TQRG/raw-osv-data huggingface dataset:
Vulnerability: PYSEC-2019-12
Aliases: GHSA-h5jv-4p7w-64jg, CVE-2019-14233
Published: 2019-08-02T15:15:00Z

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities.
Vulnerability: PYSEC-2021-321
Aliases: GHSA-4873-36h9-wv49, CVE-2021-39218
Published: 2021-09-17T21:15:00Z

Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory unsoundness vulnerability. There was an invalid free and out-of-bounds read and write bug when running Wasm that uses `externref`s in Wasmtime. To trigger this bug, Wasmtime needs to be running Wasm that uses `externref`s, the host creates non-null `externrefs`, Wasmtime performs a garbage collection (GC), and there has to be a Wasm frame on the stack that is at a GC safepoint where there are no live references at this safepoint, and there is a safepoint with live references earlier in this frame's function. Under this scenario, Wasmtime would incorrectly use the GC stack map for the safepoint from earlier in the function instead of the empty safepoint. This would result in Wasmtime treating arbitrary stack slots as `externref`s that needed to be rooted for GC. At the *next* GC, it would be determined that nothing was referencing these bogus `externref`s (because nothing could ever reference them, because they are not really `externref`s) and then Wasmtime would deallocate them and run `<ExternRef as Drop>::drop` on them. This results in a free of memory that is not necessarily on the heap (and shouldn't be freed at this moment even if it was), as well as potential out-of-bounds reads and writes. Even though support for `externref`s (via the reference types proposal) is enabled by default, unless you are creating non-null `externref`s in your host code or explicitly triggering GCs, you cannot be affected by this bug. We have reason to believe that the effective impact of this bug is relatively small because usage of `externref` is currently quite rare. This bug has been patched and users should upgrade to Wasmtime version 0.30.0. If you cannot upgrade Wasmtime at this time, you can avoid this bug by disabling the reference types proposal by passing `false` to `wasmtime::Config::wasm_reference_types`.
Vulnerability: PYSEC-2022-152
Aliases: GHSA-fx5c-h9f6-rv7c, CVE-2022-23588
Published: 2022-02-04T23:15:00Z

Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a `SavedModel` such that Grappler optimizer would attempt to build a tensor using a reference `dtype`. This would result in a crash due to a `CHECK`-fail in the `Tensor` constructor as reference types are not allowed. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Vulnerability: PYSEC-2012-8
Aliases: CVE-2012-4571
Published: 2012-11-30T22:55:00Z

Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier for local users to obtain passwords via a brute-force attack.
Vulnerability: GHSA-gjqc-q9g6-q2j3
Summary: `CHECK`-failures in binary ops in Tensorflow
Aliases: CVE-2022-23583
Severity: MODERATE
CWE: CWE-617
Published: 2022-02-10T00:34:13Z

### Impact
A malicious user can cause a denial of service by altering a `SavedModel` such that [any binary op](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/kernels/cwise_ops_common.h#L88-L137) would trigger `CHECK` failures. This occurs when the protobuf part corresponding to the tensor arguments is modified such that the `dtype` no longer matches the `dtype` expected by the op. In that case, calling the templated binary operator for the binary op would receive corrupted data, due to the type confusion involved:

```cc
functor::BinaryFunctor<Device, Functor, 1>()(
    eigen_device, out->template flat<Tout>(),
    input_0.template flat<Tin>(), input_1.template flat<Tin>(),
    error_ptr);
```
If `Tin` and `Tout` don't match the type of data in `out` and `input_*` tensors then `flat<*>` would interpret it wrongly. In most cases, this would be a silent failure, but we have noticed scenarios where this results in a `CHECK` crash, hence a denial of service.

### Patches
We have patched the issue in GitHub commit [a7c02f1a9bbc35473969618a09ee5f9f5d3e52d9](https://github.com/tensorflow/tensorflow/commit/a7c02f1a9bbc35473969618a09ee5f9f5d3e52d9).
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-mq5p-2mcr-m52j
Summary: Code injection in nbgitpuller
Aliases: CVE-2021-39160
Severity: CRITICAL
CWE: CWE-94
Published: 2021-08-30T16:17:06Z

### Impact

Due to an unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment.

### Patches

0.10.2

### Workarounds

None, other than upgrade to 0.10.2 or downgrade to 0.8.x.


### For more information

If you have any questions or comments about this advisory:

* Open an issue in [nbgitpuller](https://github.com/jupyterhub/nbgitpuller/issues)
* Email our security team at [security@ipython.org](mailto:security@ipython.org)
Vulnerability: PYSEC-2020-40
Aliases: CVE-2020-10594, GHSA-fpjm-rp2g-3r4c
Published: 2020-03-15T22:15:00Z

An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of jpadilla/django-rest-framework-jwt, which is unmaintained.
Vulnerability: GHSA-rg3m-hqc5-344v
Summary: `SparseFillEmptyRows` heap OOB
Aliases: CVE-2021-41224
Severity: HIGH
CWE: CWE-125
Published: 2021-11-10T18:45:55Z

### Impact
The [implementation](https://github.com/tensorflow/tensorflow/blob/e71b86d47f8bc1816bf54d7bddc4170e47670b97/tensorflow/core/kernels/sparse_fill_empty_rows_op.cc#L194-L241) of `SparseFillEmptyRows` can be made to trigger a heap OOB access:

```python
import tensorflow as tf
  
data=tf.raw_ops.SparseFillEmptyRows(
  indices=[[0,0],[0,0],[0,0]],
  values=['sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss'],
  dense_shape=[5,3],
  default_value='o')
```
  
This occurs whenever the size of `indices` does not match the size of `values`.

### Patches
We have patched the issue in GitHub commit [67bfd9feeecfb3c61d80f0e46d89c170fbee682b](https://github.com/tensorflow/tensorflow/commit/67bfd9feeecfb3c61d80f0e46d89c170fbee682b).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: PYSEC-2022-92
Aliases: CVE-2022-23583, GHSA-gjqc-q9g6-q2j3
Published: 2022-02-04T23:15:00Z

Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a `SavedModel` such that any binary op would trigger `CHECK` failures. This occurs when the protobuf part corresponding to the tensor arguments is modified such that the `dtype` no longer matches the `dtype` expected by the op. In that case, calling the templated binary operator for the binary op would receive corrupted data, due to the type confusion involved. If `Tin` and `Tout` don't match the type of data in `out` and `input_*` tensors then `flat<*>` would interpret it wrongly. In most cases, this would be a silent failure, but we have noticed scenarios where this results in a `CHECK` crash, hence a denial of service. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Vulnerability: PYSEC-2018-29
Aliases: CVE-2018-15750
Published: 2018-10-24T22:29:00Z

Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server.
Vulnerability: PYSEC-2021-858
Aliases: GHSA-q4xr-rc97-m4xx, SNYK-PYTHON-CELERY-2314953, CVE-2021-23727
Published: 2021-12-29T17:15:00Z

This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.
Vulnerability: GHSA-hggv-mcp4-vxc5
Summary: Improper Authentication in FreeTAKServer
Aliases: CVE-2022-25508
Severity: HIGH
CWE: CWE-400, CWE-287
Published: 2022-03-12T00:00:37Z

FreeTAKServer is an open source, lightweight Server for connect TAK clients. An access control issue in the component /ManageRoute/postRoute of FreeTAKServer version 1.9.8 allows unauthenticated attackers to cause a Denial of Service (DoS) via an unusually large amount of created routes, or create unsafe or false routes for legitimate users. There is currently no known workaround. This issue was fixed in version 1.9.8.5.
Vulnerability: PYSEC-2016-37
Aliases: CVE-2015-8748
Published: 2016-02-03T18:59:00Z

Radicale before 1.1 allows remote authenticated users to bypass owner_write and owner_only limitations via regex metacharacters in the user name, as demonstrated by ".*".
Vulnerability: GHSA-rxq3-5249-8hgg
Summary: Validation bypass vulnerability 
Severity: LOW
Published: 2020-09-09T17:29:41Z

Back in min June a security vulnerability was reported to the team, the reason for the slow response was due to ownership of some packages
was locked and we wanted to be sure to update all packages before any disclosure was released.

The issue is deemed being a Low severity vulnerability.

### Impact

This vulnerability impacts users who rely on the for last digits of personnummer to be a _real_ personnummer.  

### Patches

The issue have been patched in all repositories. The following versions should be updated to as soon as possible:

C# 3.0.2  
D 3.0.1  
Dart 3.0.3  
Elixir 3.0.0  
Go 3.0.1  
Java 3.3.0  
JavaScript 3.1.0  
Kotlin 1.1.0  
Lua 3.0.1  
PHP 3.0.2  
Perl 3.0.0  
Python 3.0.2  
Ruby 3.0.1  
Rust 3.0.0  
Scala 3.0.1  
Swift 1.0.1  

If you are using any of the earlier packages, please update to latest.

### Workarounds

The issue arrieses from the regular expression allowing the first three digits in the last four digits of the personnummer to be
000, which is invalid. To mitigate this without upgrading, a check on the last four digits can be made to make sure it's not
000x.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Personnummer Meta](https://github.com/personnummer/meta/issues)
* Email us at [Personnummer Email](mailto:security@personnummer.dev)

### Credits

Niklas Sköldmark (Medborgarskolan)
Vulnerability: GHSA-gq9m-qvpx-68hc
Summary: Insufficient Entropy in werkzeug
Aliases: CVE-2019-14806
Severity: HIGH
CWE: CWE-331
Published: 2019-08-21T16:15:24Z

Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.
Vulnerability: PYSEC-2020-272
Aliases: CVE-2020-15192, GHSA-8fxw-76px-3rxv
Published: 2020-09-25T19:15:00Z

In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes a list of strings to `dlpack.to_dlpack` there is a memory leak following an expected validation failure. The issue occurs because the `status` argument during validation failures is not properly checked. Since each of the above methods can return an error status, the `status` value must be checked before continuing. The issue is patched in commit 22e07fb204386768e5bcbea563641ea11f96ceb8 and is released in TensorFlow versions 2.2.1, or 2.3.1.
Vulnerability: GHSA-785x-qw4v-6872
Summary: Improper Output Neutralization and Improper Encoding or Escaping of Output for Logs in ansible
Aliases: CVE-2020-14330
Severity: MODERATE
CWE: CWE-117, CWE-116
Published: 2022-02-09T22:00:08Z

An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri module. The highest threat from this vulnerability is to data confidentiality.
Vulnerability: GHSA-9w4w-cpc8-h2fq
Summary: Exposure of Sensitive Information to an Unauthorized Actor in httpie
Aliases: CVE-2022-24737
Severity: MODERATE
CWE: CWE-200
Published: 2022-03-07T23:44:28Z

### Impact
HTTPie have the practical concept of [sessions](https://httpie.io/docs/cli/sessions), which help users to persistently store some of the state that belongs to the outgoing requests and incoming responses on the disk for further usage. As an example, we can make an authenticated request and save it to a [named session](https://httpie.io/docs/cli/named-sessions) called `api`:

```bash
$ http --session api -a user:pass pie.dev/basic-auth/user/pass
```

```json
{
    "authenticated": true,
    "user": "user"
}
```

Since we have now saved the authentication data to that session, we won‘t have to enter it again and again on every invocation. We can simply reference the session, and HTTPie will use the saved state directly from it:

```bash
$ http --session api pie.dev/basic-auth/user/pass
```

```json
{
    "authenticated": true,
    "user": "user"
}
```

One particular use case of these sessions is storing cookies (commonly referred to as a `Cookie Jar`). If a response has a `Set-Cookie`
header, HTTPie will parse it and store the actual cookie in the session. And from that point on, all outgoing requests will attach that cookie (in the form of a `Cookie` header).

This is extremely useful, especially when you are dealing with websites which manage their own state on the client-side through cookies.

```bash
$ http -F --session jar pie.dev/cookies/set/x/y
```

```json
{
    "cookies": {
        "x": "y"
    }
}
```

Before `3.1.0`, HTTPie didn‘t distinguish between cookies and hosts they belonged. This behavior resulted in the exposure of some cookies when there are redirects originating from the actual host to a third party website, e.g:

```bash
$ http -F --session jar pie.dev/redirect-to url==https://httpbin.org/cookies
```

(Pre 3.1.0)
```json
{
    "cookies": {
        "x": "y"
    }
}
```

(Post 3.1.0)
```json
{
    "cookies": {}
}
```

This behavior has been corrected in this release (with taking [RFC 6265 — HTTP State Management Mechanism](https://datatracker.ietf.org/doc/html/rfc6265) into the consideration).

A huge credit goes to [@Glyph](https://github.com/glyph) for disclosing the original vulnerability to us (through [huntr.dev](http://huntr.dev/)).

### Patches
We suggest users to upgrade their HTTPie version to `3.1.0` or higher, and run `httpie cli sessions upgrade` command on their sessions.

### For more information
If you have any questions or comments about this advisory:
* Email us: [`security@httpie.io`](mailto:security@httpie.io)

> Please note that this entry is covered by both [CVE-2022-24737](https://www.cvedetails.com/cve/CVE-2022-24737) and [CVE-2022-0430](https://nvd.nist.gov/vuln/detail/CVE-2022-0430).
Vulnerability: PYSEC-2021-272
Aliases: CVE-2021-37650, GHSA-f8h4-7rgh-q2gm
Published: 2021-08-12T21:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation for `tf.raw_ops.ExperimentalDatasetToTFRecord` and `tf.raw_ops.DatasetToTFRecord` can trigger heap buffer overflow and segmentation fault. The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/data/experimental/to_tf_record_op.cc#L93-L102) assumes that all records in the dataset are of string type. However, there is no check for that, and the example given above uses numeric types. We have patched the issue in GitHub commit e0b6e58c328059829c3eb968136f17aa72b6c876. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Vulnerability: GHSA-7hpj-hfcr-5qwm
Summary: Code injection in FreeIPA
Aliases: CVE-2019-14867
Severity: HIGH
CWE: CWE-94, CWE-400
Published: 2021-12-06T18:17:38Z

A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function ber_scanf() was used in some components of the IPA server, which parsed kerberos key data. An unauthenticated attacker who could trigger parsing of the krb principal key could cause the IPA server to crash or in some conditions, cause arbitrary code to be executed on the server hosting the IPA server.
Vulnerability: PYSEC-2021-788
Aliases: CVE-2021-37677, GHSA-qfpc-5pjr-mh26
Published: 2021-08-12T23:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the shape inference code for `tf.raw_ops.Dequantize` has a vulnerability that could trigger a denial of service via a segfault if an attacker provides invalid arguments. The shape inference [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/ops/array_ops.cc#L2999-L3014) uses `axis` to select between two different values for `minmax_rank` which is then used to retrieve tensor dimensions. However, code assumes that `axis` can be either `-1` or a value greater than `-1`, with no validation for the other values. We have patched the issue in GitHub commit da857cfa0fde8f79ad0afdbc94e88b5d4bbec764. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-622
Aliases: GHSA-h67m-xg8f-fxcf, CVE-2021-41213
Published: 2021-11-05T23:15:00Z

TensorFlow is an open source platform for machine learning. In affected versions the code behind `tf.function` API can be made to deadlock when two `tf.function` decorated Python functions are mutually recursive. This occurs due to using a non-reentrant `Lock` Python object. Loading any model which contains mutually recursive functions is vulnerable. An attacker can cause denial of service by causing users to load such models and calling a recursive `tf.function`, although this is not a frequent scenario. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-337
Aliases: CVE-2021-23401, SNYK-PYTHON-FLASKUSER-1293188, GHSA-4298-89hc-6rfv
Published: 2021-07-05T11:15:00Z

This affects all versions of package Flask-User. When using the make_safe_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as /////evil.com/path or \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False.
Vulnerability: GHSA-5pr9-v234-jw36
Summary: Remote Code Execution via traversal in TAL expressions
Severity: MODERATE
CWE: CWE-22
Published: 2021-06-18T18:44:01Z

### Impact
Most Python modules are not available for using in TAL expressions that you can add through-the-web, for example in Zope Page Templates. This restriction avoids file system access, for example via the 'os' module. But some of the untrusted modules are available indirectly through Python modules that are available for direct use.

By default, you need to have the Manager role to add or edit Zope Page Templates through the web. Only sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk.

### Patches
The problem has been fixed in Zope 5.2 and 4.6.

### Workarounds
A site administrator can restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web should be restricted to trusted users only.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [Zope issue tracker](https://github.com/zopefoundation/Zope/issues)
* Email us at [security@plone.org](mailto:security@plone.org)
Vulnerability: PYSEC-2021-82
Aliases: CVE-2021-33510, GHSA-4mg4-wvmx-5332
Published: 2021-05-21T22:15:00Z

Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file.
Vulnerability: PYSEC-2021-767
Aliases: GHSA-4xfp-4pfp-89wg, CVE-2021-37656
Published: 2021-08-12T21:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.RaggedTensorToSparse`. The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/ragged_tensor_to_sparse_kernel.cc#L30) has an incomplete validation of the splits values: it does not check that they are in increasing order. We have patched the issue in GitHub commit 1071f554dbd09f7e101324d366eec5f4fe5a3ece. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2015-27
Aliases: CVE-2015-7337
Published: 2015-09-29T19:59:00Z

The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.
Vulnerability: GHSA-5hj3-vjjf-f5m7
Summary: Heap OOB in `SdcaOptimizerV2`
Aliases: CVE-2021-37672
Severity: MODERATE
CWE: CWE-125
Published: 2021-08-25T14:41:39Z

### Impact
An attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to `tf.raw_ops.SdcaOptimizerV2`:

```python
import tensorflow as tf
  
tf.raw_ops.SdcaOptimizerV2(
  sparse_example_indices=[[1]],
  sparse_feature_indices=[[1]],
  sparse_feature_values=[[1.0,2.0]],
  dense_features=[[1.0]],
  example_weights=[1.0],
  example_labels=[],
  sparse_indices=[1],
  sparse_weights=[1.0],
  dense_weights=[[1.0]],
  example_state_data=[[100.0,100.0,100.0,100.0]],
  loss_type='logistic_loss',
  l1=100.0,
  l2=100.0,
  num_loss_partitions=1,
  num_inner_iterations=1,
  adaptive=True)       
``` 

The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/sdca_internal.cc#L320-L353) does not check that the length of `example_labels` is the same as the number of examples.

### Patches
We have patched the issue in GitHub commit [a4e138660270e7599793fa438cd7b2fc2ce215a6](https://github.com/tensorflow/tensorflow/commit/a4e138660270e7599793fa438cd7b2fc2ce215a6).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: PYSEC-2020-337
Aliases: CVE-2020-26271, GHSA-q263-fvxm-m5mw
Published: 2020-12-10T22:15:00Z

In affected versions of TensorFlow under certain cases, loading a saved model can result in accessing uninitialized memory while building the computation graph. The MakeEdge function creates an edge between one output tensor of the src node (given by output_index) and the input slot of the dst node (given by input_index). This is only possible if the types of the tensors on both sides coincide, so the function begins by obtaining the corresponding DataType values and comparing these for equality. However, there is no check that the indices point to inside of the arrays they index into. Thus, this can result in accessing data out of bounds of the corresponding heap allocated arrays. In most scenarios, this can manifest as unitialized data access, but if the index points far away from the boundaries of the arrays this can be used to leak addresses from the library. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.
Vulnerability: PYSEC-2019-234
Aliases: CVE-2019-16778, GHSA-844w-j86r-4x2j
Published: 2019-12-16T21:15:00Z

In TensorFlow before 1.15, a heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32. In this case data_size and num_segments fields are truncated from int64 to int32 and can produce negative numbers, resulting in accessing out of bounds heap memory. This is unlikely to be exploitable and was detected and fixed internally in TensorFlow 1.15 and 2.0.
Vulnerability: PYSEC-2018-91
Aliases: CVE-2018-17983
Published: 2018-10-04T23:29:00Z

cext/manifest.c in Mercurial before 4.7.2 has an out-of-bounds read during parsing of a malformed manifest entry.
Vulnerability: PYSEC-2020-17
Aliases: GHSA-q4p3-qw5c-mhpc, CVE-2020-11983
Published: 2020-07-17T00:15:00Z

An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the admin management screens in the new/RBAC UI handled escaping incorrectly, allowing authenticated users with appropriate permissions to create stored XSS attacks.
Vulnerability: PYSEC-2022-105
Aliases: GHSA-23hm-7w47-xw72, CVE-2022-21726
Published: 2022-02-03T11:15:00Z

Tensorflow is an Open Source Machine Learning Framework. The implementation of `Dequantize` does not fully validate the value of `axis` and can result in heap OOB accesses. The `axis` argument can be `-1` (the default value for the optional argument) or any other positive value at most the number of dimensions of the input. Unfortunately, the upper bound is not checked and this results in reading past the end of the array containing the dimensions of the input tensor. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-419
Aliases: CVE-2021-41227, GHSA-j8c8-67vp-6mx7
Published: 2021-11-05T23:15:00Z

TensorFlow is an open source platform for machine learning. In affected versions the `ImmutableConst` operation in TensorFlow can be tricked into reading arbitrary memory contents. This is because the `tstring` TensorFlow string class has a special case for memory mapped strings but the operation itself does not offer any support for this datatype. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Vulnerability: GHSA-q7f7-544h-67h9
Summary: FPE in TFLite pooling operations
Aliases: CVE-2021-37684
Severity: MODERATE
CWE: CWE-369
Published: 2021-08-25T14:40:13Z

### Impact
The implementations of pooling in TFLite are vulnerable to division by 0 errors as there are no checks for divisors not being 0.

### Patches 
We have patched the issue in GitHub commit [dfa22b348b70bb89d6d6ec0ff53973bacb4f4695](https://github.com/tensorflow/tensorflow/commit/dfa22b348b70bb89d6d6ec0ff53973bacb4f4695).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: PYSEC-2021-675
Aliases: GHSA-x83m-p7pv-ch8v, CVE-2021-29549
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a runtime division by zero error and denial of service in `tf.raw_ops.QuantizedBatchNormWithGlobalNormalization`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/6f26b3f3418201479c264f2a02000880d8df151c/tensorflow/core/kernels/quantized_add_op.cc#L289-L295) computes a modulo operation without validating that the divisor is not zero. Since `vector_num_elements` is determined based on input shapes(https://github.com/tensorflow/tensorflow/blob/6f26b3f3418201479c264f2a02000880d8df151c/tensorflow/core/kernels/quantized_add_op.cc#L522-L544), a user can trigger scenarios where this quantity is 0. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-225
Aliases: GHSA-vfr4-x8j2-3rf9, CVE-2021-29588
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. The optimized implementation of the `TransposeConv` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/0d45ea1ca641b21b73bcf9c00e0179cda284e7e7/tensorflow/lite/kernels/internal/optimized/optimized_ops.h#L5221-L5222). An attacker can craft a model such that `stride_{h,w}` values are 0. Code calling this function must validate these arguments. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2020-225
Aliases: GHSA-939m-4xpw-v34v, CVE-2020-26943
Published: 2020-10-16T06:15:00Z

An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval function is used). This may result in Horizon host unauthorized access and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.
Vulnerability: GHSA-g2xc-35jw-c63p
Summary: HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress
Aliases: CVE-2019-16786
Severity: HIGH
CWE: CWE-444
Published: 2019-12-20T23:04:18Z

### Impact

Waitress would parse the `Transfer-Encoding` header and only look for a single string value, if that value was not `chunked` it would fall through and use the `Content-Length` header instead.

According to the HTTP standard `Transfer-Encoding` should be a comma separated list, with the inner-most encoding first, followed by any further transfer codings, ending with `chunked`.

Requests sent with:

```
Transfer-Encoding: gzip, chunked
```

Would incorrectly get ignored, and the request would use a `Content-Length` header instead to determine the body size of the HTTP message.

This could allow for Waitress to treat a single request as multiple requests in the case of HTTP pipelining.

### Patches

This issue is fixed in Waitress 1.4.0. This brings a range of changes to harden Waitress against potential HTTP request confusions, and may change the behaviour of Waitress behind non-conformist proxies. 

Waitress will now return a 501 Not Implemented error if the `Transfer-Encoding` is not `chunked` or contains multiple elements. Waitress does not support any transfer codings such as `gzip` or `deflate`.

The Pylons Project recommends upgrading as soon as possible, while validating that the changes in Waitress don&#39;t cause any changes in behavior.

### Workarounds

Various reverse proxies may have protections against sending potentially bad HTTP requests to the backend, and or hardening against potential issues like this. If the reverse proxy doesn&#39;t use HTTP/1.1 for connecting to the backend issues are also somewhat mitigated, as HTTP pipelining does not exist in HTTP/1.0 and Waitress will close the connection after every single request (unless the Keep Alive header is explicitly sent... so this is not a fool proof security method).

### Issues/more security issues:

* open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related)
* email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)
Vulnerability: PYSEC-2021-730
Aliases: GHSA-8rm6-75mf-7r7r, CVE-2021-29604
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. The TFLite implementation of hashtable lookup is vulnerable to a division by zero error(https://github.com/tensorflow/tensorflow/blob/1a8e885b864c818198a5b2c0cbbeca5a1e833bc8/tensorflow/lite/kernels/hashtable_lookup.cc#L114-L115) An attacker can craft a model such that `values`'s first dimension would be 0. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: GHSA-9j59-75qj-795w
Summary: Path traversal in Pillow
Aliases: CVE-2022-24303
Severity: CRITICAL
Published: 2022-03-11T23:10:32Z

If the path to the temporary directory on Linux or macOS contained a space, this would break removal of the temporary image file after im.show() (and related actions), and potentially remove an unrelated file. This been present since PIL.
Vulnerability: PYSEC-2021-360
Aliases: CVE-2021-38598
Published: 2021-08-23T05:15:00Z

OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations.
Vulnerability: GHSA-4v5p-v5h9-6xjx
Summary: `CHECK`-failures in Tensorflow
Aliases: CVE-2022-23565
Severity: MODERATE
CWE: CWE-617
Published: 2022-02-09T23:49:01Z

### Impact
An attacker can trigger denial of service via assertion failure by altering a `SavedModel` on disk such that `AttrDef`s of some operation are duplicated.

### Patches
We have patched the issue in GitHub commit [c2b31ff2d3151acb230edc3f5b1832d2c713a9e0](https://github.com/tensorflow/tensorflow/commit/c2b31ff2d3151acb230edc3f5b1832d2c713a9e0).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: PYSEC-2021-674
Aliases: CVE-2021-29548, GHSA-p45v-v4pw-77jr
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a runtime division by zero error and denial of service in `tf.raw_ops.QuantizedBatchNormWithGlobalNormalization`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/55a97caa9e99c7f37a0bbbeb414dc55553d3ae7f/tensorflow/core/kernels/quantized_batch_norm_op.cc) does not validate all constraints specified in the op's contract(https://www.tensorflow.org/api_docs/python/tf/raw_ops/QuantizedBatchNormWithGlobalNormalization). The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-224
Aliases: CVE-2021-29587, GHSA-j7rm-8ww4-xx2g
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. The `Prepare` step of the `SpaceToDepth` TFLite operator does not check for 0 before division(https://github.com/tensorflow/tensorflow/blob/5f7975d09eac0f10ed8a17dbb6f5964977725adc/tensorflow/lite/kernels/space_to_depth.cc#L63-L67). An attacker can craft a model such that `params->block_size` would be zero. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: GHSA-v9qg-3j8p-r63v
Summary: Uncontrolled Recursion in Django
Aliases: CVE-2019-14235
Severity: HIGH
CWE: CWE-674
Published: 2019-08-06T01:43:31Z

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences.
Vulnerability: PYSEC-2020-224
Aliases: CVE-2020-1932, GHSA-fxjm-wvj9-9c39
Published: 2020-01-28T01:15:00Z

An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. Authenticated Apache Superset users are able to retrieve other users' information, including hashed passwords, by accessing an unused and undocumented API endpoint on Apache Superset.
Vulnerability: GHSA-mpf2-q34c-fc6j
Summary: Infinite Loop in scapy
Aliases: CVE-2019-1010142
Severity: HIGH
CWE: CWE-835
Published: 2019-07-22T14:53:58Z

scapy 2.4.0 is affected by Denial of Service. The impact is infinite loop, resource consumption and program unresponsive. The component is _RADIUSAttrPacketListField.getfield(self..). The attack vector is over the network or in a pcap. both work.
Vulnerability: GHSA-67cx-rhhq-mfhq
Summary: High severity vulnerability that affects indico
Severity: HIGH
CWE: CWE-77
Published: 2019-10-11T18:28:07Z

## Local file disclosure through LaTeX injection

### Impact
An external audit of the Indico codebase has discovered a vulnerability in Indico's LaTeX sanitization code, which could have malicious users to run unsafe LaTeX commands on the server. Such commands allowed for example to read local files (e.g. `indico.conf`).

As far as we know it is not possible to write files or execute code using this vulnerability.

### Patches
You need to update to [Indico 2.2.3](https://github.com/indico/indico/releases/tag/v2.2.3) as soon as possible.
We also released [Indico 2.1.10](https://github.com/indico/indico/releases/tag/v2.1.10) in case you cannot update to 2.2 for some reason.
See https://docs.getindico.io/en/stable/installation/upgrade/ for instructions on how to update.

### Workarounds
Setting `XELATEX_PATH = None` in `indico.conf` will result in an error when building a PDF, but without being able to run xelatex, the vulnerability cannot be abused.

### For more information
If you have any questions or comments about this advisory:
* Open a thread in [our forum](https://talk.getindico.io/)
* Email us privately at [indico-team@cern.ch](mailto:indico-team@cern.ch)
Vulnerability: GHSA-qr82-2c78-4m8h
Summary: Reference binding to nullptr in map operations
Aliases: CVE-2021-37671
Severity: HIGH
CWE: CWE-824
Published: 2021-08-25T14:41:42Z

### Impact
An attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.Map*` and `tf.raw_ops.OrderedMap*` operations:

```python
import tensorflow as tf
  
tf.raw_ops.MapPeek(
  key=tf.constant([8],dtype=tf.int64),
  indices=[],
  dtypes=[tf.int32],
  capacity=8,
  memory_limit=128)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/map_stage_op.cc#L222-L248) has a check in place to ensure that `indices` is in ascending order, but does not check that `indices` is not empty.
    
### Patches
We have patched the issue in GitHub commit [532f5c5a547126c634fefd43bbad1dc6417678ac](https://github.com/tensorflow/tensorflow/commit/532f5c5a547126c634fefd43bbad1dc6417678ac).
                       
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
    
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: PYSEC-2021-731
Aliases: GHSA-jf7h-7m85-w2v2, CVE-2021-29605
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. The TFLite code for allocating `TFLiteIntArray`s is vulnerable to an integer overflow issue(https://github.com/tensorflow/tensorflow/blob/4ceffae632721e52bf3501b736e4fe9d1221cdfa/tensorflow/lite/c/common.c#L24-L27). An attacker can craft a model such that the `size` multiplier is so large that the return value overflows the `int` datatype and becomes negative. In turn, this results in invalid value being given to `malloc`(https://github.com/tensorflow/tensorflow/blob/4ceffae632721e52bf3501b736e4fe9d1221cdfa/tensorflow/lite/c/common.c#L47-L52). In this case, `ret->size` would dereference an invalid pointer. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-361
Aliases: CVE-2021-40085
Published: 2021-08-31T18:15:00Z

An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Authenticated attackers can reconfigure dnsmasq via a crafted extra_dhcp_opts value.
Vulnerability: GHSA-hwvq-6gjx-j797
Summary: Special Element Injection in notebook
Aliases: CVE-2021-32798
Severity: CRITICAL
CWE: CWE-79
Published: 2021-08-23T19:40:38Z

### Impact

Untrusted notebook can execute code on load. This is a remote code execution, but requires user action to open a notebook.

### Patches

5.7.11, 6.4.1

### References

[OWASP Page on Injection Prevention](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html#injection-prevention-rules)

### For more information

If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list security@ipython.org.

Credit: Guillaume Jeanne from Google


### Example:

A notebook with the following content in a cell and it would display an alert when opened for the first time in Notebook (in an untrusted state):

```
{ "cell_type": "code", "execution_count": 0, "metadata": {}, "outputs": [ { "data": { "text/html": [ "<select><iframe></select><img src=x: onerror=alert('xss')>\n"], "text/plain": [] }, "metadata": {}, "output_type": "display_data" } ], "source": [ "" ] }
````
Vulnerability: GHSA-6gv8-p3vj-pxvr
Summary: Null pointer dereference in `UncompressElement`
Aliases: CVE-2021-37649
Severity: HIGH
CWE: CWE-476
Published: 2021-08-25T14:43:27Z

### Impact
The code for `tf.raw_ops.UncompressElement` can be made to trigger a null pointer dereference: 

```python
import tensorflow as tf

data = tf.data.Dataset.from_tensors([0.0])
tf.raw_ops.UncompressElement(
  compressed=tf.data.experimental.to_variant(data),
  output_types=[tf.int64],
  output_shapes=[2])
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/data/experimental/compression_ops.cc#L50-L53) obtains a pointer to a `CompressedElement` from a `Variant` tensor and then proceeds to dereference it for decompressing. There is no check that the `Variant` tensor contained a `CompressedElement`, so the pointer is actually `nullptr`.

### Patches
We have patched the issue in GitHub commit [7bdf50bb4f5c54a4997c379092888546c97c3ebd](https://github.com/tensorflow/tensorflow/commit/7bdf50bb4f5c54a4997c379092888546c97c3ebd).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: PYSEC-2020-16
Aliases: GHSA-9g2w-5f3v-mfmm, CVE-2020-11982
Published: 2020-07-17T00:15:00Z

An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to the broker (Redis, RabbitMQ) directly, it was possible to insert a malicious payload directly to the broker which could lead to a deserialization attack (and thus remote code execution) on the Worker.
Vulnerability: PYSEC-2018-90
Aliases: CVE-2018-13348
Published: 2018-07-06T00:29:00Z

The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.