aswin1906/github-advisory-2020.csv huggingface dataset:
Storing Password in Local Storage
Advisory: GHSA-wvh7-5p38-2qfc ()
Published: 2020-07-23T18:20:10Z

The `setPassword` method (http://parseplatform.org/Parse-SDK-JS/api/2.9.1/Parse.User.html#setPassword) stores the user's password in localStorage as raw text making it vulnerable to anyone with access to your localStorage. We believe this is the only time that password is stored at all. In the documentation under Users > Signing Up, it clearly states, "We never store passwords in plaintext, nor will we ever transmit passwords back to the client in plaintext."

Example Code:
```js
async () => {
    const user = Parse.User.current()
    if (user) {
        user.setPassword('newpass')
        await user.save()
    }
}
```
After running the above code, the new password will be stored in localStorage as a property named "password".

Proposed Solution:
Before saving anything to localStorage, Parse should strip out any properties named "password" that are attempting to be stored with a Parse.User type object.

Configuration:
Parse SDK: 2.9.1
Parse Server: 3.9.0

Affected packages:
package: ecosystem: npm, name: parse, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.10.0
Stored XSS in Apache Airflow
Advisory: GHSA-j38c-25fj-mr84 (CVE-2020-9485)
Published: 2020-07-27T16:57:34Z

An issue was found in Apache Airflow versions 1.10.10 and below. A stored XSS vulnerability was discovered in the Chart pages of the the "classic" UI.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: PyPI, name: apache-airflow, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.10.11
Cross-Site Scripting in Wagtail
Advisory: GHSA-2473-9hgq-j7xw (CVE-2020-15118)
Published: 2020-07-20T17:50:30Z

### Impact
When a form page type is made available to Wagtail editors through the `wagtail.contrib.forms` app, and the page template is built using Django's standard form rendering helpers such as `form.as_p` ([as directed in the documentation](https://docs.wagtail.io/en/stable/reference/contrib/forms/index.html#usage)), any HTML tags used within a form field's help text will be rendered unescaped in the page. Allowing HTML within help text is [an intentional design decision](https://docs.djangoproject.com/en/3.0/ref/models/fields/#django.db.models.Field.help_text) by Django; however, as a matter of policy Wagtail does not allow editors to insert arbitrary HTML by default, as this could potentially be used to carry out cross-site scripting attacks, including privilege escalation. This functionality should therefore not have been made available to editor-level users.

The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

### Patches
Patched versions have been released as Wagtail 2.7.4 (for the LTS 2.7 branch) and Wagtail 2.9.3 (for the current 2.9 branch). In these versions, help text will be escaped to prevent the inclusion of HTML tags. Site owners who wish to re-enable the use of HTML within help text (and are willing to accept the risk of this being exploited by editors) may set `WAGTAILFORMS_HELP_TEXT_ALLOW_HTML = True` in their configuration settings.

### Workarounds
Site owners who are unable to upgrade to the new versions can secure their form page templates by [rendering forms field-by-field as per Django's documentation](https://docs.djangoproject.com/en/3.0/topics/forms/#looping-over-the-form-s-fields), but omitting the `|safe` filter when outputting the help text.

### Acknowledgements
Many thanks to Timothy Bautista for reporting this issue.

### For more information
If you have any questions or comments about this advisory:
* Visit Wagtail's [support channels](https://docs.wagtail.io/en/stable/support.html)
* Email us at [security@wagtail.io](mailto:security@wagtail.io) (if you wish to send encrypted email, the public key ID is `0x6ba1e1a86e0f8ce8`)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: PyPI, name: wagtail, ranges: type: ECOSYSTEM, events: introduced: 2.8.0
fixed: 2.9.3
package: ecosystem: PyPI, name: wagtail, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.7.4
Potentially sensitive data exposure in Symfony Web Socket Bundle
Advisory: GHSA-wwgf-3xp7-cxj4 ()
Published: 2020-07-07T16:33:45Z

### Impact
Inside `Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::onPublish()`, messages are arbitrarily broadcasted to the related Topic if `Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::dispatch()` does not succeed.  The `dispatch()` method can be considered to not succeed if (depending on the version of the bundle) the callback defined on a topic route is misconfigured, a `Gos\Bundle\WebSocketBundle\Topic\TopicInterface` implementation is not found for the callback, a topic which also implements `Gos\Bundle\WebSocketBundle\Topic\SecuredTopicInterface` rejects the connection, or an Exception is unhandled.  This can result in an unintended broadcast to the websocket server potentially with data that should be considered sensitive.

### Patches
In 1.10.4, 2.6.1, and 3.3.0, `Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::onPublish()` has been changed to no longer broadcast an event's data if `Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::dispatch()` fails.

### Workarounds
Upgrade to 1.10.4, 2.6.1, and 3.3.0

Note, the 1.x branch is considered end of support as of July 1, 2020.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [this repository](https://github.com/GeniusesOfSymfony/WebSocketBundle)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: Packagist, name: gos/web-socket-bundle, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.10.4
package: ecosystem: Packagist, name: gos/web-socket-bundle, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.6.1
package: ecosystem: Packagist, name: gos/web-socket-bundle, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 3.3.0
False-positive validity for NFT1 genesis transactions
Advisory: GHSA-6jmr-jfh7-xg3h (CVE-2020-15131)
Published: 2020-07-30T14:58:53Z

### Impact
In the npm package named "slp-validate", versions prior to 1.2.2 are vulnerable to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification.

### Patches
npm package "slp-validate" has been patched and is published and tagged as version 1.2.2.

### Workarounds
Upgrade to slp-validate 1.2.2.

### References
* Package location: https://www.npmjs.com/package/slp-validate
* SLP NFT1 spec: https://slp.dev/specs/slp-nft-1/#nft1-protocol-requirements
* Git commit hash fixing this issue: https://github.com/simpleledger/slp-validate.js/commit/3963cf914afae69084059b82483da916d97af65c
* Unit tests have been added to assist validator implementations in avoiding this bug: https://github.com/simpleledger/slp-unit-test-data/commit/8c942eacfae12686dcf1f3366321445a4fba73e7

### For more information
If you have any questions or comments about this advisory please open an issue in the [slp-validate](https://github.com/simpleledger/slp-validate.js/issues) repository.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: npm, name: slp-validate, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.2.2
Insecure default config of Celery worker in Apache Airflow
Advisory: GHSA-9g2w-5f3v-mfmm (CVE-2020-11982)
Published: 2020-07-27T16:57:33Z

An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to the broker (Redis, RabbitMQ) directly, it was possible to insert a malicious payload directly to the broker which could lead to a deserialization attack (and thus remote code execution) on the Worker.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: PyPI, name: apache-airflow, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.10.11
Context isolation bypass via Promise in Electron
Advisory: GHSA-6vrv-94jv-crrg (CVE-2020-15096)
Published: 2020-07-07T00:01:05Z

### Impact
Apps using `contextIsolation` are affected.

This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.

### Workarounds
There are no app-side workarounds, you must update your Electron version to be protected.

### Fixed Versions
* `9.0.0-beta.21`
* `8.2.4`
* `7.2.4`
* `6.1.11`

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@electronjs.org](mailto:security@electronjs.org)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
Affected packages:
package: ecosystem: npm, name: electron, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.1.11
package: ecosystem: npm, name: electron, ranges: type: ECOSYSTEM, events: introduced: 7.0.0
fixed: 7.2.4
package: ecosystem: npm, name: electron, ranges: type: ECOSYSTEM, events: introduced: 8.0.0
fixed: 8.2.4
Prototype Pollution in lodash
Advisory: GHSA-p6mc-m468-83gw (CVE-2020-8203)
Published: 2020-07-15T19:15:48Z

Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The function zipObjectDeep allows a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires zipping objects based on user-provided property arrays.

This vulnerability causes the addition or modification of an existing property that will exist on all objects and may lead to Denial of Service or Code Execution under specific circumstances.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Affected packages:
package: ecosystem: npm, name: lodash, ecosystem_specific: affected_functions: lodash.baseSet, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.17.20
package: ecosystem: npm, name: lodash-es, ecosystem_specific: affected_functions: lodash.baseSet, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.17.20
SQL Injection in Kylin
Advisory: GHSA-hx5g-8hq2-8x4w (CVE-2020-13926)
Published: 2020-07-27T22:51:40Z

Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be overwritten by certain rest api, which makes SQL injection attack is possible. Users of all previous versions after 2.0 should upgrade to 3.1.0.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: org.apache.kylin:kylin-server-base, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.1.0
Log injection in uvicorn
Advisory: GHSA-33c7-2mpw-hg34 (CVE-2020-7694)
Published: 2020-07-29T18:07:16Z

This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request crafted URLs with percent-encoded escape sequences, the logging component will log the URL after it's been processed with urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths, attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either in real time or from a file).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: PyPI, name: uvicorn, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.11.7
Remote code execution via user-provided local names in ActionView
Advisory: GHSA-cr3x-7m39-c6jq (CVE-2020-8163)
Published: 2020-07-07T16:34:27Z

The is a code injection vulnerability in versions of Rails prior to 5.0.1 that would allow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: RubyGems, name: actionview, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.2.11.3, database_specific: last_known_affected_version_range: <= 4.2.11.1
Possible XSS attack in Wagtail
Advisory: GHSA-v2wc-pfq2-5cm6 (CVE-2020-11001)
Published: 2020-04-14T23:09:29Z

### Impact
A cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft a page revision history that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

### Patches
Patched versions have been released as Wagtail 2.7.2 (for the LTS 2.7 branch) and Wagtail 2.8.1 (for the current 2.8 branch).

### Workarounds
Site owners who are unable to upgrade to the new versions can disable the revision comparison view by adding the following URL route to the top of their project's `urls.py` configuration:

    from django.views.generic.base import RedirectView

    urlpatterns = [
        url(r'^admin/pages/(\d+)/revisions/compare/', RedirectView.as_view(url='/admin/')),
        # ...
    ]

### Acknowledgements
Many thanks to Vlad Gerasimenko for reporting this issue.

### For more information
If you have any questions or comments about this advisory:
* Visit Wagtail's [support channels](https://docs.wagtail.io/en/stable/support.html)
* Email us at [security@wagtail.io](mailto:security@wagtail.io) (if you wish to send encrypted email, the public key ID is `0x6ba1e1a86e0f8ce8`)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
Affected packages:
package: ecosystem: PyPI, name: wagtail, ranges: type: ECOSYSTEM, events: introduced: 1.9.0
fixed: 2.7.2
package: ecosystem: PyPI, name: wagtail, ranges: type: ECOSYSTEM, events: introduced: 2.8.0
fixed: 2.8.1, versions: 2.8.0
Machine-In-The-Middle in lix
Advisory: GHSA-q8xg-8xwf-m598 (CVE-2020-10800)
Published: 2020-04-16T03:14:59Z

All versions of `lix` are vulnerable to Machine-In-The-Middle. The package accepts downloads with `http` and follows `location` header redirects for package downloads. This allows for an attacker in a privileged network position to intercept a lix package installation and redirect the download to a malicious source.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: lix, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 15.11.4
Information disclosure through error object in auth0.js
Advisory: GHSA-prfq-f66g-43mp (CVE-2020-5263)
Published: 2020-04-10T18:19:10Z

## Overview
Between versions 8.0.0 and  9.13.1(inclusive), in the case of an (authentication) error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. 

If the error object is exposed or logged without modification, the application risks password exposure.

## Am I affected?
You are affected by this vulnerability if all of the following conditions apply:

- You are using Auth0.js version between 8.0.0 and 9.13.1(inclusive).
- You store or display error objects without filtering. 

## How to fix that?
Developers should upgrade auth0.js to version 9.13.2 or later where user inputted passwords are masked in errors. If upgrading is not possible, a temporary fix may include not storing the error object or displaying it publicly without modification.

## Will this update impact my users?

This fix patches the Auth0.js and may require changes in application code due to password no longer available in error object, but it will not impact your users, their current state, or any existing sessions.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: auth0-js, ranges: type: ECOSYSTEM, events: introduced: 8.0.0
fixed: 9.13.2
Potential XSS vulnerability in jQuery
Advisory: GHSA-jpcq-cgw6-v4j6 (CVE-2020-11023)
Published: 2020-04-29T22:19:14Z

### Impact
Passing HTML containing `<option>` elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code.

### Patches
This problem is patched in jQuery 3.5.0.

### Workarounds
To workaround this issue without upgrading, use [DOMPurify](https://github.com/cure53/DOMPurify) with its `SAFE_FOR_JQUERY` option to sanitize the HTML string before passing it to a jQuery method.

### References
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

### For more information
If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
Affected packages:
package: ecosystem: npm, name: jquery, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 1.0.3
fixed: 3.5.0
package: ecosystem: RubyGems, name: jquery-rails, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.4.0
package: ecosystem: NuGet, name: jQuery, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 1.0.3
fixed: 3.5.0
package: ecosystem: Maven, name: org.webjars.npm:jquery, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 1.0.3
fixed: 3.5.0
jackson-databind mishandles the interaction between serialization gadgets and typing
Advisory: GHSA-5p34-5m6p-p58g (CVE-2020-9546)
Published: 2020-04-23T21:08:40Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ranges: type: ECOSYSTEM, events: introduced: 2.9.0
fixed: 2.9.10.4, database_specific: last_known_affected_version_range: <= 2.9.10.3
XSS in python-markdown2
Advisory: GHSA-fv3h-8x5j-pvgq (CVE-2020-11888)
Published: 2020-04-22T20:59:50Z

python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \w+ match succeeds. For example, an attack might use elementname@ or elementname- with an onclick attribute.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: PyPI, name: markdown2, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.3.9, database_specific: last_known_affected_version_range: <= 2.3.8
Uncontrolled Resource Consumption in Pillow
Advisory: GHSA-5gm3-px64-rw72 (CVE-2019-19911)
Published: 2020-04-01T16:36:44Z

There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: PyPI, name: Pillow, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.2.2
Open Redirect in ecstatic
Advisory: GHSA-9q64-mpxx-87fg ()
Published: 2020-04-01T16:35:08Z

Versions of `ecstatic` prior to 4.1.2, 3.3.2 or 2.2.2 are vulnerable to Open Redirect. The package fails to validate redirects, allowing attackers to craft requests that result in an `HTTP 301` redirect to any other domains.


## Recommendation

If using `ecstatic` 4.x, upgrade to 4.1.2 or later.
If using `ecstatic` 3.x, upgrade to 3.3.2 or later.
If using `ecstatic` 2.x, upgrade to 2.2.2 or later.

Affected packages:
package: ecosystem: npm, name: ecstatic, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.2.2
package: ecosystem: npm, name: ecstatic, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 3.3.2
package: ecosystem: npm, name: ecstatic, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.1.2
jackson-databind mishandles the interaction between serialization gadgets and typing
Advisory: GHSA-h4rc-386g-6m85 (CVE-2020-11620)
Published: 2020-04-23T20:19:02Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ranges: type: ECOSYSTEM, events: introduced: 2.9.0
fixed: 2.9.10.4, database_specific: last_known_affected_version_range: <= 2.9.10.3
Subject Confirmation Method not validated in Saml2 Authentication Services for ASP.NET
Advisory: GHSA-9475-xg6m-j7pw (CVE-2020-5268)
Published: 2020-04-22T20:59:37Z

### Impact
Saml2 tokens are usually used as bearer tokens - a caller that presents a token is assumed to be the subject of the token. There is also support in the Saml2 protocol for issuing tokens that is tied to a subject through other means, e.g. holder-of-key where possession of a private key must be proved.
The Sustainsys.Saml2 library incorrectly treats all incoming tokens as bearer tokens, even though they have another subject confirmation method specified. This could be used by an attacker that could get access to Saml2 tokens with another subject confirmation method than bearer. The attacker could then use such a tocken to create a log in session.

### Patches
Version 1.0.2 and 2.7.0 are patched.

### Workarounds
Ensure that any IdentityProvider trusted by the Sustainsys.Saml2 SP only issues bearer tokens if the audience matches the Sustainsys.Saml2 SP.

### For more information
If you have any questions or comments about this advisory:
* Comment on #103
* Email us at security@sustainsys.com if you think that there are further security issues.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
Affected packages:
package: ecosystem: NuGet, name: Sustainsys.Saml2, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.0.2
package: ecosystem: NuGet, name: Sustainsys.Saml2, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.7.0
jackson-databind mishandles the interaction between serialization gadgets and typing
Advisory: GHSA-758m-v56v-grj4 (CVE-2020-10969)
Published: 2020-04-23T21:36:03Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ranges: type: ECOSYSTEM, events: introduced: 2.9.0
fixed: 2.9.10.4, database_specific: last_known_affected_version_range: <= 2.9.10.3
Cross-Site Scripting in seeftl
Advisory: GHSA-4g46-5grc-wq49 (CVE-2019-15603)
Published: 2020-04-01T16:36:31Z

All versions of `seeftl` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: seeftl, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 0.1.1
Command Injection in npm-programmatic
Advisory: GHSA-426h-24vj-qwxf (CVE-2020-7614)
Published: 2020-04-23T20:09:09Z

All versions of `npm-programmatic ` are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an `exec` call on the `install`, `uninstall` and `list` functions . This may allow attackers to execute arbitrary code in the system if the package name passed to the function is user-controlled.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: npm-programmatic, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 0.0.12
Potential XSS vulnerability in jQuery
Advisory: GHSA-gxr4-xjj5-5px2 (CVE-2020-11022)
Published: 2020-04-29T22:18:55Z

### Impact
Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code.

### Patches
This problem is patched in jQuery 3.5.0.

### Workarounds
To workaround the issue without upgrading, adding the following to your code:

```js
jQuery.htmlPrefilter = function( html ) {
	return html;
};
```

You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround.

### References
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
https://jquery.com/upgrade-guide/3.5/

### For more information
If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
Affected packages:
package: ecosystem: npm, name: jquery, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 1.2.0
fixed: 3.5.0
package: ecosystem: NuGet, name: jquery, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 1.2.0
fixed: 3.5.0
package: ecosystem: RubyGems, name: jquery-rails, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.4.0
package: ecosystem: Maven, name: org.webjars.npm:jquery, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 1.2.0
fixed: 3.5.0
Prototype Pollution Protection Bypass in qs
Advisory: GHSA-gqgv-6jq5-jjj9 (CVE-2017-1000048)
Published: 2020-04-30T17:16:47Z

Affected version of `qs` are vulnerable to Prototype Pollution because it is possible to bypass the protection. The `qs.parse` function fails to properly prevent an object's prototype to be altered when parsing arbitrary input. Input containing `[` or `]` may bypass the prototype pollution protection and alter the Object prototype. This allows attackers to override properties that will exist in all objects, which may lead to Denial of Service or Remote Code Execution in specific circumstances.


## Recommendation

Upgrade to 6.0.4, 6.1.2, 6.2.3, 6.3.2 or later.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: npm, name: qs, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.0.4
package: ecosystem: npm, name: qs, ranges: type: ECOSYSTEM, events: introduced: 6.1.0
fixed: 6.1.2
package: ecosystem: npm, name: qs, ranges: type: ECOSYSTEM, events: introduced: 6.2.0
fixed: 6.2.3
package: ecosystem: npm, name: qs, ranges: type: ECOSYSTEM, events: introduced: 6.3.0
fixed: 6.3.2
Regular Expression Denial of Service in Acorn
Advisory: GHSA-6chw-6frg-f759 ()
Published: 2020-04-03T21:48:38Z

Affected versions of acorn are vulnerable to Regular Expression Denial of Service.
A regex in the form of /[x-\ud800]/u causes the parser to enter an infinite loop.
The string is not valid UTF16 which usually results in it being sanitized before reaching the parser.
If an application processes untrusted input and passes it directly to acorn,
attackers may leverage the vulnerability leading to Denial of Service.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: npm, name: acorn, ranges: type: ECOSYSTEM, events: introduced: 5.5.0
fixed: 5.7.4
package: ecosystem: npm, name: acorn, ranges: type: ECOSYSTEM, events: introduced: 6.0.0
fixed: 6.4.1
package: ecosystem: npm, name: acorn, ranges: type: ECOSYSTEM, events: introduced: 7.0.0
fixed: 7.1.1
BSON rubygem contains potential denial of service
Advisory: GHSA-qh4w-7pw3-p4rp (CVE-2015-4411)
Published: 2020-04-29T15:34:50Z

The `Moped::BSON::ObjecId.legal?` method in `mongodb/bson-ruby` before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource consumption) via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: RubyGems, name: bson, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.0.4
XSS in MITREid Connect
Advisory: GHSA-c2h6-7gm8-cv4w (CVE-2020-5497)
Published: 2020-04-01T16:35:44Z

The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized. This is related to header.tag. The issue can be exploited to execute arbitrary JavaScript.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Maven, name: org.mitre:openid-connect-server, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 1.3.3
XSS in knockout
Advisory: GHSA-vcjj-xf2r-mwvc (CVE-2019-14862)
Published: 2020-04-01T15:47:45Z

There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: knockout, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.5.0
Internal NCryptDecrypt method could be used externally from WindowsHello library.
Advisory: GHSA-wvpv-ffcv-r6cw (CVE-2020-11005)
Published: 2020-04-14T23:09:13Z

### Impact
Every user of the library before version 1.0.4.

### Patches
Patched in 1.0.4+.

### Workarounds
None.

### References
https://github.com/SeppPenner/WindowsHello/issues/3

### For more information
It this library is used to encrypt text and write the output to a txt file, another executable could be able to decrypt the text using the static method NCryptDecrypt from this same library  without the need to use Windows Hello Authentication again.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: NuGet, name: HaemmerElectronics.SeppPenner.WindowsHello, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.0.4
XSS in Keycloak
Advisory: GHSA-8vf3-4w62-m3pq (CVE-2020-1697)
Published: 2020-04-15T21:09:09Z

It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further attacks.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Maven, name: org.keycloak:keycloak-core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 9.0.0
Exposure of Sensitive Information to an Unauthorized Actor in Keycloak
Advisory: GHSA-xfqh-7356-vqjj (CVE-2019-14820)
Published: 2020-04-15T21:08:21Z

It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected packages:
package: ecosystem: Maven, name: org.keycloak:keycloak-core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 8.0.0
Cross-Site Scripting in fileview
Advisory: GHSA-gvr4-7xgc-gx3w (CVE-2019-15602)
Published: 2020-04-01T16:36:15Z

All versions of `fileview` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: fileview, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 0.1.6
CSRF and DNS Rebinding in Oasis
Advisory: GHSA-j438-45hc-vjhm (CVE-2020-11003)
Published: 2020-04-16T03:14:39Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

If you're running a vulnerable application on your computer and an attacker can trick you into visiting a malicious website, they could use [DNS rebinding](https://en.wikipedia.org/wiki/DNS_rebinding) and [CSRF](https://en.wikipedia.org/wiki/Cross-site_request_forgery) attacks to read/write to vulnerable applications. 

**There is no evidence that suggests that this has been used in the wild.**

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Yes, 2.15.0.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

No.

### References
_Are there any links users can visit to find out more?_

No.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [fraction/oasis](http://github.com/fraction/oasis)
* Email me at [christianbundy@fraction.io](mailto:christianbundy@fraction.io)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: @fraction/oasis, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.15.0
XSS injection in the Grid component of Sylius
Advisory: GHSA-rc5r-697f-28x6 (CVE-2019-12186)
Published: 2020-04-15T21:07:59Z

Grid component of Sylius omits HTML input sanitisation while rendering object implementing __toString() method through the string field type.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: sylius/grid, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 1.0.0
fixed: 1.1.19
package: ecosystem: Packagist, name: sylius/grid, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 1.2.0
fixed: 1.2.18
package: ecosystem: Packagist, name: sylius/grid, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 1.3.0
fixed: 1.3.13
package: ecosystem: Packagist, name: sylius/grid, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 1.4.0
fixed: 1.4.5
package: ecosystem: Packagist, name: sylius/grid, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 1.5.0
fixed: 1.5.1
package: ecosystem: Packagist, name: sylius/grid-bundle, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 1.0.0
fixed: 1.1.19
package: ecosystem: Packagist, name: sylius/grid-bundle, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 1.2.0
fixed: 1.2.18
package: ecosystem: Packagist, name: sylius/grid-bundle, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 1.3.0
fixed: 1.3.13
package: ecosystem: Packagist, name: sylius/grid-bundle, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 1.4.0
fixed: 1.4.5
package: ecosystem: Packagist, name: sylius/grid-bundle, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 1.5.0
fixed: 1.5.1
package: ecosystem: Packagist, name: sylius/sylius, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 1.0.0
last_affected: 1.0.18
package: ecosystem: Packagist, name: sylius/sylius, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 1.1.0
last_affected: 1.1.17
package: ecosystem: Packagist, name: sylius/sylius, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 1.2.0
last_affected: 1.2.16
package: ecosystem: Packagist, name: sylius/sylius, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 1.3.0
last_affected: 1.3.11
package: ecosystem: Packagist, name: sylius/sylius, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 1.4.0
last_affected: 1.4.3
Cross-Site Scripting in sanitize-html
Advisory: GHSA-3j7m-hmh3-9jmp (CVE-2016-1000237)
Published: 2020-04-16T03:14:47Z

Affected versions of `sanitize-html` do not sanitize input recursively, which may allow an attacker to execute arbitrary Javascript.


## Recommendation

Update to version 1.4.3 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: sanitize-html, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.4.3
jackson-databind mishandles the interaction between serialization gadgets and typing
Advisory: GHSA-95cm-88f5-f2c7 (CVE-2020-10672)
Published: 2020-04-23T16:32:59Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ranges: type: ECOSYSTEM, events: introduced: 2.9.0
fixed: 2.9.10.4, database_specific: last_known_affected_version_range: <= 2.9.10.3
Machine-In-The-Middle in https-proxy-agent
Advisory: GHSA-pc5p-h8pf-mvwp ()
Published: 2020-04-16T03:14:56Z

Versions of `https-proxy-agent` prior to 2.2.3 are vulnerable to Machine-In-The-Middle. The package fails to enforce TLS on the socket if the proxy server responds the to the request with a HTTP status different than 200. This allows an attacker with access to the proxy server to intercept unencrypted communications, which may include sensitive information such as credentials.


## Recommendation

Upgrade to version 3.0.0 or 2.2.3.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N/
Affected packages:
package: ecosystem: npm, name: https-proxy-agent, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.2.3
OS Command Injection in devcert-sanscache
Advisory: GHSA-4gp3-p7ph-x2jr (CVE-2019-10778)
Published: 2020-04-14T23:09:00Z

devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. The variable `commonName` controlled by user input is used as part of the `exec` function without any sanitization.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: devcert-sanscache, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.4.7
Improper Restriction of Rendered UI Layers or Frames in Keycloak
Advisory: GHSA-3gg7-9q2x-79fc (CVE-2020-1728)
Published: 2020-04-15T21:09:40Z

A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in HTTP-responses. This does not directly lead to a security issue, yet it might aid attackers in their efforts to exploit other problems. The flaws unnecessarily make the servers more prone to Clickjacking, channel downgrade attacks and other similar client-based attack vectors.

Affected packages:
package: ecosystem: Maven, name: org.keycloak:keycloak-core, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 9.0.3
Improper Verification of Cryptographic Signature in Pure-Python ECDSA
Advisory: GHSA-8qxj-f9rh-9fg2 (CVE-2019-14859)
Published: 2020-04-01T16:35:26Z

A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable signature to create false transactions.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: PyPI, name: ecdsa, ecosystem_specific: affected_functions: ecdsa.der.remove_constructed, ecdsa.der.remove_sequence, ecdsa.der.remove_octet_string, ecdsa.der.remove_object, ecdsa.der.remove_integer, ecdsa.der.read_length, ecdsa.keys.VerifyingKey.verify_digest, ecdsa.util.sigdecode_string, ecdsa.util.sigdecode_strings, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.13.3
Negative charge in shopping cart in Shopizer
Advisory: GHSA-w8rc-pgxq-x2cj (CVE-2020-11007)
Published: 2020-04-22T20:59:26Z

### Impact
Using API or Controller based versions negative quantity is not adequately validated hence creating incorrect shopping cart and order total. 

### Patches
Adding a back-end verification to check that quantity parameter isn't negative. If so, it is set to 1. Patched in 2.11.0

### Workarounds
Without uprading, it's possible to just apply the fixes in the same files it's done for the patch. Or you use javax constraint validation on the quantity parameter.

### References
[Input Validation](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)
[Using bean validation constraint](https://javaee.github.io/tutorial/bean-validation002.html)
[Commits with fixes](https://github.com/shopizer-ecommerce/shopizer/commit/929ca0839a80c6f4dad087e0259089908787ad2a)
CVE Details below : 
[Mitre](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11007)
[NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-11007)

### Credits
Found and solved by Yannick Gosset from Aix-Marseille University cybersecurity
master program supervised by Yassine Ilmi 

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: Maven, name: com.shopizer:sm-core-model, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.11.0
Prototype pollution in class-transformer
Advisory: GHSA-6gp3-h3jj-prx4 (CVE-2020-7637)
Published: 2020-04-07T15:47:40Z

class-transformer through 0.2.3 is vulnerable to Prototype Pollution. The 'classToPlainFromExist' function could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected packages:
package: ecosystem: npm, name: class-transformer, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.3.1
Out-of-bounds Read in Pillow
Advisory: GHSA-hj69-c76v-86wr (CVE-2020-5313)
Published: 2020-04-01T16:36:00Z

`libImaging/FliDecode.c` in Pillow before 6.2.2 has an FLI buffer overflow.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Affected packages:
package: ecosystem: PyPI, name: Pillow, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.2.2
Improper Neutralization of CRLF Sequences in HTTP Headers in Jooby ('HTTP Response Splitting)
Advisory: GHSA-gv3v-92v6-m48j (CVE-2020-7622)
Published: 2020-04-03T15:23:30Z

### Impact

 - Cross Site Scripting
 - Cache Poisoning
 - Page Hijacking

### Patches

This was fixed in version `2.2.1`.

### Workarounds

If you are unable to update, ensure that user supplied data isn't able to flow to HTTP headers. If it does, pre-sanitize for CRLF characters.

### References

##### [CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')](https://cwe.mitre.org/data/definitions/113.html)

I've been poking at libraries to see if they are vulnerable to HTTP Response Splitting and Jooby is my third case of finding this vulnerability.

### Root Cause

This roots cause back to this line in the Jooby codebase:

https://github.com/jooby-project/jooby/blob/93cfc80aa20c188f71a442ea7a1827da380e1c27/modules/jooby-netty/src/main/java/io/jooby/internal/netty/NettyContext.java#L102

The `DefaultHttpHeaders` takes a parameter `validate` which, when `true` (as it is for the no-arg constructor) validates that the header isn't being abused to do HTTP Response Splitting.

### Reported By

This vulnerability was reported by @JLLeitschuh ([Twitter](https://twitter.com/JLLeitschuh))

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [jooby-project/jooby](https://github.com/jooby-project/jooby/issues)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: io.jooby:jooby-netty, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.2.1
Insecure Entropy Source - Math.random() in node-uuid
Advisory: GHSA-265q-28rp-chq5 (CVE-2015-8851)
Published: 2020-04-16T03:14:50Z

Affected versions of `node-uuid` consistently fall back to using `Math.random` as an entropy source instead of `crypto`, which may result in guessable UUID's.



## Recommendation

Update to version 1.4.4 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: node-uuid, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.4.4
confinit vulnerable to prototype pollution
Advisory: GHSA-jgpq-g82g-6c39 (CVE-2020-7638)
Published: 2020-04-07T15:52:05Z

confinit through 0.3.0 is vulnerable to Prototype Pollution.The 'setDeepProperty' function could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected packages:
package: ecosystem: npm, name: confinit, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.4.0