TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-m5ff-3wj3-8ph4
Summary: HTTP Request Smuggling: Invalid whitespace characters in headers in Waitress
Severity: HIGH
CWE: CWE-444
Published: 2019-12-26T16:34:38Z

### Impact

If a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling.

```
Content-Length: 10
Transfer-Encoding: [\x0b]chunked
```

For clarity:

```
0x0b == vertical tab
```

Would get parsed by Waitress as being a `chunked` request, but a front-end server would use the `Content-Length` instead as the `Transfer-Encoding` header is considered invalid due to containing invalid characters.

If a front-end server does HTTP pipelining to a backend Waitress server this could lead to HTTP request splitting which may lead to potential cache poisoning or unexpected information disclosure.

### Patches

Please upgrade to Waitress 1.4.1 which fixes this issue with stricter HTTP field validation.

Waitress 1.4.1 due to this change has become much more strict in what is allowed in header values, while the maintainers don't believe that these changes will cause any issues, it may cause failures with non-conformist reverse proxies or clients, and it is highly recommend that users validate the changes in their environment and make sure it won't cause any unacceptable failures.

### Workarounds

You may enable additional protections on front-end servers, those that follow RFC7230 correctly would drop the request with a 400 Bad Request.

Waitress will now correctly responds to the request with a 400 Bad Request, and will drop the connection to avoid any potential HTTP pipelining issues.

### References

This was mentioned in https://portswigger.net/research/http-desync-attacks-what-happened-next and was specifically mentioned as being an issue in HAProxy which did not properly filter it in this article: https://nathandavison.com/blog/haproxy-http-request-smuggling

### Thanks

The Pylons Project would like to thank ZeddYu Lu for doing extended testing against Waitress 1.4.0 and bringing this to our attention!

### For more information

If you have any questions or comments about this advisory:

* open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related)
* email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)
Vulnerability: PYSEC-2019-118
Aliases: CVE-2019-16328, GHSA-pj4g-4488-wmxm, GHSA-9ggp-4jpr-7ppj
Published: 2019-10-03T20:15:00Z

In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings.
Vulnerability: PYSEC-2020-45
Aliases: CVE-2020-29565
Published: 2020-12-04T08:15:00Z

An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.
Vulnerability: PYSEC-2022-78
Aliases: GHSA-qj5r-f9mv-rffh, CVE-2022-23569
Published: 2022-02-03T13:15:00Z

Tensorflow is an Open Source Machine Learning Framework. Multiple operations in TensorFlow can be used to trigger a denial of service via `CHECK`-fails (i.e., assertion failures). This is similar to TFSA-2021-198 and has similar fixes. We have patched the reported issues in multiple GitHub commits. It is possible that other similar instances exist in TensorFlow, we will issue fixes as these are discovered. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-332
Aliases: SNYK-PYTHON-SQLITEWEB-1316324, CVE-2021-23404, GHSA-2j58-pwwv-x666
Published: 2021-09-08T11:15:00Z

This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions unknowingly through a Cross Site Request Forgery (CSRF) attack.
Vulnerability: PYSEC-2021-762
Aliases: GHSA-hpv4-7p9c-mvfr, CVE-2021-37651
Published: 2021-08-12T21:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation for `tf.raw_ops.FractionalAvgPoolGrad` can be tricked into accessing data outside of bounds of heap allocated buffers. The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/fractional_avg_pool_op.cc#L205) does not validate that the input tensor is non-empty. Thus, code constructs an empty `EigenDoubleMatrixMap` and then accesses this buffer with indices that are outside of the empty area. We have patched the issue in GitHub commit 0f931751fb20f565c4e94aa6df58d54a003cdb30. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Vulnerability: GHSA-rgcm-rpq9-9cgr
Summary: Missing Authentication for Critical Function in Saleor
Aliases: CVE-2020-7964
Severity: MODERATE
CWE: CWE-306
Published: 2021-07-28T17:57:09Z

An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data (e.g., name, address, and previous orders of any other customer).
Vulnerability: PYSEC-2021-298
Aliases: CVE-2021-37676, GHSA-v768-w7m9-2vmm
Published: 2021-08-12T22:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.SparseFillEmptyRows`. The shape inference [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/ops/sparse_ops.cc#L608-L634) does not validate that the input arguments are not empty tensors. We have patched the issue in GitHub commit 578e634b4f1c1c684d4b4294f9e5281b2133b3ed. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2019-231
Aliases: CVE-2018-7576
Published: 2019-04-23T21:29:00Z

Google TensorFlow 1.6.x and earlier is affected by: Null Pointer Dereference. The type of exploitation is: context-dependent.
Vulnerability: PYSEC-2020-332
Aliases: GHSA-qhxx-j73r-qpm2, CVE-2020-26266
Published: 2020-12-10T23:15:00Z

In affected versions of TensorFlow under certain cases a saved model can trigger use of uninitialized values during code execution. This is caused by having tensor buffers be filled with the default value of the type but forgetting to default initialize the quantized floating point types in Eigen. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.
Vulnerability: PYSEC-2015-22
Aliases: CVE-2015-5963
Published: 2015-08-24T14:59:00Z

contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record.
Vulnerability: PYSEC-2020-298
Aliases: CVE-2020-26267, GHSA-c9f3-9wfr-wgh7
Published: 2020-12-10T23:15:00Z

In affected versions of TensorFlow the tf.raw_ops.DataFormatVecPermute API does not validate the src_format and dst_format attributes. The code assumes that these two arguments define a permutation of NHWC. This can result in uninitialized memory accesses, read outside of bounds and even crashes. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.
Vulnerability: PYSEC-2020-277
Aliases: CVE-2020-15197, GHSA-qc53-44cj-vfvx
Published: 2020-09-25T19:15:00Z

In Tensorflow before version 2.3.1, the `SparseCountSparseOutput` implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the `indices` tensor has rank 2. This tensor must be a matrix because code assumes its elements are accessed as elements of a matrix. However, malicious users can pass in tensors of different rank, resulting in a `CHECK` assertion failure and a crash. This can be used to cause denial of service in serving installations, if users are allowed to control the components of the input sparse tensor. The issue is patched in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and is released in TensorFlow version 2.3.1.
Vulnerability: GHSA-22gh-3r9q-xf38
Summary: Lacking Protection against HTTP Request Smuggling in mitmproxy
Aliases: CVE-2021-39214
Severity: HIGH
CWE: CWE-444
Published: 2021-09-20T19:53:30Z

### Impact

In mitmproxy 7.0.2 and below, a malicious client or server is able to perform [HTTP request smuggling](https://en.wikipedia.org/wiki/HTTP_request_smuggling) attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of another request/response's HTTP message body. While mitmproxy would only see one request, the target server would see multiple requests. A smuggled request is still captured as part of another request's body, but it does not appear in the request list and does not go through the usual mitmproxy event hooks, where users may have implemented custom access control checks or input sanitization.

Unless you use mitmproxy to protect an HTTP/1 service, no action is required.


### Patches

The vulnerability has been fixed in mitmproxy 7.0.3 and above.


### Acknowledgements

We thank João Sobral (@chinchila) for responsibly disclosing this vulnerability to the mitmproxy team.


### Timeline

- **2021-09-08**: Received initial report for mitmproxy <= 6.0.2.
- **2021-09-08**: Requested clarification if 7.x is affected.
- **2021-09-10**: Received additional details, 7.x situation still unclear.
- **2021-09-13**: Internally determined that 7.x is also affected.
- **2021-09-13**: Shared initial fix with researcher.
- **2021-09-14**: Received confirmation that fix is working, but H2.TE/H2.CL should also be looked at.
- **2021-09-14**: Shared revised fix that includes additional H2.TE mitigations.
- **2021-09-14**: Received confirmation that revised fix is working.
- **2021-09-16**: Completed internal patch review.
- **2021-09-16**: Published patch release and advisory.
Vulnerability: GHSA-xgxc-v2qg-chmh
Summary: Directory Traversal in Django
Aliases: CVE-2021-28658
Severity: MODERATE
CWE: CWE-22
Published: 2021-04-08T18:11:48Z

In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.
Vulnerability: PYSEC-2021-277
Aliases: GHSA-7fvx-3jfc-2cpc, CVE-2021-37655
Published: 2021-08-12T21:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a read from outside of bounds of heap allocated data by sending invalid arguments to `tf.raw_ops.ResourceScatterUpdate`. The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/resource_variable_ops.cc#L919-L923) has an incomplete validation of the relationship between the shapes of `indices` and `updates`: instead of checking that the shape of `indices` is a prefix of the shape of `updates` (so that broadcasting can happen), code only checks that the number of elements in these two tensors are in a divisibility relationship. We have patched the issue in GitHub commit 01cff3f986259d661103412a20745928c727326f. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-68
Aliases: CVE-2020-25340
Published: 2021-02-16T15:15:00Z

An issue was discovered in NFStream 5.2.0. Because some allocated modules are not correctly freed, if the nfstream object is directly destroyed without being used after it is created, it will cause a memory leak that may result in a local denial of service (DoS).
Vulnerability: PYSEC-2021-627
Aliases: CVE-2021-41218, GHSA-9crf-c6qr-r273
Published: 2021-11-05T22:15:00Z

TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `AllToAll` can be made to execute a division by 0. This occurs whenever the `split_count` argument is 0. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-109
Aliases: GHSA-xpfp-f569-q3p2, CVE-2021-35042
Published: 2021-07-02T10:15:00Z

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.
Vulnerability: GHSA-x4qx-4fjv-hmw6
Summary: Integer overflow leading to crash in Tensorflow
Aliases: CVE-2022-21738
Severity: MODERATE
CWE: CWE-190
Published: 2022-02-09T23:45:09Z

### Impact 
The [implementation of `SparseCountSparseOutput`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/count_ops.cc#L168-L273) can be made to crash a TensorFlow process by an integer overflow whose result is then used in a memory allocation:

```python
import tensorflow as tf
import numpy as np
    
tf.raw_ops.SparseCountSparseOutput(
  indices=[[1,1]],
  values=[2],
  dense_shape=[2 ** 31, 2 ** 32],
  weights=[1],
  binary_output=True,
  minlength=-1,
  maxlength=-1,
  name=None)
```

### Patches
We have patched the issue in GitHub commit [6f4d3e8139ec724dbbcb40505891c81dd1052c4a](https://github.com/tensorflow/tensorflow/commit/6f4d3e8139ec724dbbcb40505891c81dd1052c4a).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
Vulnerability: PYSEC-2021-559
Aliases: CVE-2021-37646, GHSA-h6jh-7gv5-28vg
Published: 2021-08-12T21:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.StringNGrams` is vulnerable to an integer overflow issue caused by converting a signed integer value to an unsigned one and then allocating memory based on this value. The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/string_ngrams_op.cc#L184) calls `reserve` on a `tstring` with a value that sometimes can be negative if user supplies negative `ngram_widths`. The `reserve` method calls `TF_TString_Reserve` which has an `unsigned long` argument for the size of the buffer. Hence, the implicit conversion transforms the negative value to a large integer. We have patched the issue in GitHub commit c283e542a3f422420cfdb332414543b62fc4e4a5. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Vulnerability: GHSA-99cv-8cvv-666c
Summary: High severity vulnerability that affects apache-airflow
Aliases: CVE-2018-20244
Severity: MODERATE
CWE: CWE-79
Published: 2019-03-06T17:35:58Z

In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.
Vulnerability: PYSEC-2014-58
Aliases: CVE-2013-4194
Published: 2014-03-11T19:37:00Z

The WYSIWYG component (wysiwyg.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers to obtain sensitive information via a crafted URL, which reveals the installation path in an error message.
Vulnerability: GHSA-g4rf-pc26-6hmr
Summary: OMERO webclient does not validate URL redirects on login or switching group.
Aliases: CVE-2021-21377
Severity: MODERATE
CWE: CWE-601
Published: 2021-03-23T15:26:49Z

### Background
OMERO.web supports redirection to a given URL after performing login or switching the group context. These URLs are not validated, allowing redirection to untrusted sites. OMERO.web 5.9.0 adds URL validation before redirecting. External URLs are not considered valid, unless specified in the ``omero.web.redirect_allowed_hosts`` setting.

### Impact
OMERO.web before 5.9.0

### Patches
5.9.0

### Workarounds
No workaround

### References

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [omero-web](https://github.com/ome/omero-web)
* Email us at [security](mailto:security@openmicroscopy.org.uk)
Vulnerability: PYSEC-2020-109
Aliases: CVE-2020-27348
Published: 2020-12-04T03:15:00Z

In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1.
Vulnerability: PYSEC-2018-94
Aliases: CVE-2018-14636
Published: 2018-09-10T19:29:00Z

Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. This brief window could be extended indefinitely if the instance's port is set administratively down prior to live-migration and kept down after the migration is complete. This is possible due to the Open vSwitch integration bridge being connected to the instance during migration. When connected to the integration bridge, all traffic for instances using the same Open vSwitch instance would potentially be visible to the migrated guest, as the required Open vSwitch VLAN filters are only applied post-migration. Versions of openstack-neutron before 13.0.0.0b2, 12.0.3, 11.0.5 are vulnerable.
Vulnerability: PYSEC-2020-12
Aliases: GHSA-vcg8-98q8-g7mj, CVE-2020-1740
Published: 2020-03-16T16:15:00Z

A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
Vulnerability: PYSEC-2022-100
Aliases: CVE-2022-23591, GHSA-247x-2f9f-5wp7
Published: 2022-02-04T23:15:00Z

Tensorflow is an Open Source Machine Learning Framework. The `GraphDef` format in TensorFlow does not allow self recursive functions. The runtime assumes that this invariant is satisfied. However, a `GraphDef` containing a fragment such as the following can be consumed when loading a `SavedModel`. This would result in a stack overflow during execution as resolving each `NodeDef` means resolving the function itself and its nodes. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Vulnerability: GHSA-74xw-82v7-hmrm
Summary: Improper Input Validation in python-dbusmock
Aliases: CVE-2015-1326
Severity: HIGH
CWE: CWE-20
Published: 2019-04-23T16:04:36Z

python-dbusmock before version 0.15.1 AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method could be tricked into executing malicious code if an attacker supplies a .pyc file.
Vulnerability: GHSA-33h2-69j3-r336
Summary: Out-of-bounds Read in OpenCV 
Aliases: CVE-2017-12598
Severity: HIGH
CWE: CWE-125
Published: 2021-10-12T22:00:51Z

OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python 3.3.0.9) has an out-of-bounds read error in the cv::RBaseStream::readBlock function in modules/imgcodecs/src/bitstrm.cpp when reading an image file by using cv::imread, as demonstrated by the 8-opencv-invalid-read-fread test case.
Vulnerability: GHSA-h2g5-2rhx-ffgj
Summary: Command injection in Weblate
Aliases: CVE-2022-24727
Severity: HIGH
CWE: CWE-77
Published: 2022-03-05T00:00:44Z

Weblate is a web based localization tool with tight version control integration. Prior to version 4.11.1, Weblate didn't properly sanitize some arguments passed to Git and Mercurial, allowing them to change their behavior in an unintended way. Instances where untrusted users cannot create new components are not affected. The issues were fixed in the 4.11.1 release.
Vulnerability: PYSEC-2017-48
Aliases: CVE-2017-5992
Published: 2017-02-15T19:59:00Z

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document.
Vulnerability: PYSEC-2021-735
Aliases: GHSA-cjc7-49v2-jp64, CVE-2021-29609
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. Incomplete validation in `SparseAdd` results in allowing attackers to exploit undefined behavior (dereferencing null pointers) as well as write outside of bounds of heap allocated data. The implementation(https://github.com/tensorflow/tensorflow/blob/656e7673b14acd7835dc778867f84916c6d1cac2/tensorflow/core/kernels/sparse_add_op.cc) has a large set of validation for the two sparse tensor inputs (6 tensors in total), but does not validate that the tensors are not empty or that the second dimension of `*_indices` matches the size of corresponding `*_shape`. This allows attackers to send tensor triples that represent invalid sparse tensors to abuse code assumptions that are not protected by validation. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-365
Aliases: CVE-2021-41121, GHSA-xv8x-pr4h-73jv
Published: 2021-10-06T18:15:00Z

Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions when performing a function call inside a literal struct, there is a memory corruption issue that occurs because of an incorrect pointer to the the top of the stack. This issue has been resolved in version 0.3.0.
Vulnerability: PYSEC-2021-670
Aliases: CVE-2021-29544, GHSA-6g85-3hm8-83f9
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a denial of service via a `CHECK`-fail in `tf.raw_ops.QuantizeAndDequantizeV4Grad`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/95078c145b5a7a43ee046144005f733092756ab5/tensorflow/core/kernels/quantize_and_dequantize_op.cc#L162-L163) does not validate the rank of the `input_*` tensors. In turn, this results in the tensors being passes as they are to `QuantizeAndDequantizePerChannelGradientImpl`(https://github.com/tensorflow/tensorflow/blob/95078c145b5a7a43ee046144005f733092756ab5/tensorflow/core/kernels/quantize_and_dequantize_op.h#L295-L306). However, the `vec<T>` method, requires the rank to 1 and triggers a `CHECK` failure otherwise. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 as this is the only other affected version.
Vulnerability: GHSA-gpvv-69j7-gwj8
Summary: Path Traversal in pip
Aliases: CVE-2019-20916
Severity: HIGH
CWE: CWE-22
Published: 2021-06-09T17:35:04Z

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py. A fix was committed 6704f2ace.
Vulnerability: PYSEC-2021-220
Aliases: GHSA-9xh4-23q4-v6wr, CVE-2021-29583
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.FusedBatchNorm` is vulnerable to a heap buffer overflow. If the tensors are empty, the same implementation can trigger undefined behavior by dereferencing null pointers. The implementation(https://github.com/tensorflow/tensorflow/blob/57d86e0db5d1365f19adcce848dfc1bf89fdd4c7/tensorflow/core/kernels/fused_batch_norm_op.cc) fails to validate that `scale`, `offset`, `mean` and `variance` (the last two only when required) all have the same number of elements as the number of channels of `x`. This results in heap out of bounds reads when the buffers backing these tensors are indexed past their boundary. If the tensors are empty, the validation mentioned in the above paragraph would also trigger and prevent the undefined behavior. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2020-220
Aliases: CVE-2020-25635
Published: 2020-10-05T14:15:00Z

A flaw was found in Ansible Base when using the aws_ssm connection plugin as garbage collector is not happening after playbook run is completed. Files would remain in the bucket exposing the data. This issue affects directly data confidentiality.
Vulnerability: GHSA-wg6j-r28m-7293
Summary: Code Injection in simple_captcha2
Aliases: CVE-2019-14282
Severity: CRITICAL
CWE: CWE-94
Published: 2019-07-31T04:21:19Z

The simple_captcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
Vulnerability: GHSA-p6p8-q4pj-f74m
Summary: Improper Certificate Validation in twitter-stream
Aliases: CVE-2020-24392
Severity: MODERATE
CWE: CWE-295
Published: 2021-03-29T16:28:42Z

In voloko twitter-stream 0.1.16, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library (because eventmachine is misused).
Vulnerability: GHSA-46f2-3v63-3xrp
Summary: Path traversal in Tempfile on Windows
Aliases: CVE-2021-28966
Severity: MODERATE
CWE: CWE-22
Published: 2021-05-06T15:01:36Z

There is an unintentional directory creation vulnerability in `tmpdir` library bundled with Ruby on Windows. And there is also an unintentional file creation vulnerability in tempfile library bundled with Ruby on Windows, because it uses tmpdir internally.
Vulnerability: GHSA-2w67-526p-gm73
Summary: redis-store deserializes untrusted data the affected version range and description should be adjust to match as well
Aliases: CVE-2017-1000248
Severity: CRITICAL
CWE: CWE-502
Published: 2017-12-06T16:41:25Z

Redis-store <=v1.3.0 allows unsafe objects to be loaded from redis
Vulnerability: GHSA-vxf6-w9mp-95hm
Summary: Low severity vulnerability that affects puppet
Aliases: CVE-2012-3408
Severity: LOW
CWE: CWE-287
Published: 2017-10-24T18:33:38Z

lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.
Vulnerability: GHSA-hxx6-p24v-wg8c
Summary: High severity vulnerability that affects curl
Aliases: CVE-2013-2617
Severity: HIGH
CWE: CWE-94
Published: 2017-10-24T18:33:37Z

lib/curl.rb in the Curl Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
Vulnerability: GHSA-qh4w-7pw3-p4rp
Summary: Potential denial of service in bson rubygem
Aliases: CVE-2015-4411
Severity: HIGH
CWE: CWE-400
Published: 2020-04-29T15:34:50Z

The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource consumption) via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410.
Vulnerability: GHSA-q7wx-62r7-j2x7
Summary: Moderate severity vulnerability that affects nokogiri
Aliases: CVE-2015-1819
Severity: MODERATE
Published: 2018-08-08T22:31:12Z

The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.
Vulnerability: GHSA-g6wq-qcwm-j5g2
Summary: Regular Expression Denial of Service in websocket-extensions (RubyGem)
Aliases: CVE-2020-7663
Severity: HIGH
CWE: CWE-400
Published: 2020-06-05T14:21:29Z

### Impact

The ReDoS flaw allows an attacker to exhaust the server's capacity to process
incoming requests by sending a WebSocket handshake request containing a header
of the following form:

    Sec-WebSocket-Extensions: a; b="\c\c\c\c\c\c\c\c\c\c ...

That is, a header containing an unclosed string parameter value whose content is
a repeating two-byte sequence of a backslash and some other character. The
parser takes exponential time to reject this header as invalid, and this will
block the processing of any other work on the same thread. Thus if you are
running a single-threaded server, such a request can render your service
completely unavailable.

### Patches

Users should upgrade to version 0.1.5.

### Workarounds

There are no known work-arounds other than disabling any public-facing
WebSocket functionality you are operating.

### References

- https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions/
Vulnerability: GHSA-m7p8-9w66-9frm
Summary: Moderate severity vulnerability that affects net-ldap
Aliases: CVE-2017-17718
Severity: MODERATE
CWE: CWE-295
Published: 2018-01-06T01:11:34Z

The Net::LDAP (aka net-ldap) gem before 0.16.0 for Ruby has Missing SSL Certificate Validation.
Vulnerability: GHSA-2j55-pcw5-x4h2
Summary: Critical severity vulnerability that affects active-support
Aliases: CVE-2018-3779
Severity: CRITICAL
CWE: CWE-77
Published: 2018-08-13T15:02:49Z

The `active-support` ruby gem gem is malware and duplicates the official `activesupport` (no hyphen) gem, but adds a compiled extension. The extension attempts to resolve a base64 encoded domain (29faea63.planfhntage.de), downloads a payload, and executes.
 
This trojan horse gem could allow a remote attacker to execute arbitrary code on the system, caused by containing a malicious backdoor. An attacker could exploit this vulnerability to execute arbitrary code on the system.  No version of this gem should be considered safe.
Vulnerability: GHSA-xrr4-p6fq-hjg7
Summary: Directory traversal vulnerability in Action View in Ruby on Rails
Aliases: CVE-2016-0752
Severity: HIGH
CWE: CWE-22
Published: 2017-10-24T18:33:35Z

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
Vulnerability: GHSA-fqfj-cmh6-hj49
Summary: Ruby OpenID
Aliases: CVE-2019-11027
Severity: CRITICAL
CWE: CWE-918
Published: 2019-06-13T16:15:56Z

Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely exploitable flaw. This library is used by Rails web applications to integrate with OpenID Providers. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developers who based their OpenID integration heavily on the "example app" provided by the project are at highest risk.
Vulnerability: GHSA-gcqq-w6gr-h9j9
Summary: Directory traversal vulnerability in RubyZip
Aliases: CVE-2017-5946
Severity: CRITICAL
CWE: CWE-22
Published: 2017-10-24T18:33:35Z

The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses "../" pathname substrings to write arbitrary files to the filesystem.
Vulnerability: GHSA-6j63-35hj-vmcg
Summary: Moderate severity vulnerability that affects mysql-binuuid-rails
Aliases: CVE-2018-18476
Severity: CRITICAL
CWE: CWE-89
Published: 2018-10-30T20:34:06Z

mysql-binuuid-rails 1.1.0 and earlier allows SQL Injection because it removes default string escaping for affected database columns.
Vulnerability: GHSA-qrqm-fpv6-6r8g
Summary: Command Injection Vulnerability in Mechanize
Aliases: CVE-2021-21289
Severity: HIGH
CWE: CWE-78
Published: 2021-02-02T18:50:27Z

This security advisory has been created for public disclosure of a Command Injection vulnerability that was responsibly reported by @kyoshidajp (Katsuhiko YOSHIDA).

### Impact

Mechanize `>= v2.0`, `< v2.7.7` allows for OS commands to be injected using several classes' methods which implicitly use Ruby's `Kernel.open` method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls:

- `Mechanize::CookieJar#load`: since v2.0 (see 208e3ed)
- `Mechanize::CookieJar#save_as`: since v2.0 (see 5b776a4)
- `Mechanize#download`: since v2.2 (see dc91667)
- `Mechanize::Download#save` and `#save!` since v2.1 (see 98b2f51, bd62ff0)
- `Mechanize::File#save` and `#save_as`: since v2.1 (see 2bf7519)
- `Mechanize::FileResponse#read_body`: since v2.0 (see 01039f5)


### Patches

These vulnerabilities are patched in Mechanize v2.7.7.


### Workarounds

No workarounds are available. We recommend upgrading to v2.7.7 or later.


### References

See https://docs.rubocop.org/rubocop/cops_security.html#securityopen for background on why `Kernel.open` should not be used with untrusted input.


### For more information

If you have any questions or comments about this advisory, please open an issue in [sparklemotion/mechanize](https://github.com/sparklemotion/mechanize/issues/new).
Vulnerability: GHSA-52p9-v744-mwjj
Summary: Remote code execution in Kramdown
Aliases: CVE-2021-28834
Severity: HIGH
CWE: CWE-94
Published: 2021-03-29T16:30:34Z

Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.
Vulnerability: GHSA-m6f7-46hw-grcj
Summary: Critical severity vulnerability that affects cremefraiche
Aliases: CVE-2013-2090
Severity: CRITICAL
CWE: CWE-78
Published: 2017-10-24T18:33:37Z

The set_meta_data function in lib/cremefraiche.rb in the Creme Fraiche gem before 0.6.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the file name of an email attachment.  NOTE: some of these details are obtained from third party information.
Vulnerability: GHSA-rp63-jfmw-532w
Summary: High severity vulnerability that affects mail
Aliases: CVE-2012-2140
Severity: HIGH
CWE: CWE-20
Published: 2017-10-24T18:33:38Z

The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery.
Vulnerability: GHSA-99ch-8mvp-g7m5
Summary: Critical severity vulnerability that affects md2pdf
Aliases: CVE-2013-1948
Severity: CRITICAL
Published: 2017-10-24T18:33:37Z

converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.
Vulnerability: GHSA-f2rp-4rv7-fc95
Summary: Exposure of Sensitive Information to an Unauthorized Actor in foreman_fog_proxmox
Aliases: CVE-2021-20259
Severity: HIGH
CWE: CWE-200
Published: 2021-06-10T15:54:43Z

A flaw was found in the Foreman project. The Proxmox compute resource exposes the password through the API to an authenticated local attacker with view_hosts permission. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Versions before foreman_fog_proxmox 0.13.1 are affected
Vulnerability: GHSA-c92m-rrrc-q5wf
Summary: High severity vulnerability that affects safemode
Aliases: CVE-2016-3693
Severity: HIGH
CWE: CWE-200
Published: 2017-10-24T18:33:35Z

The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackers to obtain sensitive information via the inspect method.
Vulnerability: GHSA-x3v4-pxvm-63j8
Summary: HTTP Request Smuggling in reel
Aliases: CVE-2020-7659
Severity: MODERATE
CWE: CWE-444
Published: 2021-05-24T18:13:36Z

reel through 0.6.1 allows Request Smuggling attacks due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TECL smuggling attacks. Note, This project is deprecated, and is not maintained any more.
Vulnerability: GHSA-6x45-86q6-rcmr
Summary: Gyazo allows local users to write arbitrary files
Aliases: CVE-2014-4994
Severity: MODERATE
CWE: CWE-20
Published: 2018-01-22T23:17:39Z

lib/gyazo/client.rb in the gyazo gem 1.0.0 for Ruby allows local users to write to arbitrary files via a symlink attack on a temporary file, related to time-based filenames.
Vulnerability: GHSA-hxhj-hp9m-qwc4
Summary: Moderate severity vulnerability that affects private_address_check
Aliases: CVE-2017-0904
Severity: MODERATE
CWE: CWE-242
Published: 2017-11-29T23:21:05Z

The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security measures, such as when used to blacklist private network addresses to prevent server-side request forgery.
Vulnerability: GHSA-qpxp-5j56-gg3x
Summary: Improper Input Validation in Zendesk Samlr
Aliases: CVE-2018-20857
Severity: HIGH
CWE: CWE-20
Published: 2019-07-31T04:22:03Z

Zendesk Samlr before 2.6.2 allows an XML nodes comment attack such as a name_id node with user@example.com followed by <!---->. and then the attacker's domain name.
Vulnerability: GHSA-3crr-9vmg-864v
Summary: Moderate severity vulnerability that affects activerecord
Aliases: CVE-2013-1854
Severity: MODERATE
CWE: CWE-20
Published: 2017-10-24T18:33:37Z

The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method.
Vulnerability: GHSA-gm25-fpmr-43fj
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2007-3227
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:38Z

Cross-site scripting (XSS) vulnerability in the to_json (ActiveRecord::Base#to_json) function in Ruby on Rails before edge 9606 allows remote attackers to inject arbitrary web script via the input values.
Vulnerability: GHSA-hg78-4f6x-99wq
Summary: Moderate severity vulnerability that affects rack
Aliases: CVE-2018-16470
Severity: MODERATE
CWE: CWE-400
Published: 2018-11-15T15:58:58Z

There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause the multipart parser to enter a pathological state, causing the parser to use CPU resources disproportionate to the request size.
Vulnerability: GHSA-mf6w-45cf-qhmp
Summary: Git-fastclone passes user modifiable strings directly to a shell command
Aliases: CVE-2015-8969
Severity: CRITICAL
CWE: CWE-77
Published: 2018-08-15T20:04:44Z

git-fastclone before 1.0.5 passes user modifiable strings directly to a shell command. An attacker can execute malicious commands by modifying the strings that are passed as arguments to "cd " and "git clone " commands in the library.
Vulnerability: GHSA-q86f-fmqf-qrf6
Summary: Moderate severity vulnerability that affects mail
Aliases: CVE-2015-9097
Severity: MODERATE
CWE: CWE-93
Published: 2017-10-24T18:33:36Z

The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring.
Vulnerability: GHSA-w754-gq8r-pf5f
Summary: High severity vulnerability that affects mini_magick
Aliases: CVE-2013-2616
Severity: HIGH
CWE: CWE-94
Published: 2017-10-24T18:33:37Z

lib/mini_magick.rb in the MiniMagick Gem 1.3.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
Vulnerability: GHSA-fmx4-26r3-wxpf
Summary: Integer overflow in cmark-gfm table parsing extension leads to heap memory corruption
Severity: HIGH
CWE: CWE-190
Published: 2022-03-03T20:28:47Z

### Impact

CommonMarker uses `cmark-gfm` for rendering [Github Flavored Markdown](https://github.github.com/gfm/). An [integer overflow in `cmark-gfm`'s table row parsing](https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x) may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution.

If affected versions of CommonMarker are used for rendering remote user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE).

### Patches

This vulnerability has been patched in the following CommonMarker release:

- v0.23.4

### Workarounds

The vulnerability exists in the table markdown extensions of `cmark-gfm`. Disabling any use of the table extension will prevent this vulnerability from being triggered.

### References

- https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x

### Acknowledgements

We would like to thank Felix Wilhelm of Google's Project Zero for reporting this vulnerability

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [CommonMarker](http://github.com/gjtorikian/commonmarker)
Vulnerability: GHSA-75w6-p6mg-vh8j
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2011-0446
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:38Z

Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
Vulnerability: GHSA-mhwp-qhpc-h3jm
Summary: High severity vulnerability that affects activerecord
Aliases: CVE-2014-3482
Severity: HIGH
CWE: CWE-89
Published: 2017-10-24T18:33:36Z

SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.
Vulnerability: GHSA-fjfg-q662-gm6j
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2007-5379
Severity: MODERATE
CWE: CWE-200
Published: 2017-10-24T18:33:38Z

Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.
Vulnerability: GHSA-rhgq-vv9x-j4p5
Summary: lawn-login exposes database password to unauthorized users
Aliases: CVE-2014-5000
Severity: HIGH
CWE: CWE-200
Published: 2018-01-22T23:45:33Z

The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process.
Vulnerability: GHSA-g266-3crh-h7gj
Summary: Moderate severity vulnerability that affects ldoce
Aliases: CVE-2013-1911
Severity: MODERATE
CWE: CWE-20
Published: 2017-10-24T18:33:37Z

lib/ldoce/word.rb in the ldoce 0.0.2 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in (1) an mp3 URL or (2) file name.
Vulnerability: GHSA-cj92-c4fj-w9c5
Summary: Moderate severity vulnerability that affects mail
Aliases: CVE-2012-2139
Severity: MODERATE
CWE: CWE-22
Published: 2017-10-24T18:33:38Z

Directory traversal vulnerability in lib/mail/network/delivery_methods/file_delivery.rb in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a .. (dot dot) in the to parameter.
Vulnerability: GHSA-ww79-8xwv-932x
Summary: Moderate severity vulnerability that affects rbovirt
Aliases: CVE-2014-0036
Severity: MODERATE
Published: 2017-10-24T18:33:36Z

The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.
Vulnerability: GHSA-h56m-vwxc-3qpw
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2014-7829
Severity: MODERATE
CWE: CWE-22
Published: 2017-10-24T18:33:36Z

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.
Vulnerability: GHSA-m2jr-hmc3-qmpr
Summary: Authorization bypass in Spree
Aliases: CVE-2020-26223
Severity: HIGH
CWE: CWE-863
Published: 2020-11-13T17:18:22Z

### Impact
The perpetrator could query the [API v2 Order Status](https://guides.spreecommerce.org/api/v2/storefront#tag/Order-Status) endpoint with an empty string passed as an Order token

### Patches
Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected.

### References
Pull request with a fix and in-depth explanation - https://github.com/spree/spree/pull/10573

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@spreecommerce.org](mailto:security@spreecommerce.org)
Vulnerability: GHSA-4hpq-rjcx-7vj9
Summary: Open Redirect in clearance
Aliases: CVE-2021-23435
Severity: HIGH
CWE: CWE-601
Published: 2021-09-13T20:05:09Z

This affects the package clearance before 2.5.0. The vulnerability can be possible when users are able to set the value of session[:return_to]. If the value used for return_to contains multiple leading slashes (/////example.com) the user ends up being redirected to the external domain that comes after the slashes (http://example.com).