aswin1906/github-advisory-2019.csv huggingface dataset:
Privilege escalation vulnerability in Apache Hadoop
Advisory: GHSA-37pw-qw47-4jxm
Aliases: CVE-2018-8029
Published: 2019-05-31T16:09:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: org.apache.hadoop:hadoop-main
ranges: type: ECOSYSTEM
events: introduced: 2.2.0
fixed: 2.8.4
package: ecosystem: Maven
name: org.apache.hadoop:hadoop-main
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.9.2
package: ecosystem: Maven
name: org.apache.hadoop:hadoop-main
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.1.1
cwe_ids: CWE-285
severity: HIGH

In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.
Directory Traversal in ltt.js
Advisory: GHSA-6qh5-wx38-q92g
Published: 2019-05-30T17:15:59Z
Affected: package: ecosystem: npm
name: ltt.js
versions: 1.0.0
cwe_ids: CWE-22
severity: HIGH

Affected versions of `ltt.js` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Cross-site Scripting in NodeBB
Advisory: GHSA-72fv-qgj6-2w2p
Aliases: CVE-2015-9286
Published: 2019-05-01T18:37:08Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: nodebb
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.8.2
cwe_ids: CWE-79
severity: MODERATE

Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.
Improper Authentication in Buildbot
Advisory: GHSA-g86p-hgx5-2pfh
Aliases: CVE-2019-12300
Published: 2019-05-29T18:48:11Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: PyPI
name: buildbot
ecosystem_specific: affected_functions: buildbot.www.oauth2.OAuth2Auth.acceptToken
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.8.2
package: ecosystem: PyPI
name: buildbot
ecosystem_specific: affected_functions: buildbot.www.oauth2.OAuth2Auth.acceptToken
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 2.3.1
cwe_ids: CWE-287
severity: CRITICAL

Buildbot before 1.8.2 and 2.x before 2.3.1 accepts a user-submitted authorization token from OAuth and uses it to authenticate a user. If an attacker has a token allowing them to read the user details of a victim, they can login as the victim.
Cross-Site Scripting in simditor
Advisory: GHSA-8v67-x8q5-3x3g
Aliases: CVE-2018-19048
Published: 2019-05-14T04:01:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: simditor
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.3.22
cwe_ids: CWE-79
severity: MODERATE

Versions of `simditor` prior to 2.3.22 are vulnerable to Cross-Site Scripting. The package does not sanitize user input that is rendered with `innerHTML`, allowing attackers to execute arbitrary JavaScript.


## Recommendation

Upgrade to version 2.3.22 or later.
mysql Node.JS Module Vulnerable to Remote Memory Exposure
Advisory: GHSA-5f7m-mmpc-qhh4
Published: 2019-05-23T09:27:00Z
Affected: package: ecosystem: npm
name: mysql
ranges: type: ECOSYSTEM
events: introduced: 2.0.0-alpha8
fixed: 2.14.0
cwe_ids: CWE-201
severity: MODERATE

Versions of `mysql` before 2.14.0 are vulnerable to remove memory exposure.

Affected versions of `mysql` package allocate and send an uninitialized memory over the network when a number is provided as a password.

Only `mysql` running on Node.js versions below 6.0.0 are affected due to a throw added in newer node.js versions.

Proof of Concept:

```
require('mysql').createConnection({
  host: 'localhost',
  user: 'user',
  password : USERPROVIDEDINPUT,  // number
  database : 'my_db'
}).connect();
```



## Recommendation

Update to version 2.14.0 or later.
Cross-Site Scripting in public
Advisory: GHSA-7jfh-2xc9-ccv7
Published: 2019-05-31T23:46:40Z
Affected: package: ecosystem: npm
name: public
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.1.4
package: ecosystem: npm
name: public
versions: 0.1.5
cwe_ids: CWE-79
severity: LOW

All versions of `public` are vulnerable to stored cross-site scripting (XSS). 


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time.
Improper Key Verification in ipns
Advisory: GHSA-j59f-6m4q-62h6
Published: 2019-05-30T17:28:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/
Affected: package: ecosystem: npm
name: ipns
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.1.3
cwe_ids: CWE-287
severity: HIGH

Versions 0.1.1 or 0.1.2 of `ipns` are vulnerable to improper key validation. This is due to the public key verification was not being performed properly, resulting in any key being valid.


## Recommendation

Update to version 0.1.3 or later.
Server-Side Request Forgery in terriajs-server
Advisory: GHSA-p72p-rjr2-r439
Published: 2019-05-29T20:24:02Z
Affected: package: ecosystem: npm
name: terriajs-server
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.7.4
cwe_ids: CWE-918
severity: HIGH

Versions of `terriajs-server`prior to 2.7.4 are vulnerable to Server-Side Request Forgery (SSRF). If an attacker has access to a server whitelisted by the terriajs-server proxy or if the attacker is able to modify the DNS records of a domain whitelisted by the terriajs-server proxy, the attacker can use the terriajs-server proxy to access any HTTP-accessible resources that are accessible to the server, including private resources in the hosting environment.


## Recommendation

Upgrade to version 2.7.4 or later.
Prototype Pollution in deap
Advisory: GHSA-xrmp-99wj-p6jc
Published: 2019-05-31T23:43:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected: package: ecosystem: npm
name: deap
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.0.1
cwe_ids: CWE-400
severity: HIGH

Versions of `deap` before 1.0.1 are vulnerable to prototype pollution.


## Recommendation

Update to version 1.0.1 or later.
Cross-site scripting in Apache Archiva
Advisory: GHSA-cqcf-4g4h-rghf
Aliases: CVE-2019-0213
Published: 2019-05-14T04:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: Maven
name: org.apache.archiva:archiva
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.2.4
cwe_ids: CWE-79
severity: MODERATE

In Apache Archiva before 2.2.4, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. Existing files can be overwritten, if the archiva run user has appropriate permission on the filesystem for the target file.
Denial of Service in axios
Advisory: GHSA-42xw-2xvc-qx8m
Aliases: CVE-2019-10742
Published: 2019-05-29T18:04:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: npm
name: axios
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.18.1
database_specific: last_known_affected_version_range: <= 0.18.0
cwe_ids: CWE-20
CWE-755
severity: HIGH

Versions of `axios` prior to 0.18.1 are vulnerable to Denial of Service. If a request exceeds the `maxContentLength` property, the package prints an error but does not stop the request. This may cause high CPU usage and lead to Denial of Service.


## Recommendation

Upgrade to 0.18.1 or later.
Path Traversal in angular-http-server
Advisory: GHSA-vmhw-fhj6-m3g5
Published: 2019-05-31T23:46:33Z
Affected: package: ecosystem: npm
name: angular-http-server
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.4.4
cwe_ids: CWE-22
severity: HIGH

Versions of `angular-http-server` before 1.4.4 are vulnerable to path traversal.


## Recommendation

Update to version 1.4.4 or later.
OmniAuth Ruby gem Cross-site Request Forgery in request phase
Advisory: GHSA-ww4x-rwq6-qpgf
Aliases: CVE-2015-9284
Published: 2019-05-29T19:11:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: RubyGems
name: omniauth
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.0.0
database_specific: last_known_affected_version_range: <= 1.9.2
cwe_ids: CWE-352
severity: HIGH

The request phase of the OmniAuth Ruby gem (1.9.2 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able to sign into the web application as the primary account.

As of v2 OmniAuth no longer has the vulnerable configuration by default, but it is still possible to configure OmniAuth in such a way that the web application becomes vulnerable to Cross-Site Request Forgery. There is a recommended remediation described [here](https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284).
Arbitrary File Overwrite in fstream
Advisory: GHSA-xf7w-r453-m56c
Aliases: CVE-2019-13173
Published: 2019-05-30T17:19:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: npm
name: fstream
ecosystem_specific: affected_functions: fstream.DirWriter
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.0.12
cwe_ids: CWE-59
severity: HIGH

Versions of `fstream` prior to 1.0.12 are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file. The `fstream.DirWriter()` function is vulnerable.


## Recommendation

Upgrade to version 1.0.12 or later.
Cross-Site Scripting in bracket-template
Advisory: GHSA-jj6g-7j8p-7gf2
Published: 2019-05-30T21:03:24Z
Affected: package: ecosystem: npm
name: bracket-template
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.1.5
cwe_ids: CWE-79
severity: HIGH

All versions of `bracket-template` are vulnerable to stored cross-site scripting (XSS). This is exploitable when a variable passed in via a GET parameter is used in a template.


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time.
XML External Entity injection in Apache Camel
Advisory: GHSA-h896-mx9x-g32g
Aliases: CVE-2019-0188
Published: 2019-05-29T18:15:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: Maven
name: org.apache.camel:camel-core
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.24.0
package: ecosystem: Maven
name: org.apache.camel:camel-xmljson
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 2.23.4
cwe_ids: CWE-611
severity: HIGH

Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson component, which was removed.
Cross-Site Scripting (XSS) in Verdaccio
Advisory: GHSA-78j5-gcmf-vqc8
Aliases: CVE-2019-14772
Published: 2019-05-29T18:02:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: verdaccio
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.12.0
cwe_ids: CWE-79
severity: MODERATE

### Impact
What kind of vulnerability is it? Who is impacted?

Cross-Site Scripting XSS, malicious packages with content Javascript that might be executed in the User Interface stealing user credentials. 

### Patches
Has the problem been patched? What versions should users upgrade to?

Users that still using `v3` must upgrade to **>3.12.0** or those have no problem to migrate to a major version **>=4.0.0** also fix the issue.

### Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?

No, the users must update.

### References
Are there any links users can visit to find out more?

https://www.npmjs.com/advisories/832
https://www.npmjs.com/advisories/833

The issue was reported by the NPMJS Security Team

### For more information
If you have any questions or comments about this advisory:
* Read the Security Policy to find the ways to be in contact with us.
Cryptographically Weak PRNG in generate-password
Advisory: GHSA-6qqf-vvcr-7qrv
Published: 2019-05-23T09:27:22Z
Affected: package: ecosystem: npm
name: generate-password
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.4.1
cwe_ids: CWE-338
severity: MODERATE

Affected versions of generate-password generate random values that are biased towards certain characters depending on the chosen character sets. This may result in guessable passwords.


## Recommendation

Update to version 1.4.1 or later.
Cross-site Scripting in remarkable
Advisory: GHSA-36m4-6v6m-4vpr
Aliases: CVE-2019-12043
Published: 2019-05-29T18:04:55Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: remarkable
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.7.2
cwe_ids: CWE-79
severity: MODERATE

In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows attackers to trigger XSS via unprintable characters, as demonstrated by a `\x0ejavascript:` URL.
Access control bypass in Apache ZooKeeper
Advisory: GHSA-2hw2-62cp-p9p7
Aliases: CVE-2019-0201
Published: 2019-05-29T18:54:11Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: Maven
name: org.apache.zookeeper:zookeeper
ranges: type: ECOSYSTEM
events: introduced: 1.0.0
fixed: 3.4.14
package: ecosystem: Maven
name: org.apache.zookeeper:zookeeper
ranges: type: ECOSYSTEM
events: introduced: 3.5.0
fixed: 3.5.5
cwe_ids: CWE-862
severity: MODERATE

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper?s getACL() command doesn?t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.
Insecure Credential Storage in web3
Advisory: GHSA-27v7-qhfv-rqq8
Published: 2019-05-30T17:26:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: package: ecosystem: npm
name: web3
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.5.2
severity: LOW

All versions of `web3` are vulnerable to Insecure Credential Storage. The package stores encrypted wallets in local storage and requires a password to load the wallet. Once the wallet is loaded, the private key is accessible via LocalStorage. Exploiting this vulnerability likely requires a Cross-Site Scripting vulnerability to access the private key.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Command Injection in fs-git
Advisory: GHSA-qr32-j4j6-3m7r
Aliases: CVE-2017-16087
Published: 2019-05-29T20:23:00Z
Affected: package: ecosystem: npm
name: fs-git
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.0.2
cwe_ids: CWE-77
severity: HIGH

Affected versions of `fs-git` do not sanitize strings passed into the `buildCommand` method, resulting in arbitrary code execution.


## Recommendation

Update to version 1.0.2 or later.
Command Injection in Xstream
Advisory: GHSA-f554-x222-wgf7
Aliases: CVE-2013-7285
Published: 2019-05-29T18:05:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: com.thoughtworks.xstream:xstream
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.4.6
cwe_ids: CWE-77
CWE-78
severity: CRITICAL

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
Infinite Loop in Apache Sanselan
Advisory: GHSA-g99m-3m46-4gm9
Aliases: CVE-2018-17202
Published: 2019-05-14T04:00:47Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: Maven
name: org.apache.sanselan:sanselan
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.97-incubator
cwe_ids: CWE-835
severity: HIGH

Certain input files could make the code to enter into an infinite loop when Apache Sanselan 0.97-incubator was used to parse them, which could be used in a DoS attack. Note that Apache Sanselan (incubating) was renamed to Apache Commons Imaging.
Improper Input Validation in Apache Archiva
Advisory: GHSA-jxgm-9f58-w4xp
Aliases: CVE-2019-0214
Published: 2019-05-14T04:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: Maven
name: org.apache.archiva:archiva
ranges: type: ECOSYSTEM
events: introduced: 2.2.0
fixed: 2.2.4
cwe_ids: CWE-20
severity: MODERATE

In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. Existing files can be overwritten, if the archiva run user has appropriate permission on the filesystem for the target file.
Path Traversal in Apache Camel
Advisory: GHSA-4wjq-69rc-8wcp
Aliases: CVE-2019-0194
Published: 2019-05-02T15:21:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: Maven
name: org.apache.camel:camel-core
ranges: type: ECOSYSTEM
events: introduced: 2.21.0
fixed: 2.21.5
database_specific: last_known_affected_version_range: <= 2.21.3
package: ecosystem: Maven
name: org.apache.camel:camel-core
ranges: type: ECOSYSTEM
events: introduced: 2.22.0
fixed: 2.22.3
package: ecosystem: Maven
name: org.apache.camel:camel-core
ranges: type: ECOSYSTEM
events: introduced: 2.23.0
fixed: 2.23.1
versions: 2.23.0
cwe_ids: CWE-22
severity: HIGH

Apache Camel's File is vulnerable to directory traversal. Camel 2.21.0 to 2.21.3, 2.22.0 to 2.22.2, 2.23.0 and the unsupported Camel 2.x (2.19 and earlier) versions may be also affected.
Cross-Site Scripting in bootbox
Advisory: GHSA-87mg-h5r3-hw88
Published: 2019-05-30T17:23:28Z
Affected: package: ecosystem: npm
name: bootbox
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 5.5.2
cwe_ids: CWE-64
CWE-79
severity: MODERATE

All version of `bootbox` are vulnerable to Cross-Site Scripting. The package does not sanitize user input in the provided dialog boxes, allowing attackers to inject HTML code and execute arbitrary JavaScript.


## Recommendation

Sanitize user input being passed to `bootbox` or consider using an alternative package.
Information exposure in FasterXML jackson-databind
Advisory: GHSA-5ww9-j83m-q7qx
Aliases: CVE-2019-12086
Published: 2019-05-23T09:32:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 2.9.9
cwe_ids: CWE-502
severity: HIGH

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.
Server Side Request Forgery in Apache Axis
Advisory: GHSA-h9gj-rqrw-x4fq
Aliases: CVE-2019-0227
Published: 2019-05-14T04:02:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: org.apache.axis:axis
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.4
cwe_ids: CWE-918
severity: HIGH

A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.
Arbitrary File Overwrite in tar
Advisory: GHSA-j44m-qm6p-hp7m
Aliases: CVE-2018-20834
Published: 2019-05-01T18:37:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: npm
name: tar
ecosystem_specific: affected_functions: tar.Unpack
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 4.4.2
package: ecosystem: npm
name: tar
ecosystem_specific: affected_functions: tar.Extract
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.2.2
cwe_ids: CWE-59
severity: HIGH

Versions of `tar` prior to 4.4.2 for 4.x and 2.2.2 for 2.x are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file.


## Recommendation

For tar 4.x, upgrade to version 4.4.2 or later.
For tar 2.x, upgrade to version 2.2.2 or later.
Denial of Service in foreman
Advisory: GHSA-xm28-fw2x-fqv2
Published: 2019-05-31T23:08:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: npm
name: foreman
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.0.1
cwe_ids: CWE-400
severity: HIGH

All versions of `foreman` are vulnerable to Regular Expression Denial of Service when requests to it are made with a specially crafted path.


## Recommendation

Upgrade to version 3.0.1.
Path Traversal in Spring Cloud Config
Advisory: GHSA-4x49-w62v-76q7
Aliases: CVE-2019-3799
Published: 2019-05-23T08:39:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected: package: ecosystem: Maven
name: org.springframework.cloud:spring-cloud-config-server
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.4.6
package: ecosystem: Maven
name: org.springframework.cloud:spring-cloud-config-server
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 2.0.4
package: ecosystem: Maven
name: org.springframework.cloud:spring-cloud-config-server
ranges: type: ECOSYSTEM
events: introduced: 2.1.0
fixed: 2.1.2
cwe_ids: CWE-22
severity: MODERATE

Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
Out-of-bounds Read in base64-url
Advisory: GHSA-j4mr-9xw3-c9jx
Published: 2019-05-31T23:47:01Z
Affected: package: ecosystem: npm
name: base64-url
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.0.0
cwe_ids: CWE-125
severity: HIGH

Versions of `base64-url` before 2.0.0 are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input.


## Recommendation

Update to version 2.0.0 or later.