available at https://prometheus.io/docs/operating/security/
Vulnerability: GHSA-8cvr-4rrf-f244
Summary: Infinite open connection causes OctoRPKI to hang forever
Aliases: CVE-2021-3909
Severity: MODERATE
CWE: CWE-400
Published: 2021-11-10T20:15:44Z

OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically, the repository that OctoRPKI sends HTTP requests to will keep the connection open for a day before a response is returned, but does keep drip feeding new bytes to keep the connection alive.

## Patches

## For more information
If you have any questions or comments about this advisory email us at security@cloudflare.com
Vulnerability: GHSA-362v-wg5p-64w2
Summary: Incorrect Privilege Assignment in HashiCorp Vault
Aliases: CVE-2021-42135
Severity: HIGH
CWE: CWE-863, CWE-266
Published: 2021-10-12T18:41:16Z

HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine. Users may, in some situations, have more privileges than intended, e.g., a user with read permission for the /gcp/roleset/* path may be able to issue Google Cloud service account credentials.
Vulnerability: GHSA-jj6m-r8jc-2gp7
Summary: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings 
Aliases: CVE-2021-32699
Severity: MODERATE
CWE: CWE-405
Published: 2021-06-23T18:03:18Z

### Impact
All versions of Pterodactyl Wings preior to `1.4.4` are vulnerable to system resource exhaustion due to improper container process limits being defined. A malicious user can consume more resources than intended and cause downstream impacts to other clients on the same hardware, eventually causing the physical server to stop responding.

### Patches
Users should upgrade to `1.4.4`.

### Workarounds
There is no non-code based workaround for impacted versions of the software. Users running customized versions of this software can manually set a PID limit for containers created.

### For more information
If you have any questions or comments about this advisory:
* Contact us on [Discord](https://discord.gg/pterodactyl)
* Email us at `dane ät pterodactyl dot io`
Vulnerability: GHSA-mr6h-chqp-p9g2
Summary: SQL Injection in gogs.io/gogs
Aliases: CVE-2014-8681
Severity: MODERATE
CWE: CWE-89
Published: 2021-06-29T18:32:44Z

SQL injection vulnerability in the GetIssues function in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.6.x before 0.5.6.1025 Beta allows remote attackers to execute arbitrary SQL commands via the label parameter to user/repos/issues.
Vulnerability: GHSA-x6jv-5vfg-gm7x
Summary: Path traversal in ServcieCenter
Aliases: CVE-2021-21501
Severity: HIGH
CWE: CWE-22
Published: 2021-09-01T18:35:52Z

Improper configuration will cause ServiceComb ServiceCenter Directory Traversal problem in ServcieCenter 1.x.x versions and fixed in 2.0.0.
Vulnerability: GHSA-4fqx-74rv-638w
Summary: SQL Injection
Aliases: CVE-2019-3792
Severity: HIGH
CWE: CWE-89
Published: 2022-02-15T01:57:18Z

Pivotal Concourse version 5.0.0, contains an API that is vulnerable to SQL injection. An Concourse resource can craft a version identifier that can carry a SQL injection payload to the Concourse server, allowing the attacker to read privileged data.
Vulnerability: GHSA-fx95-883v-4q4h
Summary: Path traversal in github.com/valyala/fasthttp
Aliases: CVE-2022-21221
Severity: HIGH
CWE: CWE-22
Published: 2022-03-18T00:01:11Z

The package github.com/valyala/fasthttp before 1.34.0 is vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. **Note:** This security issue impacts Windows users only.
Vulnerability: GHSA-xw37-57qp-9mm4
Summary: Consensus flaw during block processing in github.com/ethereum/go-ethereum
Aliases: CVE-2020-26265
Severity: MODERATE
CWE: CWE-682
Published: 2021-06-29T21:14:16Z

### Impact

A consensus-vulnerability in Geth could cause a chain split, where vulnerable versions refuse to accept the canonical chain. 

### Description


A flaw was repoted at 2020-08-11 by John Youngseok Yang (Software Platform Lab), where a particular sequence of transactions could cause a consensus failure.

- Tx 1:
  - `sender` invokes `caller`.
  - `caller` invokes `0xaa`. `0xaa` has 3 wei, does a self-destruct-to-self
  - `caller` does a  `1 wei` -call to `0xaa`, who thereby has 1 wei (the code in `0xaa` still executed, since the tx is still ongoing, but doesn't redo the selfdestruct, it takes a different path if callvalue is non-zero)

- Tx 2:
  - `sender` does a 5-wei call to 0xaa. No exec (since no code). 

In geth, the result would be that `0xaa` had `6 wei`, whereas OE reported (correctly) `5` wei. Furthermore, in geth, if the second tx was not executed, the `0xaa` would be destructed, resulting in `0 wei`. Thus obviously wrong. 

It was determined that the root cause was this [commit](https://github.com/ethereum/go-ethereum/commit/223b950944f494a5b4e0957fd9f92c48b09037ad) from [this PR](https://github.com/ethereum/go-ethereum/pull/19953). The semantics of `createObject` was subtly changd, into returning a non-nil object (with `deleted=true`) where it previously did not if the account had been destructed. This return value caused the new object to inherit the old `balance`:

```golang
func (s *StateDB) CreateAccount(addr common.Address) {
	newObj, prev := s.createObject(addr)
	if prev != nil {
		newObj.setBalance(prev.data.Balance)
	}
}
```

It was determined that the minimal possible correct fix was

```diff
+++ b/core/state/statedb.go
@@ -589,7 +589,10 @@ func (s *StateDB) createObject(addr common.Address) (newobj, prev *stateObject)
                s.journal.append(resetObjectChange{prev: prev, prevdestruct: prevdestruct})
        }
        s.setStateObject(newobj)
-       return newobj, prev
+       if prev != nil && !prev.deleted {
+               return newobj, prev
+       }
+       return newobj, nil
```

### Patches

See above. The fix was included in Geth `v1.9.20` "Paragade".

### Credits

The bug was found by @johnyangk and reported via bounty@ethereum.org.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)
* Email us at [security@ethereum.org](mailto:security@ethereum.org)
Vulnerability: GO-2020-0029
Published: 2021-04-14T12:00:00Z

Due to improper HTTP header santization, a malicious user can spoof their
source IP address by setting the X-Forwarded-For header. This may allow
a user to bypass IP based restrictions, or obfuscate their true source.
Vulnerability: GHSA-4cxw-hq44-r344
Summary: Off-by-one Error in v2fly/v2ray-core
Aliases: CVE-2021-4070
Severity: CRITICAL
CWE: CWE-193
Published: 2022-02-24T00:00:52Z

v2fly/v2ray-core prior to 4.44.0 is vulnerable to an off-by-one error. Indexing operations on arrays, slices, or strings should use an index at most one less than the length. If the index is checked for being less than or equal to the length (`<=`), instead of less than the length (`<`), the index could be out of bounds.
Vulnerability: GHSA-465w-gg5p-85c9
Summary: Insufficient Session Expiration in Kiali
Aliases: CVE-2020-1762
Severity: HIGH
CWE: CWE-613, CWE-384, CWE-295
Published: 2021-05-18T21:09:01Z

An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.
Vulnerability: GHSA-63qx-x74g-jcr7
Summary: Path traversal and dereference of symlinks in Argo CD
Aliases: CVE-2022-24348
Severity: HIGH
CWE: CWE-200, CWE-22
Published: 2022-02-07T19:06:18Z

### Impact

All versions of Argo CD are vulnerable to a path traversal bug that allows to pass arbitrary values files to be consumed by Helm charts. 

Additionally, it is possible to craft special Helm chart packages containing value files that are actually symbolic links, pointing to arbitrary files outside the repository's root directory.

If an attacker with permissions to create or update Applications knows or can guess the full path to a file containing valid YAML, they can create a malicious Helm chart to consume that YAML as values files, thereby gaining access to data they would otherwise have no access to. 

The impact can especially become critical in environments that make use of encrypted value files (e.g. using plugins with git-crypt or SOPS) containing sensitive or confidential data, and decrypt these secrets to disk before rendering the Helm chart.

Also, because any error message from `helm template` is passed back to the user, and these error messages are quite verbose, enumeration of files on the repository server's file system is possible.

### Patches

A patch for this vulnerability has been released in the following Argo CD versions:

* v2.3.0
* v2.2.4
* v2.1.9

We urge users of Argo CD to update their installation to one of the fixed versions as listed above.

### Workarounds

No workaround for this issue.

### References

* https://apiiro.com/blog/malicious-kubernetes-helm-charts-can-be-used-to-steal-sensitive-information-from-argo-cd-deployments
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24348

### For more information

* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)
* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel `#argo-cd`

### Credits

The path traversal vulnerability was discovered and reported by Moshe Zioni, VP Security Research, [Apiiro](https://www.apiiro.com). 

During the development of a fix for the path traversal vulnerability, the Argo CD team discovered the related issue with symbolic links.

The Argo CD team would like to thank Moshe Zioni for the responsible disclosure, and the constructive discussions during handling this issue!
Vulnerability: GHSA-c52f-pq47-2r9j
Summary: plugin.yaml file allows for duplicate entries in helm
Aliases: CVE-2020-15187
Severity: LOW
CWE: CWE-694, CWE-74
Published: 2021-05-24T16:57:21Z

### Impact

During a security audit of Helm's code base, Helm maintainers identified a bug in which a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs to modify a plugin's install hooks, causing a local execution attack.

To perform this attack, an attacker must have write access to the git repository or plugin archive (.tgz) while being downloaded (which can occur during a MITM attack on a non-SSL connection).

### Patches

This issue has been patched in Helm 2.16.11 and Helm 3.3.2.

### Workarounds

Make sure to install plugins using a secure connection protocol like SSL.
Vulnerability: GHSA-gfh2-7jg5-653p
Summary: Denial of Service in docker2aci
Aliases: CVE-2016-8579
Severity: MODERATE
CWE: CWE-835
Published: 2022-02-15T01:57:18Z

docker2aci <= 0.12.3 has an infinite loop when handling local images with cyclic dependency chain.
Vulnerability: GHSA-6239-28c2-9mrm
Summary: Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault
Aliases: CVE-2021-38554
Severity: MODERATE
CWE: CWE-212
Published: 2021-08-30T17:22:38Z

HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.
Vulnerability: GHSA-q9vw-wr57-xjv3
Summary: Information Exposure in Heketi
Aliases: CVE-2017-15104
Severity: HIGH
CWE: CWE-200, CWE-552
Published: 2022-02-15T01:57:18Z

An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable. An attacker having local access to the Heketi server could read plain-text passwords from the heketi.json file.
Vulnerability: GO-2021-0063
Aliases: CVE-2020-26264
Published: 2021-04-14T12:00:00Z

Due to a nil pointer dereference, a malicously crafted RPC message
can cause a panic. If handling RPC messages from untrusted clients,
this may be used as a denial of service vector.
Vulnerability: GHSA-5x92-p4p5-33c4
Summary: Path Traversal in HashiCorp Nomad
Aliases: CVE-2020-28348
Severity: MODERATE
CWE: CWE-22
Published: 2022-02-15T01:57:18Z

HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8.
Vulnerability: GO-2020-0028
Aliases: CVE-2018-17419
Published: 2021-04-14T12:00:00Z

Due to a nil pointer dereference, parsing a malformed zone file
containing TA records may cause a panic. If parsing user supplied
input, this may be used as a denial of service vector.
Vulnerability: GHSA-h395-qcrw-5vmq
Summary: Inconsistent Interpretation of HTTP Requests in github.com/gin-gonic/gin
Aliases: CVE-2020-28483
Severity: HIGH
CWE: CWE-113, CWE-444
Published: 2021-06-23T17:53:21Z

This affects all versions of package github.com/gin-gonic/gin under 1.7.0. When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header.
Vulnerability: GHSA-v592-xf75-856p
Summary: Erroneous Proof of Work calculation in geth
Aliases: CVE-2020-26240
Severity: MODERATE
CWE: CWE-682
Published: 2021-06-29T21:12:56Z

### Impact
An ethash mining DAG generation flaw in Geth could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected.

### Patches
This issue is also fixed as of 1.9.24. Thanks to @slavikus for bringing the issue to our attention and writing the fix. 

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)
* Email us at [security@ethereum.org](mailto:security@ethereum.org)
Vulnerability: GHSA-4cx6-fj7j-pjx9
Summary: Code injection in Stripe CLI on windows
Aliases: CVE-2022-24753
Severity: HIGH
CWE: CWE-78
Published: 2022-03-10T18:17:50Z

### Impact
A vulnerability in Stripe CLI exists on Windows when certain commands are run in a directory where an attacker has planted files. The commands are `stripe login`, `stripe config -e`, `stripe community`, and `stripe open`. MacOS and Linux are unaffected.

An attacker who successfully exploits the vulnerability can run arbitrary code in the context of the current user. The update addresses the vulnerability by throwing an error in these situations before the code can run.

There has been no evidence of exploitation of this vulnerability.

### Recommendation
Upgrade to Stripe CLI v1.7.13.

### Acknowledgments
Thanks to [trungpabc](https://hackerone.com/trungpabc) for reporting the issue.

### For more information
Email us at [security@stripe.com](mailto:security@stripe.com).
Vulnerability: GHSA-mh3m-8c74-74xh
Summary: Denial of Service in graphql-go
Aliases: CVE-2022-21708
Severity: MODERATE
CWE: CWE-400
Published: 2022-01-27T15:28:06Z

### Impact
This is a DoS vulnerability that is possible due to a bug in the library that would allow an attacker with specifically designed queries to cause stack overflow panics. Any user with access to the GraphQL handler can send these queries and cause stack overflows. This in turn could potentially compromise the ability of the server to serve data to its users. To make things worse the only mitigation in affected versions creates opportunities for other attacks. This issue is only available if you are using `graphql.MaxDepth` option in your schema (which is highly recommended in most cases).

### Patches
The issue has been patched in version `v1.3.0`. We have been trying to maintain backwards compatibility and avoid breaking changes so upgrading should not be problematic. 

### Workarounds
The best workaround is to patch to a version greater than or equal to `v1.3.0`. 
Otherwise, the only workaround in versions prior to `v1.3.0` is to disable the `graphql.MaxDepth` option from your schema. Unfortunately, this could potentially create opportunities for other attacks.

### References
There are no references or links. This issue was reported privately and was fixed before creating this Security Advisory.

### For more information
If you have any questions or comments feel free to reach out to @pavelnikolov or @tony on the Gopher Slack.