TQRG/raw-osv-data huggingface dataset:
Vulnerability: GO-2020-0003
Published: 2021-04-14T12:00:00Z

If the application accepts
[slice parameters](https://revel.github.io/manual/parameters.html#slices), an
attacker can cause the application to allocate large amounts of memory and
crash by manipulating the request query.
Vulnerability: GHSA-vfvf-6gx5-mqv6
Summary: Incorrect Authorization in ORY Oathkeeper
Aliases: CVE-2021-32701
Severity: HIGH
CWE: CWE-863
Published: 2021-06-24T20:16:02Z

ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. When you make a request to an endpoint that requires the scope `foo` using an access token granted with that `foo` scope, introspection will be valid and that token will be cached. The problem comes when a second requests to an endpoint that requires the scope `bar` is made before the cache has expired. Whether the token is granted or not to the `bar` scope, introspection will be valid. A patch will be released with `v0.38.12-beta.1`. Per default, caching is disabled for the `oauth2_introspection` authenticator. When caching is disabled, this vulnerability does not exist. The cache is checked in [`func (a *AuthenticatorOAuth2Introspection) Authenticate(...)`](https://github.com/ory/oathkeeper/blob/6a31df1c3779425e05db1c2a381166b087cb29a4/pipeline/authn/authenticator_oauth2_introspection.go#L152). From [`tokenFromCache()`](https://github.com/ory/oathkeeper/blob/6a31df1c3779425e05db1c2a381166b087cb29a4/pipeline/authn/authenticator_oauth2_introspection.go#L97) it seems that it only validates the token expiration date, but ignores whether the token has or not the proper scopes. The vulnerability was introduced in PR #424. During review, we failed to require appropriate test coverage by the submitter which is the primary reason that the vulnerability passed the review process.
Vulnerability: GHSA-f6px-w8rh-7r89
Summary: Data race in Beego
Aliases: CVE-2019-16354
Severity: MODERATE
CWE: CWE-732, CWE-362
Published: 2021-08-02T17:15:05Z

The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions.
Vulnerability: GHSA-r33q-22hv-j29q
Summary: Denial of service in github.com/ethereum/go-ethereum
Aliases: CVE-2020-26264
Severity: MODERATE
CWE: CWE-400
Published: 2021-06-29T21:14:07Z

### Impact

A DoS vulnerability can make a LES server crash via malicious `GetProofsV2` request from a connected LES client.

### Patches

The vulnerability was patched in https://github.com/ethereum/go-ethereum/pull/21896. 

### Workarounds

This vulnerability only concerns users explicitly enabling `les` server; disabling `les` prevents the exploit. 
It can also be patched by manually applying the patch in https://github.com/ethereum/go-ethereum/pull/21896. 


### For more information
If you have any questions or comments about this advisory:
* Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)
* Email us at [security@ethereum.org](mailto:security@ethereum.org)
Vulnerability: GHSA-7qw8-847f-pggm
Summary: Improper Locking in github.com/containers/storage
Aliases: CVE-2021-20291
Severity: HIGH
CWE: CWE-400, CWE-667
Published: 2021-05-10T19:35:07Z

A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS).
Vulnerability: GHSA-44gg-pmqr-4669
Summary: Access Restriction Bypass in Docker
Aliases: CVE-2014-6408
Severity: MODERATE
CWE: CWE-285
Published: 2022-02-15T01:57:18Z

Docker 1.3.0 through 1.3.1 allows remote attackers to modify the default run profile of image containers and possibly bypass the container by applying unspecified security options to an image.
Vulnerability: GO-2020-0015
Aliases: CVE-2020-14040
Published: 2021-04-14T12:00:00Z

An attacker could provide a single byte to a [`UTF16`] decoder instantiated with
[`UseBOM`] or [`ExpectBOM`] to trigger an infinite loop if the [`String`] function on
the [`Decoder`] is called, or the [`Decoder`] is passed to [`transform.String`].
If used to parse user supplied input, this may be used as a denial of service
vector.
Vulnerability: GHSA-9cx9-x2gp-9qvh
Summary: CRLF vulnerability in Fiber
Aliases: CVE-2020-15111
Severity: MODERATE
CWE: CWE-93, CWE-74
Published: 2021-06-29T21:24:28Z

### Impact
The filename that is given in [c.Attachment()](https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack. I.e. an attacker could upload a custom filename and then give the link to the victim. With this filename, the attacker can change the name of the downloaded file, redirect to another site, change the authorization header, etc.

### Steps to reproduce
```go
package main

import "github.com/gofiber/fiber"

const badFileName = "another secret document.pdf\"\r\nLocation: google.com\r\nAuthorization: \"example_of_session_fixation"

func splitTheResponse(c *fiber.Ctx) {
	c.Attachment(badFileName)
}

func main() {
	app := fiber.New()
	app.Get("/attack", splitTheResponse)
	app.Listen("127.0.0.1:8080")
}
```
```
HTTP/1.1 200 OK
Date: Fri, 10 Jul 2020 19:47:04 GMT
Content-Type: application/octet-stream
Content-Length: 0
Content-Disposition: attachment; filename="another secret document.pdf"
Location: google.com
Authorization: "example_of_session_fixation"
```

### Patches
This issue has been patched in `v1.12.6` with commit [579](https://github.com/gofiber/fiber/pull/579/commits/f698b5d5066cfe594102ae252cd58a1fe57cf56f) escaping the filename by default.

### Workarounds
You could of course serialize the input yourself before passing it to `ctx.Attachment()`, this is actually a good practice by default. But in case you forget, we got you covered 👍 

### References
A CRLF injection attack is one of several types of injection attacks. It can be used to escalate to more malicious attacks such as Cross-site Scripting (XSS), page injection, web cache poisoning, cache-based defacement, and more. A CRLF injection vulnerability exists if an attacker can inject the CRLF characters into a web application, for example using a user input form or an HTTP request, [see acunetix](https://www.acunetix.com/websitesecurity/crlf-injection/)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [gofiber/fiber](https://github.com/gofiber/fiber)
* Join us on [Discord](https://gofiber.io/discord)
Vulnerability: GHSA-2575-pghm-6qqx
Summary: Incorrect Permission Assignment for Critical Resource	and Use of Cache Containing Sensitive Information in Kubernetes
Aliases: CVE-2019-11244
Severity: MODERATE
CWE: CWE-732, CWE-524
Published: 2022-02-15T01:57:18Z

In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-dir is specified and pointed at a different location accessible to other users/groups, the written files may be modified by other users/groups and disrupt the kubectl invocation.
Vulnerability: GHSA-877x-32pm-p28x
Summary: Link Following in Kata Runtime
Aliases: CVE-2020-2026
Severity: HIGH
CWE: CWE-59
Published: 2022-02-15T01:57:18Z

A malicious guest compromised before a container creation (e.g. a malicious guest image or a guest running multiple containers) can trick the kata runtime into mounting the untrusted container filesystem on any host path, potentially allowing for code execution on the host. This issue affects Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; Kata Containers 1.9 and earlier versions.
Vulnerability: GO-2020-0042
Aliases: CVE-2020-7667
Published: 2021-04-14T12:00:00Z

Due to improper path santization, RPMs containing relative file
paths can cause files to be written (or overwritten) outside of the
target directory.
Vulnerability: GHSA-f37q-q7p2-ccfc
Summary: Resource exhaustion in Mattermost
Aliases: CVE-2022-1337
Severity: MODERATE
CWE: CWE-400
Published: 2022-04-14T00:00:17Z

The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attacker to crash the server via links to very large image files.
Vulnerability: GHSA-wc9w-wvq2-ffm9
Summary: Server Side Request Forgery in Grafana
Aliases: CVE-2020-13379
Severity: MODERATE
CWE: CWE-918
Published: 2022-02-15T01:57:18Z

The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue that allows remote code execution. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on.
Vulnerability: GHSA-5mv9-q7fq-9394
Summary: Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint
Aliases: CVE-2021-32635
Severity: MODERATE
CWE: CWE-20
Published: 2021-06-01T21:21:01Z

### Impact

Due to incorrect use of a default URL, `singularity` action commands (`run`/`shell`/`exec`) specifying a container using a `library://` URI will always attempt to retrieve the container from the default remote endpoint (`cloud.sylabs.io`) rather than the configured remote endpoint.

An attacker may be able to push a malicious container to the default remote endpoint with a URI that is identical to the URI used by a victim with a non-default remote endpoint, thus executing the malicious container.

Only action commands (`run`/`shell`/`exec`) against `library://` URIs are affected. Other commands such as `pull` / `push` respect the configured remote endpoint.

### Patches

All users should upgrade to Singularity 3.7.4 or later.

### Workarounds

Users who only interact with the default remote endpoint are not affected.

Installations with an execution control list configured to restrict execution to containers signed with specific secure keys are not affected.

### For more information

General questions about the impact of the advisory can be asked in the:

- [SingularityCE Slack Channel](https://singularityce.slack.com)
- [SingularityCE Mailing List](https://groups.google.com/g/singularity-ce)

Any sensitive security concerns should be directed to: security@sylabs.io

See our Security Policy here: https://sylabs.io/security-policy
Vulnerability: GHSA-4gh8-x3vv-phhg
Summary: Predictable SIF UUID Identifiers in github.com/sylabs/sif
Aliases: CVE-2021-29499
Severity: HIGH
CWE: CWE-330, CWE-340
Published: 2021-05-18T18:30:38Z

### Impact

The `siftool new` command and [func siftool.New()](https://pkg.go.dev/github.com/sylabs/sif/pkg/siftool#New) produce predictable UUID identifiers due to insecure randomness in the version of the `github.com/satori/go.uuid` module used as a dependency.

### Patches
A patch is available in versions 1.2.3 and newer of the module. Users are encouraged to upgrade.

### Workarounds
Users passing [CreateInfo struct](https://pkg.go.dev/github.com/sylabs/sif/pkg/sif#CreateInfo) should ensure the `ID` field is generated using a version of `github.com/satori/go.uuid` that is not vulnerable to this issue. Unfortunately, the latest tagged release is vulnerable to this issue. One way to obtain a non-vulnerable version is:

```
go get github.com/satori/go.uuid@75cca531ea763666bc46e531da3b4c3b95f64557
```
Vulnerability: GHSA-2x32-jm95-2cpx
Summary: Authentication Bypass in dex
Aliases: CVE-2020-27847
Severity: CRITICAL
CWE: CWE-290, CWE-228
Published: 2021-12-20T17:52:12Z

A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to bypass SAML authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. This flaw affects dex versions before 2.27.0.
Vulnerability: GO-2020-0039
Aliases: CVE-2020-12666
Published: 2021-04-14T12:00:00Z

Due to improper request santization, a specifically crafted URL
can cause the static file handler to redirect to an attacker chosen
URL, allowing for open redirect attacks.
Vulnerability: GHSA-9wvh-ff5f-xjpj
Summary: Missing Authorization in Harbor
Aliases: CVE-2019-16097
Severity: MODERATE
CWE: CWE-862
Published: 2022-02-15T01:57:18Z

core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API. This is fixed in 1.9.0-rc1.
Vulnerability: GHSA-g42g-737j-qx6j
Summary: Access Restriction Bypass in kube-apiserver
Aliases: CVE-2021-25735
Severity: MODERATE
CWE: CWE-863, CWE-284
Published: 2021-05-28T19:49:59Z

A vulnerability in Kubernetes `kube-apiserver` could allow node updates to bypass a _Validating Admission Webhook_ and allow unauthorized node updates. The information that is provided to the admission controller could contain old configurations that overwrite values used for validation. Since the overwriting takes place before the validation, this could lead the admission controller to accept requests that should be blocked. The vulnerability can be exploited when an update action on node resources is performed and an admission controller is in place and configured to validate the action.

Users are only affected by this vulnerability if they are running a _Validating Admission Webhook_ for Nodes that denies admission based partially on the old state of the Node object. It only impacts validating admission plugins that rely on old values in certain fields and does not impact calls from kubelets that go through the built-in NodeRestriction admission plugin.
Vulnerability: GHSA-mfv7-gq43-w965
Summary: Incomplete List of Disallowed Inputs in Kubernetes
Aliases: CVE-2021-25737
Severity: MODERATE
CWE: CWE-184, CWE-601
Published: 2021-09-07T23:09:24Z

A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.
Vulnerability: GO-2021-0072
Aliases: CVE-2017-11468
Published: 2021-04-14T12:00:00Z

Various storage methods do not impose limits on how much content is accepted
from user requests, allowing a malicious user to force the caller to allocate
an arbitary amount of memory.
Vulnerability: GHSA-77cr-6gr8-7rr9
Summary: Use After Free in HashiCorp Nomad
Aliases: CVE-2020-27195
Severity: CRITICAL
CWE: CWE-416
Published: 2022-02-15T01:57:18Z

HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6
Vulnerability: GHSA-75pc-qvwc-jf3g
Summary: Improper Input Validation in HashiCorp Vault
Aliases: CVE-2020-12757
Severity: HIGH
CWE: CWE-20
Published: 2021-05-18T18:20:48Z

HashiCorp Vault and Vault Enterprise 1.4.x before 1.4.2 has Incorrect Access Control.
Vulnerability: GHSA-78hj-86cr-6j2v
Summary: Improper Access Control in Lightning Network Daemon
Aliases: CVE-2019-12999
Severity: HIGH
CWE: CWE-284
Published: 2021-05-18T15:30:22Z

Lightning Network Daemon (lnd) before 0.7 allows attackers to trigger loss of funds because of Incorrect Access Control.
Vulnerability: GHSA-hpmr-prr2-cqc4
Summary: Remote Code Execution
Aliases: CVE-2019-11229
Severity: HIGH
CWE: CWE-94
Published: 2022-02-15T01:57:18Z

models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution.
Vulnerability: GHSA-m4jx-6526-vvhm
Summary: Denial of service in github.com/nats-io/nats-server/server
Aliases: CVE-2020-28466
Severity: HIGH
CWE: CWE-400
Published: 2022-02-15T01:57:18Z

This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers - Running a NATS service which is exposed to untrusted users presents a heightened risk. Any remote execution flaw or equivalent seriousness, or denial-of-service by unauthenticated users, will lead to prompt releases by the NATS maintainers. Fixes for denial of service issues with no threat of remote execution, when limited to account holders, are likely to just be committed to the main development branch with no special attention. Those who are running such services are encouraged to build regularly from git.
Vulnerability: GHSA-35vc-w93w-75c2
Summary: JWT leak via Open Redirect in Programmatic access
Aliases: CVE-2021-29651
Severity: HIGH
CWE: CWE-601, CWE-200
Published: 2021-05-21T16:24:34Z

### Impact
Using programmatic access on protected sites, one can get a signed login URL with pomerium_redirect_uri set to an arbitrary URL. Then, if the user has already logged into Pomerium, they will be redirected to the specified pomerium_redirect_uri with a JWT attached. This allows an outside attacker to get a signed login URL that, upon visiting it, will redirect a victim to the attacker’s site. This creates an issue of Open Redirect and, more seriously, JWT leakage.

With a leaked JWT, the attacker will be able to unveil the victim’s identity (.e.g. email address) by supplying the JWT to the authenticate service or verify.pomerium.com. In addition, if an application integrating Pomerium only verifies the iss claim and others but not the aud claim, the attacker will be able to access it as the victim.

### Patches
Patched in Pomerium v0.13.4

### For more information
If you have any questions or comments about this advisory
* Open an issue in [pomerium](http://github.com/pomerium/pomerium)
* Email us at [security@pomerium.com](mailto:security@pomerium.com)
Vulnerability: GHSA-xhqq-x44f-9fgg
Summary: Authentication Bypass in github.com/russellhaering/gosaml2
Aliases: CVE-2020-29509
Severity: CRITICAL
CWE: CWE-115
Published: 2022-02-11T23:58:09Z

### Impact
Given a valid SAML Response, it may be possible for an attacker to mutate the XML document in such a way that gosaml2 will trust a different portion of the document than was signed.

Depending on the implementation of the Service Provider this enables a variety of attacks, including users accessing accounts other than the one to which they authenticated in the Identity Provider, or full authentication bypass.

### Patches
Service Providers utilizing gosaml2 should upgrade to v0.6.0 or greater.
Vulnerability: GHSA-qq5v-f4c3-395c
Summary: Possible XSS when using SSO with the CLI in github.com/argoproj/argo-cd/v2
Aliases: CVE-2021-23347
Severity: MODERATE
CWE: CWE-79
Published: 2021-05-21T14:31:41Z

### Impact

When using SSO with the Argo CD CLI, a malicious SSO provider could have sent specially crafted error message that would result in XSS on the client by means of executing arbitrary JavaScript code.

We believe the exploitation of this vulnerability is only be possible when Argo CD is connected to a compromised/malicious SSO provider.

### Patches

A patch for this vulnerability is available with the v1.8.7 and v1.7.14 releases of Argo CD.

### Workarounds

* Do not use SSO with the CLI when you don't trust your SSO provider


If you have any questions or comments about this advisory:

* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)
* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel `#argo-cd`

### Credits

The issue was found during static code scanning with CodeQL and fixed by the Argo CD team. While we believed that a rogue SSO provider would pose a severe threat by itself, we fixed it like a regular bug.

The Argo CD team would like to thank Adam Gold of Snyk (https://snyk.io) for stepping up and classifying this correctly as a  security issue and for his help in determining its severity. Also, Snyk kindly reserved and provided the CVE for this vulnerability.

We fully agree with Adam that this bug is a security vulnerability and justifies publishing a SA, to provide our community and users full transparancy.
Vulnerability: GHSA-38r5-34mr-mvm7
Summary: "catalog's registry v2 api exposed on unauthenticated path in Harbor"
Aliases: CVE-2020-29662
Severity: MODERATE
CWE: CWE-319, CWE-287
Published: 2022-02-12T00:01:51Z

### **Impact**
Javier Provecho, member of the TCCT (Telefonica Cloud & Cybersecurity Tech better known as ElevenPaths) SRE team discovered a vulnerability regarding Harbor’s v2 API.

The catalog’s registry v2 api is exposed on an unauthenticated path. The current catalog API path is served at the following path and it requires to be authenticated as an admin.

"GET /v2/_catalog"

However, the authorization can be bypassed by using the following path

"GET /v2/_catalog/"

### **Patches**
If your product uses the affected releases of Harbor, update to either version v2.1.2 or v2.0.5 to fix this issue immediately

https://github.com/goharbor/harbor/releases/tag/v2.1.2
https://github.com/goharbor/harbor/releases/tag/v2.0.5

### **Workarounds**
If you cannot access a patched release, it can be mitigated by disabling that API. For example, redirecting it to a 404 sink hole in the ingress.

### **For more information**
If you have any questions or comments about this advisory, contact cncf-harbor-security@lists.cncf.io
View our security policy at https://github.com/goharbor/harbor/security/policy
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29662
Vulnerability: GHSA-jphm-g89m-v42p
Summary: Path traversal in Grafana Cortex
Aliases: CVE-2021-36157
Severity: MODERATE
CWE: CWE-22
Published: 2021-09-02T21:59:50Z

An issue was discovered in Grafana Cortex through 1.9.0. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Cortex will attempt to parse a rules file at that location and include some of the contents in the error message. (Other Cortex API requests can also be sent a malicious OrgID header, e.g., tricking the ingester into writing metrics to a different location, but the effect is nuisance rather than information disclosure.)
Vulnerability: GHSA-qr2j-wrhx-4829
Summary: Improper Input Validation
Aliases: CVE-2018-16733
Severity: MODERATE
CWE: CWE-20
Published: 2021-05-18T18:38:06Z

In Go Ethereum (aka geth) before 1.8.14, TraceChain in eth/api_tracer.go does not verify that the end block is after the start block.
Vulnerability: GHSA-85p9-j7c9-v4gr
Summary: Insufficiently Protected Credentials
Aliases: CVE-2019-10214
Severity: MODERATE
CWE: CWE-522
Published: 2022-02-15T01:57:18Z

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens.
Vulnerability: GHSA-fx8w-mjvm-hvpc
Summary: Path Traversal in Buildah
Aliases: CVE-2020-10696
Severity: HIGH
CWE: CWE-22
Published: 2021-05-18T18:32:41Z

A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions.
Vulnerability: GHSA-m898-h4pm-pqfr
Summary: Arbitrary code execution due to an uncontrolled search path for the git binary
Aliases: CVE-2021-28955
Severity: HIGH
CWE: CWE-427
Published: 2021-05-25T18:44:09Z

### Impact

The go language recently addressed a security issue in the way that binaries are found before being executed. Some operating systems like Windows persist to have the current directory being part of the default search path, and having priority over the system-wide path.

This means that it's possible for a malicious user to craft for example a `git.bat` command, commit it and push it in a repository. Later when git-bug search for the git binary, this malicious executable can take priority  and be executed.

### Who is impacted

This issue happen on Windows and some other operating systems with a badly configured PATH.

All version prior to 0.7.2 are vulnerable to this issue.

### Patches

Version 0.7.2 fix this issue. Users should update as soon as possible.

### References

More details about this issue can be found [here](https://blog.golang.org/path-security).
Vulnerability: GO-2021-0064
Aliases: CVE-2020-8565
Published: 2021-04-14T12:00:00Z

Authorization tokens may be inappropriately logged if the verbosity
level is set to a debug level.
Vulnerability: GHSA-h746-rm5q-8mgq
Summary: Legacy Node API Allows Impersonation in github.com/spiffe/spire/pkg/server/endpoints/node
Aliases: CVE-2021-27098
Severity: HIGH
CWE: CWE-295, CWE-284
Published: 2021-05-21T14:31:11Z

#### Summary
In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy Node API can result in the possible issuance of an X.509 certificate with a URI SAN for a SPIFFE ID that the agent is not authorized to distribute. Proper controls are in place to require that the caller presents a valid agent certificate that is already authorized to issue at least one SPIFFE ID, and the requested SPIFFE ID belongs to the same trust domain, prior to being able to trigger this vulnerability. This issue has been fixed in SPIRE versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1.

#### What are the changes introduced by the patched versions?
The changes introduced to address this issue are related to enforcing that the FetchX509SVID RPC of SPIRE Server’s Legacy Node API only issues X.509 certificates with SPIFFE IDs that the agent is authorized to distribute.

The patched version also includes a back-ported change that improves the handling of file descriptors related to workload attestation in SPIRE Agent.

There are no changes in the expected behavior of SPIRE.

#### Should I upgrade SPIRE?
All SPIRE users running affected versions are advised to upgrade to the corresponding patched version.

#### Workarounds
No workarounds have been identified for this vulnerability.
Vulnerability: GHSA-x462-89pf-6r5h
Summary: Crash due to malformed relay protocol message
Aliases: CVE-2021-21404
Severity: LOW
CWE: CWE-20
Published: 2021-05-21T16:23:17Z

### Impact

1. `syncthing` can be caused to crash and exit if sent a malformed relay
   protocol message message with a negative length field.

2. The relay server `strelaysrv` can be caused to crash and exit if sent
   a malformed relay protocol message with a negative length field.

At no point is sensitive data exposed or liable to be altered due to this
issue. Sensitive data is never exposed to relay operators. Syncthing itself
would need to be lured to connect to a malicious relay server in order to
exploit the issue.

### Patches

Fixed in version 1.15.0.

### Workarounds

1. No known workaround for `strelaysrv`.

2. `syncthing` can be configured to not use relays, or to only use specific,
   trusted relays. If Syncthing is used in a closed environment or with
   relaying disabled, i.e., it does not communicate with unknown relays,
   Syncthing is not vulnerable.

### For more information

If you have any questions or comments about this advisory, please discuss it [on the forum](https://forum.syncthing.net/).

Thanks to Wojciech Paciorek for discovering and reporting this issue.
Vulnerability: GHSA-qh36-44jv-c8xj
Summary: Potential proxy IP restriction bypass in Kubernetes
Aliases: CVE-2020-8562
Severity: LOW
CWE: CWE-367
Published: 2022-02-02T00:01:58Z

As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane.
Vulnerability: GHSA-vrcc-g6vj-mh5w
Summary: Denial of service in go-ethereum
Aliases: CVE-2021-42219
Severity: HIGH
CWE: CWE-400
Published: 2022-03-18T00:01:13Z

Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a denial of service (DoS) via sending an excessive amount of messages to a node. This is caused by missing memory in the component /ethash/algorithm.go.
Vulnerability: GHSA-3x58-xr87-2fcj
Summary: Cross-site scripting in bluemonday
Aliases: CVE-2021-29272
Severity: MODERATE
CWE: CWE-79
Published: 2021-05-18T21:07:37Z

bluemonday before 1.0.5 allows XSS because certain Go lowercasing converts an uppercase Cyrillic character, defeating a protection mechanism against the "script" string.
Vulnerability: GHSA-c66w-hq56-4q97
Summary: Network policy may be bypassed by some ICMP Echo Requests
Severity: LOW
Published: 2021-05-21T14:32:37Z

## Impact

Under certain conditions, ICMP Echo Request sent to a Cilium endpoint from an actor may bypass a network policy which _disallows_ access from the actor to the endpoint, but _allows_ from the endpoint to the actor. This does _NOT_ apply to UDP and TCP traffic.

The actor is either a pod or a cluster host or a remote host.

The following conditions must be met:
1. Network policies have been created which:
  a) do not allow access from the actor to the endpoint;
  b) allow access from the endpoint to the actor and does not specify neither protocol nor port. 
2. The endpoint has sent ICMP Echo Request to the actor with the ICMP identifier X.
3. The actor sends ICMP Echo Request to the endpoint with the same ICMP identifier X.
4. The request from the actor (3.) is sent before the Cilium's conntrack GC has removed the previously created conntrack entry (2.).

## Detailed description

See https://github.com/cilium/cilium/commit/dfb008a9099c4da1e0fd964c899c43ee13280b0e (v1.9.x), https://github.com/cilium/cilium/commit/ff6ebae6efca1bd991302b464dea428512823e79 (v1.8.x), https://github.com/cilium/cilium/commit/472bbeff75161979c317ab21d563f826291b5f37 (v1.7.x).

## Example

```
$ kubectl run server --image=quay.io/cilium/net-test:v1.0.0 --restart=Never -- sleep 3600
$ kubectl run client --image=quay.io/cilium/net-test:v1.0.0 --restart=Never -- sleep 3600
$ cat <<EOF | kubectl apply -f
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: server-netpol # allow client->server
spec:
  podSelector:
    matchLabels:
      run: server
  ingress:
  - from:
    - podSelector:
        matchLabels:
          run: client
  policyTypes:
  - Ingress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: client-netpol # deny any->client
spec:
  podSelector:
    matchLabels:
      run: client
  policyTypes:
  - Ingress
EOF

$ kubectl exec -ti server -- xping -c1 -x666 $CLIENT_POD_IP
PING 10.154.0.50 (10.154.0.50): 56 data bytes
^C
--- 10.154.0.50 ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss   <--- "client-netpol" policy denied
command terminated with exit code 1

$ kubectl exec -ti client -- xping -c1 -x666 $SERVER_POD_IP
PING 10.154.1.16 (10.154.1.16): 56 data bytes
64 bytes from 10.154.1.16: seq=0 ttl=60 time=0.822 ms

--- 10.154.1.16 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss   <--- "server-netpol" policy allowed
round-trip min/avg/max = 0.822/0.822/0.822 ms

$ kubectl exec -ti server -- xping -c1 -x666 $CLIENT_POD_IP
PING 10.154.0.50 (10.154.0.50): 56 data bytes
64 bytes from 10.154.0.50: seq=0 ttl=60 time=0.527 ms

--- 10.154.0.50 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss   <--- "client-netpol" policy bypassed
round-trip min/avg/max = 0.527/0.527/0.527 ms
```

## For more information

If you have any questions or comments about this advisory:

- Open an issue in [Cilium Issues](https://github.com/cilium/cilium/issues)
- Email us at security@cilium.io
Vulnerability: GO-2021-0101
Aliases: CVE-2019-0210
Published: 2021-07-28T12:00:00Z

Due to an improper bounds check, parsing maliciously crafted messages can cause panics. If
this package is used to parse untrusted input, this may be used as a vector for a denial of
service attack.
Vulnerability: GHSA-h5rh-w6vm-9ghc
Summary: Denial of service in Grafana
Aliases: CVE-2021-27358
Severity: HIGH
CWE: CWE-400, CWE-306
Published: 2022-02-15T01:57:18Z

The snapshot feature in Grafana before 7.4.2 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.
Vulnerability: GO-2021-0052
Aliases: CVE-2020-28483
Published: 2021-04-14T12:00:00Z

Due to improper HTTP header santization, a malicious user can spoof their
source IP address by setting the X-Forwarded-For header. This may allow
a user to bypass IP based restrictions, or obfuscate their true source.
Vulnerability: GHSA-w6ww-fmfx-2x22
Summary: Misconfigured IP address field in ROA leads to OctoRPKI crash
Aliases: CVE-2021-3911
Severity: MODERATE
CWE: CWE-20, CWE-252
Published: 2021-11-10T19:56:04Z

If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.

## Patches

## For more information
If you have any questions or comments about this advisory email us at security@cloudflare.com
Vulnerability: GHSA-g95p-88p4-76cm
Summary: Cross-site Scripting in Gitea
Aliases: CVE-2021-28378
Severity: MODERATE
CWE: CWE-79
Published: 2021-09-27T20:17:39Z

Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations.
Vulnerability: GHSA-xx8c-m748-xr4j
Summary: Access Restriction Bypass in kubernetes
Aliases: CVE-2016-1905
Severity: MODERATE
CWE: CWE-284
Published: 2022-02-15T01:57:18Z

The API server in Kubernetes does not properly check admission control, which allows remote authenticated users to access additional resources via a crafted patched object.
Vulnerability: GO-2020-0019
Aliases: CVE-2020-27813
Published: 2021-04-14T12:00:00Z

An attacker can craft malicious WebSocket frames that cause an integer
overflow in a variable which tracks the number of bytes remaining. This
may cause the server or client to get stuck attempting to read frames
in a loop, which can be used as a denial of service vector.
Vulnerability: GHSA-27pv-q55r-222g
Summary: Path traversal in github.com/ipfs/go-ipfs
Aliases: CVE-2020-26279
Severity: HIGH
CWE: CWE-22
Published: 2021-06-23T17:27:44Z

### Impact
It is currently possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten, or written to incorrect output directories. The issue can only occur when `ipfs get` is done on an affected DAG.

1. The only affected command is `ipfs get`.
2. The gateway is not affected.

### Patches
Traversal fix patched in https://github.com/whyrusleeping/tar-utils/commit/20a61371de5b51380bbdb0c7935b30b0625ac227
`tar-utils` patch applied to go-ipfs via https://github.com/ipfs/go-ipfs/commit/b7ddba7fe47dee5b1760b8ffe897908417e577b2

### Workarounds
Upgrade to go-ipfs 0.8 or later.

### References
Binaries for the patched versions of go-ipfs are available on the IPFS distributions site, https://dist.ipfs.io/go-ipfs

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [go-ipfs](https://github.com/ipfs/go-ipfs)
* Email us at [security@ipfs.io](mailto:security@ipfs.io)
Vulnerability: GHSA-76wf-9vgp-pj7w
Summary: Unencrypted md5 plaintext hash in metadata in AWS S3 Crypto SDK for golang
Severity: MODERATE
Published: 2022-02-11T23:26:12Z

### Summary

The golang AWS S3 Crypto SDK was impacted by an issue that can result in loss of confidentiality. An attacker with read access to an encrypted S3 bucket was able to recover the plaintext without accessing the encryption key.

### Risk/Severity

The vulnerability poses insider risks/privilege escalation risks, circumventing KMS controls for stored data.

### Impact

The issue has been fully mitigated by AWS as of Aug. 5th by disallowing the header in question.

The S3 crypto library tries to store an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext in an offline attack, if the hash is readable to the attacker. In order to be impacted by this issue, the attacker has to be able to guess the plaintext as a whole. The attack is theoretically valid if the plaintext entropy is below the key size, i.e. if it is easier to brute force the plaintext instead of the key itself, but practically feasible only for short plaintexts or plaintexts otherwise accessible to the attacker in order to create a rainbow table.

The issue has been fixed server-side by AWS as of Aug 5th, by blocking the related metadata field. No S3 objects are affected anymore.

### Mitigation

The header in question is no longer served by AWS, making this attack fully mitigated as of Aug. 5th.

### Proof of concept

A [Proof of concept](https://github.com/sophieschmieg/exploits/tree/master/aws_s3_crypto_poc) is available in a separate github repository, this particular issue can be found at [here](https://github.com/sophieschmieg/exploits/blob/master/aws_s3_crypto_poc/exploit/hash_exploit.go):

```golang
func HashExploit(bucket string, key string, input *OfflineAttackInput) (string, error) {
	_, header, err := input.S3Mock.GetObjectDirect(bucket, key)
	length, err := strconv.Atoi(header.Get("X-Amz-Meta-X-Amz-Unencrypted-Content-Length"))
	plaintextMd5 := header.Get("X-Amz-Meta-X-Amz-Unencrypted-Content-Md5")
	blocks := length / 16
	possiblePlaintextNum := 1
	segNum := len(input.PossiblePlaintextSegments)
	for i := 0; i < blocks; i++ {
		possiblePlaintextNum *= segNum
	}
	for i := 0; i < possiblePlaintextNum; i++ {
		w := i
		guess := ""
		for j := 0; j < blocks; j++ {
			guess += input.PossiblePlaintextSegments[w%segNum]
			w /= segNum
		}
		guessMd5 := md5.Sum([]byte(guess))
		if plaintextMd5 == base64.StdEncoding.EncodeToString(guessMd5[:]) {
			return guess, nil
		}
	}
	return "", fmt.Errorf("No plaintext found!")
}
```

The PoC will only work on old versions of the library, as the hash has been removed from being calculated as well.
Vulnerability: GO-2021-0091
Aliases: CVE-2020-15111
Published: 2021-04-14T12:00:00Z

Due to improper input validation when uploading a file, a malicious user may
force the server to return arbitary HTTP headers when the uploaded file
is downloaded.
Vulnerability: GHSA-5684-g483-2249
Summary: Signature Validation Bypass
Severity: CRITICAL
CWE: CWE-347
Published: 2021-05-24T16:59:47Z

### Impact
Given a valid SAML Response, an attacker can potentially modify the document, bypassing signature validation in order to pass off the altered document as a signed one.

This enables a variety of attacks, including users accessing accounts other than the one to which they authenticated in the identity provider, or full authentication bypass if an external attacker can obtain an expired, signed SAML Response.

### Patches
A patch is available, users of gosaml2 should upgrade to v0.5.0 or higher.

### References
See the [underlying advisory on goxmldsig](https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7) for more details.
Vulnerability: GHSA-cqh2-vc2f-q4fh
Summary: Arbitrary filepath traversal via URI injection 
Aliases: CVE-2021-3907
Severity: HIGH
CWE: CWE-20, CWE-22
Published: 2021-11-10T20:08:29Z

OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex.  `rsync://example.org/repo/../../etc/cron.daily/evil.roa`), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on. 

## Patches

## For more information
If you have any questions or comments about this advisory email us at security@cloudflare.com
Vulnerability: GO-2020-0035
Published: 2021-04-14T12:00:00Z

Due to improper path santization, archives containing relative file
paths can cause files to be written (or overwritten) outside of the
target directory.
Vulnerability: GHSA-jrpg-35hw-m4p9
Summary: Capture-replay in Gitea
Aliases: CVE-2021-45327
Severity: CRITICAL
CWE: CWE-294
Published: 2022-02-09T00:00:29Z

Gitea is a project to help users set up a self-hosted Git service. Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. This could allow a remote malicious user to execute arbitrary code.
Vulnerability: GHSA-vmp5-c5hp-6c65
Summary: Woodpecker allows cross-site scripting (XSS) via build logs
Aliases: CVE-2022-29947
Severity: MODERATE
CWE: CWE-79
Published: 2022-04-30T00:00:33Z

Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping.
Vulnerability: GHSA-w2j5-3rcx-vx7x
Summary: Sysctls applied to containers with host IPC or host network namespaces can affect the host
Severity: MODERATE
Published: 2022-03-15T20:02:54Z

### Impact
Before setting the sysctls for a pod, the pods namespaces must be unshared (created). However, in cases where the pod is using a host network or IPC namespace, a bug in CRI-O caused the namespace creating tool [pinns](https://github.com/cri-o/cri-o/tree/main/pinns/) to configure the sysctls of the host. This allows a malicious user to set sysctls on the host, assuming they have access to hostNetwork and hostIPC.

Any CRI-O cluster after CRI-O 1.18 that drops the infra container
1.22 and 1.23 clusters drop infra container by default, and are thus vulnerable by default.

### Patches
CRI-O versions 1.24.0, 1.23.1, 1.22.2, 1.21.5, 1.20.6, 1.19.5 all have the patches.

### Workarounds
Users can set `manage_ns_lifecycle` to false, which causes the sysctls to be configured by the OCI runtime, which typically filter these cases. This option is available in 1.20 and 1.19. Newer versions don't have this option.
An admission webhook could also be created to deny pods that use host IPC or network namespaces and also attempt to configure sysctls related to that namespace.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the CRI-O repo](http://github.com/cri-o/cri-o/issues)
* To make a report, email your vulnerability to the private
[cncf-crio-security@lists.cncf.io](mailto:cncf-crio-security@lists.cncf.io) list
with the security details and the details expected for [all CRI-O bug
reports](https://github.com/cri-o/cri-o/blob/main/.github/ISSUE_TEMPLATE/bug-report.yml).
Vulnerability: GHSA-q47x-6mqq-4w92
Summary: Improper Input Validation
Aliases: CVE-2019-11228
Severity: HIGH
CWE: CWE-20
Published: 2022-02-15T01:57:18Z

repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress.
Vulnerability: GHSA-m54r-vrmv-hw33
Summary: Improper Sanitizing of plugin names in helm
Aliases: CVE-2020-15186
Severity: LOW
CWE: CWE-20, CWE-74
Published: 2021-05-24T16:57:12Z

### Impact

Security researchers at Trail of Bits discovered that plugin names are not sanitized properly. As a result, a malicious plugin author could use characters in a plugin name that would result in unexpected behavior, such as duplicating the name of another plugin or spoofing the output to `helm --help`.

### Patches

This issue has been patched in Helm 3.3.2.

### Workarounds

Do not install untrusted Helm plugins. Examine the `name` field in the `plugin.yaml` file for a plugin, looking for characters outside of the [a-zA-Z0-9._-] range.
Vulnerability: GO-2021-0087
Aliases: CVE-2019-19921
Published: 2021-04-14T12:00:00Z

A race while mounting volumes allows a possible symlink-exchange
attack, allowing a user whom can start multiple containers with
custom volume mount configurations to escape the container.
Vulnerability: GO-2021-0068
Aliases: CVE-2021-3115
Published: 2021-04-14T12:00:00Z

The go command may execute arbitrary code at build time when using cgo on Windows.
This can be triggered by running go get on a malicious module, or any other time
the code is built.
Vulnerability: GHSA-77vh-xpmg-72qh
Summary: Clarify `mediaType` handling
Severity: LOW
CWE: CWE-843
Published: 2021-11-18T16:02:41Z

### Impact
In the OCI Image Specification version 1.0.1 and prior, manifest and index documents are not self-describing and documents with a single digest could be interpreted as either a manifest or an index.

### Patches
The Image Specification will be updated to recommend that both manifest and index documents contain a `mediaType` field to identify the type of document.
Release [v1.0.2](https://github.com/opencontainers/image-spec/releases/tag/v1.0.2) includes these updates.

### Workarounds
Software attempting to deserialize an ambiguous document may reject the document if it contains both “manifests” and “layers” fields or “manifests” and “config” fields.

### References
https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/opencontainers/image-spec
* Email us at [security@opencontainers.org](mailto:security@opencontainers.org)
* https://github.com/opencontainers/image-spec/commits/v1.0.2
Vulnerability: GHSA-4wp3-8q92-mh8w
Summary: Cross Site Request Forgery in Gitea
Aliases: CVE-2021-45326
Severity: HIGH
CWE: CWE-352
Published: 2022-02-09T00:00:29Z

Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests.
Vulnerability: GO-2020-0023
Published: 2021-04-14T12:00:00Z

Token validation methods are susceptible to a timing side-channel
during HMAC comparison. With a large enough number of requests
over a low latency connection, an attacker may use this to determine
the expected HMAC.
Vulnerability: GHSA-8j34-9876-pvfq
Summary: Hugo can execute a binary from the current directory on Windows
Aliases: CVE-2020-26284
Severity: HIGH
CWE: CWE-78
Published: 2021-06-23T17:28:26Z

## Impact

Hugo depends on Go's `os/exec` for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system `%PATH%` on Windows. However, if a malicious file with the same name (`exe` or `bat`) is found in the current working directory at the time of running `hugo`, the malicious command will be invoked instead of the system one.

Windows users who run `hugo` inside untrusted Hugo sites are affected.

## Patches
Users should upgrade to Hugo v0.79.1.
Vulnerability: GHSA-jm56-5h66-w453
Summary: Repository index file allows for duplicates of the same chart entry in helm
Aliases: CVE-2020-15185
Severity: LOW
CWE: CWE-694, CWE-20, CWE-74
Published: 2021-05-24T16:57:06Z

### Impact

During a security audit of Helm's code base, security researchers at Trail of Bits identified a bug in which the a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository.

To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection).

### Patches

This issue has been patched in Helm 3.3.2 and 2.16.11

### Workarounds

- do not install charts from repositories you do not trust
- fetch charts using a secure channel of communication (such as TLS)
- use `helm pull` to fetch the chart, then review the chart’s content (either manually, or with `helm verify` if it has been signed) to ensure it has not been tampered with
- manually review the index file in the Helm repository cache before installing software.