TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-85rr-4rh9-hhwh
Summary: Memory leak in Nanopb
Aliases: CVE-2020-26243
Severity: MODERATE
CWE: CWE-20, CWE-119
Published: 2020-11-25T16:53:27Z

### Impact
Decoding specifically formed message can leak memory if dynamic allocation is enabled and an oneof field contains a static submessage that contains a dynamic field, and the message being decoded contains the submessage multiple times. This is rare in normal messages, but it is a concern when untrusted data is parsed.

### Patches
Preliminary patch is [available on git](https://github.com/nanopb/nanopb/commit/edf6dcbffee4d614ac0c2c1b258ab95185bdb6e9) and problem will be patched in versions 0.3.9.7 and 0.4.4 once testing has been completed.

### Workarounds
Following workarounds are available:
* Set the option `no_unions` for the oneof field. This will generate fields as separate instead of C union, and avoids triggering the problematic code.
* Set the type of the submessage field inside oneof to `FT_POINTER`. This way the whole submessage will be dynamically allocated and the problematic code is not executed.
* Use an arena allocator for nanopb, to make sure all memory can be released afterwards.

### References
Bug report: https://github.com/nanopb/nanopb/issues/615

### For more information
If you have any questions or comments about this advisory, comment on the bug report linked above.
Vulnerability: GHSA-384w-5v3f-q499
Summary: Base class whitelist configuration ignored in OAuthenticator
Aliases: CVE-2020-26250
Severity: HIGH
CWE: CWE-863
Published: 2020-12-01T20:25:00Z

### Impact

__What goes wrong?__

The deprecated (in jupyterhub 1.2) configuration `Authenticator.whitelist`, which should be transparently mapped to `Authenticator.allowed_users` with a warning, is instead ignored by OAuthenticator classes, resulting in the same behavior as if this configuration has not been set. If this is the only mechanism of authorization restriction (i.e. no group or team restrictions in configuration) then all authenticated users will be allowed. Provider-based restrictions, including deprecated values such as `GitHubOAuthenticator.org_whitelist` are **not** affected.

__Who is impacted?__

All users of OAuthenticator 0.12.0 and 0.12.1 with JupyterHub 1.2 (JupyterHub Helm chart 0.10.0-0.10.5) who use the `admin.whitelist.users` configuration in the jupyterhub helm chart or the `c.Authenticator.whitelist` configuration directly. Users of other deprecated configuration, e.g. `c.GitHubOAuthenticator.team_whitelist` are **not** affected.

If you see a log line like this and expect a specific list of allowed usernames:

```
[I 2020-11-27 16:51:54.528 JupyterHub app:1717] Not using allowed_users. Any authenticated user will be allowed.
```

you are likely affected.

### Patches

- Replacing deprecated `c.Authenticator.whitelist = ...` with `c.Authenticator.allowed_users = ...` avoids the issue.
- Update oauthenticator to 0.12.2
- Update jupyterhub helm chart to 0.10.6

If any users have been authorized during this time who should not have been, they must be deleted via the API or admin interface, [per the documentation](https://jupyterhub.readthedocs.io/en/1.2.2/getting-started/authenticators-users-basics.html#add-or-remove-users-from-the-hub).

### Workarounds

Replacing `c.Authenticator.whitelist = ...` with `c.Authenticator.allowed_users = ...` avoids the issue.

In the jupyterhub helm chart prior to 0.10.6, this can be done via `hub.extraConfig`:

```yaml
auth:
  allowedUsers:
  - user1
  - user2

hub:
  extraConfig:
    allowedUsers: |
        # set new field not exposed in helm chart < 0.10.6
        set_config_if_not_none(c.Authenticator, "allowed_users", "auth.allowedUsers")
```


### For more information

If you have any questions or comments about this advisory:

* Open a thread [on the Jupyter forum](http://discourse.jupyter.org)
* Email us at [security@ipython.org](mailto:security@ipython.org)
Vulnerability: PYSEC-2022-42
Aliases: CVE-2022-21691, GHSA-w9m4-7w72-r766
Published: 2022-01-18T22:15:00Z

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions chat participants can spoof their channel leave message, tricking others into assuming they left the chatroom.
Vulnerability: GHSA-gcvh-66ff-4mwm
Summary: `CHECK`-failures in Tensorflow
Aliases: CVE-2022-21734
Severity: MODERATE
CWE: CWE-617, CWE-843
Published: 2022-02-10T00:21:12Z

### Impact 
The [implementation of `MapStage`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/map_stage_op.cc#L519-L550) is vulnerable a `CHECK`-fail if the key tensor is not a scalar:

```python
import tensorflow as tf
import numpy as np

tf.raw_ops.MapStage(
    key = tf.constant(value=[4], shape= (1,2), dtype=tf.int64),
    indices = np.array([[6]]),
    values = np.array([-60]),
    dtypes = [tf.int64], capacity=0, memory_limit=0,
    container='', shared_name='', name=None
)   
``` 

### Patches
We have patched the issue in GitHub commit [f57315566d7094f322b784947093406c2aea0d7d](https://github.com/tensorflow/tensorflow/commit/f57315566d7094f322b784947093406c2aea0d7d).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution 
This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
~
Vulnerability: PYSEC-2020-90
Aliases: CVE-2020-7941
Published: 2020-01-23T21:15:00Z

A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.
Vulnerability: PYSEC-2018-16
Aliases: CVE-2018-16405
Published: 2018-09-03T19:29:00Z

An issue was discovered in Mayan EDMS before 3.0.2. The Appearance app sets window.location directly, leading to XSS.
Vulnerability: PYSEC-2021-867
Aliases: CVE-2021-43857, GHSA-9w7f-m4j4-j3xw
Published: 2021-12-27T19:15:00Z

Gerapy is a distributed crawler management framework. Gerapy prior to version 0.9.8 is vulnerable to remote code execution, and this issue is patched in version 0.9.8.
Vulnerability: PYSEC-2014-35
Aliases: CVE-2012-5493
Published: 2014-09-30T14:55:00Z

gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the Python sandbox and execute arbitrary Python code via unspecified vectors.
Vulnerability: PYSEC-2021-534
Aliases: CVE-2021-29606, GHSA-h4pc-gx2w-f2xv
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. A specially crafted TFLite model could trigger an OOB read on heap in the TFLite implementation of `Split_V`(https://github.com/tensorflow/tensorflow/blob/c59c37e7b2d563967da813fa50fe20b21f4da683/tensorflow/lite/kernels/split_v.cc#L99). If `axis_value` is not a value between 0 and `NumDimensions(input)`, then the `SizeOfDimension` function(https://github.com/tensorflow/tensorflow/blob/102b211d892f3abc14f845a72047809b39cc65ab/tensorflow/lite/kernels/kernel_util.h#L148-L150) will access data outside the bounds of the tensor shape array. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: GHSA-8h2j-cgx8-6xv7
Summary: Cross-Site Request Forgery (CSRF) in FastAPI
Aliases: CVE-2021-32677
Severity: HIGH
CWE: CWE-352
Published: 2021-06-10T15:43:54Z

### Impact

FastAPI versions lower than `0.65.2` that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF) attack.

In versions lower than `0.65.2`, FastAPI would try to read the request payload as JSON even if the `content-type` header sent was not set to `application/json` or a compatible JSON media type (e.g. `application/geo+json`).

So, a request with a content type of `text/plain` containing JSON data would be accepted and the JSON data would be extracted.

But requests with content type `text/plain` are exempt from [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) preflights, for being considered [Simple requests](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests). So, the browser would execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application.

### Patches

This is fixed in FastAPI `0.65.2`.

The request data is now parsed as JSON only if the `content-type` header is `application/json` or another JSON compatible media type like `application/geo+json`.

### Workarounds

It's best to upgrade to the latest FastAPI.

But still, it would be possible to add a middleware or a dependency that checks the `content-type` header and aborts the request if it is not `application/json` or another JSON compatible content type.

### References

* [CORS on Mozilla web docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)
* [This answer on StackExchange](https://security.stackexchange.com/questions/157528/ways-to-bypass-browsers-cors-policy/157531#157531)
* [OWASP CSRF](https://owasp.org/www-community/attacks/csrf)
* Fixed in PR [#2118](https://github.com/tiangolo/fastapi/pull/2118)

### For more information

If you have any questions or comments, write to [security@tiangolo.com](mailto:security@tiangolo.com)
Vulnerability: PYSEC-2021-164
Aliases: GHSA-x4g7-fvjj-prg8, CVE-2021-29527
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a division by 0 in `tf.raw_ops.QuantizedConv2D`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/00e9a4d67d76703fa1aee33dac582acf317e0e81/tensorflow/core/kernels/quantized_conv_ops.cc#L257-L259) does a division by a quantity that is controlled by the caller. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: GHSA-6cwv-x26c-w2q4
Summary: Jupyter Notebook file bypasses sanitization, executes JavaScript
Aliases: CVE-2018-8768
Severity: HIGH
Published: 2018-07-12T12:00:00Z

In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.
Vulnerability: PYSEC-2021-52
Aliases: CVE-2021-25283
Published: 2021-02-27T05:15:00Z

An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks.
Vulnerability: PYSEC-2021-308
Aliases: CVE-2021-37686, GHSA-mhhc-q96p-mfm9
Published: 2021-08-12T22:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the strided slice implementation in TFLite has a logic bug which can allow an attacker to trigger an infinite loop. This arises from newly introduced support for [ellipsis in axis definition](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/strided_slice.cc#L103-L122). An attacker can craft a model such that `ellipsis_end_idx` is smaller than `i` (e.g., always negative). In this case, the inner loop does not increase `i` and the `continue` statement causes execution to skip over the preincrement at the end of the outer loop. We have patched the issue in GitHub commit dfa22b348b70bb89d6d6ec0ff53973bacb4f4695. TensorFlow 2.6.0 is the only affected version.
Vulnerability: GHSA-57h3-9rgr-c24m
Summary: Out of bounds write in Pillow
Aliases: CVE-2021-25289
Severity: HIGH
CWE: CWE-787
Published: 2021-03-29T16:35:16Z

An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654.
Vulnerability: PYSEC-2021-758
Aliases: GHSA-c5x2-p679-95wc, CVE-2021-37647
Published: 2021-08-12T19:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. When a user does not supply arguments that determine a valid sparse tensor, `tf.raw_ops.SparseTensorSliceDataset` implementation can be made to dereference a null pointer. The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/data/sparse_tensor_slice_dataset_op.cc#L240-L251) has some argument validation but fails to consider the case when either `indices` or `values` are provided for an empty sparse tensor when the other is not. If `indices` is empty, then [code that performs validation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/data/sparse_tensor_slice_dataset_op.cc#L260-L261) (i.e., checking that the indices are monotonically increasing) results in a null pointer dereference. If `indices` as provided by the user is empty, then `indices` in the C++ code above is backed by an empty `std::vector`, hence calling `indices->dim_size(0)` results in null pointer dereferencing (same as calling `std::vector::at()` on an empty vector). We have patched the issue in GitHub commit 02cc160e29d20631de3859c6653184e3f876b9d7. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2017-25
Aliases: GHSA-c2vx-49jm-h3f6, CVE-2016-10149
Published: 2017-03-24T14:59:00Z

XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.
Vulnerability: PYSEC-2015-18
Aliases: CVE-2015-2316
Published: 2015-03-25T14:59:00Z

The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.
Vulnerability: PYSEC-2020-308
Aliases: CVE-2020-15193, GHSA-rjjg-hgv6-h69v
Published: 2020-09-25T19:15:00Z

In Tensorflow before versions 2.2.1 and 2.3.1, the implementation of `dlpack.to_dlpack` can be made to use uninitialized memory resulting in further memory corruption. This is because the pybind11 glue code assumes that the argument is a tensor. However, there is nothing stopping users from passing in a Python object instead of a tensor. The uninitialized memory address is due to a `reinterpret_cast` Since the `PyObject` is a Python object, not a TensorFlow Tensor, the cast to `EagerTensor` fails. The issue is patched in commit 22e07fb204386768e5bcbea563641ea11f96ceb8 and is released in TensorFlow versions 2.2.1, or 2.3.1.
Vulnerability: PYSEC-2013-9
Aliases: CVE-2013-1888
Published: 2013-08-17T06:54:00Z

pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory.
Vulnerability: GHSA-fpcp-9h7m-ffpx
Summary: Null pointer dereference in TensorFlow 
Aliases: CVE-2022-23595
Severity: MODERATE
CWE: CWE-476
Published: 2022-02-09T23:33:17Z

### Impact
When [building an XLA compilation cache](https://github.com/tensorflow/tensorflow/blob/274df9b02330b790aa8de1cee164b70f72b9b244/tensorflow/compiler/jit/xla_platform_info.cc#L43-L104), if default settings are used, TensorFlow triggers a null pointer dereference:

```cc 
  string allowed_gpus =
      flr->config_proto()->gpu_options().visible_device_list();
``` 
    
In the default scenario, all devices are allowed, so `flr->config_proto` is `nullptr`.
    
### Patches
We have patched the issue in GitHub commit [e21af685e1828f7ca65038307df5cc06de4479e8](https://github.com/tensorflow/tensorflow/commit/e21af685e1828f7ca65038307df5cc06de4479e8).
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: PYSEC-2022-116
Aliases: CVE-2022-21737, GHSA-f2vv-v9cg-qhh7
Published: 2022-02-03T14:15:00Z

Tensorflow is an Open Source Machine Learning Framework. The implementation of `*Bincount` operations allows malicious users to cause denial of service by passing in arguments which would trigger a `CHECK`-fail. There are several conditions that the input arguments must satisfy. Some are not caught during shape inference and others are not caught during kernel implementation. This results in `CHECK` failures later when the output tensors get allocated. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Vulnerability: PYSEC-2019-159
Aliases: CVE-2019-9644
Published: 2019-03-12T09:29:00Z

An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are authenticated with a Jupyter server. Access to the content of resources has been demonstrated with Internet Explorer through capturing of error messages, though not reproduced with other browsers. This occurs because Internet Explorer's error messages can include the content of any invalid JavaScript that was encountered.
Vulnerability: PYSEC-2022-39
Aliases: CVE-2022-21688, GHSA-x7wr-283h-5h2v
Published: 2022-01-18T22:15:00Z

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Affected versions of the desktop application were found to be vulnerable to denial of service via an undisclosed vulnerability in the QT image parsing. Roughly 20 bytes lead to 2GB memory consumption and this can be triggered multiple times. To be abused, this vulnerability requires rendering in the history tab, so some user interaction is required. An adversary with knowledge of the Onion service address in public mode or with authentication in private mode can perform a Denial of Service attack, which quickly results in out-of-memory for the server. This requires the desktop application with rendered history, therefore the impact is only elevated. This issue has been patched in version 2.5.
Vulnerability: PYSEC-2018-82
Aliases: GHSA-v4x4-98cg-wr4g, CVE-2018-20325
Published: 2018-12-21T23:29:00Z

There is a vulnerability in load() method in definitions/parser.py in the Danijar Hafner definitions package for Python. It can execute arbitrary python commands resulting in command execution.
Vulnerability: PYSEC-2021-373
Aliases: CVE-2021-40323, GHSA-cpqf-3c3r-c9g2
Published: 2021-10-04T06:15:00Z

Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.
Vulnerability: GHSA-6qgm-fv6v-rfpv
Summary: Overflow/denial of service in `tf.raw_ops.ReverseSequence`
Aliases: CVE-2021-29575
Severity: LOW
CWE: CWE-120, CWE-119
Published: 2021-05-21T14:26:13Z

### Impact
The implementation of `tf.raw_ops.ReverseSequence` allows for stack overflow and/or `CHECK`-fail based denial of service.

```python
import tensorflow as tf

input = tf.zeros([1, 1, 1], dtype=tf.int32)
seq_lengths = tf.constant([0], shape=[1], dtype=tf.int32)

tf.raw_ops.ReverseSequence(
    input=input, seq_lengths=seq_lengths, seq_dim=-2, batch_dim=0)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/5b3b071975e01f0d250c928b2a8f901cd53b90a7/tensorflow/core/kernels/reverse_sequence_op.cc#L114-L118) fails to validate that `seq_dim` and `batch_dim` arguments are valid.
  
Negative values for `seq_dim` can result in stack overflow or `CHECK`-failure, depending on the version of Eigen code used to implement the operation. Similar behavior can be exhibited by invalid values of `batch_dim`.
  
### Patches
We have patched the issue in GitHub commit [ecf768cbe50cedc0a45ce1ee223146a3d3d26d23](https://github.com/tensorflow/tensorflow/commit/ecf768cbe50cedc0a45ce1ee223146a3d3d26d23).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution 
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: PYSEC-2021-689
Aliases: GHSA-ph87-fvjr-v33w, CVE-2021-29563
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service by exploiting a `CHECK`-failure coming from the implementation of `tf.raw_ops.RFFT`. Eigen code operating on an empty matrix can trigger on an assertion and will cause program termination. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: GHSA-vqj2-4v8m-8vrq
Summary: Insecure Temporary File in mlflow
Aliases: CVE-2022-0736
Severity: HIGH
CWE: CWE-668, CWE-377
Published: 2022-02-24T00:00:54Z

mlflow prior to 1.23.1 contains an insecure temporary file. The insecure function `tempfile.mktemp()` is deprecated and `mkstemp()` should be used instead.
Vulnerability: PYSEC-2011-20
Aliases: GHSA-2p78-8hh6-96xc, CVE-2011-1157
Published: 2011-04-11T18:55:00Z

Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via malformed XML comments.
Vulnerability: PYSEC-2021-723
Aliases: GHSA-v52p-hfjf-wg88, CVE-2021-29597
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. The implementation of the `SpaceToBatchNd` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/412c7d9bb8f8a762c5b266c9e73bfa165f29aac8/tensorflow/lite/kernels/space_to_batch_nd.cc#L82-L83). An attacker can craft a model such that one dimension of the `block` input is 0. Hence, the corresponding value in `block_shape` is 0. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: GHSA-232r-66cg-79px
Summary: Paramiko not properly checking authention before processing other requests
Aliases: CVE-2018-7750
Severity: CRITICAL
CWE: CWE-287
Published: 2018-07-12T20:29:30Z

transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.
Vulnerability: PYSEC-2020-236
Aliases: CVE-2020-26257, GHSA-hxmp-pqch-c8mm
Published: 2020-12-09T19:15:00Z

Matrix is an ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homeserver" implementation of Matrix. A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a `/send_join`, `/send_leave`, `/invite` or `/exchange_third_party_invite` request. This can lead to a denial of service in which future events will not be correctly sent to other servers over federation. This affects any server which accepts federation requests from untrusted servers. The Matrix Synapse reference implementation before version 1.23.1 the implementation is vulnerable to this injection attack. Issue is fixed in version 1.23.1. As a workaround homeserver administrators could limit access to the federation API to trusted servers (for example via `federation_domain_whitelist`).
Vulnerability: GHSA-c4qh-4vgv-qc6g
Summary: Uncontrolled Resource Consumption in Django
Aliases: CVE-2019-14232
Severity: HIGH
CWE: CWE-400
Published: 2019-08-06T01:43:29Z

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
Vulnerability: GHSA-24x6-8c7m-hv3f
Summary: Heap OOB read in TFLite's implementation of `Minimum` or `Maximum`
Aliases: CVE-2021-29590
Severity: LOW
CWE: CWE-125
Published: 2021-05-21T14:26:53Z

### Impact
The implementations of the `Minimum` and `Maximum` TFLite operators can be used to read data outside of bounds of heap allocated objects, if any of the two input tensor arguments are empty.

This is because [the broadcasting implementation](https://github.com/tensorflow/tensorflow/blob/0d45ea1ca641b21b73bcf9c00e0179cda284e7e7/tensorflow/lite/kernels/internal/reference/maximum_minimum.h#L52-L56) indexes in both tensors with the same index but does not validate that the index is within bounds:

```cc
auto maxmin_func = [&](int indexes[N]) {
  output_data[SubscriptToIndex(output_desc, indexes)] =
    op(input1_data[SubscriptToIndex(desc1, indexes)],
        input2_data[SubscriptToIndex(desc2, indexes)]);
};
```

### Patches
We have patched the issue in GitHub commit [953f28dca13c92839ba389c055587cfe6c723578](https://github.com/tensorflow/tensorflow/commit/953f28dca13c92839ba389c055587cfe6c723578).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: PYSEC-2021-236
Aliases: CVE-2021-29599, GHSA-97wf-p777-86jq
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. The implementation of the `Split` TFLite operator is vulnerable to a division by zero error(https://github.com/tensorflow/tensorflow/blob/e2752089ef7ce9bcf3db0ec618ebd23ea119d0c7/tensorflow/lite/kernels/split.cc#L63-L65). An attacker can craft a model such that `num_splits` would be 0. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: GHSA-ph87-fvjr-v33w
Summary: CHECK-fail in `tf.raw_ops.RFFT`
Aliases: CVE-2021-29563
Severity: LOW
CWE: CWE-617
Published: 2021-05-21T14:25:05Z

### Impact
An attacker can cause a denial of service by exploiting a `CHECK`-failure coming from the implementation of `tf.raw_ops.RFFT`:
    
```python
import tensorflow as tf

inputs = tf.constant([1], shape=[1], dtype=tf.float32)
fft_length = tf.constant([0], shape=[1], dtype=tf.int32)

tf.raw_ops.RFFT(input=inputs, fft_length=fft_length)
```

The above example causes Eigen code to operate on an empty matrix. This triggers on an assertion and causes program termination.
    
### Patches
We have patched the issue in GitHub commit [31bd5026304677faa8a0b77602c6154171b9aec1](https://github.com/tensorflow/tensorflow/commit/31bd5026304677faa8a0b77602c6154171b9aec1).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions. 

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: PYSEC-2021-29
Aliases: CVE-2021-32560
Published: 2021-05-11T14:15:00Z

The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not *.log files.
Vulnerability: PYSEC-2021-666
Aliases: GHSA-xgc3-m89p-vr3x, CVE-2021-29540
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow to occur in `Conv2DBackpropFilter`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/1b0296c3b8dd9bd948f924aa8cd62f87dbb7c3da/tensorflow/core/kernels/conv_grad_filter_ops.cc#L495-L497) computes the size of the filter tensor but does not validate that it matches the number of elements in `filter_sizes`. Later, when reading/writing to this buffer, code uses the value computed here, instead of the number of elements in the tensor. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: GHSA-h67m-xg8f-fxcf
Summary: Deadlock in mutually recursive `tf.function` objects
Aliases: CVE-2021-41213
Severity: MODERATE
CWE: CWE-667
Published: 2021-11-10T18:59:32Z

### Impact
The [code behind `tf.function` API](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/python/eager/def_function.py#L542) can be made to deadlock when two `tf.function` decorated Python functions are mutually recursive:

```python 
import tensorflow as tf

@tf.function()               
def fun1(num):
    if num == 1:
        return
    print(num)
    fun2(num-1)

@tf.function()
def fun2(num):
    if num == 0:
        return
    print(num)
    fun1(num-1)

fun1(9)
```

This occurs due to using a non-reentrant `Lock` Python object.

Loading any model which contains mutually recursive functions is vulnerable. An attacker can cause denial of service by causing users to load such models and calling a recursive `tf.function`, although this is not a frequent scenario.

### Patches
We have patched the issue in GitHub commit [afac8158d43691661ad083f6dd9e56f327c1dcb7](https://github.com/tensorflow/tensorflow/commit/afac8158d43691661ad083f6dd9e56f327c1dcb7).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: PYSEC-2021-148
Aliases: GHSA-x823-j7c4-vpc5, CVE-2021-25926
Published: 2021-04-12T14:15:00Z

In SiCKRAGE, versions 9.3.54.dev1 to 10.0.11.dev1 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly in the `quicksearch` feature. Therefore, an attacker can steal a user's sessionID to masquerade as a victim user, to carry out any actions in the context of the user.
Vulnerability: GHSA-p4v2-r99v-wjc2
Summary: Improper Encoding or Escaping of Output in Nicotine+
Aliases: CVE-2021-45848
Severity: HIGH
CWE: CWE-116
Published: 2022-03-16T00:00:38Z

Denial of service (DoS) vulnerability in Nicotine+ starting with version 3.0.3 and prior to version 3.2.1 allows a user with a modified Soulseek client to crash Nicotine+ by sending a file download request with a file path containing a null character.
Vulnerability: PYSEC-2021-518
Aliases: GHSA-24x6-8c7m-hv3f, CVE-2021-29590
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. The implementations of the `Minimum` and `Maximum` TFLite operators can be used to read data outside of bounds of heap allocated objects, if any of the two input tensor arguments are empty. This is because the broadcasting implementation(https://github.com/tensorflow/tensorflow/blob/0d45ea1ca641b21b73bcf9c00e0179cda284e7e7/tensorflow/lite/kernels/internal/reference/maximum_minimum.h#L52-L56) indexes in both tensors with the same index but does not validate that the index is within bounds. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2016-24
Aliases: CVE-2016-9964
Published: 2016-12-16T09:59:00Z

redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.
Vulnerability: PYSEC-2014-19
Aliases: CVE-2014-1418
Published: 2014-05-16T15:55:00Z

Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.
Vulnerability: GHSA-jhjh-ghwx-6h7r
Summary: Low severity vulnerability that affects modulemd
Aliases: CVE-2017-1002157
Severity: LOW
CWE: CWE-242
Published: 2019-01-17T13:56:18Z

modulemd 1.3.1 and earlier uses an unsafe function for processing externally provided data, leading to remote code execution.
Vulnerability: PYSEC-2020-148
Aliases: CVE-2020-26137, GHSA-wqvq-5m8c-6g24
Published: 2020-09-30T18:15:00Z

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.
Vulnerability: PYSEC-2022-81
Aliases: GHSA-rww7-2gpw-fv6j, CVE-2022-23572
Published: 2022-02-04T23:15:00Z

Tensorflow is an Open Source Machine Learning Framework. Under certain scenarios, TensorFlow can fail to specialize a type during shape inference. This case is covered by the `DCHECK` function however, `DCHECK` is a no-op in production builds and an assertion failure in debug builds. In the first case execution proceeds to the `ValueOrDie` line. This results in an assertion failure as `ret` contains an error `Status`, not a value. In the second case we also get a crash due to the assertion failure. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.
Vulnerability: PYSEC-2020-53
Aliases: CVE-2020-12689
Published: 2020-05-07T00:15:00Z

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges.
Vulnerability: PYSEC-2022-141
Aliases: GHSA-8cxv-76p7-jxwr, CVE-2022-23577
Published: 2022-02-04T23:15:00Z

Tensorflow is an Open Source Machine Learning Framework. The implementation of `GetInitOp` is vulnerable to a crash caused by dereferencing a null pointer. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Vulnerability: PYSEC-2015-34
Aliases: CVE-2014-9706
Published: 2015-03-31T14:59:00Z

The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.
Vulnerability: PYSEC-2020-324
Aliases: GHSA-qh32-6jjc-qprm, CVE-2020-15209
Published: 2020-09-25T19:15:00Z

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a `nullptr` buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one. The runtime assumes that these buffers are written to before a possible read, hence they are initialized with `nullptr`. However, by changing the buffer index for a tensor and implicitly converting that tensor to be a read-write one, as there is nothing in the model that writes to it, we get a null pointer dereference. The issue is patched in commit 0b5662bc, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
Vulnerability: PYSEC-2019-227
Aliases: CVE-2019-16778, GHSA-844w-j86r-4x2j
Published: 2019-12-16T21:15:00Z

In TensorFlow before 1.15, a heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32. In this case data_size and num_segments fields are truncated from int64 to int32 and can produce negative numbers, resulting in accessing out of bounds heap memory. This is unlikely to be exploitable and was detected and fixed internally in TensorFlow 1.15 and 2.0.
Vulnerability: GHSA-vwhq-49r4-gj9v
Summary: Reference binding to `nullptr` in `tf.ragged.cross`
Aliases: CVE-2021-41214
Severity: HIGH
CWE: CWE-824
Published: 2021-11-10T18:58:16Z

### Impact
The [shape inference code for `tf.ragged.cross`](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/ops/ragged_array_ops.cc#L64) has an undefined behavior due to binding a reference to `nullptr`. In the following scenario, this results in a crash:

```python
import tensorflow as tf
  
@tf.function                 
def test():     
  y = tf.ragged.cross([tf.ragged.constant([['1']]),'2'])
  return y                   
                             
test()        
```                          
             
### Patches
We have patched the issue in GitHub commit [fa6b7782fbb14aa08d767bc799c531f5e1fb3bb8](https://github.com/tensorflow/tensorflow/commit/fa6b7782fbb14aa08d767bc799c531f5e1fb3bb8).
  
The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: PYSEC-2021-774
Aliases: GHSA-g25h-jr74-qp5j, CVE-2021-37663
Published: 2021-08-12T23:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions due to incomplete validation in `tf.raw_ops.QuantizeV2`, an attacker can trigger undefined behavior via binding a reference to a null pointer or can access data outside the bounds of heap allocated arrays. The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/quantize_op.cc#L59) has some validation but does not check that `min_range` and `max_range` both have the same non-zero number of elements. If `axis` is provided (i.e., not `-1`), then validation should check that it is a value in range for the rank of `input` tensor and then the lengths of `min_range` and `max_range` inputs match the `axis` dimension of the `input` tensor. We have patched the issue in GitHub commit 6da6620efad397c85493b8f8667b821403516708. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-91
Aliases: CVE-2021-21241
Published: 2021-01-11T21:15:00Z

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable.
Vulnerability: PYSEC-2021-324
Aliases: CVE-2021-32297
Published: 2021-09-20T16:15:00Z

An issue was discovered in LIEF through 0.11.4. A heap-buffer-overflow exists in the function main located in pe_reader.c. It allows an attacker to cause code Execution.
Vulnerability: PYSEC-2019-17
Aliases: CVE-2019-3498, GHSA-337x-4q8g-prc5
Published: 2019-01-09T23:29:00Z

In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.
Vulnerability: PYSEC-2021-631
Aliases: GHSA-cpf4-wx82-gxp6, CVE-2021-41222
Published: 2021-11-05T23:15:00Z

TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SplitV` can trigger a segfault is an attacker supplies negative arguments. This occurs whenever `size_splits` contains more than one value and at least one value is negative. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Vulnerability: GHSA-grmf-4fq6-2r79
Summary: Improper Restriction of Operations within the Bounds of a Memory Buffer in aubio
Aliases: CVE-2018-19800
Severity: CRITICAL
CWE: CWE-119
Published: 2019-07-26T16:10:28Z

aubio v0.4.0 to v0.4.8 has a Buffer Overflow in new_aubio_tempo.
Vulnerability: PYSEC-2021-261
Aliases: GHSA-gh6x-4whr-2qv4, CVE-2021-37639
Published: 2021-08-12T19:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. When restoring tensors via raw APIs, if the tensor name is not provided, TensorFlow can be tricked into dereferencing a null pointer. Alternatively, attackers can read memory outside the bounds of heap allocated data by providing some tensor names but not enough for a successful restoration. The [implementation](https://github.com/tensorflow/tensorflow/blob/47a06f40411a69c99f381495f490536972152ac0/tensorflow/core/kernels/save_restore_tensor.cc#L158-L159) retrieves the tensor list corresponding to the `tensor_name` user controlled input and immediately retrieves the tensor at the restoration index (controlled via `preferred_shard` argument). This occurs without validating that the provided list has enough values. If the list is empty this results in dereferencing a null pointer (undefined behavior). If, however, the list has some elements, if the restoration index is outside the bounds this results in heap OOB read. We have patched the issue in GitHub commit 9e82dce6e6bd1f36a57e08fa85af213e2b2f2622. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Vulnerability: GHSA-5rpc-gwh9-q9fg
Summary: Improper Restriction of Operations within the Bounds of a Memory Buffer in OpenCV
Aliases: CVE-2017-12862
Severity: HIGH
CWE: CWE-787, CWE-119
Published: 2021-10-12T22:02:21Z

In modules/imgcodecs/src/grfmt_pxm.cpp, the length of buffer AutoBuffer _src is small than expected, which will cause copy buffer overflow later. If the image is from remote, may lead to remote code execution or denial of service. This affects OpenCV 3.3 (corresponding to OpenCV-Python 3.3.0.9) and earlier.
Vulnerability: PYSEC-2020-261
Aliases: GHSA-wqgp-vphw-hphf, CVE-2020-8897
Published: 2020-11-16T12:15:00Z

A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript prior to versions 2.0.0. Due to the non-committing property of AES-GCM (and other AEAD ciphers such as AES-GCM-SIV or (X)ChaCha20Poly1305) used by the SDKs to encrypt messages, an attacker can craft a unique cyphertext which will decrypt to multiple different results, and becomes especially relevant in a multi-recipient setting. We recommend users update their SDK to 2.0.0 or later.
Vulnerability: PYSEC-2022-97
Aliases: GHSA-fx5c-h9f6-rv7c, CVE-2022-23588
Published: 2022-02-04T23:15:00Z

Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a `SavedModel` such that Grappler optimizer would attempt to build a tensor using a reference `dtype`. This would result in a crash due to a `CHECK`-fail in the `Tensor` constructor as reference types are not allowed. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Vulnerability: PYSEC-2016-32
Aliases: CVE-2015-8557
Published: 2016-01-08T20:59:00Z

The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.
Vulnerability: PYSEC-2022-157
Aliases: GHSA-gwcx-jrx4-92w2, CVE-2022-23593
Published: 2022-02-04T23:15:00Z

Tensorflow is an Open Source Machine Learning Framework. The `simplifyBroadcast` function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segfault (hence, denial of service), if called with scalar shapes. If all shapes are scalar, then `maxRank` is 0, so we build an empty `SmallVector`. The fix will be included in TensorFlow 2.8.0. This is the only affected version.