TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-gx5w-rrhp-f436
Summary: XSS in mdBook
Aliases: CVE-2020-26297
Severity: HIGH
CVSS score: 8.2
CWE: CWE-79
Published: 2021-08-25T20:56:20Z

> This is a cross-post of [the official security advisory][ml]. The official post contains a signed version with our PGP key, as well.

[ml]: https://groups.google.com/g/rustlang-security-announcements/c/3-sO6of29O0

The Rust Security Response Working Group was recently notified of a security issue affecting the search feature of mdBook, which could allow an attacker to execute arbitrary JavaScript code on the page.

The CVE for this vulnerability is [CVE-2020-26297](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26297).

## Overview

The search feature of mdBook (introduced in version 0.1.4) was affected by a cross site scripting vulnerability that allowed an attacker to execute arbitrary JavaScript code on an user's browser by tricking the user into typing a malicious search query, or tricking the user into clicking a link to the search page with the malicious search query prefilled.

mdBook 0.4.5 fixes the vulnerability by properly escaping the search query.

## Mitigations

Owners of websites built with mdBook have to upgrade to mdBook 0.4.5 or greater and rebuild their website contents with it. It's possible to install mdBook 0.4.5 on the local system with:

```
cargo install mdbook --version 0.4.5 --force
```

## Acknowledgements

Thanks to Kamil Vavra for responsibly disclosing the vulnerability to us according to [our security policy](https://www.rust-lang.org/policies/security).

## Timeline of events

All times are listed in UTC.

- 2020-12-30 20:14 - The issue is reported to the Rust Security Response WG
- 2020-12-30 20:32 - The issue is acknowledged and the investigation began
- 2020-12-30 21:21 - Found the cause of the vulnerability and prepared the patch
- 2021-01-04 15:00 - Patched version released and vulnerability disclosed
Vulnerability: GHSA-pqm6-cgwr-x6pf
Summary: Signature validation bypass in XmlSecLibs
Aliases: CVE-2019-3465
Severity: HIGH
CVSS score: 8.8
CWE: CWE-347
Published: 2019-11-08T20:06:46Z

Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.
Vulnerability: GHSA-6r3p-fcvm-xh7c
Summary: SSRF vulnerability in Arache Airflow
Aliases: CVE-2020-17513
Severity: MODERATE
CVSS score: 0
CWE: CWE-918
Published: 2020-12-17T21:00:58Z

In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack.
Vulnerability: GHSA-ph58-4vrj-w6hr
Summary: XSS vulnerability that affects bootstrap
Aliases: CVE-2018-20677
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-01-17T13:57:56Z

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.
Vulnerability: GHSA-255r-pghp-r5wh
Summary: Malicious Package in hdeky
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T17:05:34Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-4hq8-gmxx-h6w9
Summary: XML Processing error in github.com/crewjam/saml
Aliases: CVE-2020-27846
Severity: HIGH
CVSS score: 9.8
CWE: CWE-287, CWE-115
Published: 2021-06-23T17:29:42Z

### Impact

There are three vulnerabilities in the go `encoding/xml` package that can allow an attacker to forge part of a signed XML document. For details on this vulnerability see [xml-roundtrip-validator](https://github.com/mattermost/xml-roundtrip-validator)

### Patches

In version 0.4.3, all XML input is validated prior to being parsed.
Vulnerability: GHSA-pqhq-xx62-2v2p
Summary: Cross-site scripting in Apache NiFi
Aliases: CVE-2020-1933
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-01-06T20:35:39Z

A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to the UI through action by an unaware authenticated user in Firefox. Did not appear to occur in other browsers.
Vulnerability: GHSA-735c-r4vc-6gm9
Summary: Downloads Resources over HTTP in bionode-sra
Aliases: CVE-2016-10613
Severity: HIGH
CVSS score: 0
CWE: CWE-311, CWE-269
Published: 2019-02-18T23:56:45Z

Affected versions of `bionode-sra` insecurely downloads resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. The author of this package has suggested using [urllib-sync](https://www.npmjs.com/package/urllib-sync).

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-6h88-qjpv-p32m
Summary: OpenSSL gem for Ruby using inadequate encryption strength
Aliases: CVE-2016-7798
Severity: HIGH
CVSS score: 7.5
CWE: CWE-326
Published: 2017-10-24T18:33:35Z

The OpenSSL gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism.
Vulnerability: GHSA-8w3x-457r-wg53
Summary: Out-of-bounds Write in OpenCV
Aliases: CVE-2017-12597
Severity: HIGH
CVSS score: 8.8
CWE: CWE-787
Published: 2021-10-12T22:00:41Z

OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to opencv-python and opencv-contrib-python through 3.3.0.9) has an out-of-bounds write error in the function FillColorRow1 in utils.cpp when reading an image file by using cv::imread.
Vulnerability: GHSA-4gw3-8f77-f72c
Summary: Regular expression denial of service in codemirror
Aliases: CVE-2020-7760
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2021-05-10T18:46:27Z

This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2.
 The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/*.*?*/)*
Vulnerability: GHSA-6m4r-cgm3-6q7q
Summary: Cross-Site Scripting in status-board
Aliases: CVE-2019-15478
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-09-23T18:32:54Z

All versions of `status-board` are vulnerable to Cross-Site Scripting. The `renderJsDashboard()` function concatenates the `safeDashboard` variable to the HTTP response message with insufficient sanitization. If this variable is controlled by user input it may allow attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-6x2m-w449-qwx7
Summary: Code Injection in CRI-O
Aliases: CVE-2022-0811
Severity: HIGH
CVSS score: 8.8
CWE: CWE-94
Published: 2022-03-15T20:13:38Z

### Impact
A flaw introduced in CRI-O version 1.19 which an attacker can use to bypass the safeguards and set arbitrary kernel parameters on the host. As a result, anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime can abuse the `kernel.core_pattern` kernel parameter to achieve container escape and arbitrary code execution as root on any node in the cluster.

### Patches
The patches will be present in 1.19.6, 1.20.7, 1.21.6, 1.22.3, 1.23.2, 1.24.0

### Workarounds
- Users can set manage_ns_lifecycle to false, which causes the sysctls to be configured by the OCI runtime, which typically filter these cases. This option is available in 1.20 and 1.19. Newer versions don't have this option.
- An admission webhook could be created to deny pods that specify a `+` in the sysctl value of a pod.
- A [PodSecurityPolicy](https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#podsecuritypolicy) [deprecated] could be created, specifying all sysctls as forbidden like so: 
```
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: sysctl-psp
spec:
  forbiddenSysctls:
    - "*"
```
However, this option will not work if any sysctls are required by any pods in the cluster.


### Credits
Credit for finding this vulnerability goes to John Walker and Manoj Ahuje of Crowdstrike. The CRI-O community deeply thanks them for the report.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the CRI-O repo](http://github.com/cri-o/cri-o/issues)
* To make a report, email your vulnerability to the private
[cncf-crio-security@lists.cncf.io](mailto:cncf-crio-security@lists.cncf.io) list
with the security details and the details expected for [all CRI-O bug
reports](https://github.com/cri-o/cri-o/blob/main/.github/ISSUE_TEMPLATE/bug-report.yml).
Vulnerability: GHSA-vqhp-cxgc-6wmm
Summary: regular expression denial-of-service (ReDoS) in Bleach
Aliases: CVE-2020-6817
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2020-03-30T19:45:56Z

### Impact

`bleach.clean` behavior parsing style attributes could result in a regular expression denial of service (ReDoS).

Calls to ``bleach.clean`` with an allowed tag with an allowed ``style`` attribute are vulnerable to ReDoS. For example, ``bleach.clean(..., attributes={'a': ['style']})``.

### Patches

3.1.4

### Workarounds

* do not whitelist the style attribute in `bleach.clean` calls

* limit input string length

### References

* https://bugzilla.mozilla.org/show_bug.cgi?id=1623633
* https://www.regular-expressions.info/redos.html
* https://blog.r2c.dev/posts/finding-python-redos-bugs-at-scale-using-dlint-and-r2c/
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6817

### Credits

* Reported by schwag09 of r2c

### For more information
If you have any questions or comments about this advisory:

* Open an issue at https://github.com/mozilla/bleach/issues
* Email us at security@mozilla.org
Vulnerability: GHSA-vmjw-c2vp-p33c
Summary: Crash in NMS ops caused by integer conversion to unsigned
Aliases: CVE-2021-37669
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-681
Published: 2021-08-25T14:42:03Z

### Impact
An attacker can cause denial of service in applications serving models using `tf.raw_ops.NonMaxSuppressionV5` by triggering a division by 0:

```python
import tensorflow as tf

tf.raw_ops.NonMaxSuppressionV5(
  boxes=[[0.1,0.1,0.1,0.1],[0.2,0.2,0.2,0.2],[0.3,0.3,0.3,0.3]],
  scores=[1.0,2.0,3.0],
  max_output_size=-1,
  iou_threshold=0.5,
  score_threshold=0.5,
  soft_nms_sigma=1.0,
  pad_to_max_output_size=True)
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/image/non_max_suppression_op.cc#L170-L271) uses a user controlled argument to resize a `std::vector`:

```cc
  const int output_size = max_output_size.scalar<int>()();
  // ...
  std::vector<int> selected;
  // ...
  if (pad_to_max_output_size) {
    selected.resize(output_size, 0);
    // ...
  }
```
    
However, as `std::vector::resize` takes the size argument as a `size_t` and `output_size` is an `int`, there is an implicit conversion to usigned. If the attacker supplies a negative value, this conversion results in a crash.

A similar issue occurs in `CombinedNonMaxSuppression`:

```python
import tensorflow as tf

tf.raw_ops.NonMaxSuppressionV5(
  boxes=[[[[0.1,0.1,0.1,0.1],[0.2,0.2,0.2,0.2],[0.3,0.3,0.3,0.3]],[[0.1,0.1,0.1,0.1],[0.2,0.2,0.2,0.2],[0.3,0.3,0.3,0.3]],[[0.1,0.1,0.1,0.1],[0.2,0.2,0.2,0.2],[0.3,0.3,0.3,0.3]]]],
  scores=[[[1.0,2.0,3.0],[1.0,2.0,3.0],[1.0,2.0,3.0]]],
  max_output_size_per_class=-1,
  max_total_size=10,
  iou_threshold=score_threshold=0.5,
  pad_per_class=True,
  clip_boxes=True)
```
  
### Patches
We have patched the issue in GitHub commit [3a7362750d5c372420aa8f0caf7bf5b5c3d0f52d](https://github.com/tensorflow/tensorflow/commit/3a7362750d5c372420aa8f0caf7bf5b5c3d0f52d) and commit [b5cdbf12ffcaaffecf98f22a6be5a64bb96e4f58](https://github.com/tensorflow/tensorflow/commit/b5cdbf12ffcaaffecf98f22a6be5a64bb96e4f58).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information 
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-wm2m-xrrp-j74c
Summary: HTTP Request Smuggling in netius
Aliases: CVE-2020-7655
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-444
Published: 2021-06-18T18:31:40Z

netius prior to 1.17.58 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Transfer encoding header parsing which could allow for CL:TE or TE:TE attacks.
Vulnerability: GHSA-c9h5-hf8r-m97x
Summary: Dangling reference in flatbuffers
Aliases: CVE-2020-35864
Severity: HIGH
CVSS score: 7.5
CWE: CWE-704
Published: 2021-08-25T20:47:36Z

An issue was discovered in the flatbuffers crate through 2020-04-11 for Rust. read_scalar (and read_scalar_at) can transmute values without unsafe blocks.
Vulnerability: GHSA-hg2p-2cvq-4ppv
Summary: Cross-site scripting in lazysizes
Aliases: CVE-2020-7642
Severity: LOW
CVSS score: 5.4
CWE: CWE-79
Published: 2021-12-10T20:06:23Z

lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript.
Vulnerability: GHSA-w749-p3v6-hccq
Summary: Possible code injection vulnerability in Rails / Active Storage
Aliases: CVE-2022-21831
Severity: HIGH
CVSS score: 0
CWE: CWE-94
Published: 2022-03-08T21:25:54Z

The Active Storage module of Rails starting with version 5.2.0 are possibly vulnerable to code injection. This issue was patched in versions 5.2.6.3, 6.0.4.7, 6.1.4.7, and 7.0.2.3. To work around this issue, applications should implement a strict allow-list on accepted transformation methods or arguments.  Additionally, a strict ImageMagick security policy will help mitigate this issue.
Vulnerability: GHSA-6q3p-36f4-cwxv
Summary: Server-Side Request Forgery in UReport
Aliases: CVE-2020-21122
Severity: HIGH
CVSS score: 0
CWE: CWE-918
Published: 2021-09-20T20:45:21Z

UReport v2.2.9 contains a Server-Side Request Forgery (SSRF) in the designer page which allows attackers to detect intranet device ports.
Vulnerability: GHSA-f89g-whpf-6q9m
Summary: Cross-Site Scripting in i18next
Aliases: CVE-2017-16008
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2018-11-09T17:46:56Z

Affected versions of `i18next` allow untrusted user input to be injected into dictionary key names, resulting in a cross-site scripting vulnerability.

## Proof of Concept
```
var init = i18n.init({debug: true}, function(){
  var test = i18n.t('__firstName__ __lastName__', {
        escapeInterpolation: true,
        firstName: '__lastNameHTML__',
        lastName: '<script>',
  });
  console.log(test);
});
// equals "<script> &lt;script&gt;"
```


## Recommendation

Update to version 1.10.3 or later.
Vulnerability: GHSA-qcj6-jqrg-4wp2
Summary: Template injection in thymeleaf-spring5
Aliases: CVE-2021-43466
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2021-11-10T19:52:33Z

In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution.
Vulnerability: GHSA-3fw8-66wf-pr7m
Summary: methodOverride Middleware Reflected Cross-Site Scripting in connect
Aliases: CVE-2013-7370
Severity: LOW
CVSS score: 0
CWE: CWE-79
Published: 2020-08-31T22:41:27Z

Connect is a stack of middleware that is executed in order in each request.

The "methodOverride" middleware allows the http post to override the method of the request with the value of the "_method" post key or with the header "x-http-method-override".

Because the user post input was not checked, req.method could contain any kind of value. Because the req.method did not match any common method VERB, connect answered with a 404 page containing the "Cannot `[method]` `[url]`" content. The method was not properly encoded for output in the browser.


###Example:
```
~ curl "localhost:3000" -d "_method=<script src=http://nodesecurity.io/xss.js></script>"
Cannot <SCRIPT SRC=HTTP://NODESECURITY.IO/XSS.JS></SCRIPT> /
```

## Recommendation

Update to the newest version of Connect or disable methodOverride. It is not possible to avoid the vulnerability if you have enabled this middleware in the top of your stack.
Vulnerability: GHSA-7c82-mp33-r854
Summary: Cross-site scripting in bootstrap-select
Aliases: CVE-2019-20921
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-05-07T16:47:54Z

bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim's browser.
Vulnerability: GHSA-4mv4-gmmf-q382
Summary: Cross-Site Scripting in datatables
Aliases: CVE-2015-6584
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-08-31T22:42:29Z

Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unit_testing/templates/6776.php.


## Recommendation

Update to a version greater than 1.10.8.
Vulnerability: GHSA-5cp4-xmrw-59wf
Summary: XSS via JQLite DOM manipulation functions in AngularJS
Severity: MODERATE
CVSS score: 5
CWE: CWE-79
Published: 2020-08-05T21:47:02Z

### Summary
XSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to `JQLite` methods like `JQLite.prepend`, `JQLite.after`, `JQLite.append`, `JQLite.replaceWith`, `JQLite.append`, `new JQLite` and `angular.element`.

### Description

JQLite (DOM manipulation library that's part of AngularJS) manipulates input HTML before inserting it to the DOM in `jqLiteBuildFragment`.

One of the modifications performed [expands an XHTML self-closing tag](https://github.com/angular/angular.js/blob/418355f1cf9a9a9827ae81d257966e6acfb5623a/src/jqLite.js#L218).

If `jqLiteBuildFragment` is called (e.g. via `new JQLite(aString)`) with user-controlled HTML string that was sanitized (e.g. with [DOMPurify](https://github.com/cure53/DOMPurify)), the transformation done by JQLite may modify some forms of an inert, sanitized payload into a payload containing JavaScript - and trigger an XSS when the payload is inserted into DOM.

This is similar to a bug in jQuery `htmlPrefilter` function that was [fixed in 3.5.0](https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/).

### Proof of concept

```javascript
const inertPayload = `<div><style><style/><img src=x onerror="alert(1337)"/>` 
```
Note that the style element is not closed and `<img` would be a text node inside the style if inserted into the DOM as-is.
As such, some HTML sanitizers would leave the `<img` as is without processing it and stripping the `onerror` attribute.

```javascript
angular.element(document).append(inertPayload);
```
This will alert, as `<style/>` will be replaced with `<style></style>` before adding it to the DOM, closing the style element early and reactivating `img`.

### Patches
The issue is patched in `JQLite` bundled with angular 1.8.0. AngularJS users using JQuery should upgrade JQuery to 3.5.0, as a similar vulnerability [affects jQuery <3.5.0](https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2).

### Workarounds
Changing sanitizer configuration not to allow certain tag grouping (e.g. `<option><style></option>`) or inline style elements may stop certain exploitation vectors, but it's uncertain if all possible exploitation vectors would be covered. Upgrade of AngularJS to 1.8.0 is recommended.

### References
https://github.com/advisories/GHSA-mhp6-pxh8-r675
https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2
https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
https://snyk.io/vuln/SNYK-JS-ANGULAR-570058
Vulnerability: GHSA-hvwm-2624-rp9x
Summary: Moderate severity vulnerability that affects org.apache.activemq:activemq-web-console
Aliases: CVE-2018-8006
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-10-30T20:48:58Z

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.
Vulnerability: GHSA-68v9-3jjq-rvp4
Summary: Exposure of Sensitive Information to an Unauthorized Actor
Aliases: CVE-2021-32716
Severity: MODERATE
CVSS score: 4.4
CWE: CWE-200
Published: 2021-09-08T18:00:40Z

Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been loaded with a to many reference. Users are recommend to update to version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.
Vulnerability: GHSA-q7fr-vqhq-v5xr
Summary: Improper Access Control in Apache ActiveMQ Artemis
Aliases: CVE-2021-26118
Severity: HIGH
CVSS score: 7.5
CWE: CWE-287, CWE-284
Published: 2021-06-16T17:39:05Z

While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.
Vulnerability: GHSA-3f99-hvg4-qjwj
Summary: Insecure random number generation in keypair
Aliases: CVE-2021-41117
Severity: HIGH
CVSS score: 8.7
CWE: CWE-335
Published: 2021-10-11T17:09:05Z

## Description and Impact

A bug in the pseudo-random number generator used by [keypair](https://github.com/juliangruber/keypair) versions up to and including 1.0.3 could allow for weak RSA key generation. This could enable an attacker to decrypt confidential messages or gain authorized access to an account belonging to the victim. We recommend replacing any RSA keys that were generated using keypair version 1.0.3 or earlier.

## Fix

* The [bug](https://github.com/juliangruber/keypair/blob/87c62f255baa12c1ec4f98a91600f82af80be6db/index.js#L1008) in the pseudo-random number generator is fixed in commit [`9596418`](https://github.com/juliangruber/keypair/commit/9596418d3363d3e757676c0b6a8f2d35a9d1cb18).
* If the crypto module is available, it is used instead of the pseudo-random number generator. Also fixed in [`9596418`](https://github.com/juliangruber/keypair/commit/9596418d3363d3e757676c0b6a8f2d35a9d1cb18)

## Additional Details

The specific [line](https://github.com/juliangruber/keypair/blob/87c62f255baa12c1ec4f98a91600f82af80be6db/index.js#L1008) with the flaw is:

```javascript
b.putByte(String.fromCharCode(next & 0xFF))
```

The [definition](https://github.com/juliangruber/keypair/blob/87c62f255baa12c1ec4f98a91600f82af80be6db/index.js#L350-L352) of `putByte` is 

```javascript
util.ByteBuffer.prototype.putByte = function(b) {
  this.data += String.fromCharCode(b);
};
```

Simplified, this is `String.fromCharCode(String.fromCharCode(next & 0xFF))`. This results in most of the buffer containing zeros. An example generated buffer:

(Note: truncated for brevity)

```
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x04\x00\x00\x00....\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
```

Since it is masking with 0xFF, approximately 97% of the bytes are converted to zeros. The impact is that each byte in the RNG seed has a 97% chance of being 0 due to incorrect conversion.

## Credit

This issue was reported to GitHub Security Lab by Ross Wheeler of Axosoft. It was discovered by Axosoft engineer Dan Suceava, who noticed that [keypair](https://github.com/juliangruber/keypair) was regularly generating duplicate RSA keys. GitHub security engineer [@vcsjones (Kevin Jones)](https://github.com/vcsjones) independently investigated the problem and identified the cause and source code location of the bug.
Vulnerability: GHSA-ch4f-829c-v5pw
Summary: Division by 0 in `ResourceScatterDiv`
Aliases: CVE-2021-37642
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-369
Published: 2021-08-25T14:43:56Z

### Impact
The implementation of `tf.raw_ops.ResourceScatterDiv` is vulnerable to a division by 0 error:

```python
import tensorflow as tf

v= tf.Variable([1,2,3])
tf.raw_ops.ResourceScatterDiv(
  resource=v.handle,
  indices=[1],
  updates=[0])
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/resource_variable_ops.cc#L865) uses a common class for all binary operations but fails to treat the division by 0 case separately.

### Patches
We have patched the issue in GitHub commit [4aacb30888638da75023e6601149415b39763d76](https://github.com/tensorflow/tensorflow/commit/4aacb30888638da75023e6601149415b39763d76).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-gr44-7grc-37vq
Summary: Moderate severity vulnerability that affects activerecord
Aliases: CVE-2013-0276
Severity: MODERATE
CVSS score: 0
Published: 2017-10-24T18:33:37Z

ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify protected model attributes via a crafted request.
Vulnerability: GHSA-hxcc-f52p-wc94
Summary: Insecure serialization leading to RCE in serialize-javascript
Aliases: CVE-2020-7660
Severity: HIGH
CVSS score: 8.1
CWE: CWE-502
Published: 2020-08-11T17:21:13Z

serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js". 

An object such as `{"foo": /1"/, "bar": "a\"@__R-<UID>-0__@"}` was serialized as `{"foo": /1"/, "bar": "a\/1"/}`, which allows an attacker to escape the `bar` key. This requires the attacker to control the values of both `foo` and `bar` and guess the value of `<UID>`. The UID has a keyspace of approximately 4 billion making it a realistic network attack.
Vulnerability: GHSA-6wrh-279j-6hvw
Summary: HTTP caching is marking private HTTP headers as public in Shopware
Aliases: CVE-2022-24747
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-200
Published: 2022-03-10T17:55:21Z

### Impact
HTTP caching is marking private HTTP headers as public

## Patches
Fixed in  recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

## Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Vulnerability: GHSA-ppj3-7jw3-8vc4
Summary: Data races in lock_api
Aliases: CVE-2020-35910
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-362
Published: 2021-08-25T20:49:35Z

An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedMutexGuard unsoundness.
Vulnerability: GHSA-cvx3-pqmj-x57x
Summary: Downloads Resources over HTTP in scalajs-standalone-bin
Aliases: CVE-2016-10634
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:47:13Z

Affected versions of `scalajs-standalone-bin` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `scalajs-standalone-bin`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-27g8-r9vw-765x
Summary: Private Field data leak
Aliases: CVE-2021-32624
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2021-05-27T18:39:03Z

This security advisory relates to a newly discovered capability in our query infrastructure to directly or indirectly expose the values of private fields, bypassing the configured access control.

This is an access control related oracle attack in that the attack method guides an attacker during their attempt to reveal information they do not have access to. The complexity of completing the attack is limited by some length-dependent behaviors and the fidelity of the exposed information.

### Impact

Under some circumstances, field values or field value meta data can be determined, despite the field or list having `read` access control configured. If you use private fields or lists, you may be impacted.

### Patches

None, at this time

### Workarounds

None, at this time

### References

None

### For more information

For the protection of the community and private deployments, we think that the best course of action will be to not disclose further details on any open GitHub issues related to this advisory until a hot-fix or work-around has been deployed or published.

If needed, you can email us at keystone@thinkmill.com.au
Vulnerability: GHSA-xr53-m937-jr9c
Summary: Cross-Site Scripting in ngx-md
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-03T15:49:14Z

Versions of `ngx-md` prior to 6.0.3 are vulnerable to Cross-Site Scripting.  Links are not properly restricted to http/https and can contain JavaScript which may lead to arbitrary code execution. Markdown input such as `[Click Me](javascript:alert('Injected!'%29)` is rendered as a `Click Me` link that executes JavaScript.


## Recommendation

Upgrade to version 6.0.3 or later.
Vulnerability: GHSA-cw6w-q88j-6mqf
Summary: Potential session hijack in Apache CXF 
Aliases: CVE-2019-12419
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-863
Published: 2019-11-08T17:12:59Z

Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.
Vulnerability: GHSA-q6cj-6jvq-jwmh
Summary: Privilege Escalation in Cloud Native Computing Foundation Harbor
Aliases: CVE-2019-19023
Severity: MODERATE
CVSS score: 9.3
CWE: CWE-269
Published: 2021-05-18T18:27:28Z

Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 has a Privilege Escalation Vulnerability in the VMware Harbor Container Registry for the Pivotal Platform.
Vulnerability: GHSA-9hx8-2mrv-r674
Summary: Deserialization of Untrusted Data in Apache jUDDI
Aliases: CVE-2021-37578
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2021-08-09T20:41:37Z

Apache jUDDI uses several classes related to Java's Remote Method Invocation (RMI) which (as an extension to UDDI) provides an alternate transport for accessing UDDI services.

RMI uses the default Java serialization mechanism to pass parameters in RMI invocations. A remote attacker can send a malicious serialized object to the above RMI entries. The objects get deserialized without any check on the incoming data. In the worst case, it may let the attacker run arbitrary code remotely. 

For both jUDDI web service applications and jUDDI clients, the usage of RMI is disabled by default. Since this is an optional feature and an extension to the UDDI protocol, the likelihood of impact is low. Starting with 3.3.10, all RMI related code was removed.
Vulnerability: GHSA-hgpf-97c5-74fc
Summary: Regular expression denial of service in @absolunet/kafe
Aliases: CVE-2020-7761
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2021-05-10T19:08:29Z

This affects the package @absolunet/kafe before 3.2.10. It allows cause a denial of service when validating crafted invalid emails.
Vulnerability: GHSA-w4f8-fxq2-j35v
Summary: Possible privilege escalation via bash completion script
Severity: MODERATE
CVSS score: 0
Published: 2022-03-01T21:04:57Z

The bash completion script for `fscrypt` through v0.3.2 allows injection of commands via crafted mountpoint paths, allowing privilege escalation under a specific set of circumstances. A local user who has control over mountpoint paths could potentially escalate their privileges if they create a malicious mountpoint path and if the system administrator happens to be using the `fscrypt` bash completion script to complete mountpoint paths. We recommend upgrading to v0.3.3 or above.

For more details, see [CVE-2022-25328](https://www.cve.org/CVERecord?id=CVE-2022-25328).
Vulnerability: GHSA-fqq2-xp7m-xvm8
Summary: Data race in ruspiro-singleton
Aliases: CVE-2020-36435
Severity: HIGH
CVSS score: 8.1
CWE: CWE-119, CWE-362
Published: 2021-08-25T20:58:19Z

`Singleton<T>` is meant to be a static object that can be initialized lazily. In
order to satisfy the requirement that `static` items must implement `Sync`,
`Singleton` implemented both `Sync` and `Send` unconditionally.

This allows for a bug where non-`Sync` types such as `Cell` can be used in
singletons and cause data races in concurrent programs.

The flaw was corrected in commit `b0d2bd20e` by adding trait bounds, requiring
the contaiend type to implement `Sync`.
Vulnerability: GHSA-w6rq-6h34-vh7q
Summary: Cached redirect poisoning via X-Forwarded-Host header
Aliases: CVE-2021-29479
Severity: HIGH
CVSS score: 7
CWE: CWE-807
Published: 2021-07-01T17:02:38Z

A user supplied `X-Forwarded-Host` header can be used to perform cache poisoning of a cache fronting a Ratpack server if the cache key does not include the `X-Forwarded-Host` header as a cache key.

Users are only vulnerable if they do not configure a custom `PublicAddress` instance. A custom `PublicAddress` can be specified by using [ServerConfigBuilder::publicAddress](https://ratpack.io/manual/current/api/ratpack/server/ServerConfigBuilder.html#publicAddress-java.net.URI-). For versions prior to 1.9.0, by default, Ratpack utilizes an inferring version of `PublicAddress` which is vulnerable.

### Impact

This can be used to perform redirect cache poisoning where an attacker can force a cached redirect to redirect to their site instead of the intended redirect location.

### Patches

As of Ratpack 1.9.0, two changes have been made that mitigate this vulnerability:

1. The default PublicAddress implementation no longer infers the address from the request context, instead relying on the configured bind host/port
2. Relative redirects issued by the application are no longer absolutized; they are passed through as-is

### Workarounds

In production, ensure that [ServerConfigBuilder::publicAddress](https://ratpack.io/manual/current/api/ratpack/server/ServerConfigBuilder.html#publicAddress-java.net.URI-) correctly configures the server.

### References
 - https://portswigger.net/web-security/web-cache-poisoning
Vulnerability: GHSA-q6w2-89hq-hq27
Summary: Cross-site scripting in keycloak
Aliases: CVE-2021-20195
Severity: CRITICAL
CVSS score: 9.6
CWE: CWE-20, CWE-79
Published: 2021-06-08T23:02:43Z

A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Vulnerability: GHSA-cwcx-rxgc-cmw3
Summary: Prototype pollution in 101
Aliases: CVE-2021-25943
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-05-17T20:57:40Z

Prototype pollution vulnerability in '101' versions 1.0.0 through 1.6.3 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-gjh6-wvhq-h4qx
Summary: Cross-site Scripting in FreeTAKServer-UI
Aliases: CVE-2022-25507
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-12T00:00:37Z

FreeTAKServer-UI v1.9.8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Callsign parameter.
Vulnerability: GHSA-p3jx-g34v-q56j
Summary: Malicious Package in j3-sha3
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:54:02Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-9pq7-rcxv-47vq
Summary: Incorrect Regular Expression in RestSharp
Aliases: CVE-2021-27293
Severity: HIGH
CVSS score: 7.5
CWE: CWE-697, CWE-185
Published: 2021-07-14T19:10:01Z

RestSharp < 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when converting strings into DateTimes. If a server responds with a malicious string, the client using RestSharp will be stuck processing it for an exceedingly long time. Thus the remote server can trigger Denial of Service.
Vulnerability: GHSA-hjf3-r7gw-9rwg
Summary: Moderate severity vulnerability that affects feedparser
Aliases: CVE-2012-2921
Severity: MODERATE
CVSS score: 0
Published: 2018-07-24T20:00:41Z

Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.
Vulnerability: GHSA-h6rj-8r3c-9gpj
Summary: bson is vulnerable to denial of service due to incorrect regex validation
Aliases: CVE-2015-4412
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-400
Published: 2018-03-05T19:43:21Z

BSON injection vulnerability in the legal? function in BSON (bson-ruby) gem before 3.0.4 for Ruby allows remote attackers to cause a denial of service (resource consumption) or inject arbitrary data via a crafted string.
Vulnerability: GHSA-fgfj-rj24-mj7q
Summary: Malicious Package in kraken-api
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-02T21:47:08Z

Version 0.1.8 of `kraken-api` contains malicious code as a postinstall script. When installed, the package calls home to a Command and Control server to execute arbitrary commands.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-8xfw-5q82-3652
Summary: Authentication Bypass by CSRF Weakness
Severity: CRITICAL
CVSS score: 9.3
CWE: CWE-352
Published: 2021-11-18T20:15:23Z

### Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of `spree_auth_devise` are affected if `protect_from_forgery` method is both:

* Executed whether as:
  * A before_action callback (the default)
  * A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
* Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏 

### Patches

Spree 4.1 users should update to spree_auth_devise 4.1.1
 
### Workarounds

If possible, change your strategy to :exception:

```ruby
class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end
```

Add the following to`config/application.rb `to at least run the `:exception` strategy on the affected controller:

```ruby
config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end
```

### References
https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2
Vulnerability: GHSA-h6rp-8v4j-hwph
Summary: High severity vulnerability that affects org.apache.camel:camel-core
Aliases: CVE-2014-0003
Severity: HIGH
CVSS score: 0
Published: 2018-10-16T23:13:49Z

The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.
Vulnerability: GHSA-v3px-6cc8-f8j3
Summary: Path traversal in servey
Aliases: CVE-2020-8214
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2021-05-07T15:56:19Z

A path traversal vulnerability in servey versions prior to 3.3.2 allows an attacker to read content of any arbitrary file.
Vulnerability: GHSA-6v52-mj5r-7j2m
Summary: Moderate severity vulnerability that affects org.apache.tomcat.embed:tomcat-embed-core
Aliases: CVE-2018-8037
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-362
Published: 2018-10-17T16:33:02Z

If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.
Vulnerability: GHSA-3fc5-9x9m-vqc4
Summary: Privilege Escalation in express-cart
Severity: CRITICAL
CVSS score: 9.8
Published: 2019-06-03T17:31:32Z

Versions of `express-cart` before 1.1.6 are vulnerable to privilege escalation. This vulnerability can be exploited so that normal users can escalate their privilege and add new administrator users.


## Recommendation

Update to version 1.1.6 or later.
Vulnerability: GHSA-mw25-f5r2-hpc6
Summary: Insertion of Sensitive Information into Log File in Apache Geode
Aliases: CVE-2021-34797
Severity: HIGH
CVSS score: 0
CWE: CWE-532
Published: 2022-01-06T22:23:25Z

Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the prefix "sysprop-", "javax.net.ssl", or "security-". This issue is fixed by overhauling the log file redaction in Apache Geode versions 1.12.5, 1.13.5, and 1.14.0.
Vulnerability: GHSA-mc23-976p-j42x
Summary: Low severity vulnerability that affects xterm
Aliases: CVE-2019-0542
Severity: LOW
CVSS score: 0
Published: 2019-01-14T16:19:55Z

A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka "Xterm Remote Code Execution Vulnerability." This affects xterm.js.
Vulnerability: GHSA-h8hx-2c5r-32cf
Summary: Cross-Site Request Forgery (CSRF) in trestle-auth
Aliases: CVE-2021-29435
Severity: HIGH
CVSS score: 8.1
CWE: CWE-352
Published: 2021-04-13T17:01:50Z

### Impact
A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially allows an attacker to alter protected data, including admin account credentials.

### Patches
The vulnerability has been fixed in trestle-auth 0.4.2 released to RubyGems.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [trestle-auth](https://github.com/TrestleAdmin/trestle-auth/issues)
* Email the maintainer at [sam@sampohlenz.com](mailto:sam@sampohlenz.com)
Vulnerability: GHSA-487w-pqcm-63hq
Summary: Command injection in buns
Aliases: CVE-2020-7794
Severity: CRITICAL
CVSS score: 0
CWE: CWE-77, CWE-78
Published: 2021-01-13T18:22:13Z

There is a command injection vulnerability in all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function install(requestedModule).
Vulnerability: GHSA-6g6m-m6h5-w9gf
Summary: Authorization bypass in express-jwt
Aliases: CVE-2020-15084
Severity: HIGH
CVSS score: 7.7
CWE: CWE-285
Published: 2020-06-30T16:05:24Z

### Overview
Versions before and including 5.3.3, we are not enforcing the **algorithms** entry to be specified in the configuration.
When **algorithms** is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. 

### Am I affected?
You are affected by this vulnerability if all of the following conditions apply:

You are using express-jwt
AND 
You do not have **algorithms**  configured in your express-jwt configuration.
AND
You are using libraries such as jwks-rsa as the **secret**. 

### How to fix that?
Specify **algorithms** in the express-jwt configuration. The following is an example of a proper configuration

``` 
const checkJwt = jwt({
  secret: jwksRsa.expressJwtSecret({
    rateLimit: true,
    jwksRequestsPerMinute: 5,
    jwksUri: `https://${DOMAIN}/.well-known/jwks.json`
  }),
  // Validate the audience and the issuer.
  audience: process.env.AUDIENCE,
  issuer: `https://${DOMAIN}/`,
  // restrict allowed algorithms
  algorithms: ['RS256']
}); 
```

### Will this update impact my users?
The fix provided in patch will not affect your users if you specified the algorithms allowed. The patch now makes **algorithms** a required configuration. 


### Credit
IST Group