aswin1906/github-advisory-2020.csv huggingface dataset:
Command Injection in wxchangba
Advisory: GHSA-j6v9-xgvh-f796 ()
Published: 2020-09-11T21:11:34Z

All versions of `wxchangba` are vulnerable to Command Injection. The package does not validate user input on the `reqPostMaterial` function, passing contents of the `file` parameter to an exec call. This may allow attackers to run arbitrary commands in the system.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

Affected packages:
package: ecosystem: npm, name: wxchangba, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Remote Memory Exposure in openwhisk
Advisory: GHSA-53mj-mc38-q894 ()
Published: 2020-09-01T19:40:41Z

Versions of `openwhisk` before 3.3.1 are vulnerable to remote memory exposure.

When a number is passed to `api_key`, affected versions of `openwhisk` allocate an uninitialized buffer and send that over network in Authorization header (base64-encoded).

Proof of concept:

```js
var openwhisk = require('openwhisk');
var options = {
  apihost: '127.0.0.1:1433', 
  api_key: USERSUPPLIEDINPUT // number
};
var ow = openwhisk(options);
ow.actions.invoke({actionName: 'sample'}).then(result => console.log(result))
```


## Recommendation

Update to version 3.3.1 or later.

Affected packages:
package: ecosystem: npm, name: openwhisk, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.3.1
Cross-Site Scripting in jquery-mobile
Advisory: GHSA-fj93-7wm4-8x2g ()
Published: 2020-09-02T21:22:47Z

All version of `jquery-mobile` are vulnerable to Cross-Site Scripting. The package checks for content in `location.hash` and if a URL is found it does an XmlHttpRequest (XHR) to the URL and renders the response with `innerHTML`. It fails to validate the `Content-Type` of the response, allowing attackers to include malicious payloads as part of query parameters that are reflected back to the user. A response such as `{"q":"<iframe/src='javascript:alert(1)'></iframe>","results":[]}` would be parsed as HTML and the JavaScript payload executed.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: jquery-mobile, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in carloprojectlesang
Advisory: GHSA-qj2g-642f-4jrv ()
Published: 2020-09-02T21:17:30Z

All versions of `carloprojectlesang` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts.


## Recommendation

Remove the package from your environment. Review your Discord account access and rotate tokens if possible. If a credit card was linked to a compromised account contact your credit card company.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: carloprojectlesang, ranges: type: ECOSYSTEM, events: introduced: 0
Denial of Service in handlebars
Advisory: GHSA-f52g-6jhx-586p ()
Published: 2020-09-03T23:20:12Z

Affected versions of `handlebars` are vulnerable to Denial of Service. The package's parser may be forced into an endless loop while processing specially-crafted templates. This may allow attackers to exhaust system resources leading to Denial of Service.


## Recommendation

Upgrade to version 4.4.5 or later.

Affected packages:
package: ecosystem: npm, name: handlebars, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.4.5
Malicious Package in bsae-x
Advisory: GHSA-mgff-xpg3-3gwc ()
Published: 2020-09-03T19:42:25Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bsae-x, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in bmap
Advisory: GHSA-p59g-6cqr-m73w ()
Published: 2020-09-03T20:45:27Z

Version 1.0.3 of `bmap` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`


## Recommendation

If version 1.0.3 of this module is found installed you will want to replace it with a version before or after 1.0.3. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: bmap, versions: 1.0.3
Denial of Service in Tensorflow
Advisory: GHSA-qc53-44cj-vfvx (CVE-2020-15197)
Published: 2020-09-25T18:28:30Z

### Impact
The `SparseCountSparseOutput` implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the `indices` tensor has rank 2. This tensor must be a matrix because code assumes its elements are accessed as elements of a matrix:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/count_ops.cc#L185

However, malicious users can pass in tensors of different rank, resulting in a `CHECK` assertion failure and a crash. This can be used to cause denial of service in serving installations, if users are allowed to control the components of the input sparse tensor.

### Patches
We have patched the issue in 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and will release a patch release.

We recommend users to upgrade to TensorFlow 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability is a variant of [GHSA-p5f8-gfw5-33w4](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-p5f8-gfw5-33w4)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
Affected packages:
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
Deserialization of Untrusted Data in Log4j
Advisory: GHSA-2qrg-x229-3v8q (CVE-2019-17571)
Published: 2020-01-06T18:43:49Z

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions 1.2 up to 1.2.17.

Users are advised to migrate to `org.apache.logging.log4j:log4j-core`.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: log4j:log4j, ranges: type: ECOSYSTEM, events: introduced: 1.2
last_affected: 1.2.17
PrestaShop module ps_facetedsearch might be vulnerable from CVE-2017-9841
Advisory: GHSA-f884-gm86-cg3q ()
Published: 2020-01-07T17:20:47Z

### Impact

We have identified that some ps_facetedsearch module ZIP archives have been built with phpunit dev dependencies. PHPUnit contains a php script that would allow, on a webserver, an attacker to perform a RCE.

This vulnerability impacts
- phpunit before 4.8.28 and 5.x before 5.6.3 as reported in [CVE-2017-9841](https://nvd.nist.gov/vuln/detail/CVE-2017-9841)
- phpunit >= 5.63 before 7.5.19 and 8.5.1 (this is a newly found vulnerability that is currently being submitted as a CVE after disclosure was provided to phpunit maintainers)

### Patches

In the [security patch](https://github.com/PrestaShop/ps_facetedsearch/releases/tag/v3.4.1), we look for the unwanted vendor/phpunit folder and remove it if we find it. This allows users to fix the security issue when upgrading.

### Workarounds
Users can also simply remove the unwanted vendor/phpunit folder.

### References
https://nvd.nist.gov/vuln/detail/CVE-2017-9841

### For more information
If you have any questions or comments about this advisory, email us at security@prestashop.com

Affected packages:
package: ecosystem: Packagist, name: prestashop/ps_facetedsearch, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.4.1
Local Privilege Escalation in PyInstaller
Advisory: GHSA-7fcj-pq9j-wh2r (CVE-2019-16784)
Published: 2020-01-16T22:18:27Z

### Impact

Local Privilege Escalation in all Windows software frozen by PyInstaller in "onefile" mode.

The vulnerability is present only on Windows and in this particular case: If a **software frozen by PyInstaller in "onefile" mode** is launched by a (privileged) user who has **his/her "TempPath" resolving to a world writable directory**. This is the case e.g. if the software is launched as a service or as a scheduled task using a system account (in which case TempPath will default to C:\Windows\Temp).

In order to be exploitable the software has to be (re)started after the attacker has launched the exploit program. So for a service launched at startup, a service restart is needed (e.g. after a crash or an upgrade).

While PyInstaller itself was not vulnerable, all Windows software frozen by PyInstaller in "onefile" mode is vulnerable.

CVSSv3 score 7.0 (High)
CVSSv3 vector CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected
- all Windows software frozen by PyInstaller in "onefile" mode

No affected
- PyInstaller itself (except if frozen by PyInstaller in "onefile" mode on Windows)
- software frozen in "one*dir*" mode
- other platforms (GNU/Linux, OS X, BSD, etc.)

### Patches
The problem is patched in commits 42a67148b3bdf9211fda8499fdc5b63acdd7e6cc (fixed code) and be948cf0954707671aa499da17b10c86b6fa5e5c (recompiled bootloaders). Users should upgrade to PyInstaller version 3.6 and rebuild their software.

### Workarounds
There is no known workaround. Users using PyInstaller to freeze their Windows software using "onefile" mode should upgrade PyInstaller and rebuild their software.

### Credits
This vulnerability was discovered and reported by Farid AYOUJIL (@faridtsl), David HA, Florent LE NIGER and Yann GASCUEL (@lnv42) from Alter Solutions (@AlterSolutions) and fixed in collaboration with
Hartmut Goebel (@htgoebel, maintainer of PyInstaller).

### Funding Development

PyInstaller is in urgent need of funding to make future security fixes happen, see <https://github.com/pyinstaller/pyinstaller/issues/4404> for details.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: PyPI, name: PyInstaller, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.6
PrestaShop autoupgrade module ZIP archives were vulnerable from CVE-2017-9841
Advisory: GHSA-wqq8-mqj9-697f ()
Published: 2020-01-08T03:10:30Z

### Impact

We have identified that some autoupgrade module ZIP archives have been built with phpunit dev dependencies. PHPUnit contains a php script that would allow, on a webserver, an attacker to perform a RCE.

This vulnerability impacts
- phpunit before 4.8.28 and 5.x before 5.6.3 as reported in [CVE-2017-9841](https://nvd.nist.gov/vuln/detail/CVE-2017-9841)
- phpunit >= 5.63 before 7.5.19 and 8.5.1 (this is a newly found vulnerability that is currently being submitted as a CVE after disclosure was provided to phpunit maintainers)

You can read PrestaShop official statement about this vulnerability [here](https://build.prestashop.com/news/critical-security-vulnerability-in-prestashop-modules/).

### Patches

In the [security patch](https://github.com/PrestaShop/autoupgrade/releases/tag/v4.10.1), we look for the unwanted vendor/phpunit folder and remove it if we find it. This allows users to fix the security issue when upgrading.

### Workarounds
Users can also simply remove the unwanted vendor/phpunit folder.

### References
https://nvd.nist.gov/vuln/detail/CVE-2017-9841

### For more information
If you have any questions or comments about this advisory, email us at security@prestashop.com

Affected packages:
package: ecosystem: Packagist, name: prestashop/autoupgrade, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.10.1
PrestaShop gamification module ZIP archives were vulnerable from CVE-2017-9841
Advisory: GHSA-769f-539v-f5jg ()
Published: 2020-01-08T03:10:44Z

### Impact

We have identified that some gamification module ZIP archives have been built with phpunit dev dependencies. PHPUnit contains a php script that would allow, on a webserver, an attacker to perform a RCE.

This vulnerability impacts
- phpunit before 4.8.28 and 5.x before 5.6.3 as reported in [CVE-2017-9841](https://nvd.nist.gov/vuln/detail/CVE-2017-9841)
- phpunit >= 5.63 before 7.5.19 and 8.5.1 (this is a newly found vulnerability that is currently being submitted as a CVE after disclosure was provided to phpunit maintainers)

You can read PrestaShop official statement about this vulnerability [here](https://build.prestashop.com/news/critical-security-vulnerability-in-prestashop-modules/).

### Patches

In the [security patch](https://github.com/PrestaShop/gamification/releases/tag/v2.3.2), we look for the unwanted vendor/phpunit folder and remove it if we find it. This allows users to fix the security issue when upgrading.

### Workarounds
Users can also simply remove the unwanted vendor/phpunit folder.

### References
https://nvd.nist.gov/vuln/detail/CVE-2017-9841

### For more information
If you have any questions or comments about this advisory, email us at security@prestashop.com

Affected packages:
package: ecosystem: Packagist, name: prestashop/gamification, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.3.2
cookie-signature Timing Attack
Advisory: GHSA-92vm-wfm5-mxvv (CVE-2016-1000236)
Published: 2020-01-06T18:44:10Z

Affected versions of `cookie-signature` are vulnerable to timing attacks as a result of using a fail-early comparison instead of a constant-time comparison. 

Timing attacks remove the exponential increase in entropy gained from increased secret length, by providing per-character feedback on the correctness of a guess via miniscule timing differences.

Under favorable network conditions, an attacker can exploit this to guess the secret in no more than `charset*length` guesses, instead of `charset^length` guesses required were the timing attack not present. 



## Recommendation

Update to 1.0.4 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: cookie-signature, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.0.4
Hard-Coded Key Used For Remember-me Token in Opencast
Advisory: GHSA-mh8g-hprg-8363 (CVE-2020-5222)
Published: 2020-01-30T21:21:44Z

### Impact

The security configuration in `etc/security/mh_default_org.xml` enables a remember-me cookie based on a hash created from the [username, password, and an additional system key](https://docs.spring.io/spring-security/site/docs/3.0.x/reference/remember-me.html). Opencast has hard-coded this system key in the large XML file and never mentions to change this, basically ensuring that all systems use the same key:

```xml
<sec:remember-me key="opencast" user-service-ref="userDetailsService" />
```

This means that an attacker getting access to a remember-me token for one server can get access to all servers which allow log-in using the same credentials without ever needing the credentials. For example, a remember-me token obtained from develop.opencast.org can be used on stable.opencast.org without actually knowing the log-in credentials.

Such an attack will usually not work on different installations – assuming that safe, unique passwords are used – but it is basically guaranteed to work to get access to all machines of one cluster if a token from one machine is compromised.

### Patches

This problem is fixed in Opencast 7.6 and Opencast 8.1

### Workarounds

We strongly recommend updating to the patched version. Still, as a workaround for older versions, in `etc/security/mh_default_org.xml`, set a custom key for each server:

```xml
<sec:remember-me key="CUSTOM_RANDOM_KEY" user-service-ref="userDetailsService" />
```

### References

- [Relevant lines in the security configuration](https://github.com/opencast/opencast/blob/161ee619382f144dc35eea211fc6b556025b98e1/etc/security/mh_default_org.xml#L335-L336)
- [Spring Security Remember-Me Authentication Documentation](https://docs.spring.io/spring-security/site/docs/3.0.x/reference/remember-me.html#remember-me-hash-token)

### For more information
If you have any questions or comments about this advisory:
- Open an issue in [opencast/opencast](https://github.com/opencast/opencast/issues)
- For security-relevant information, email us at [security@opencast.org](mailto:security@opencast.org)

### Thanks
Thanks to @LukasKalbertodt for reporting the issue.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Affected packages:
package: ecosystem: Maven, name: org.opencastproject:opencast-kernel, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 7.6
package: ecosystem: Maven, name: org.opencastproject:opencast-kernel, ranges: type: ECOSYSTEM, events: introduced: 8.0
fixed: 8.1
auth0-lock vulnerable to XSS via unsanitized placeholder property
Advisory: GHSA-w2pf-g6r8-pg22 (CVE-2019-20174)
Published: 2020-01-31T17:59:51Z

## Overview

Auth0 Lock version 11.20.4 and earlier did not properly sanitize the generated HTML code. Customers using the `additionalSignUpFields` customization option to add a checkbox to the sign-up dialog that are passing a `placeholder` property obtained from an untrusted source (e.g. a query parameter) could allow cross-site scripting (XSS) on their signup pages.

## Am I affected?

You are affected by this vulnerability if all of the following conditions apply:

- You are using Auth0 Lock version 11.20.4 or earlier.
- You pass `additionalSignUpFields` as options when initializing Lock which includes a field of type `checkbox` whose `placeholder` value is obtained from an untrusted source.

An example of a vulnerable snippet is the following where the `placeholder` value is partially user-controlled by the `name` query parameter:

```javascript
<script>
    var params = new URLSearchParams(window.location.search);
    var options = {
        auth: {
            redirectUrl: 'http://localhost:12345/callback',
            responseType: 'code',
            params: {
                scope: 'openid email',
            },
        },
        additionalSignUpFields: [{
            name: 'agree',
            type: 'checkbox',
            placeholder: "I agree to Terms and Conditions for " + params.get('name'),
        }],
    };
    var lock = new Auth0Lock('<CLIENT_ID>', '<TENANT_NAME>.auth0.com', options);
    lock.show({
        allowShowPassword: true,
        initialScreen: 'signUp',
    });
</script>
```

## How to fix that?

Developers using Auth0’s signin solution Lock need to upgrade to version 11.21.0 or later. Version 11.21.0 introduces two changes:

1. The existing `placeholder` property is now treated as plain text to mitigate the problem.
2. A new `placeholderHTML` property is introduced that indicates the level of control it provides and that it should be only supplied from trusted sources.

## Will this update impact my users?

This fix patches the Auth0 Lock widget and may require changes in application code, but it will not impact your users, their current state, or any existing sessions.

Developers using the `placeholder` property with HTML content from a trusted source should start using the `placeholderHTML` property to continue providing the same user experience.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: auth0-lock, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 11.21.0
Unrestricted upload of file with dangerous type in Apache Solr
Advisory: GHSA-2289-pqfq-6wx7 (CVE-2019-12409)
Published: 2020-01-28T22:26:54Z

The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configuration file shipping with Solr. If you use the default solr.in.sh file from the affected releases, then JMX monitoring will be enabled and exposed on RMI_PORT (default=18983), without any authentication. If this port is opened for inbound traffic in your firewall, then anyone with network access to your Solr nodes will be able to access JMX, which may in turn allow them to upload malicious code for execution on the Solr server.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: org.apache.solr:solr-core, ranges: type: ECOSYSTEM, events: introduced: 8.1.1
fixed: 8.3.0, database_specific: last_known_affected_version_range: <= 8.2.0
Ability to expose data in Sylius by using an unintended serialisation group
Advisory: GHSA-8vp7-j5cj-vvm2 (CVE-2020-5220)
Published: 2020-01-31T18:00:43Z

### Impact

ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API.

Anyone exposing an API with ResourceBundle's controller is affected. The vulnerable versions are: `<1.3 || >=1.3.0 <=1.3.12 || >=1.4.0 <=1.4.5 || >=1.5.0 <=1.5.0 || >=1.6.0 <=1.6.2`.

### Patches

The patch is provided for ResourceBundle 1.3.13, 1.4.6, 1.5.1 and 1.6.3, but not for any versions below 1.3.

After it is applied, It allows to choose only the groups that are defined in `serialization_groups` or `allowed_serialization_groups` route definition. Any group not defined in those will not be used.

This behaviour might be a BC break for those using custom groups via the HTTP header, please adjust `allowed_serialization_groups` accordingly.

### Workarounds

Service `sylius.resource_controller.request_configuration_factory` can be overridden with an implementation copied from `\Sylius\Bundle\ResourceBundle\Controller\RequestConfigurationFactory` where the part that handles custom serialisation groups is deleted.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: sylius/resource-bundle, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.3.13
package: ecosystem: Packagist, name: sylius/resource-bundle, ranges: type: ECOSYSTEM, events: introduced: 1.4.0
fixed: 1.4.6
package: ecosystem: Packagist, name: sylius/resource-bundle, ranges: type: ECOSYSTEM, events: introduced: 1.5.0
fixed: 1.5.1
package: ecosystem: Packagist, name: sylius/resource-bundle, ranges: type: ECOSYSTEM, events: introduced: 1.6.0
fixed: 1.6.3
package: ecosystem: Packagist, name: sylius/sylius, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.3.12
package: ecosystem: Packagist, name: sylius/sylius, ranges: type: ECOSYSTEM, events: introduced: 1.4.0
fixed: 1.4.4
HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers (Follow-up)
Advisory: GHSA-968f-66r5-5v74 (CVE-2019-16789)
Published: 2020-01-06T18:44:21Z

### Impact

The patches introduced to fix https://github.com/Pylons/waitress/security/advisories/GHSA-m5ff-3wj3-8ph4 were not complete and still would allow an attacker to smuggle requests/split a HTTP request with invalid data.

This updates the existing CVE with ID: CVE-2019-16789

### Patches

Waitress version 1.4.2 has been updated to now validate HTTP headers better to avoid the issue, completely fixing all known issues with whitespace.

### Workarounds

There are no work-arounds, upgrading to Waitress 1.4.2 is highly recommended.

### References

See https://github.com/Pylons/waitress/security/advisories/GHSA-m5ff-3wj3-8ph4 for more information on the security issue.

### For more information

If you have any questions or comments about this advisory:

* open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related)
* email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N
Affected packages:
package: ecosystem: PyPI, name: waitress, ecosystem_specific: affected_functions: waitress.parser.HTTPRequestParser.parse_header, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.4.2
Password Hashing: Do not use MD5
Advisory: GHSA-h362-m8f2-5x7c (CVE-2020-5229)
Published: 2020-01-30T21:21:58Z

### Impact

User passwords are stored in the database using the rather outdated and cryptographically insecure MD5 hash algorithm. Furthermore, the hashes are salted using the username instead of a random salt, causing hashes for users with the same username and password to collide which is problematic especially for popular users like the default `admin` user.

This essentially means that for an attacker, it might be feasible to reconstruct a user's password given access to these hashes.

Note that attackers needing access to the hashes means that they must gain access to the database in which these are stored first to be able to start cracking the passwords.


### Patches

The problem is addressed in Opencast 8.1 which now uses the modern and much stronger bcrypt password hashing algorithm for storing passwords. Note, that old hashes remain MD5 until the password is updated.

For a list of users whose password hashes are stored using MD5, take a look at the `/user-utils/users/md5.json` REST endpoint.


### Workarounds

There is no workaround.

### References

- [MD5 (Wikipedia)](https://en.wikipedia.org/wiki/MD5)
- [bcrypt (Wikipedia)](https://en.wikipedia.org/wiki/Bcrypt)
- [How weak is MD5 as a password hashing function?](https://security.stackexchange.com/q/52461)


### For more information

If you have any questions or comments about this advisory:

- Open an issue in [opencast/opencast](https://github.com/opencast/opencast/issues)
- For security-relevant information, email us at security@opencast.org

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: Maven, name: org.opencastproject:opencast-common-jpa-impl, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 7.6
package: ecosystem: Maven, name: org.opencastproject:opencast-common-jpa-impl, ranges: type: ECOSYSTEM, events: introduced: 8.0
fixed: 8.1
Deserialization of Untrusted Data in Log4j
Advisory: GHSA-fxph-q3j8-mv87 (CVE-2017-5645)
Published: 2020-01-06T18:43:38Z

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: org.apache.logging.log4j:log4j, ranges: type: ECOSYSTEM, events: introduced: 2.0
fixed: 2.8.2
package: ecosystem: Maven, name: org.apache.logging.log4j:log4j-core, ranges: type: ECOSYSTEM, events: introduced: 2.0
fixed: 2.8.2
Users with ROLE_COURSE_ADMIN can create new users in Opencast
Advisory: GHSA-94qw-r73x-j7hg (CVE-2020-5231)
Published: 2020-01-30T21:21:37Z

### Impact

Users with the role `ROLE_COURSE_ADMIN` can use the user-utils endpoint to create new users not including the role `ROLE_ADMIN`. For example:

```bash
# Use the admin to create a new user with ROLE_COURSE_ADMIN using the admin user.
# We expect this to work.
% curl -i -u admin:opencast 'https://example.opencast.org/user-utils/xy.json' -X PUT \
  --data 'password=f&roles=%5B%22ROLE_COURSE_ADMIN%22%5D'
HTTP/2 201

# Use the new user to create more new users.
# We don't expüect a user with just role ROLE_COURSE_ADMIN to succeed.
# But it does work
% curl -i -u xy:f 'https://example.opencast.org/user-utils/ab.json' -X PUT \
  --data 'password=f&roles=%5B%22ROLE_COURSE_ADMIN%22%5D'
HTTP/2 201
```
`ROLE_COURSE_ADMIN` is a non-standard role in Opencast which is referenced neither in the documentation nor in any code (except for tests) but only in the security configuration. From the name – implying an admin for a specific course – users would never expect that this role allows user creation.

### Patches

This issue is fixed in 7.6 and 8.1 which both ship a new default security configuration.

### Workarounds

You can fix this issue by removing all instances of `ROLE_COURSE_ADMIN` in your organization's security configuration (`etc/security/mh_default_org.xml` by default).

### For more information

If you have any questions or comments about this advisory:

- Open an issue in [opencast/opencast](https://github.com/opencast/opencast/issues)
- For security-relevant information, email us at security@opencast.org

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Maven, name: org.opencastproject:opencast-kernel, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 7.6
package: ecosystem: Maven, name: org.opencastproject:opencast-kernel, ranges: type: ECOSYSTEM, events: introduced: 8.0
fixed: 8.1
Request smuggling is possible when both chunked TE and content length specified
Advisory: GHSA-xrr9-rh8p-433v (CVE-2020-5207)
Published: 2020-01-27T19:28:40Z

### Impact
Request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't handle alone \n as a headers separator.

### Patches
https://github.com/ktorio/ktor/pull/1547

### Workarounds
None except migrating to a better proxy.

### References
https://portswigger.net/web-security/request-smuggling
https://tools.ietf.org/html/rfc7230#section-9.5

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Maven, name: io.ktor:ktor-client-cio, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.3.0
package: ecosystem: Maven, name: io.ktor:ktor-server-cio, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.3.0
Cross-Site Scripting in node-red
Advisory: GHSA-8w65-xjc5-9w79 (CVE-2019-15607)
Published: 2020-01-30T21:00:21Z

Versions of `node-red` prior to 0.20.8are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize the `name` field in new Flows, allowing attackers to execute arbitrary JavaScript in the victim's browser.


## Recommendation

Upgrade to version 0.18.6 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: node-red, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.20.8, database_specific: last_known_affected_version_range: <= 0.20.7
XSS in enshrined/svg-sanitize due to mishandled script and data values in attributes
Advisory: GHSA-gf8j-v8x5-h9qp (CVE-2019-18857)
Published: 2020-01-08T17:15:37Z

enshrined/svg-sanitize before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript&#9;:alert substring.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: Packagist, name: enshrined/svg-sanitize, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.12.0
Uncontrolled resource consumption in validators Python package
Advisory: GHSA-5qcg-w2cc-xffw (CVE-2019-19588)
Published: 2020-01-21T20:32:09Z

The validators package 0.12.2 through 0.12.5 for Python enters an infinite loop when validators.domain is called with a crafted domain string. This is fixed in 0.12.6.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: PyPI, name: validators, ranges: type: ECOSYSTEM, events: introduced: 0.12.2
fixed: 0.12.6
The SafeHtml annotation in Hibernate-Validator does not properly guard against XSS attacks
Advisory: GHSA-m8p2-495h-ccmh (CVE-2019-10219)
Published: 2020-01-08T17:01:52Z

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected packages:
package: ecosystem: Maven, name: org.hibernate.validator:hibernate-validator, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.0.18
Session key exposure through session list in Django User Sessions
Advisory: GHSA-5fq8-3q2f-4m5g (CVE-2020-5224)
Published: 2020-01-24T19:56:59Z

### Impact
The views provided by django-user-sessions allow users to terminate specific sessions. The session key is used to identify sessions, and thus included in the rendered HTML. In itself this is not a problem. However if the website has an XSS vulnerability, the session key could be extracted by the attacker and a session takeover could happen.

### Patches
Patch is under way.

### Workarounds
Remove the session_key from the template.

### References
_None._

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Bouke/django-user-sessions](https://github.com/Bouke/django-user-sessions/issues)
* Email us at [bouke@haarsma.eu](mailto:bouke@haarsma.eu)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
Affected packages:
package: ecosystem: PyPI, name: django-user-sessions, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.7.1
XML external entity (XXE) processing ('external-parameter-entities' feature was not fully disabled))
Advisory: GHSA-763g-fqq7-48wg (CVE-2019-10782)
Published: 2020-01-31T18:00:07Z

Due to an incomplete fix for [CVE-2019-9658](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9658), checkstyle was still vulnerable to XML External Entity (XXE) Processing.

### Impact

#### User: Build Maintainers

This vulnerability probably doesn't impact Maven/Gradle users as, in most cases, these builds are processing files that are trusted, or pre-vetted by a pull request reviewer before being run on internal CI infrastructure.

#### User: Static Analysis as a Service

If you operate a site/service that parses "untrusted" Checkstyle XML configuration files, you are vulnerable to this and should patch.

Note from the discoverer of the original CVE-2019-9658:

> While looking at a few companies that run Checkstyle/PMD/ect... as a service I notice that it's a common pattern to run the static code analysis tool inside of a Docker container with the following flags:
> ```
> --net=none \
> --privileged=false \
> --cap-drop=ALL
> ```
> Running the analysis in Docker has the advantage that there should be no sensitive local file information that XXE can exfiltrate from the container. Additionally, these flags prevent vulnerabilities in static analysis tools like Checkstyle from being used to exfiltrate data via XXE or to perform SSRF.
> \- [Jonathan Leitschuh](https://twitter.com/jlleitschuh)

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Patched, will be released with version 8.29 at 26 Jan 2020.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

No workaround are available

### References

 - [CWE-611: Improper Restriction of XML External Entity Reference](https://cwe.mitre.org/data/definitions/611.html)
 - GitHub Issue https://github.com/checkstyle/checkstyle/issues/7468

### For more information

If you have any questions or comments about this advisory:
* Open an issue in https://github.com/checkstyle/checkstyle/issues


Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected packages:
package: ecosystem: Maven, name: com.puppycrawl.tools:checkstyle, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 8.29
Ability to switch channels via GET parameter enabled in production environments
Advisory: GHSA-prg5-hg25-8grq (CVE-2020-5218)
Published: 2020-01-31T18:00:58Z

### Impact

This vulnerability gives the ability to switch channels via the `_channel_code` GET parameter in production environments. This was meant to be enabled only when `%kernel.debug%` is set to true. 

However, if no `sylius_channel.debug` is set explicitly in the configuration, the default value which is `%kernel.debug%` will be not resolved and cast to boolean, enabling this debug feature even if that parameter is set to false.

### Patches

Patch has been provided for Sylius 1.3.x and newer - **1.3.16, 1.4.12, 1.5.9, 1.6.5**. Versions older than 1.3 are not covered by our security support anymore.

### Workarounds

Unsupported versions could be patched by adding the following configuration to run in production:

```yaml
sylius_channel:
    debug: false
```

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: sylius/sylius, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.3.16
package: ecosystem: Packagist, name: sylius/sylius, ranges: type: ECOSYSTEM, events: introduced: 1.4.0
fixed: 1.4.12
package: ecosystem: Packagist, name: sylius/sylius, ranges: type: ECOSYSTEM, events: introduced: 1.5
fixed: 1.5.9
package: ecosystem: Packagist, name: sylius/sylius, ranges: type: ECOSYSTEM, events: introduced: 1.6.0
fixed: 1.6.5
Improper implementation of the session fixation protection in Infinispan
Advisory: GHSA-6x3v-rw2q-9gx7 (CVE-2019-10158)
Published: 2020-01-21T21:18:44Z

A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: org.infinispan:infinispan-core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 9.4.15.Final
Log injection in SimpleSAMLphp
Advisory: GHSA-6gc6-m364-85ww (CVE-2020-5225)
Published: 2020-01-24T21:26:13Z

### Background

SimpleSAMLphp has a logging functionality that allows system administrators to keep track of the activity, errors, and statistics. Additionally, it allows users to report errors, shall they happen. An error report contains a report identifier, which is logged once submitted.

### Description

The `www/erroreport.php` script, which receives error reports and sends them via email to the system administrator, didn't properly sanitize the report identifier obtained from the request. This allows an attacker, under specific circumstances, to inject new log lines by manually crafting this report ID.

When configured to use the `file` logging handler, SimpleSAMLphp will output all its logs by appending each log line to a given file. Since the `reportID` parameter received in a request sent to `www/errorreport.php` was not properly sanitized, it was possible to inject newline characters into it, effectively allowing a malicious user to inject new log lines with arbitrary content.

### Affected versions

SimpleSAMLphp versions up to **1.18.3**.

### Impact

An attacker may use this issue to inject logs messages into a SimpleSAMLphp log file, trying to trick or confuse system administrators. However, the attack surface is considered small, as the attack will only work with the `file` logging handler, which opens the log file in _append-only_ mode. This means an attacker cannot edit or remove existing log messages, and even if non-ascii characters are written to the log, the file will always be readable with a simple text editor.

### Resolution

Upgrade the SimpleSAMLphp installation to version **1.18.4**.

### Credit

This vulnerability was discovered and reported by Frederic Vleminckx on January 23, 2020.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: simplesamlphp/simplesamlphp, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.18.4
Remote Code Execution in Angular Expressions
Advisory: GHSA-hxhm-96pp-2m43 (CVE-2020-5219)
Published: 2020-01-24T15:27:25Z

### Impact

The vulnerability, reported by GoSecure Inc, allows Remote Code Execution, if you call `expressions.compile(userControlledInput)` where `userControlledInput` is text that comes from user input.

* If running angular-expressions in the browser, an attacker could run any browser script when the application code calls expressions.compile(userControlledInput).
* If running angular-expressions on the server, an attacker could run any Javascript expression, thus gaining Remote Code Execution.

### Patches

Users should upgrade to version 1.0.1 of angular-expressions

### Workarounds

A temporary workaround might be either to : 

* disable user-controlled input that will be fed into angular-expressions in your application

OR

* allow only following characters in the userControlledInput : 

```js
if (/^[|a-zA-Z.0-9 :"'+-?]+$/.test(userControlledInput)) {
      var result = expressions.compile(userControlledInput);
}
else {
     result = undefined;
}
```

### References

[Removal of angular-expression sandbox](http://blog.angularjs.org/2016/09/angular-16-expression-sandbox-removal.html)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [angular-expressions](https://github.com/peerigon/angular-expressions/issues)
* [Email us](mailto:contact@javascript-ninja.fr)

### Credits 

The issue was reported by Maxime Nadeau from GoSecure, Inc.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: angular-expressions, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.0.1
Remote code execution in verot/class.upload.php
Advisory: GHSA-r5gm-4p5w-pq2p (CVE-2019-19576)
Published: 2020-01-16T22:17:40Z

class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Packagist, name: verot/class.upload.php, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.0.3
package: ecosystem: Packagist, name: verot/class.upload.php, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.4
SQL injection in phpMyAdmin
Advisory: GHSA-jgjc-332c-8cmc (CVE-2019-18622)
Published: 2020-01-16T21:56:15Z

An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Packagist, name: phpmyadmin/phpmyadmin, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.9.2
Segmentation faultin TensorFlow when converting a Python string to `tf.float16`
Advisory: GHSA-977j-xj7q-2jr9 (CVE-2020-5215)
Published: 2020-01-28T21:32:29Z

### Impact

Converting a string (from Python) to a `tf.float16` value results in a segmentation fault in eager mode as the format checks for this use case are only in the graph mode.

This issue can lead to denial of service in inference/training where a malicious attacker can send a data point which contains a string instead of a `tf.float16` value.

Similar effects can be obtained by manipulating saved models and checkpoints whereby replacing a scalar `tf.float16` value with a scalar string will trigger this issue due to automatic conversions.

This can be easily reproduced by `tf.constant("hello", tf.float16)`, if eager execution is enabled.

### Patches
We have patched the vulnerability in GitHub commit [5ac1b9](https://github.com/tensorflow/tensorflow/commit/5ac1b9e24ff6afc465756edf845d2e9660bd34bf).

We are additionally releasing TensorFlow 1.15.1 and 2.0.1 with this vulnerability patched.

TensorFlow 2.1.0 was released after we fixed the issue, thus it is not affected.

We encourage users to switch to TensorFlow 1.15.1, 2.0.1 or 2.1.0.

### For more information

Please consult [`SECURITY.md`](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
Affected packages:
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.15.2
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.1, versions: 2.0.0
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.15.2
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.1, versions: 2.0.0
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.15.2
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.1, versions: 2.0.0
Django Potential account hijack via password reset form
Advisory: GHSA-vfq6-hq5r-27r6 (CVE-2019-19844)
Published: 2020-01-16T22:35:12Z

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: PyPI, name: django, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.11.27
package: ecosystem: PyPI, name: django, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.2.9
package: ecosystem: PyPI, name: django, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 3.0.1