TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-79fv-9865-4qcv
Summary: Heap buffer overflow in `MaxPoolGrad`
Aliases: CVE-2021-29579
Severity: LOW
CVSS score: 2.5
CWE: CWE-119, CWE-787
Published: 2021-05-21T14:26:23Z

### Impact
The implementation of `tf.raw_ops.MaxPoolGrad` is vulnerable to a heap buffer overflow:
  
```python
import tensorflow as tf

orig_input = tf.constant([0.0], shape=[1, 1, 1, 1], dtype=tf.float32)
orig_output = tf.constant([0.0], shape=[1, 1, 1, 1], dtype=tf.float32)
grad = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.float32)
ksize = [1, 1, 1, 1] 
strides = [1, 1, 1, 1]
padding = "SAME"

tf.raw_ops.MaxPoolGrad(
  orig_input=orig_input, orig_output=orig_output, grad=grad, ksize=ksize,
  strides=strides, padding=padding, explicit_paddings=[])
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/ab1e644b48c82cb71493f4362b4dd38f4577a1cf/tensorflow/core/kernels/maxpooling_op.cc#L194-L203) fails to validate that indices used to access elements of input/output arrays are valid:

```cc
for (int index = out_start; index < out_end; ++index) {
  int input_backprop_index = out_arg_max_flat(index);
  FastBoundsCheck(input_backprop_index - in_start, in_end - in_start);
  input_backprop_flat(input_backprop_index) += out_backprop_flat(index);
}
```

Whereas accesses to `input_backprop_flat` are guarded by `FastBoundsCheck`, the indexing in `out_backprop_flat` can result in OOB access.

### Patches
We have patched the issue in GitHub commit [a74768f8e4efbda4def9f16ee7e13cf3922ac5f7](https://github.com/tensorflow/tensorflow/commit/a74768f8e4efbda4def9f16ee7e13cf3922ac5f7).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-5phw-3jrp-3vj8
Summary: Server-Side Request Forgery in Apache Solr
Aliases: CVE-2021-27905
Severity: HIGH
CVSS score: 7.1
CWE: CWE-918
Published: 2021-05-10T15:18:06Z

The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the "shards" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.
Vulnerability: GHSA-jp55-vvmf-63mv
Summary: URL Redirection to Untrusted Site ('Open Redirect')
Aliases: CVE-2022-23618
Severity: MODERATE
CVSS score: 4.7
CWE: CWE-601
Published: 2022-02-09T21:42:47Z

### Impact
There's no protection against URL redirection to untrusted site, in particular some well known parameters (xredirect) can be used to perform such redirections.

### Patches
The problem has been patched in XWiki 12.10.7 and XWiki 13.3RC1.

### Workarounds
There's no known workaround for this issue. 

### References
https://jira.xwiki.org/browse/XWIKI-10309

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [JIRA](https://jira.xwiki.org)
* Email us at [Security ML](mailto:security@xwiki.org)
Vulnerability: GHSA-cqjg-whmm-8gv6
Summary: Denial of Service via malformed accept-encoding header in hapi
Aliases: CVE-2017-16013
Severity: MODERATE
CVSS score: 0
CWE: CWE-400
Published: 2018-10-09T00:57:28Z

Affected versions of `hapi` will crash or lock the event loop when a malformed `accept-encoding` header is recieved.


## Recommendation

Update to version 16.1.1 or later.
Vulnerability: GHSA-j7wp-vjj6-cp5m
Summary: Cross-Site Scripting in @progress/kendo-angular-editor
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-08-11T19:40:10Z

Kendo UI for Angular Editor Component (npm package @progress/kendo-angular-editor) before version 1.2.3 is vulnerable to Cross-Site Scripting. When the Editor content contains potentially malicious scripts in element event handlers, they get executed.
Adding the following content to the Editor value demonstrates the issue: `<img src="" onerror=alert(document.domain)>`.
Vulnerability: GHSA-4m6q-rxhm-675w
Summary:  OS Command Injection in adb-driver
Aliases: CVE-2020-7636
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2021-12-09T19:54:29Z

adb-driver through 0.1.8 is vulnerable to Command Injection.It allows execution of arbitrary commands via the command function.
Vulnerability: GHSA-mg85-8mv5-ffjr
Summary: Denial of Service in ammo
Severity: HIGH
CVSS score: 0
Published: 2020-09-03T15:45:40Z

All versions of `ammo` are vulnerable to Denial of Service. The Range HTTP header parser has a vulnerability which will cause the function to throw a system error if the header is set to an invalid value. Because hapi is not expecting the function to ever throw, the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

This package is deprecated and is now maintained as `@hapi/ammo`. Please update your dependencies to use `@hapi/ammo`.
Vulnerability: GHSA-8rc5-mr4f-m243
Summary: Use after free in rio
Aliases: CVE-2020-35876
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-416, CWE-772
Published: 2021-08-25T20:46:57Z

An issue was discovered in the rio crate through 2020-05-11 for Rust. A struct can be leaked, allowing attackers to obtain sensitive information, cause a use-after-free, or cause a data race.
Vulnerability: GHSA-425c-ccf3-3jrr
Summary: Critical severity vulnerability that affects slpjs
Aliases: CVE-2019-16762
Severity: CRITICAL
CVSS score: 5.7
CWE: CWE-20
Published: 2019-11-15T23:10:35Z

## Validator parsing discrepancy due to string encoding

### Impact
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus.

### Patches
All versions > 0.21.3 are patched.

### Workarounds
Upgrade to any version >= 0.21.4.

### References
The bug was located and fixed [here](https://github.com/simpleledger/slpjs/commit/ac8809b42e47790a6f0205991b36f2699ed10c84#diff-fe58606994c412ba56a65141a7aa4a62L701).

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [slpjs repo](https://github.com/simpleledger/slpjs/issues)
* Email us at [info@slp.cash](mailto:info@slp.cash)
Vulnerability: GHSA-pfv6-prqm-85q8
Summary: Prototype Pollution in madlib-object-utils
Aliases: CVE-2022-24279
Severity: HIGH
CVSS score: 7.5
CWE: CWE-1321
Published: 2022-04-16T00:00:26Z

The package madlib-object-utils before version 0.1.8 is vulnerable to Prototype Pollution via the `setValue` method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix of [CVE-2020-7701](https://security.snyk.io/vuln/SNYK-JS-MADLIBOBJECTUTILS-598676)
Vulnerability: GHSA-mc6h-4qgp-37qh
Summary: Deserialization of untrusted data in Jackson Databind
Aliases: CVE-2020-14195
Severity: HIGH
CVSS score: 8.1
CWE: CWE-502
Published: 2020-06-18T14:44:43Z

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).
Vulnerability: GHSA-p4q6-qxjx-8jgp
Summary: Directory Traversal in spring-boot-actuator-logview
Aliases: CVE-2021-21234
Severity: HIGH
CVSS score: 7.7
CWE: CWE-22
Published: 2021-01-05T17:29:40Z

### Impact
The nature of this library is to expose a log file directory via admin (spring boot actuator) HTTP endpoints. Both the filename to view and a base folder (relative to the logging folder root) can be specified via request parameters. While the filename parameter was checked to prevent directory traversal exploits (so that `filename=../somefile` would not work), the base folder parameter was not sufficiently checked, so that `filename=somefile&base=../` could access a file outside the logging base directory).

### Patches
The vulnerability has been patched in release 0.2.13. Any users of 0.2.12 should be able to update without any issues as there are no other changes in that release.

### Workarounds
There is no workaround to fix the vulnerability other than updating or removing the dependency. However, removing read access of the user the application is run with to any directory not required for running the application can limit the impact. Additionally, access to the logview endpoint can be limited by deploying the application behind a reverse proxy.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [github repo](https://github.com/lukashinsch/spring-boot-actuator-logview)
Vulnerability: GHSA-2vj5-px25-gjrp
Summary: pytorch-lightning is vulnerable to Deserialization of Untrusted Data
Aliases: CVE-2021-4118
Severity: HIGH
CVSS score: 7.8
CWE: CWE-502
Published: 2022-01-06T23:58:59Z

pytorch-lightning is vulnerable to Deserialization of Untrusted Data.
Vulnerability: GHSA-j32x-j8pj-pg2h
Summary: Prototype Pollution in decal
Aliases: CVE-2020-28450
Severity: HIGH
CVSS score: 8.6
CWE: CWE-94, CWE-400, CWE-1321
Published: 2021-04-13T15:20:34Z

This affects all versions of package decal. The vulnerability is in the extend function.
Vulnerability: GHSA-hj8g-cw8x-2c6m
Summary: Cross-site Scripting in Microweber
Aliases: CVE-2022-0719
Severity: HIGH
CVSS score: 7.6
CWE: CWE-79
Published: 2022-02-24T00:00:53Z

Microweber prior to version 1.3 is vulnerable to reflected cross-site scripting.
Vulnerability: GHSA-q3wr-qw3g-3p4h
Summary: Injection/XSS in Redcarpet
Aliases: CVE-2020-26298
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-79
Published: 2021-01-11T19:06:10Z

Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used.  This is fixed in version 3.5.1 by the referenced commit.
Vulnerability: GHSA-hq37-853p-g5cf
Summary: Regular Expression Denial of Service in CairoSVG
Aliases: CVE-2021-21236
Severity: MODERATE
CVSS score: 0
CWE: CWE-400
Published: 2021-01-06T16:57:50Z

# Doyensec Vulnerability Advisory 

* Regular Expression Denial of Service (REDoS) in cairosvg
* Affected Product: CairoSVG v2.0.0+
* Vendor: https://github.com/Kozea
* Severity: Medium
* Vulnerability Class: Denial of Service
* Author(s): Ben Caller ([Doyensec](https://doyensec.com))

## Summary

When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS).
If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time.

## Technical description

The vulnerable regular expressions are

https://github.com/Kozea/CairoSVG/blob/9c4a982b9a021280ad90e89707eacc1d114e4ac4/cairosvg/colors.py#L190-L191

The section between 'rgb(' and the final ')' contains multiple overlapping groups.

Since all three infinitely repeating groups accept spaces, a long string of spaces causes catastrophic backtracking when it is not followed by a closing parenthesis.

The complexity is cubic, so doubling the length of the malicious string of spaces makes processing take 8 times as long.

## Reproduction steps

Create a malicious SVG of the form:

    <svg width="1" height="1"><rect fill="rgb(                     ;"/></svg>

with the following code:

    '<svg width="1" height="1"><rect fill="rgb(' + (' ' * 3456) + ';"/></svg>'

Note that there is no closing parenthesis before the semi-colon.

Run cairosvg e.g.:

    cairosvg cairo-redos.svg -o x.png

and notice that it hangs at 100% CPU. Increasing the number of spaces increases the processing time with cubic complexity.

## Remediation

Fix the regexes to avoid overlapping parts. Perhaps remove the [ \n\r\t]* groups from the regex, and use .strip() on the returned capture group.

## Disclosure timeline

- 2020-12-30: Vulnerability disclosed via email to CourtBouillon
Vulnerability: GHSA-3ff2-r28g-w7h9
Summary: Heap buffer overflow in `Transpose`
Aliases: CVE-2021-41216
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-787, CWE-120
Published: 2021-11-10T18:57:19Z

### Impact
The [shape inference function for `Transpose`](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/ops/array_ops.cc#L121-L185) is vulnerable to a heap buffer overflow:

```python
import tensorflow as tf
@tf.function
def test():
  y = tf.raw_ops.Transpose(x=[1,2,3,4],perm=[-10])
  return y

test()
```

This occurs whenever `perm` contains negative elements. The shape inference function does not validate that the indices in `perm` are all valid:
        
```cc
for (int32_t i = 0; i < rank; ++i) {
  int64_t in_idx = data[i];
  if (in_idx >= rank) {
    return errors::InvalidArgument("perm dim ", in_idx,
                                   " is out of range of input rank ", rank);
  }
  dims[i] = c->Dim(input, in_idx);
}
```

where `Dim(tensor, index)` accepts either a positive index less than the rank of the tensor or the special value `-1` for unknown dimensions.

### Patches
We have patched the issue in GitHub commit [c79ba87153ee343401dbe9d1954d7f79e521eb14](https://github.com/tensorflow/tensorflow/commit/c79ba87153ee343401dbe9d1954d7f79e521eb14).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-mq8p-h798-xcrp
Summary: Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main
Aliases: CVE-2017-15718
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-200
Published: 2018-12-21T17:50:20Z

The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications.
Vulnerability: GHSA-xvch-5gv4-984h
Summary: Prototype Pollution in minimist
Aliases: CVE-2021-44906
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2022-03-18T00:01:09Z

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
Vulnerability: GHSA-xhh6-956q-4q69
Summary: Argument injection in a MimeTypeGuesser in Symfony
Aliases: CVE-2019-18888
Severity: HIGH
CVSS score: 7.5
CWE: CWE-88, CWE-20
Published: 2019-12-02T18:08:19Z

An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. This is related to symfony/http-foundation (and symfony/mime in 4.3.x).
Vulnerability: GHSA-vm7j-4rj6-mw2p
Summary: Malicious Package in ember_cli_babe
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:08:42Z

Version 6.16.0 of `ember_cli_babe` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-hr2v-3952-633q
Summary: Prototype Pollution in deep-extend
Aliases: CVE-2018-3750
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-20
Published: 2018-10-09T00:44:59Z

Versions of `deep-extend` before 0.5.1 are vulnerable to prototype pollution.


## Recommendation

Update to version 0.5.1 or later.
Vulnerability: GHSA-vvwp-3f54-xc39
Summary: Downloads Resources over HTTP in broccoli-closure
Aliases: CVE-2016-10635
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:57:05Z

Affected versions of `broccoli-closure` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `broccoli-closure`.


## Recommendation

Update to version 1.3.1 or later.
Vulnerability: GHSA-j657-59rv-qwm6
Summary: Cross-Site Scripting in min-http-server
Aliases: CVE-2019-5457
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2019-07-31T04:22:27Z

All versions of `min-http-server` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-gxr4-xjj5-5px2
Summary: Potential XSS vulnerability in jQuery
Aliases: CVE-2020-11022
Severity: MODERATE
CVSS score: 6.9
CWE: CWE-79
Published: 2020-04-29T22:18:55Z

### Impact
Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code.

### Patches
This problem is patched in jQuery 3.5.0.

### Workarounds
To workaround the issue without upgrading, adding the following to your code:

```js
jQuery.htmlPrefilter = function( html ) {
	return html;
};
```

You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround.

### References
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
https://jquery.com/upgrade-guide/3.5/

### For more information
If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.
Vulnerability: GHSA-p5w9-856p-8q4g
Summary: Assumed memory layout of std::net::SocketAddr
Severity: MODERATE
CVSS score: 0
CWE: CWE-824
Published: 2021-08-25T21:00:23Z

The [`socket2`](https://crates.io/crates/socket2) crate has assumed `std::net::SocketAddrV4`
and `std::net::SocketAddrV6` have the same memory layout as the system C representation
`sockaddr`. It has simply casted the pointers to convert the socket addresses to the
system representation. The standard library does not say anything about the memory
layout, and this will cause invalid memory access if the standard library
changes the implementation. No warnings or errors will be emitted once the
change happens.
Vulnerability: GHSA-g3xp-v2ff-x5c3
Summary: Downloads Resources over HTTP in go-ipfs-dep
Aliases: CVE-2016-10563
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:54:18Z

Affected versions of `go-ipfs-deps` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

Update to version 0.4.4 or later.
Vulnerability: GHSA-gjmw-vf9h-g25v
Summary: Polymorphic typing issue
Aliases: CVE-2019-17531
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2019-11-13T00:32:38Z

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.
Vulnerability: GHSA-2hhw-p8mg-jrm6
Summary: Path Traversal in http-live-simulator
Aliases: CVE-2019-5423
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2019-04-08T15:18:40Z

Versions of `http-live-simulator` prior to 1.0.6 are vulnerable to Path Traversal.  Due to insufficient input sanitization, attackers can access server files by using relative paths. 


## Recommendation

Upgrade to version 1.0.6
Vulnerability: GHSA-jw37-5gqr-cf9j
Summary: Server-Side Request Forgery in ftp-srv
Aliases: CVE-2020-15152
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-918
Published: 2020-08-17T21:44:54Z

### Background

The FTP protocol creates two connections, one for commands and one for transferring data.
This second data connection can be created in two ways, on the server by sending the PASV command, or on the client by sending the PORT command.

The PORT command sends the IP and port for the server to connect to the client with.

### Issue
Since the client can send an arbitrary IP with the PORT command, this can be used to cause the server to make a connection elsewhere.

### Patches

* _fix: disallow PORT connections to alternate hosts_: e449e75219d918c400dec65b4b0759f60476abca

Deprecation notices have been published for older versions.

### Workarounds

Blacklisting the FTP Command `PORT` will prevent the server from exposing this behaviour through active connections until a fix is applied.
```js
const ftp = new FtpSrv({
  blacklist: ['PORT']
});
```

### References
https://www.npmjs.com/advisories/1445

### Credits

Thank you to;
@trs for fixing it
@andreeleuterio for reporting it to us for an anonymous user (Vincent) through the NPM platform
@quiquelhappy for bringing it to our attention after it slipped through the cracks during Christmas

### For more information
If you have any questions or comments about this advisory:
* Open an issue at [https://github.com/autovance/ftp-srv](https://github.com/autovance/ftp-srv)
* Email us directly; security@autovance.com
Vulnerability: GHSA-wmv4-5w76-vp9g
Summary: Authorization Bypass in Spring Security
Aliases: CVE-2014-3527
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-287
Published: 2020-09-15T20:16:22Z

When using Spring Security's CAS Proxy ticket authentication a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the HttpServletRequest which is populated based upon untrusted information within the HTTP request.

This means if there are access control restrictions on which CAS services can authenticate to one another, those restrictions can be bypassed.

If users are not using CAS Proxy tickets and not basing access control decisions based upon the CAS Service, then there is no impact to users.

## Mitigation
Users of affected versions should apply the following mitigation:
- Users of 3.2x should upgrade to 3.2.5 or later
- Users of 3.1.x should upgrade to 3.1.7 or later

## Credit
This issue was identified by David Ohsie and brought to our attention by the CAS Development team.
Vulnerability: GHSA-m5v7-pr32-mjx2
Summary: Critical severity vulnerability in Ignition
Aliases: CVE-2020-13909
Severity: CRITICAL
CVSS score: 9.8
Published: 2021-10-12T16:29:13Z

The Ignition page before version 2.0.5 for Laravel mishandles globals, _get, _post, _cookie, and _env.

NOTE: in the 1.x series, versions 1.16.15 and later are unaffected as a consequence of the CVE-2021-43996 fix.
Vulnerability: GHSA-g622-r636-qfqh
Summary: SQL Injection in Couchbase Sync Gateway
Aliases: CVE-2019-9039
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2022-02-15T01:57:18Z

The Couchbase Sync Gateway 2.1.2 in combination with a Couchbase Server is affected by a previously undisclosed N1QL-injection vulnerability in the REST API. An attacker with access to the public REST API can insert additional N1QL statements through the parameters ?startkey? and ?endkey? of the ?_all_docs? endpoint.
Vulnerability: GHSA-4fc4-chg7-h8gh
Summary: Unprotected dynamically loaded chunks
Aliases: CVE-2020-15262
Severity: LOW
CVSS score: 3.7
CWE: CWE-345
Published: 2020-10-19T20:02:44Z

### Impact

All dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected.

### Patches

This issue is patched in version 1.5.1.

### Workarounds

N/A

### References

https://github.com/waysact/webpack-subresource-integrity/issues/131

### For more information
If you have any questions or comments about this advisory:
* Comment on [webpack-subresource-integrity issue #131](https://github.com/waysact/webpack-subresource-integrity/issues/131)
* Or email us at [security@waysact.com](mailto:security@waysact.com)
Vulnerability: GHSA-8225-6cvr-8pqp
Summary: Large gzip Denial of Service in superagent
Aliases: CVE-2017-16129
Severity: LOW
CVSS score: 0
CWE: CWE-409
Published: 2018-08-09T20:13:01Z

Affected versions of `superagent` do not check the post-decompression size of ZIP compressed HTTP responses prior to decompressing. This results in the package being vulnerable to a [ZIP bomb](https://en.wikipedia.org/wiki/Zip_bomb) attack, where an extremely small ZIP file becomes many orders of magnitude larger when decompressed. 

This may result in unrestrained CPU/Memory/Disk consumption, causing a denial of service condition.


## Recommendation

Update to version 3.7.0 or later.
Vulnerability: GHSA-5rc4-8qqh-vq7f
Summary: Handling of URL Encoding permitting access to ignored
Aliases: CVE-2018-3718
Severity: MODERATE
CVSS score: 0
CWE: CWE-177
Published: 2021-08-09T22:24:26Z

serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.
Vulnerability: GHSA-26xx-m4q2-xhq8
Summary: Authentication Bypass by CSRF Weakness
Aliases: CVE-2021-41275
Severity: CRITICAL
CVSS score: 9.3
CWE: CWE-352
Published: 2021-11-18T20:14:19Z

### Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of `spree_auth_devise` are affected if `protect_from_forgery` method is both:

* Executed whether as:
  * A before_action callback (the default)
  * A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
* Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏 

### Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1
Spree 4.2 users should update to spree_auth_devise 4.2.1
Spree 4.1 users should update to spree_auth_devise 4.1.1
Older Spree version users should update to spree_auth_devise 4.0.1
 
### Workarounds

If possible, change your strategy to :exception:

```ruby
class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end
```

Add the following to`config/application.rb `to at least run the `:exception` strategy on the affected controller:

```ruby
config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end
```

### References
https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2
Vulnerability: GHSA-jrhj-2j3q-xf3v
Summary: Stored Cross-Site Scripting in simplehttpserver
Aliases: CVE-2018-3716
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2018-07-26T15:03:30Z

All versions of simplehttpserver are vulnerable to stored cross-site scripting (XSS). To be exploited an attacker needs to control the filename of a file that is used in the directory listing output.


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not use this module if the exploitable conditions are met.
Vulnerability: GHSA-v4x8-gw49-7hv4
Summary: Path Traversal in swagger-injector
Severity: CRITICAL
CVSS score: 0
CWE: CWE-22
Published: 2020-09-03T20:37:42Z

All versions of `swagger-injector` are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the configured `dist` folder using relative paths.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-257v-vj4p-3w2h
Summary: Regular Expression Denial of Service (ReDOS)
Aliases: CVE-2021-29060
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-770
Published: 2021-06-22T01:14:09Z

In the npm package `color-string`, there is a  ReDos (Regular Expression Denial of Service) vulnerability regarding an exponential time complexity for
linearly increasing input lengths for `hwb()` color strings.

Strings reaching more than 5000 characters would see several
milliseconds of processing time; strings reaching more than
50,000 characters began seeing 1500ms (1.5s) of processing time.

The cause was due to a the regular expression that parses
hwb() strings - specifically, the hue value - where
the integer portion of the hue value used a 0-or-more quantifier
shortly thereafter followed by a 1-or-more quantifier.

This caused excessive backtracking and a cartesian scan,
resulting in exponential time complexity given a linear
increase in input length.
Vulnerability: GHSA-cv7m-wc7g-7gfp
Summary: Cross-Site Request Forgery in MAGMI
Aliases: CVE-2020-5776
Severity: MODERATE
CVSS score: 8.8
CWE: CWE-352
Published: 2021-05-06T18:54:41Z

All versions of MAGMI up to and including version 0.7.24 are vulnerable to CSRF due to the lack of CSRF tokens. RCE (via phpcli command) is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI.
Vulnerability: GHSA-m5pq-gvj9-9vr8
Summary: Regular expression denial of service in Rust's regex crate
Aliases: CVE-2022-24713
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2022-03-08T20:00:36Z

> This is a cross-post of [the official security advisory][advisory]. The official advisory contains a signed version with our PGP key, as well.

[advisory]: https://groups.google.com/g/rustlang-security-announcements/c/NcNNL1Jq7Yw

The Rust Security Response WG was notified that the `regex` crate did not properly limit the complexity of the regular expressions (regex) it parses. An attacker could use this security issue to perform a denial of service, by sending a specially crafted regex to a service accepting untrusted regexes. No known vulnerability is present when parsing untrusted input with trusted regexes.

This issue has been assigned CVE-2022-24713. The severity of this vulnerability is "high" when the `regex` crate is used to parse untrusted regexes. Other uses of the `regex` crate are not affected by this vulnerability.

## Overview

The `regex` crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations already provide sane defaults to prevent attacks. This guarantee is documented and it's considered part of the crate's API.

Unfortunately a bug was discovered in the mitigations designed to prevent untrusted regexes to take an arbitrary amount of time during parsing, and it's possible to craft regexes that bypass such mitigations. This makes it possible to perform denial of service attacks by sending specially crafted regexes to services accepting user-controlled, untrusted regexes.

## Affected versions

All versions of the `regex` crate before or equal to 1.5.4 are affected by this issue. The fix is include starting from  `regex` 1.5.5.

## Mitigations

We recommend everyone accepting user-controlled regexes to upgrade immediately to the latest version of the `regex` crate.

Unfortunately there is no fixed set of problematic regexes, as there are practically infinite regexes that could be crafted to exploit this vulnerability. Because of this, we do not recommend denying known problematic regexes.

## Acknowledgements

We want to thank Addison Crump for responsibly disclosing this to us according to the [Rust security policy](https://www.rust-lang.org/policies/security), and for helping review the fix.

We also want to thank Andrew Gallant for developing the fix, and Pietro Albini for coordinating the disclosure and writing this advisory.
Vulnerability: GHSA-8px5-63x9-5c7p
Summary: Command Injection in pullit
Severity: HIGH
CVSS score: 0
CWE: CWE-77
Published: 2020-09-03T16:47:30Z

Versions of `pullit` prior to 1.4.0 are vulnerable to Command Injection. The package does not validate input on git branch names  and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.


## Recommendation

Upgrade to version 1.4.0 or later.

## Credits

   This vulnerability was discovered by @lirantal
Vulnerability: GHSA-r32r-3977-cgc3
Summary: Moderate severity vulnerability that affects org.keycloak:keycloak-core
Aliases: CVE-2014-3651
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2018-10-18T16:50:20Z

JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/qrcode, related to QR code generation.
Vulnerability: GHSA-7xxv-wpxj-mx5v
Summary: Out-of-bounds read in typed-ast and cpython may allow an attacker to crash the interpreter process (ast_for_arguments case).
Aliases: CVE-2019-19275
Severity: HIGH
CVSS score: 7.5
CWE: CWE-125
Published: 2019-12-02T18:03:09Z

typed_ast 1.3.0 and 1.3.1 has an ast_for_arguments out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.)
Vulnerability: GHSA-r9w3-g83q-m6hq
Summary: Prototype Pollution in deepmerge-ts
Aliases: CVE-2022-24802
Severity: HIGH
CVSS score: 8.1
CWE: CWE-1321, CWE-915
Published: 2022-04-01T17:26:03Z

deepmerge-ts is used to merge 2 or more objects respecting type information. deepmerge-ts is vulnerable to Prototype Pollution via file deepmerge.ts, function defaultMergeRecords(). A fix was released in version 4.0.2. Currently, there is no known workaround.
Vulnerability: GHSA-55xv-f85c-248q
Summary: Regular Expression Denial of Service (ReDoS) in jsx-slack
Aliases: CVE-2021-43838
Severity: LOW
CVSS score: 3.7
CWE: CWE-400
Published: 2021-12-17T19:59:02Z

jsx-slack v4.5.1 and earlier versions are vulnerable to a regular expression denial-of-service (ReDoS) attack. 

### Impact

If attacker can put a lot of JSX elements into `<blockquote>` tag, an internal regular expression for escaping characters may consume an excessive amount of computing resources.

```javascript
/** @jsxImportSource jsx-slack */
import { Section } from 'jsx-slack'

console.log(
  <Section>
    <blockquote>
      {[...Array(40)].map((_, i) => (
        <p>{i + 1}</p>
      ))}
    </blockquote>
  </Section>
)
```

### Patches

_See also: https://github.com/yhatt/jsx-slack/security/advisories/GHSA-hp68-xhvj-x6j6_

jsx-slack v4.5.2 has updated regular expressions to prevent catastrophic backtracking.

jsx-slack v4.5.1 also had patched a workaround. It has no problems to contents with ASCII characters, but _still vulnerable to contents with multibyte characters_. (https://github.com/yhatt/jsx-slack/commit/36e4a10405e4c7745333e245fcc5029c02c7065d)

### References

- https://nvd.nist.gov/vuln/detail/CVE-2021-43838
- https://github.com/yhatt/jsx-slack/commit/36e4a10405e4c7745333e245fcc5029c02c7065d

### Credits

Thanks to @hieki for finding out this vulnerability.
Vulnerability: GHSA-9p5g-vg43-mj5r
Summary: Authenticated users can read data from other sources than intended 
Aliases: CVE-2021-36749
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-668, CWE-863
Published: 2021-09-27T20:13:25Z

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource. This issue was previously mentioned as being fixed in 0.21.0 as per CVE-2021-26920 but was not fixed in 0.21.0 or 0.21.1.
Vulnerability: GHSA-2c64-vj8g-vwrq
Summary: Incorrect handling of credential expiry by NATS Server
Severity: HIGH
CVSS score: 0
CWE: CWE-284
Published: 2021-05-21T16:11:49Z

(This advisory is canonically https://advisories.nats.io/CVE/CVE-2020-26892.txt )

## Problem Description

NATS nats-server through 2020-10-07 has Incorrect Access Control because of how expired credentials are handled.

The NATS accounts system has expiration timestamps on credentials; the <https://github.com/nats-io/jwt> library had an API which encouraged misuse and an `IsRevoked()` method which misused its own API.

A new `IsClaimRevoked()` method has correct handling and the nats-server has been updated to use this.  The old `IsRevoked()` method now always returns true and other client code will have to be updated to avoid calling it.

The CVE identifier should cover any application using the old JWT API, where the nats-server is one of those applications.


## Affected versions

#### JWT library

 * all versions prior to 1.1.0
 * fixed after nats-io/jwt PR 103 landed (2020-10-06)

#### NATS Server

 * Version 2 prior to 2.1.9
   + 2.0.0 through and including 2.1.8 are vulnerable.
 * fixed with nats-io/nats-server PRs 1632, 1635, 1645


## Impact

Time-based credential expiry did not work.


## Workaround

Have credentials which only expire after fixes can be deployed.


## Solution

Upgrade the JWT dependency in any application using it.

Upgrade the NATS server if using NATS Accounts.
Vulnerability: GHSA-c9hq-g4q8-w893
Summary: Privilage Escalation in moodle
Aliases: CVE-2020-25701
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-863
Published: 2021-03-29T20:42:55Z

If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable that enrollment method. This could lead to unintended users gaining access to the course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.
Vulnerability: GHSA-23jv-v6qj-3fhh
Summary: Denial of Service (DoS) in HashiCorp Consul
Aliases: CVE-2020-7219
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400, CWE-770
Published: 2021-05-18T18:19:21Z

HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 1.6.3.
Vulnerability: GHSA-g4xq-jx4w-4cjv
Summary: Moderate severity vulnerability that affects loofah
Aliases: CVE-2018-16468
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2018-11-01T14:46:01Z

In the Loofah gem for Ruby, through version 2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. Users are advised to upgrade to version 2.2.3.

See https://github.com/flavorjones/loofah/issues/154 for more details.
Vulnerability: GHSA-4wm5-q7wv-6jx3
Summary: Downloads Resources over HTTP in bkjs-wand
Aliases: CVE-2016-10571
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:52:20Z

Affected versions of `bkjs-wand` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `bkjs-wand`.


## Recommendation

Update to version 0.3.2 or later.
Vulnerability: GHSA-x2gw-85w6-fjjw
Summary: Cross-site scripting in demos/demo.mysqli.php in getID3
Aliases: CVE-2021-40926
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-10-04T20:13:55Z

Cross-site scripting (XSS) vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter.
Vulnerability: GHSA-c8hm-7hpq-7jhg
Summary: High severity vulnerability that affects com.fasterxml.jackson.core:jackson-databind
Aliases: CVE-2018-19362
Severity: HIGH
CVSS score: 9.8
CWE: CWE-502
Published: 2019-01-04T19:07:03Z

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
Vulnerability: GHSA-r28m-g6j9-r2h5
Summary: Information Exposure vulnerability in Eclipse Jetty
Aliases: CVE-2019-10246
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200, CWE-213
Published: 2019-04-23T16:07:18Z

In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.
Vulnerability: GHSA-x5x7-3v85-wpc4
Summary:  Apache Struts allows entering a custom URL in a form field if built-in URLValidator is used
Aliases: CVE-2017-9804
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2018-10-16T19:37:33Z

In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.  NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.
Vulnerability: GHSA-vqx7-pw4r-29rr
Summary: Out of bounds read in bumpalo
Aliases: CVE-2020-35861
Severity: HIGH
CVSS score: 7.5
CWE: CWE-125
Published: 2021-08-25T20:47:13Z

An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read cryptographic keys.
Vulnerability: GHSA-rqgx-hpg4-456r
Summary: Use-after-free in actix-codec
Aliases: CVE-2020-35902
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-416
Published: 2021-08-25T20:49:45Z

An issue was discovered in the actix-codec crate before 0.3.0-beta.1 for Rust. There is a use-after-free in Framed.
Vulnerability: GHSA-838r-hvwh-24h8
Summary: XML Injection in Any23
Aliases: CVE-2021-38555
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-611
Published: 2021-09-13T20:06:31Z

An XML external entity (XXE) injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions < 2.5. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access.
Vulnerability: GHSA-9w7f-m4j4-j3xw
Summary: Gerapy < 0.9.8 may cause remote code execution
Aliases: CVE-2021-43857
Severity: HIGH
CVSS score: 9.8
CWE: CWE-78
Published: 2022-01-06T17:36:38Z

### Impact

project_configure function exist remote code execute in Gerapy < 0.9.8

### Patches

Patched in version 0.9.8, please install with:

```
pip3 install -U gerapy
```
Vulnerability: GHSA-5r5r-6hpj-8gg9
Summary: Serialization gadget exploit in jackson-databind
Aliases: CVE-2020-35728
Severity: HIGH
CVSS score: 8.1
CWE: CWE-502
Published: 2021-12-09T19:15:24Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).
Vulnerability: GHSA-mjvc-j6rv-9xj8
Summary: Insertion of Sensitive Information Into Debugging Code in Microweber
Aliases: CVE-2022-0721
Severity: HIGH
CVSS score: 8.8
CWE: CWE-215
Published: 2022-02-24T00:00:54Z

Microweber prior to 1.3 may expose sensitive information about a server and a user when running the server in debug mode.
Vulnerability: GHSA-phph-xpj4-wvcv
Summary: Cross-Site Scripting in hexo-admin
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-03T21:13:07Z

All versions of `hexo-admin` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize rendered markdown, allowing attackers to execute arbitrary JavaScript in a victim's browser if they are able to create new posts.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-32m2-9f76-4gv8
Summary: Business Logic Errors in SilverStripe Framework
Aliases: CVE-2022-0227
Severity: MODERATE
CVSS score: 4.3
Published: 2022-02-06T00:01:01Z

SilverStripe Framework prior to version 4.10.1 is vulnerable to business logic errors.
Vulnerability: GHSA-3w67-q784-6w7c
Summary: Division by zero in TFLite's implementation of `GatherNd`
Aliases: CVE-2021-29589
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:26:51Z

### Impact
The reference implementation of the `GatherNd` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/0d45ea1ca641b21b73bcf9c00e0179cda284e7e7/tensorflow/lite/kernels/internal/reference/reference_ops.h#L966):

```cc 
ret.dims_to_count[i] = remain_flat_size / params_shape.Dims(i);
```

An attacker can craft a model such that `params` input would be an empty tensor. In turn, `params_shape.Dims(.)` would be zero, in at least one dimension.

### Patches
We have patched the issue in GitHub commit [8e45822aa0b9f5df4b4c64f221e64dc930a70a9d](https://github.com/tensorflow/tensorflow/commit/8e45822aa0b9f5df4b4c64f221e64dc930a70a9d).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions. 

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-mgh5-4h95-qj4p
Summary: Information Exposure in Snyk Broker
Aliases: CVE-2020-7654
Severity: HIGH
CVSS score: 7.5
CWE: CWE-532
Published: 2020-06-03T22:02:14Z

All versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure. It logs private keys if logging level is set to DEBUG.