TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-38j9-7pp9-2hjw
Summary: Invalid session token expiration 
Aliases: CVE-2021-32923
Severity: HIGH
CWE: CWE-613
Published: 2021-06-08T18:52:05Z

HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2.
Vulnerability: GO-2020-0022
Published: 2021-04-14T12:00:00Z

LZ4 bindings use a deprecated C API that is vulnerable to
memory corruption, which could lead to arbitrary code execution
if called with untrusted user input.
Vulnerability: GHSA-g7v2-2qxx-wjrw
Summary: Symlink Attack in Libcontainer and Docker Engine
Aliases: CVE-2015-3627
Severity: MODERATE
CWE: CWE-59
Published: 2022-02-15T01:18:02Z

Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.
Vulnerability: GHSA-cj2h-ww36-v932
Summary: Improper Certificate Validation in HashiCorp Nomad
Aliases: CVE-2020-7956
Severity: HIGH
CWE: CWE-295
Published: 2021-05-18T18:20:26Z

HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and were susceptible to privilege escalation. Fixed in 0.10.3.
Vulnerability: GHSA-mq47-6wwv-v79w
Summary: Path traversal in claircore
Aliases: CVE-2021-3762
Severity: HIGH
CWE: CWE-22
Published: 2022-03-04T00:00:16Z

A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which, when scanned by Clair, allows for arbitrary file write on the filesystem, potentially allowing for remote code execution.
Vulnerability: GHSA-cfc2-wjcm-c8fm
Summary: Incorrect Authorization with specially crafted requests
Aliases: CVE-2021-39206
Severity: HIGH
CWE: CWE-863
Published: 2021-09-10T17:54:25Z

Envoy, which Pomerium is based on, contains two authorization related vulnerabilities:

- [CVE-2021-32777](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32779): incorrectly transform a URL containing a `#fragment` element, causing a mismatch in path-prefix based authorization decisions.
- [CVE-2021-32779](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32777): incorrectly handle duplicate headers, dropping all but the last.  This may lead to incorrect routing or authorization policy decisions.

### Impact
With specially crafted requests, incorrect authorization or routing decisions may be made by Pomerium.

### Patches

Pomerium v0.14.8 and v0.15.1 contain an upgraded envoy binary with these vulnerabilities patched.

### Workarounds

- This issue can only be triggered when using path prefix based policy.  Removing any such policies should provide mitigation.


### References
[envoy GSA CVE-2021-32777](https://github.com/envoyproxy/envoy/security/advisories/GHSA-r222-74fw-jqr9)
[envoy GSA CVE-2021-32779](https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h)
[envoy announcement](https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [pomerium/pomerium](https://github.com/pomerium/pomerium/issues)
* Email us at [security@pomerium.com](mailto:security@pomerium.com)
Vulnerability: GO-2021-0086
Aliases: CVE-2019-19619
Published: 2021-04-14T12:00:00Z

HTML content in mardkwon is not santized during rendering, possibly allowing
XSS if used to render untrusted user input.
Vulnerability: GO-2021-0069
Aliases: CVE-2020-28362
Published: 2021-04-14T12:00:00Z

A number of math/big.Int methods can panic when provided large inputs due
to a flawed division method.
Vulnerability: GHSA-g636-q5fc-4pr7
Summary: accounts: Hash account number using Salt
Severity: LOW
Published: 2021-05-24T17:00:27Z

@alovak found that currently when we build hash of account number we do not "salt" it. Which makes it vulnerable to rainbow table attack.

**What did you expect to see?**
I expected salt (some random number from configuration) to be used in [hash.AccountNumber](https://github.com/moov-io/customers/blob/master/pkg/secrets/hash/account_number.go#L13)

I would generate salt per tenant at least (maybe per organization).
Vulnerability: GHSA-f854-hpxv-cw9r
Summary: Drainage of FeeCollector's Block Transaction Fees in cronos
Aliases: CVE-2021-43839
Severity: HIGH
CWE: CWE-670
Published: 2022-01-06T18:30:54Z

### Impact
In Cronos nodes running versions before v0.6.5, it is possible to take transaction fees from Cosmos SDK's FeeCollector for the current block by sending a custom crafted MsgEthereumTx.

User funds and balances are safe.


### Patches
This problem has been patched in Cronos v0.6.5 on the mempool level.
The next network upgrade with consensus-breaking changes will patch it on the consensus level.

### Workarounds
There are no tested workarounds. All validator node operators are recommended to upgrade to Cronos v0.6.5 at their earliest possible convenience.

### Credits
Thank you to @zb3 for reporting this issue on [Cronos Immunefi Bug Bounty Program](https://immunefi.com/bounty/cronos/), to @cyril-crypto for reproducing the issue and to @yihuang and @thomas-nguy for patching the issue on the CheckTx (mempool) and the DeliverTx (consensus) levels.

### For more information
If you have any questions or comments about this advisory:
* Open a discussion in [crypto-org-chain/cronos](https://github.com/crypto-org-chain/cronos/discussions/new)
* Email us at [chain@crypto.org](mailto:chain@crypto.org)
Vulnerability: GHSA-c77f-4rgj-jfr4
Summary: Cross-site Scripting in Beego
Aliases: CVE-2021-39391
Severity: HIGH
CWE: CWE-79, CWE-64
Published: 2021-09-15T20:23:28Z

Cross Site Scripting (XSS) vulnerability exists in the admin panel in Beego v2.0.1 via the URI path in an HTTP request, which is activated by administrators viewing the "Request Statistics" page.
Vulnerability: GHSA-qmfx-75ff-8mw6
Summary: Listing of upload directory contents possible
Severity: HIGH
Published: 2021-05-27T18:41:00Z

There's an security issue in prosody-filer versions **< 1.0.1** which leads to unwanted directory listings of download directories. 

An attacker is able to list previous uploads of a certain user by shortening the URL and accessing a URL subdirectors other than `/upload/` (or the corresponding user defined root dir)

Version 1.0.1 and later fix this problem and allow only direct file access if the full path is known. Directory listings are blocked entirely.
Vulnerability: GHSA-36h2-95gj-w488
Summary: Open redirect in Gitea
Aliases: CVE-2021-45328
Severity: MODERATE
CWE: CWE-601
Published: 2022-02-09T00:00:28Z

Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs.
Vulnerability: GHSA-57q7-rxqq-7vgp
Summary: On Windows, `git-sizer` might run a `git` executable within the repository being analyzed
Severity: MODERATE
Published: 2022-02-15T01:57:18Z

### Impact
On Windows, if `git-sizer` is run against a non-bare repository, and that repository has an executable called `git.exe`, `git.bat`, etc., then that executable might be run by `git-sizer` rather than the system `git` executable. An attacker could try to use social engineering to get a victim to run `git-sizer` against a hostile repository and thereby get the victim to run arbitrary code.

On Linux or other Unix-derived platforms, a similar problem could occur if the user's `PATH` has the current directory before the path to the standard `git` executable, but this is would be a very unusual configuration that has been known for decades to lead to all kinds of security problems.

### Patches
Users should update to git-sizer v1.4.0

### Workarounds
If you are on Windows, then either
* Don't run `git-sizer` against a repository that might contain hostile code, or, if you must…
* Run `git-sizer` against a bare clone of the hostile repository, or, if that is not possible…
* Make sure that the hostile repository doesn't have an executable in its top-level directory before running `git-sizer`.

If you are on Linux or other Unix-based system, then (for myriad reasons!) don't add the current directory to your `PATH`.

### References
* [Command PATH security in Go](https://blog.golang.org/path-security)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the `git-sizer` project](https://github.com/github/git-sizer).
* Email us at [GitHub support](mailto:support@github.com).
Vulnerability: GHSA-r4gv-vj59-cccm
Summary: Control character injection in console output in github.com/ipfs/go-ipfs 
Aliases: CVE-2020-26283
Severity: MODERATE
CWE: CWE-150, CWE-116
Published: 2021-06-23T17:27:27Z

### Impact
Control characters are not escaped from console output. This can result in hiding input from the user which could result in the user taking an unknown, malicious action.

### Patches
<!-- _Has the problem been patched? What versions should users upgrade to?_  -->

- Patched via https://github.com/ipfs/go-ipfs/pull/7831 in v0.8.0

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [go-ipfs](http://github.com/ipfs/go-ipfs)
* Email us at [security@ipfs.io](mailto:security@ipfs.io)
Vulnerability: GHSA-hgwp-4vp4-qmm2
Summary: Local Privilege Escalation in cloudflared
Aliases: CVE-2020-24356
Severity: HIGH
CWE: CWE-427
Published: 2021-05-24T16:56:35Z

In `cloudflared` versions < 2020.8.1 on Windows, if an administrator has started `cloudflared` and set it to read configuration files from a certain directory, an unprivileged user can exploit a misconfiguration in order to escalate privileges and execute system-level commands. The misconfiguration was due to the way that `cloudflared` reads its configuration file. One of the locations that `cloudflared` reads from (C:\etc\) is not a secure by default directory due to the fact that Windows does not enforce access controls on this directory without further controls applied. A malformed config.yaml file can be written by any user. Upon reading this config, `cloudflared` would output an error message to a log file defined in the malformed config. The user-controlled log file location could be set to a specific location that Windows will execute when any user logs in.
Vulnerability: GHSA-g44j-7vp3-68cv
Summary: Arbitrary File Write in Libcontainer
Aliases: CVE-2015-3629
Severity: HIGH
CWE: CWE-59
Published: 2022-02-15T01:57:18Z

Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container.
Vulnerability: GO-2020-0034
Published: 2021-04-14T12:00:00Z

Due to improper path santization, archives containing relative file
paths can cause files to be written (or overwritten) outside of the
target directory.
Vulnerability: GHSA-jv9c-w74q-6762
Summary: Insecure permissions on build temporary rootfs in Singularity
Aliases: CVE-2020-25040
Severity: HIGH
CWE: CWE-732, CWE-668
Published: 2021-05-24T16:56:23Z

### Impact

Insecure permissions on temporary directories used in explicit and implicit container build operations.

When a Singularity command that results in a container build operation is executed, it is possible for a user with access to the system to read the contents of the image during the build. Additionally, if the image contains a world-writable file or directory, it is possible for a user to inject arbitrary content into the running build, which in certain circumstances may enable arbitrary code execution during the build and/or when the built container is run.

### Patches

This issue is addressed in Singularity 3.6.3.

All users are advised to upgrade to 3.6.3.

### Workarounds

The issue is mitigated if `TMPDIR` is set to a location that is only accessible to the user, as any subdirectories directly under `TMPDIR` cannot then be accessed by others. However, this is difficult to enforce so it is not recommended to rely on this as a mitigation.

### For more information

General questions about the impact of the advisory / changes made in the 3.6.0 release can be asked in the:

* [Singularity Slack Channel](https://bit.ly/2m0g3lX)
* [Singularity Mailing List](https://groups.google.com/a/lbl.gov/forum/??sdf%7Csort:date#!forum/singularity)

Any sensitive security concerns should be directed to: security@sylabs.io

See our Security Policy here: https://sylabs.io/security-policy
Vulnerability: GHSA-8w94-cf6g-c8mg
Summary: Man-in-the-Middle (MitM)
Aliases: CVE-2014-5277
Severity: MODERATE
Published: 2022-02-15T01:57:18Z

Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic.
Vulnerability: GHSA-hv53-vf5m-8q94
Summary: Validation bypass vulnerability 
Severity: LOW
Published: 2022-02-11T23:28:20Z

Back in min June a security vulnerability was reported to the team, the reason for the slow response was due to ownership of some packages
was locked and we wanted to be sure to update all packages before any disclosure was released.

The issue is deemed being a Low severity vulnerability.

### Impact

This vulnerability impacts users who rely on the for last digits of personnummer to be a _real_ personnummer.  

### Patches

The issue have been patched in all repositories. The following versions should be updated to as soon as possible:

C# 3.0.2  
D 3.0.1  
Dart 3.0.3  
Elixir 3.0.0  
Go 3.0.1  
Java 3.3.0  
JavaScript 3.1.0  
Kotlin 1.1.0  
Lua 3.0.1  
PHP 3.0.2  
Perl 3.0.0  
Python 3.0.2  
Ruby 3.0.1  
Rust 3.0.0  
Scala 3.0.1  
Swift 1.0.1  

If you are using any of the earlier packages, please update to latest.

### Workarounds

The issue arrieses from the regular expression allowing the first three digits in the last four digits of the personnummer to be
000, which is invalid. To mitigate this without upgrading, a check on the last four digits can be made to make sure it's not
000x.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Personnummer Meta](https://github.com/personnummer/meta/issues)
* Email us at [Personnummer Email](mailto:security@personnummer.dev)

### Credits

Niklas Sköldmark (Medborgarskolan)
Vulnerability: GO-2021-0090
Aliases: CVE-2020-15091
Published: 2021-04-14T12:00:00Z

Proposed commits may contain signatures for blocks not contained within the commit. Instead of skipping
these signatures, they cause failure during verification. A malicious proposer can use this to force
consensus failures.
Vulnerability: GHSA-rmh2-65xw-9m6q
Summary: Infinite Loop in jsonparser
Aliases: CVE-2020-10675
Severity: MODERATE
CWE: CWE-835
Published: 2021-05-18T18:26:25Z

The Library API in buger jsonparser through 2019-12-04 allows attackers to cause a denial of service (infinite loop) via a Delete call.
Vulnerability: GHSA-h6xx-pmxh-3wgp
Summary: Improper Authentication in etcd
Aliases: CVE-2018-16886
Severity: HIGH
CWE: CWE-287, CWE-285
Published: 2022-04-12T22:41:32Z

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.
Vulnerability: GHSA-27rq-4943-qcwp
Summary: Insertion of Sensitive Information into Log File in Hashicorp go-getter
Aliases: CVE-2022-29810
Severity: MODERATE
CWE: CWE-532
Published: 2022-04-28T00:00:35Z

The Hashicorp go-getter library before 1.5.11 could write SSH credentials into its logfile, exposing sensitive credentials to local users able to read the logfile.
Vulnerability: GHSA-9h63-7qf6-mv6r
Summary: Improper Authorization in github.com/containers/libpod
Aliases: CVE-2021-20188
Severity: HIGH
CWE: CWE-863
Published: 2021-05-18T18:33:12Z

A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if owned by the root user inside the container. It does not allow to directly escape the container, though being a privileged container means that a lot of security features are disabled when running the container. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Vulnerability: GO-2020-0018
Published: 2021-04-14T12:00:00Z

UUIDs generated using [`NewV1`] and [`NewV4`] may not read the expected
number of random bytes. These UUIDs may contain a significantly smaller
amount of entropy than expected, possibly leading to collisions.
Vulnerability: GHSA-wxj3-qwv4-cvfm
Summary: Privilege Escalation in Docker
Aliases: CVE-2014-3499
Severity: HIGH
CWE: CWE-269
Published: 2022-02-15T00:40:44Z

Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.
Vulnerability: GO-2021-0053
Aliases: CVE-2021-3121
Published: 2021-04-14T12:00:00Z

Due to improper bounds checking, maliciously crafted input to generated
Unmarshal methods can cause an out-of-bounds panic. If parsing messages
from untrusted parties, this may be used as a denial of service vector.
Vulnerability: GHSA-86r9-39j9-99wp
Summary: Elliptic Curve Key Disclosure in go-jose
Aliases: CVE-2016-9121
Severity: CRITICAL
CWE: CWE-326
Published: 2021-06-23T17:17:52Z

go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making it vulnerable to an invalid curve attack.
Vulnerability: GHSA-35rf-v2jv-gfg7
Summary: Privilege escalation to cluster admin on multi-tenant environments
Aliases: CVE-2021-41254
Severity: HIGH
CWE: CWE-78
Published: 2021-11-15T17:35:33Z

Users that can create Kubernetes Secrets, Service Accounts and Flux Kustomization objects, could execute commands inside the kustomize-controller container by embedding a shell script in a Kubernetes Secret. This can be used to run `kubectl` commands under the Service Account of kustomize-controller, thus allowing an authenticated Kubernetes user to gain cluster admin privileges.

### Impact

Multitenant environments where non-admin users have permissions to create Flux Kustomization objects are affected by this issue.

### Exploit 

To exploit the command injection, first we create a secret with a shell command:

```sh
kubectl create secret generic exploit-token --from-literal=token=" || kubectl api-versions"
```

Then we create a Service Account that refers to the above Secret:

```yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: exploit
  namespace: default
automountServiceAccountToken: false
secrets:
- name: exploit-token
```

And finally a Kustomization that runs under the above Service Account:

```yaml
apiVersion: kustomize.toolkit.fluxcd.io/v1beta1
kind: Kustomization
metadata:
  name: exploit
  namespace: default
spec:
  interval: 5m
  path: "./deploy/"
  sourceRef:
    kind: GitRepository
    name: app
  serviceAccountName: exploit
```

When kustomize-controller reconciles the above Kustomization, it will execute the shell command from the secret.

### Patches

This vulnerability was fixed in kustomize-controller v0.15.0 (included in flux2 v0.18.0) released on 2021-10-08. Starting with v0.15, the kustomize-controller no longer executes shell commands on the container OS and the `kubectl` binary has been removed from the container image.

### Workarounds

To prevent the creation of Kubernetes Service Accounts with `secrets` in namespaces owned by tenants, a Kubernetes validation webhook such as Gatekeeper OPA or Kyverno can be used.

```yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-sa
spec:
  validationFailureAction: enforce
  background: false
  rules:
    - name: validate-sa
      match:
        resources:
          kinds:
            - ServiceAccount
          namespaces:
            - tenant1
            - tenant2
        subjects:
          - kind: User
            name: some@tenant1.com
          - kind: User
            name: some@tenant2.com
          - kind: ServiceAccount
            name: kustomize-controller
            namespace: flux-system
          - kind: ServiceAccount
            name: helm-controller
            namespace: flux-system
      validate:
        message: "Invalid service account"
        pattern:
          X(secrets): "*?"
```

### References

Disclosed by ADA Logics in a security audit of the Flux project sponsored by CNCF and facilitated by OSTIF.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [kustomize-controller repository](http://github.com/fluxcd/kustomize-controller)
Vulnerability: GHSA-g5gj-9ggf-9vmq
Summary: Infinite certificate chain depth results in OctoRPKI running forever
Aliases: CVE-2021-3908
Severity: MODERATE
CWE: CWE-400
Published: 2021-11-10T20:38:53Z

OctoRPKI does not limit the depth of a certificate chain, allowing for a CA to create children in an ad-hoc fashion, thereby making tree traversal never end.

## Patches 

## For more information
If you have any questions or comments about this advisory email us at security@cloudflare.com
Vulnerability: GHSA-vj3f-3286-r4pf
Summary: Path Traversal in Docker
Aliases: CVE-2014-9356
Severity: HIGH
CWE: CWE-22
Published: 2021-05-18T21:09:17Z

Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile.
Vulnerability: GHSA-mc8v-mgrf-8f4m
Summary: Clarify Content-Type handling
Aliases: CVE-2021-41190
Severity: LOW
CWE: CWE-843
Published: 2021-11-18T16:13:08Z

### Impact
In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently.

### Patches
The OCI Distribution Specification will be updated to require that a `mediaType` value present in a manifest or index match the Content-Type header used during the push and pull operations.

### Workarounds
Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields.

### References
https://github.com/opencontainers/image-spec/security/advisories/GHSA-77vh-xpmg-72qh

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/opencontainers/distribution-spec/
* Email us at security@opencontainers.org
Vulnerability: GHSA-4w5x-x539-ppf5
Summary: Incorrect handling of credential expiry by NATS Server
Aliases: CVE-2020-26892
Severity: HIGH
CWE: CWE-798
Published: 2022-02-11T23:42:20Z


## Problem Description

NATS nats-server through 2020-10-07 has Incorrect Access Control because of how expired credentials are handled.

The NATS accounts system has expiration timestamps on credentials; the <https://github.com/nats-io/jwt> library had an API which encouraged misuse and an `IsRevoked()` method which misused its own API.

A new `IsClaimRevoked()` method has correct handling and the nats-server has been updated to use this.  The old `IsRevoked()` method now always returns true and other client code will have to be updated to avoid calling it.

The CVE identifier should cover any application using the old JWT API, where the nats-server is one of those applications.


## Affected versions

#### JWT library

 * all versions prior to 1.1.0
 * fixed after nats-io/jwt PR 103 landed (2020-10-06)

#### NATS Server

 * Version 2 prior to 2.1.9
   + 2.0.0 through and including 2.1.8 are vulnerable.
 * fixed with nats-io/nats-server PRs 1632, 1635, 1645


## Impact

Time-based credential expiry did not work.


## Workaround

Have credentials which only expire after fixes can be deployed.


## Solution

Upgrade the JWT dependency in any application using it.

Upgrade the NATS server if using NATS Accounts.
Vulnerability: GHSA-m358-g4rp-533r
Summary: SQL Injection in Casdoor
Aliases: CVE-2022-24124
Severity: HIGH
CWE: CWE-89
Published: 2022-02-01T00:49:39Z

The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.
Vulnerability: GHSA-m6m5-pp4g-fcc8
Summary: S3 storage write is not aborted on errors leading to unbounded memory usage
Severity: HIGH
CWE: CWE-772
Published: 2021-10-06T17:47:35Z

### Impact

Anyone using storage.blob.s3 introduced in 0.5.0 with storage.imapsql.
```
storage.imapsql local_mailboxes {
  ...
  msg_store s3 {
    ...
  }
}
```

### Patches

The relevant commit is pushed to master and will be included in the 0.5.1 release.

No special handling of the issue has been done due to the small amount of affected users.

### Workarounds

None.

### References

* Original report: https://github.com/foxcpp/maddy/issues/395
* Fix: https://github.com/foxcpp/maddy/commit/07c8495ee4394fabbf5aac4df8aebeafb2fb29d8
Vulnerability: GHSA-xhg2-rvm8-w2jh
Summary: Cross-site Request Forgery (CSRF)
Aliases: CVE-2019-13209
Severity: HIGH
CWE: CWE-352, CWE-79
Published: 2021-05-18T15:42:40Z

Rancher 2 through 2.2.4 is vulnerable to a Cross-Site Websocket Hijacking attack that allows an exploiter to gain access to clusters managed by Rancher. The attack requires a victim to be logged into a Rancher server, and then to access a third-party site hosted by the exploiter. Once that is accomplished, the exploiter is able to execute commands against the cluster's Kubernetes API with the permissions and identity of the victim.
Vulnerability: GHSA-8h2g-r292-j8xh
Summary: L7 deny intention results in an allow action
Aliases: CVE-2021-36213
Severity: HIGH
Published: 2021-07-19T21:21:12Z

In HashiCorp Consul before 1.10.1 (and Consul Enterprise), xds can generate a situation where a single L7 deny intention (with a default deny policy) results in an allow action.
Vulnerability: GO-2021-0100
Aliases: CVE-2021-20291
Published: 2021-07-28T12:00:00Z

Due to a goroutine deadlock, using github.com/containers/storage/pkg/archive.DecompressStream
on a xz archive returns a reader which will hang indefinitely when Close is called. An attacker
can use this to cause denial of service if they are able to cause the caller to attempt to
decompress an archive they control.
Vulnerability: GHSA-5hjh-c26m-xw8w
Summary: ProxyScotch is vulnerable to a server-side Request Forgery (SSRF)
Aliases: CVE-2022-25850
Severity: HIGH
CWE: CWE-918
Published: 2022-05-03T00:00:44Z

ProxyScotch is a simple proxy server created for hoppscotch.io. The package github.com/hoppscotch/proxyscotch before 1.0.0 are vulnerable to Server-side Request Forgery (SSRF) when interceptor mode is set to proxy. It occurs when an HTTP request is made by a backend server to an untrusted URL submitted by a user. It leads to a leakage of sensitive information from the server.
Vulnerability: GHSA-pvx3-gm3c-gmpr
Summary: Denial of Service in Go-Ethereum
Aliases: CVE-2022-23327
Severity: HIGH
Published: 2022-03-05T00:00:46Z

A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which can purge all of pending transactions in a victim node's memory pool, causing a denial of service (DoS).
Vulnerability: GO-2021-0065
Aliases: CVE-2019-11250
Published: 2021-04-14T12:00:00Z

Authorization tokens may be inappropriately logged if the verbosity
level is set to a debug level.
Vulnerability: GHSA-458f-26r3-x2c3
Summary: Cross-site Scripting in github.com/schollz/rwtxt
Aliases: CVE-2021-20848
Severity: MODERATE
CWE: CWE-79
Published: 2021-11-29T18:00:21Z

Cross-site scripting vulnerability in rwtxt versions prior to v1.8.6 allows a remote attacker to inject an arbitrary script via unspecified vectors.
Vulnerability: GHSA-mpq4-rjj8-fjph
Summary: Uncontrolled Resource Consumption in github.com/google/fscrypt
Aliases: CVE-2022-25326
Severity: MODERATE
CWE: CWE-400
Published: 2022-02-26T00:00:44Z

fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We recommend upgrading to fscrypt 0.3.3 or above and adjusting the permissions on existing fscrypt metadata directories where applicable.
Vulnerability: GHSA-q547-gmf8-8jr7
Summary: Signature Validation Bypass in goxmldsig
Aliases: CVE-2020-15216
Severity: MODERATE
CWE: CWE-347
Published: 2021-05-24T16:57:32Z

### Impact
With a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. 

### Patches
A patch is available, all users of goxmldsig should upgrade to v1.1.0.

### For more information
If you have any questions or comments about this advisory open an issue at https://github.com/russellhaering/goxmldsig
Vulnerability: GHSA-77gc-fj98-665h
Summary: Signature Validation Bypass
Aliases: CVE-2016-9122
Severity: HIGH
CWE: CWE-284
Published: 2021-05-18T19:15:09Z

Go JOSE before 1.1.0 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the library might mistakenly read protected header values from an attached signature that was different from the one originally validated.
Vulnerability: GHSA-ffhg-7mh4-33c4
Summary: Improper Verification of Cryptographic Signature in golang.org/x/crypto
Aliases: CVE-2020-9283
Severity: MODERATE
CWE: CWE-347
Published: 2021-05-18T15:29:31Z

golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.
Vulnerability: GHSA-jh63-28gx-7p26
Summary: Command Injection in CasaOS
Aliases: CVE-2022-24193
Severity: CRITICAL
CWE: CWE-78
Published: 2022-03-11T00:02:17Z

CasaOS before v0.2.7 was discovered to contain a command injection vulnerability via the component leave or join zerotier api.
Vulnerability: GHSA-hf6f-jq25-8gq9
Summary: Remote Code Execution (RCE)
Aliases: CVE-2018-18926
Severity: CRITICAL
CWE: CWE-94
Published: 2022-02-15T01:57:18Z

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron.
Vulnerability: GHSA-5gjm-fj42-x983
Summary: Cross-site Request Forgery (CSRF)
Aliases: CVE-2018-1098
Severity: HIGH
CWE: CWE-352
Published: 2022-02-15T01:57:18Z

A cross-site request forgery flaw was found in etcd 3.3.1 and earlier. An attacker can set up a website that tries to send a POST request to the etcd server and modify a key. Adding a key is done with PUT so it is theoretically safe (can't PUT from an HTML form or such) but POST allows creating in-order keys that an attacker can send.
Vulnerability: GO-2021-0073
Aliases: CVE-2017-17831
Published: 2021-04-14T12:00:00Z

Arbitary command execution can be triggered by improperly
sanitized SSH URLs in LFS configuration files. This can be
triggered by cloning a malicious repoistory.
Vulnerability: GHSA-hwqm-x785-qh8p
Summary: Incorrect Permission Assignment for Critical Resource	in Hashicorp Consul
Aliases: CVE-2020-12797
Severity: MODERATE
CWE: CWE-732
Published: 2021-06-23T17:52:33Z

HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4.
Vulnerability: GO-2020-0038
Aliases: CVE-2019-20786
Published: 2021-04-14T12:00:00Z

Due to improper verification of packets, unencrypted packets containing
application data are accepted after the initial handshake. This allows
an attacker to inject arbitary data which the client/server believes
was encrypted, despite not knowing the session key.
Vulnerability: GHSA-w3wf-cfx3-6gcx
Summary: SAML authentication vulnerability due to stdlib XML parsing
Aliases: CVE-2020-26276
Severity: HIGH
CWE: CWE-290
Published: 2022-02-11T23:59:14Z

### Impact
Due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP.

Users that configure Fleet with SSO login may be vulnerable to this issue.

### Patches
This issue is patched in 3.5.1 using https://github.com/mattermost/xml-roundtrip-validator.

### Workarounds
If upgrade to 3.5.1 is not possible, users should disable SSO authentication in Fleet.

### References
See https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/ for more information about the underlying vulnerabilities.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@fleetdm.com](mailto:security@fleetdm.com)
* Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)
Vulnerability: GHSA-fqfh-778m-2v32
Summary: GitHub CLI can execute a git binary from the current directory
Severity: MODERATE
Published: 2022-02-11T23:41:11Z

### Impact
GitHub CLI depends on a `git.exe` executable being found in system `%PATH%` on Windows. However, if a malicious `.\git.exe` or `.\git.bat` is found in the current working directory at the time of running `gh`, the malicious command will be invoked instead of the system one.

Windows users who run `gh` inside untrusted directories are affected.

### Patches
Users should upgrade to GitHub CLI v1.2.1.

### Workarounds
Other than avoiding untrusted repositories, there is no workaround.

### References
https://github.com/golang/go/issues/38736
Vulnerability: GHSA-8m9g-647g-5pxw
Summary: Infinite loop in Yubico yubihsm-connector
Aliases: CVE-2021-28484
Severity: HIGH
CWE: CWE-835
Published: 2022-02-15T01:57:18Z

An issue was discovered in the /api/connector endpoint handler in Yubico yubihsm-connector before 3.0.1 (in YubiHSM SDK before 2021.04). The handler did not validate the length of the request, which can lead to a state where yubihsm-connector becomes stuck in a loop waiting for the YubiHSM to send it data, preventing any further operations until the yubihsm-connector is restarted. An attacker can send 0, 1, or 2 bytes to trigger this.
Vulnerability: GHSA-m3fm-h5jp-q79p
Summary: Authorization bypass in Openshift
Aliases: CVE-2016-1906
Severity: CRITICAL
CWE: CWE-285
Published: 2021-12-20T16:58:14Z

Openshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that is not allowed.
Vulnerability: GO-2020-0043
Aliases: CVE-2018-21246
Published: 2021-04-14T12:00:00Z

Due to improper TLS verification when serving traffic for multiple
SNIs, an attacker may bypass TLS client authentication by indicating
an SNI during the TLS handshake that is different from the name in
the HTTP Host header.
Vulnerability: GHSA-cx3w-xqmc-84g5
Summary: Git LFS can execute a Git binary from the current directory on Windows
Aliases: CVE-2021-21237
Severity: HIGH
CWE: CWE-94, CWE-426
Published: 2022-02-15T00:30:37Z

### Impact
On Windows, if Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, that program would be executed, permitting the attacker to execute arbitrary code. This does not affect Unix systems.

This is the result of an incomplete fix for CVE-2020-27955.

This issue occurs because on Windows, [Go includes (and prefers) the current directory when the name of a command run does not contain a directory separator](https://github.com/golang/go/issues/38736).

### Patches
This version should be patched in v2.13.2, which will be released in coordination with this security advisory.

### Workarounds
Other than avoiding untrusted repositories or using a different operating system, there is no workaround.

### References
_Are there any links users can visit to find out more?_

### For more information
If you have any questions or comments about this advisory:

- Start a discussion in [the Git LFS discussion page](https://github.com/git-lfs/git-lfs/discussions).
- If you cannot open a discussion, please email the core team using their usernames at `github.com`.
Vulnerability: GHSA-4g52-pqcj-phvh
Summary: BLS Signature "Malleability"
Aliases: CVE-2021-21405
Severity: MODERATE
CWE: CWE-347
Published: 2021-05-21T16:23:43Z

### Impact

1. BLS signature validation in lotus uses blst library method VerifyCompressed. This method accepts signatures in 2 forms - "serialized", and "compressed", meaning that BLS signatures can be provided as either of 2 unique byte arrays.
2. Lotus block validation functions perform a uniqueness check on provided blocks. Two blocks are considered distinct if the CIDs of their blockheader do not match. The CID method for blockheader includes the BlockSig of the block.

The result of these issues is that it would be possible to punish miners for valid blocks, as there are two different valid block CIDs available for each block, even though this must be unique.

### Patches

By switching from the go based `blst` bindings over to the bindings in `filecoin-ffi`, the code paths now ensure that all signatures are compressed by size and the way they are deserialized.
This happened in https://github.com/filecoin-project/lotus/pull/5393


### References

- Original POC: https://gist.github.com/wadeAlexC/2490d522e81a796af9efcad1686e6754
Vulnerability: GHSA-rf3m-mhv7-x39f
Summary: Denial of Service in OpenShift Origin
Aliases: CVE-2015-5250
Severity: MODERATE
CWE: CWE-20
Published: 2021-12-20T16:58:22Z

The API server in OpenShift Origin 1.0.5 allows remote attackers to cause a denial of service (master process crash) via crafted JSON data.
Vulnerability: GO-2020-0014
Aliases: CVE-2018-17846
Published: 2021-04-14T12:00:00Z

[`html.Parse`] does not properly handle "select" tags, which can lead
to an infinite loop. If parsing user supplied input, this may be used
as a denial of service vector.
Vulnerability: GHSA-g622-r636-qfqh
Summary: SQL Injection in Couchbase Sync Gateway
Aliases: CVE-2019-9039
Severity: CRITICAL
CWE: CWE-89
Published: 2022-02-15T01:57:18Z

The Couchbase Sync Gateway 2.1.2 in combination with a Couchbase Server is affected by a previously undisclosed N1QL-injection vulnerability in the REST API. An attacker with access to the public REST API can insert additional N1QL statements through the parameters ?startkey? and ?endkey? of the ?_all_docs? endpoint.
Vulnerability: GO-2020-0002
Aliases: CVE-2020-8945
Published: 2021-04-14T12:00:00Z

The [`Data`][], [`Context`][], or [`Key`][] finalizers might run during or
before GPGME operations, releasing the C structures as they are still in use,
leading to crashes and potentially code execution through a use-after-free.
Vulnerability: GHSA-2c64-vj8g-vwrq
Summary: Incorrect handling of credential expiry by NATS Server
Severity: HIGH
CWE: CWE-284
Published: 2021-05-21T16:11:49Z

(This advisory is canonically https://advisories.nats.io/CVE/CVE-2020-26892.txt )

## Problem Description

NATS nats-server through 2020-10-07 has Incorrect Access Control because of how expired credentials are handled.

The NATS accounts system has expiration timestamps on credentials; the <https://github.com/nats-io/jwt> library had an API which encouraged misuse and an `IsRevoked()` method which misused its own API.

A new `IsClaimRevoked()` method has correct handling and the nats-server has been updated to use this.  The old `IsRevoked()` method now always returns true and other client code will have to be updated to avoid calling it.

The CVE identifier should cover any application using the old JWT API, where the nats-server is one of those applications.


## Affected versions

#### JWT library

 * all versions prior to 1.1.0
 * fixed after nats-io/jwt PR 103 landed (2020-10-06)

#### NATS Server

 * Version 2 prior to 2.1.9
   + 2.0.0 through and including 2.1.8 are vulnerable.
 * fixed with nats-io/nats-server PRs 1632, 1635, 1645


## Impact

Time-based credential expiry did not work.


## Workaround

Have credentials which only expire after fixes can be deployed.


## Solution

Upgrade the JWT dependency in any application using it.

Upgrade the NATS server if using NATS Accounts.
Vulnerability: GHSA-23jv-v6qj-3fhh
Summary: Denial of Service (DoS) in HashiCorp Consul
Aliases: CVE-2020-7219
Severity: HIGH
CWE: CWE-400, CWE-770
Published: 2021-05-18T18:19:21Z

HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 1.6.3.
Vulnerability: GHSA-qq97-vm5h-rrhg
Summary: OCI Manifest Type Confusion Issue
Severity: LOW
CWE: CWE-843
Published: 2022-02-08T18:53:56Z

### Impact

Systems that rely on digest equivalence for image attestations may be vulnerable to type confusion.

### Patches

Upgrade to at least `v2.8.0-beta.1`  if you are running `v2.x` release. If you use the code from the `main` branch, update at least to the commit after [b59a6f827947f9e0e67df0cfb571046de4733586](https://github.com/distribution/distribution/commit/b59a6f827947f9e0e67df0cfb571046de4733586).

### Workarounds

There is no way to work around this issue without patching.

### References

Due to [an oversight in the OCI Image Specification](https://github.com/opencontainers/image-spec/pull/411) that removed the embedded `mediaType` field from manifests, a maliciously crafted OCI Container Image can cause registry clients to parse the same image in two different ways without modifying the image’s digest by modifying the `Content-Type` header returned by a registry. This can invalidate a common pattern of relying on container image digests for equivalence.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [distribution](https://github.com/distribution/distribution) 
* Open an issue in [distribution-spec](https://github.com/opencontainers/distribution-spec) 
* Email us at [cncf-distribution-security@lists.cncf.io](mailto:cncf-distribution-security@lists.cncf.io)
Vulnerability: GHSA-jp32-vmm6-3vf5
Summary: Directory Traversal in Kubernetes
Aliases: CVE-2015-5305
Severity: MODERATE
CWE: CWE-22
Published: 2022-02-15T01:57:18Z

Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is not properly handled before passing it to etcd.
Vulnerability: GHSA-59qg-grp7-5r73
Summary: Weave Net clusters susceptible to MitM attacks via IPv6 rogue router advertisements
Aliases: CVE-2020-11091
Severity: MODERATE
CWE: CWE-350
Published: 2021-05-27T19:00:08Z

### Impact
An attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert themselves as a fake service.

In a cluster with an IPv4 internal network, if IPv6 is not totally disabled on the host (via ipv6.disable=1 on the kernel cmdline), it will be either unconfigured or configured on some interfaces, but it’s pretty likely that ipv6 forwarding is disabled, ie /proc/sys/net/ipv6/conf//forwarding == 0. Also by default, /proc/sys/net/ipv6/conf//accept_ra == 1. The combination of these 2 sysctls means that the host accepts router advertisements and configure the IPv6 stack using them.

By sending “rogue” router advertisements, an attacker can reconfigure the host to redirect part or all of the IPv6 traffic of the host to the attacker controlled container.
Even if there was no IPv6 traffic before, if the DNS returns A (IPv4) and AAAA (IPv6) records, many HTTP libraries will try to connect via IPv6 first then fallback to IPv4, giving an opportunity to the attacker to respond.
If by chance you also have on the host a vulnerability like last year’s RCE in apt (CVE-2019-3462), you can now escalate to the host.

### Patches
Weave Net version 2.6.3 (to be released soon) will disable the accept_ra option on the veth devices that it creates.

### Workarounds
Users should not run containers with CAP_NET_RAW capability.  This has been the advice from Weave Net for years.
https://www.weave.works/docs/net/latest/kubernetes/kube-addon/#-securing-the-setup

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the Weave Net repo](https://github.com/weaveworks/weave/issues/new)
* Join the <a href="https://slack.weave.works/" target="_blank">Weave Users Slack</a>.
Vulnerability: GHSA-f6mq-5m25-4r72
Summary: Improper Validation of Specified Type of Input
Aliases: CVE-2021-20329
Severity: MODERATE
CWE: CWE-20, CWE-1287
Published: 2021-06-15T16:08:16Z

Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers up to (and including) 1.5.0.
Vulnerability: GO-2021-0107
Published: 2021-07-28T12:00:00Z

Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a
nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or
authentication bypass.
Vulnerability: GO-2020-0009
Aliases: CVE-2016-9123
Published: 2021-04-14T12:00:00Z

On 32-bit platforms an attacker can manipulate a ciphertext encrypted with AES-CBC
with HMAC such that they can control how large the input buffer is when computing
the HMAC authentication tag. This can can allow a manipulated ciphertext to be
verified as authentic, opening the door for padding oracle attacks.
Vulnerability: GHSA-5gjg-jgh4-gppm
Summary: Websocket requests did not call AuthenticateMethod
Severity: MODERATE
CWE: CWE-304
Published: 2021-06-23T17:26:30Z

### Impact

Depending on implementation, a denial-of-service or privilege escalation vulnerability may occur in software that uses the `github.com/ecnepsnai/web` package with Web Sockets that have an AuthenticateMethod.

The `AuthenticateMethod` is not called, and `UserData` will be nil in request methods. Attempts to read the `UserData` may result in a panic.

This issue only affects web sockets where an `AuthenticateMethod` is supplied to the handle options. Users who do not use web sockets, or users who do not require authentication are not at risk.

#### Example

In the example below, one would expect that the `AuthenticateMethod` function would be called for each request to `/example`

```go
handleOptions := web.HandleOptions{
	AuthenticateMethod: func(request *http.Request) interface{} {
		// Assume there is logic here to check for an active sessions, look at cookies or headers, etc...
		var session Session{} // Example

		return session
	},
}

server.Socket("/example", handle, handleOptions)
```

However, the method is not called, and therefor the `UserData` parameter of the request object in the handle will be nil, when it would have been expected to be the `session` object we returned.

### Patches

Release v1.5.2 fixes this vulnerability. The authenticate method is now called for websocket requests.

All users of the web package should update to v1.5.2 or later.

### Workarounds

You may work around this issue by making the authenticate method a named function, then calling that function at the start of the handle method for the websocket. Reject connections when the return value of the method is nil.