aswin1906/github-advisory-2020.csv huggingface dataset:
SQL injection in Centreon
Advisory: GHSA-wgjx-hm34-qgf7 (CVE-2019-16194)
Published: 2020-02-11T20:36:04Z

SQL injection vulnerabilities in Centreon through 19.04 allow attacks via the svc_id parameter in include/monitoring/status/Services/xml/makeXMLForOneService.php.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Packagist, name: centreon/centreon, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 18.10.8
package: ecosystem: Packagist, name: centreon/centreon, ranges: type: ECOSYSTEM, events: introduced: 19.0.0
fixed: 19.04.5
Inclusion of Sensitive Information in Log Files and Improper Output Neutralization for Logs in Ansible
Advisory: GHSA-3m93-m4q6-mc6v (CVE-2019-14864)
Published: 2020-02-26T19:54:31Z

Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: PyPI, name: ansible, ranges: type: ECOSYSTEM, events: introduced: 2.7.0
fixed: 2.7.16, database_specific: last_known_affected_version_range: <= 2.7.15
package: ecosystem: PyPI, name: ansible, ranges: type: ECOSYSTEM, events: introduced: 2.8.0
fixed: 2.8.8, database_specific: last_known_affected_version_range: <= 2.8.7
package: ecosystem: PyPI, name: ansible, ranges: type: ECOSYSTEM, events: introduced: 2.9.0
fixed: 2.9.2, database_specific: last_known_affected_version_range: <= 2.9.1
Private data exposure via REST API in BuddyPress
Advisory: GHSA-3j78-7m59-r7gv (CVE-2020-5244)
Published: 2020-02-24T17:18:26Z

In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed.

This has been patched in version 5.1.2.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: Packagist, name: buddypress/buddypress, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 5.1.2
Server-Side Request Forgery (SSRF) in Apache Olingo
Advisory: GHSA-v4qh-6367-4cx2 (CVE-2020-1925)
Published: 2020-02-04T22:38:38Z

Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It may allow to implement a SSRF attack. If an attacker tricks a client to connect to a malicious server, the server can make the client call any URL including internal resources which are not directly accessible by the attacker.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: Maven, name: org.apache.olingo:odata-client-core, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.7.1, database_specific: last_known_affected_version_range: <= 4.7.0
HTTP Request Smuggling in Netty
Advisory: GHSA-cqqj-4p63-rrmm (CVE-2019-20444)
Published: 2020-02-21T18:55:24Z

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: Maven, name: io.netty:netty-codec-http, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.1.44
package: ecosystem: Maven, name: org.jboss.netty:netty, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0, database_specific: last_known_affected_version_range: < 4.0.0
package: ecosystem: Maven, name: io.netty:netty, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0, database_specific: last_known_affected_version_range: < 4.0.0
URL Redirection to Untrusted Site (Open Redirect) in Ktor
Advisory: GHSA-xwgq-pcqx-hpmv (CVE-2019-19703)
Published: 2020-02-12T18:45:50Z

In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Maven, name: io.ktor:ktor-client-core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.3.0, database_specific: last_known_affected_version_range: <= 1.2.6
Improper Input Validation in Symfony
Advisory: GHSA-w4rc-rx25-8m86 (CVE-2019-11325)
Published: 2020-02-12T18:44:16Z

An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Packagist, name: symfony/symfony, ranges: type: ECOSYSTEM, events: introduced: 4.2.0
fixed: 4.2.12
package: ecosystem: Packagist, name: symfony/symfony, ranges: type: ECOSYSTEM, events: introduced: 4.3.0
fixed: 4.3.8
package: ecosystem: Packagist, name: symfony/var-exporter, ranges: type: ECOSYSTEM, events: introduced: 4.2.0
fixed: 4.2.12
package: ecosystem: Packagist, name: symfony/var-exporter, ranges: type: ECOSYSTEM, events: introduced: 4.3.0
fixed: 4.3.8
class.upload.php in verot.net omits .pht from the set of dangerous file extensions
Advisory: GHSA-2gc7-w4hw-rr2m (CVE-2019-19634)
Published: 2020-02-28T01:10:17Z

class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Packagist, name: verot/class.upload.php, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 1.0.3
package: ecosystem: Packagist, name: verot/class.upload.php, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
last_affected: 2.0.4
Users able to query database metadata in Apache Superset
Advisory: GHSA-p5w7-qmq6-pmjr (CVE-2019-12413)
Published: 2020-02-26T19:55:32Z

In Apache Incubator Superset before 0.31 user could query database metadata information from a database he has no access to, by using a specially crafted complex query.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected packages:
package: ecosystem: PyPI, name: apache-superset, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.31.0
OS command injection in git-diff-apply
Advisory: GHSA-84cm-v6jp-gjmr (CVE-2019-10776)
Published: 2020-02-14T23:09:24Z

In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to 0.22.2.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: git-diff-apply, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.22.2, database_specific: last_known_affected_version_range: <= 0.22.1
Improper input validation in Apache Olingo
Advisory: GHSA-477x-w7m6-c6ph (CVE-2019-17555)
Published: 2020-02-04T22:37:15Z

The AsyncResponseWrapperImpl class in Apache Olingo versions 4.0.0 to 4.6.0 reads the Retry-After header and passes it to the Thread.sleep() method without any check. If a malicious server returns a huge value in the header, then it can help to implement a DoS attack.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: Maven, name: org.apache.olingo:odata-client-core, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.7.0, database_specific: last_known_affected_version_range: <= 4.6.0
Improper authentication in Symfony
Advisory: GHSA-cchx-mfrc-fwqr (CVE-2019-10911)
Published: 2020-02-12T18:45:08Z

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Packagist, name: symfony/security-http, ranges: type: ECOSYSTEM, events: introduced: 2.7.0
fixed: 2.7.51
package: ecosystem: Packagist, name: symfony/security-http, ranges: type: ECOSYSTEM, events: introduced: 2.8.0
fixed: 2.8.50
package: ecosystem: Packagist, name: symfony/security-http, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 3.4.26
package: ecosystem: Packagist, name: symfony/security-http, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.1.12
package: ecosystem: Packagist, name: symfony/security-http, ranges: type: ECOSYSTEM, events: introduced: 4.2.0
fixed: 4.2.7
package: ecosystem: Packagist, name: symfony/security, ranges: type: ECOSYSTEM, events: introduced: 2.7.0
fixed: 2.7.51
package: ecosystem: Packagist, name: symfony/security, ranges: type: ECOSYSTEM, events: introduced: 2.8.0
fixed: 2.8.50
package: ecosystem: Packagist, name: symfony/security, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 3.4.26
package: ecosystem: Packagist, name: symfony/security, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.1.12
package: ecosystem: Packagist, name: symfony/security, ranges: type: ECOSYSTEM, events: introduced: 4.2.0
fixed: 4.2.7
package: ecosystem: Packagist, name: symfony/symfony, ranges: type: ECOSYSTEM, events: introduced: 2.7.0
fixed: 2.7.51
package: ecosystem: Packagist, name: symfony/symfony, ranges: type: ECOSYSTEM, events: introduced: 2.8.0
fixed: 2.8.50
package: ecosystem: Packagist, name: symfony/symfony, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 3.4.26
package: ecosystem: Packagist, name: symfony/symfony, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.1.12
package: ecosystem: Packagist, name: symfony/symfony, ranges: type: ECOSYSTEM, events: introduced: 4.2.0
fixed: 4.2.7
libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation
Advisory: GHSA-7553-jr98-vx47 (CVE-2020-7595)
Published: 2020-02-24T19:12:36Z

xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
The Nokogiri RubyGem has patched its vendored copy of libxml2 in order to prevent this issue from affecting nokogiri.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: RubyGems, name: nokogiri, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.10.8
XSS in dojox due to insufficient escape in dojox.xmpp.util.xmlEncode 
Advisory: GHSA-pg97-ww7h-5mjr (CVE-2019-10785)
Published: 2020-02-13T22:21:06Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

Potential XSS vulnerability for users of `dojox/xmpp` and `dojox/dtl`.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Yes, patches are available for the 1.11 through 1.16 versions. Users should upgrade to one of these versions of Dojo:

* 1.16.1
* 1.15.2
* 1.14.5
* 1.13.6
* 1.12.7
* 1.11.9

Users of Dojo 1.10.x and earlier should review this change and determine if it impacts them, and backport the change as appropriate.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

The change applied in https://github.com/dojo/dojox/pull/315 could get added separately as a patch.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [dojo/dojox](https://github.com/dojo/dojox/)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: dojox, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.11.9
package: ecosystem: npm, name: dojox, ranges: type: ECOSYSTEM, events: introduced: 1.12.0
fixed: 1.12.7
package: ecosystem: npm, name: dojox, ranges: type: ECOSYSTEM, events: introduced: 1.13.0
fixed: 1.13.6
package: ecosystem: npm, name: dojox, ranges: type: ECOSYSTEM, events: introduced: 1.14.0
fixed: 1.14.5
package: ecosystem: npm, name: dojox, ranges: type: ECOSYSTEM, events: introduced: 1.15.0
fixed: 1.15.2
package: ecosystem: npm, name: dojox, ranges: type: ECOSYSTEM, events: introduced: 1.16.0
fixed: 1.16.1, versions: 1.16.0
Potential HTTP request smuggling in Apache Tomcat
Advisory: GHSA-qxf4-chvg-4r8r (CVE-2020-1935)
Published: 2020-02-28T01:10:48Z

In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected packages:
package: ecosystem: Maven, name: org.apache.tomcat.embed:tomcat-embed-core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 7.0.100
package: ecosystem: Maven, name: org.apache.tomcat.embed:tomcat-embed-core, ranges: type: ECOSYSTEM, events: introduced: 8.0.0
fixed: 8.5.51
package: ecosystem: Maven, name: org.apache.tomcat.embed:tomcat-embed-core, ranges: type: ECOSYSTEM, events: introduced: 9.0.0
fixed: 9.0.31
package: ecosystem: Maven, name: org.apache.tomcat:tomcat, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 7.0.100
package: ecosystem: Maven, name: org.apache.tomcat:tomcat, ranges: type: ECOSYSTEM, events: introduced: 8.0.0
fixed: 8.5.51
package: ecosystem: Maven, name: org.apache.tomcat:tomcat, ranges: type: ECOSYSTEM, events: introduced: 9.0.0
fixed: 9.0.31
Catastrophic backtracking in regex allows Denial of Service in Waitress
Advisory: GHSA-73m2-3pwg-5fgc (CVE-2020-5236)
Published: 2020-02-04T03:07:31Z

### Impact

When waitress receives a header that contains invalid characters it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and blocking any other interactions.

This would allow an attacker to send a single request with an invalid header and take the service offline.

Invalid header example:

```
Bad-header: xxxxxxxxxxxxxxx\x10
```

Increasing the number of `x`'s in the header will increase the amount of time Waitress spends in the regular expression engine.

This issue was introduced in version 1.4.2 when the regular expression was updated to attempt to match the behaviour required by errata associated with RFC7230.

### Patches

The regular expression that is used to validate incoming headers has been updated in version 1.4.3, it is recommended that people upgrade to the new version of Waitress as soon as possible.

### Workarounds

If you have deployed a reverse proxy in front of Waitress it may already be rejecting requests that include invalid headers.

### Thanks

The Pylons Project would like to thank [Fil Zembowicz](https://github.com/fzembow) for reaching out and disclosing this vulnerability!

### References

Catastrophic backtracking explained: https://www.regular-expressions.info/catastrophic.html

### For more information
If you have any questions or comments about this advisory:

- open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related)
- email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: PyPI, name: waitress, ecosystem_specific: affected_functions: waitress.rfc7230.FIELD_CONTENT, waitress.rfc7230.FIELD_VALUE, waitress.rfc7230.OWS_STRIP, ranges: type: ECOSYSTEM, events: introduced: 1.4.2
fixed: 1.4.3, versions: 1.4.2
SQL injection in Django
Advisory: GHSA-hmr4-m2h5-33qx (CVE-2020-7471)
Published: 2020-02-11T21:03:20Z

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: PyPI, name: django, ecosystem_specific: affected_functions: django.contrib.postgres.aggregates.StringAgg, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.11.28
package: ecosystem: PyPI, name: django, ecosystem_specific: affected_functions: django.contrib.postgres.aggregates.StringAgg, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.2.10
package: ecosystem: PyPI, name: django, ecosystem_specific: affected_functions: django.contrib.postgres.aggregates.StringAgg, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 3.0.3
Reflected XSS in SilverStripe
Advisory: GHSA-qvrv-2x7x-78x2 (CVE-2019-19325)
Published: 2020-02-24T17:33:31Z

SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms. Silverstripe Forms allow malicious HTML or JavaScript to be inserted through non-scalar FormField attributes, which allows performing XSS (Cross-Site Scripting) on some forms built with user input (Request data). This can lead to phishing attempts to obtain a user&amp;#39;s credentials or other sensitive user input.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: silverstripe/framework, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.4.5
package: ecosystem: Packagist, name: silverstripe/framework, ranges: type: ECOSYSTEM, events: introduced: 4.5.0
fixed: 4.5.2
Improper Restriction of XML External Entity Reference in Apache Olingo
Advisory: GHSA-mgh8-hcwj-h57v (CVE-2019-17554)
Published: 2020-02-04T22:37:43Z

The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: Maven, name: org.apache.olingo:odata-client-core, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.7.0, database_specific: last_known_affected_version_range: <= 4.6.0
package: ecosystem: Maven, name: org.apache.olingo:odata-server-core, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.7.0, database_specific: last_known_affected_version_range: <= 4.6.0
OS command injection in aws-lambda
Advisory: GHSA-934x-72xh-5hrg (CVE-2019-10777)
Published: 2020-02-14T23:09:45Z

In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName".

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: aws-lambda, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.0.5, database_specific: last_known_affected_version_range: <= 1.0.4
BibTeX-Ruby vulnerable to OS command injection
Advisory: GHSA-c5r5-7pfh-6qg6 (CVE-2019-10780)
Published: 2020-02-14T23:10:01Z

BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby `Kernel.open` method through BibTeX.open.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: RubyGems, name: bibtex-ruby, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 5.1.0, database_specific: last_known_affected_version_range: <= 5.0.1
Improper input validation in Apache Shiro
Advisory: GHSA-r679-m633-g7wc (CVE-2019-12422)
Published: 2020-02-04T22:36:36Z

Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: Maven, name: org.apache.shiro:shiro-core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.4.2
Improper Restriction of XML External Entity Reference in jackson-mapper-asl
Advisory: GHSA-r6j9-8759-g62w (CVE-2019-10172)
Published: 2020-02-04T22:39:19Z

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar to CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: Maven, name: org.codehaus.jackson:jackson-mapper-asl, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 1.9.13
Information disclosure in Apache Superset
Advisory: GHSA-fxjm-wvj9-9c39 (CVE-2020-1932)
Published: 2020-02-26T19:54:57Z

An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. Authenticated Apache Superset users are able to retrieve other users' information, including hashed passwords, by accessing an unused and undocumented API endpoint on Apache Superset.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: PyPI, name: apache-superset, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.34.0
fixed: 0.35.2
XSS/Script injection vulnerability in matestack
Advisory: GHSA-3jqw-vv45-mjhh (CVE-2020-5241)
Published: 2020-02-12T23:37:46Z

matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XSS/Script injection.

This vulnerability is patched in version 0.7.4.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: RubyGems, name: matestack-ui-core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.7.4
OS Command Injection in Rake
Advisory: GHSA-jppv-gw3r-w3q8 (CVE-2020-8130)
Published: 2020-02-28T16:54:36Z

There is an OS command injection vulnerability in Ruby Rake before 12.3.3 in `Rake::FileList` when supplying a filename that begins with the pipe character `|`.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: RubyGems, name: rake, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 12.3.3, database_specific: last_known_affected_version_range: <= 12.3.2
TaffyDB can allow access to any data items in the DB
Advisory: GHSA-mxhp-79qh-mcx6 (CVE-2019-10790)
Published: 2020-02-19T16:43:42Z

TaffyDB allows attackers to forge adding additional properties into user-input processed by taffy which can allow access to any data items in the DB. Taffy sets an internal index for each data item in its DB. However, it is found that the internal index can be forged by adding additional properties into user-input. If index is found in the query, TaffyDB will ignore other query conditions and directly return the indexed data item. Moreover, the internal index is in an easily-guessable format (e.g., T000002R000001). As such, attackers can use this vulnerability to access any data items in the DB. **Note:** `taffy` and its successor package `taffydb` are not maintained.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: taffy, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 2.6.2
package: ecosystem: npm, name: taffydb, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 2.7.3
Command Injection in node-df
Advisory: GHSA-wp7m-mrvf-599c (CVE-2019-15597)
Published: 2020-02-14T23:09:10Z

All versions of `node-df` are vulnerable to Command Injection. The package fails to sanitize filenames passed to the  `file` option. If this value is user-controlled it  may allow attackers to run arbitrary commands in the server.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: node-df, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 0.1.4
Sanitizer bypass in svg-sanitizer
Advisory: GHSA-8rc5-hx3v-2jg7 (CVE-2019-10772)
Published: 2020-02-27T20:36:29Z

It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by the sanitizer.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: enshrined/svg-sanitize, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.13.1
Denial of Service in uap-core when processing crafted User-Agent strings
Advisory: GHSA-cmcx-xhr8-3w9p (CVE-2020-5243)
Published: 2020-02-20T23:26:10Z

### Impact

Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.

### Patches

Please update uap-core to &amp;amp;gt;= v0.7.3

Downstream packages such as uap-python, uap-ruby etc which depend upon uap-core follow different version schemes.

### Details

Each vulnerable regular expression reported here contains 3 overlapping capture groups. Backtracking has approximately cubic time complexity with respect to the length of the user-agent string.

#### Regex 1:

```
\bSmartWatch *\( *([^;]+) *; *([^;]+) *;
```

is vulnerable in portion ` *([^;]+) *` and can be attacked with

```python
&amp;amp;quot;SmartWatch(&amp;amp;quot; + (&amp;amp;quot; &amp;amp;quot; * 3500) + &amp;amp;quot;z&amp;amp;quot;
```
e.g.
```
SmartWatch(                                   z
```


#### Regex 2:

```
; *([^;/]+) Build[/ ]Huawei(MT1-U06|[A-Z]+\d+[^\);]+)[^\);]*\)
```

is vulnerable in portion `\d+[^\);]+[^\);]*` and can be attacked with

```python
&amp;amp;quot;;A Build HuaweiA&amp;amp;quot; + (&amp;amp;quot;4&amp;amp;quot; * 3500) + &amp;amp;quot;z&amp;amp;quot;
```


#### Regex 3:

```
(HbbTV)/[0-9]+\.[0-9]+\.[0-9]+ \([^;]*; *(LG)E *; *([^;]*) *;[^;]*;[^;]*;\)
```

is vulnerable in portion ` *([^;]*) *` and can be attacked with

```python
&amp;amp;quot;HbbTV/0.0.0 (;LGE;&amp;amp;quot; + (&amp;amp;quot; &amp;amp;quot; * 3500) + &amp;amp;quot;z&amp;amp;quot;
```

#### Regex 4:

```
(HbbTV)/[0-9]+\.[0-9]+\.[0-9]+ \([^;]*; *(?:CUS:([^;]*)|([^;]+)) *; *([^;]*) *;.*;
```

is vulnerable in portions ` *(?:CUS:([^;]*)|([^;]+)) *` and ` *([^;]*) *` and can be attacked with

```python
&amp;amp;quot;HbbTV/0.0.0 (;CUS:;&amp;amp;quot; + (&amp;amp;quot; &amp;amp;quot; * 3500) + &amp;amp;quot;z&amp;amp;quot;
&amp;amp;quot;HbbTV/0.0.0 (;&amp;amp;quot; + (&amp;amp;quot; &amp;amp;quot; * 3500) + &amp;amp;quot;z&amp;amp;quot;
&amp;amp;quot;HbbTV/0.0.0 (;z;&amp;amp;quot; + (&amp;amp;quot; &amp;amp;quot; * 3500) + &amp;amp;quot;z&amp;amp;quot;
```

Reported by Ben Caller @bcaller

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: npm, name: uap-core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.7.3
package: ecosystem: RubyGems, name: user_agent_parser, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.6.0
discord-html not escaping HTML code blocks when lacking a language identifier
Advisory: GHSA-9r27-994c-4xch ()
Published: 2020-02-24T17:34:02Z

### Impact
Any website using discord-markdown with user-generated markdown is vulnerable to having code injected into the page where the markdown is displayed.

### Patches
This has been patched in version 2.3.1

### Workarounds
Escape the characters `&lt;&gt;&amp;` before sending plain code blocks to discord-markdown.

### References
https://github.com/brussell98/discord-markdown/issues/13

Affected packages:
package: ecosystem: npm, name: discord-markdown, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.3.1
Users can view database names in Apache Superset
Advisory: GHSA-9c29-9h4m-wg5p (CVE-2019-12414)
Published: 2020-02-26T19:55:14Z

In Apache Incubator Superset before 0.32, a user can view database names that he has no access to on a dropdown list in SQLLab

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected packages:
package: ecosystem: PyPI, name: apache-superset, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.32.0
Deserialization of untrusted data in Symfony
Advisory: GHSA-w2fr-65vp-mxw3 (CVE-2019-10912)
Published: 2020-02-12T18:44:50Z

In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Affected packages:
package: ecosystem: Packagist, name: symfony/cache, ranges: type: ECOSYSTEM, events: introduced: 3.1.0
fixed: 3.4.26
package: ecosystem: Packagist, name: symfony/cache, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.1.12
package: ecosystem: Packagist, name: symfony/cache, ranges: type: ECOSYSTEM, events: introduced: 4.2.0
fixed: 4.2.7
package: ecosystem: Packagist, name: symfony/phpunit-bridge, ranges: type: ECOSYSTEM, events: introduced: 2.8.0
fixed: 2.8.50
package: ecosystem: Packagist, name: symfony/phpunit-bridge, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 3.4.26
package: ecosystem: Packagist, name: symfony/phpunit-bridge, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.1.12
package: ecosystem: Packagist, name: symfony/phpunit-bridge, ranges: type: ECOSYSTEM, events: introduced: 4.2.0
fixed: 4.2.7
package: ecosystem: Packagist, name: symfony/symfony, ranges: type: ECOSYSTEM, events: introduced: 2.8.0
fixed: 2.8.50
package: ecosystem: Packagist, name: symfony/symfony, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 3.4.26
package: ecosystem: Packagist, name: symfony/symfony, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.1.12
package: ecosystem: Packagist, name: symfony/symfony, ranges: type: ECOSYSTEM, events: introduced: 4.2.0
fixed: 4.2.7
HTTP Request Smuggling in Netty
Advisory: GHSA-p2v9-g2qv-p635 (CVE-2019-20445)
Published: 2020-02-21T18:55:04Z

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

Affected packages:
package: ecosystem: Maven, name: io.netty:netty-handler, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.1.45
package: ecosystem: Maven, name: org.jboss.netty:netty, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0, database_specific: last_known_affected_version_range: < 4.0.0
package: ecosystem: Maven, name: io.netty:netty, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0, database_specific: last_known_affected_version_range: < 4.0.0
AngularJS Cross-site Scripting due to failure to sanitize `xlink.href` attributes
Advisory: GHSA-r5fx-8r73-v86c (CVE-2019-14863)
Published: 2020-02-14T23:08:49Z

Versions of `angular` prior to 1.5.0-beta.1 are vulnerable to Cross-Site Scripting. The package fails to sanitize `xlink:href` attributes, which may allow attackers to execute arbitrary JavaScript in a victim's browser if the value is user-controlled.


## Recommendation

Upgrade to version 1.5.0-beta.1 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: angular, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.5.0-beta.1
Relative Path Traversal (CWE-23) in chunked uploads in oneup/uploader-bundle
Advisory: GHSA-x8wj-6m73-gfqp (CVE-2020-5237)
Published: 2020-02-18T18:59:24Z

### Impact
The vulnerability was identified in the web service for a chunked file
upload. While the names of the POST parameters vary with the used
frontend, their values are always used in the same way to build a path
where the chunks are stored and assembled temporarily. By not validating
these parameters properly, OneupUploaderBundle is susceptible to a path
traversal vulnerability which can be exploited to upload files to
arbitrary folders on the filesystem. The assembly process can further be
misused with some restrictions to delete and copy files to other
locations.

The vulnerability can be exploited by any users that have legitimate
access to the upload functionality and can lead to arbitrary code
execution, denial of service and disclosure of confidential information.

### Patches
Yes, see version 1.9.3 and 2.1.5.

### References
https://owasp.org/www-community/attacks/Path_Traversal

### Credits:
This security vulnerability was found by Thibaud Kehler of SySS GmbH.
E-Mail: thibaud.kehler@syss.de

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Packagist, name: oneup/uploader-bundle, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.9.3
package: ecosystem: Packagist, name: oneup/uploader-bundle, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.1.5
Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled.
Advisory: GHSA-94vp-rmqv-5875 (CVE-2020-15247)
Published: 2020-11-23T19:48:27Z

### Impact
An authenticated backend user with the `cms.manage_pages`, `cms.manage_layouts`, or `cms.manage_partials` permissions who would **normally** not be permitted to provide PHP code to be executed by the CMS due to `cms.enableSafeMode` being enabled is able to write specific Twig code to escape the Twig sandbox and execute arbitrary PHP.

This is not a problem for anyone that trusts their users with those permissions to normally write & manage PHP within the CMS by not having `cms.enableSafeMode` enabled, but would be a problem for anyone relying on `cms.enableSafeMode` to ensure that users with those permissions in production do not have access to write & execute arbitrary PHP.

### Patches
Issue has been patched in Build 469 (v1.0.469) and v1.1.0.

### Workarounds
Apply https://github.com/octobercms/october/compare/106daa2930de4cebb18732732d47d4056f01dd5b...7cb148c1677373ac30ccfd3069d18098e403e1ca to your installation manually if unable to upgrade to Build 469.

### References
Reported by [ka1n4t](https://github.com/ka1n4t)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1108" alt="Screen Shot 2020-10-10 at 1 21 13 PM" src="https://user-images.githubusercontent.com/7253840/95663316-7de28b80-0afb-11eb-999d-a6526cf78709.png">

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Affected packages:
package: ecosystem: Packagist, name: october/cms, ranges: type: ECOSYSTEM, events: introduced: 1.0.319
fixed: 1.0.469
Bypass of fix for CVE-2020-15247, Twig sandbox escape
Advisory: GHSA-r89v-cgv7-3jhx (CVE-2020-26231)
Published: 2020-11-23T20:54:18Z

### Impact
A bypass of CVE-2020-15247 (fixed in 1.0.469 and 1.1.0) was discovered that has the same impact as CVE-2020-15247:

An authenticated backend user with the `cms.manage_pages`, `cms.manage_layouts`, or `cms.manage_partials` permissions who would **normally** not be permitted to provide PHP code to be executed by the CMS due to `cms.enableSafeMode` being enabled is able to write specific Twig code to escape the Twig sandbox and execute arbitrary PHP.

This is not a problem for anyone that trusts their users with those permissions to normally write & manage PHP within the CMS by not having `cms.enableSafeMode` enabled, but would be a problem for anyone relying on `cms.enableSafeMode` to ensure that users with those permissions in production do not have access to write & execute arbitrary PHP.

### Patches
Issue has been patched in Build 470 (v1.0.470) and v1.1.1.

### Workarounds
Apply https://github.com/octobercms/october/commit/d34fb8ab51108495a9a651b841202d935f4e12f7 to your installation manually if unable to upgrade to Build 470 or v1.1.1.

### References
Reported by [ka1n4t](https://github.com/ka1n4t)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1108" alt="Screen Shot 2020-10-10 at 1 21 13 PM" src="https://user-images.githubusercontent.com/7253840/95663316-7de28b80-0afb-11eb-999d-a6526cf78709.png">

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Affected packages:
package: ecosystem: Packagist, name: october/cms, ranges: type: ECOSYSTEM, events: introduced: 1.0.469
fixed: 1.0.470, versions: 1.0.469
Persistent XSS in shopping worlds
Advisory: GHSA-28fw-88hq-6jmm ()
Published: 2020-11-13T18:26:03Z

### Impact
Persistent XSS in shopping worlds

### Patches

We recommend updating to the current version 5.6.9. You can get the update to 5.6.9 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-11-2020

Affected packages:
package: ecosystem: Packagist, name: shopware/shopware, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 5.6.9
Implementation trusts the "me" field returned by the authorization server without verifying it
Advisory: GHSA-mjcr-rqjg-rhg3 ()
Published: 2020-11-24T21:21:04Z

### Impact

A malicious user can sign in as a user with any IndieAuth identifier. This is because the implementation does not verify that the final `"me"` URL value returned by the authorization server belongs to the same domain as the initial value entered by the user.

### Patches

Version 1.1 fixes this issue.

### Workarounds

There is no workaround. Upgrade to 1.1 immediately.

### References

- [Security Considerations: Differing User Profile URLs](https://indieauth.spec.indieweb.org/#differing-user-profile-urls-li-1) in the IndieAuth specification.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [simonw/datasette-indieauth](https://github.com/simonw/datasette-indieauth/issues)

Affected packages:
package: ecosystem: PyPI, name: datasette-indieauth, ecosystem_specific: affected_functions: datasette_indieauth.indieauth_page, datasette_indieauth.indieauth_done, ranges: type: ECOSYSTEM, events: introduced: 1.0
fixed: 1.1, versions: 1.0
Vulnerability in RPKI manifest validation
Advisory: GHSA-q76j-58cx-wp5v ()
Published: 2020-11-13T17:28:49Z


A vulnerability in RPKI manifest validation exists when objects on the manifest are hidden, or expired objects are replayed. An attacker successfully exploiting this vulnerability could prevent new ROAs from being received or selectively hide ROAs, causing routes to become INVALID.

To exploit this vulnerability, an attacker would need to perform a man in the middle attack on the TLS connection between the validator and an RRDP repository or perform a man in the middle attack against a rsync-only repository.

The update addresses the vulnerability by implementing validation methods from [RFC 6486bis](https://datatracker.ietf.org/doc/draft-ietf-sidrops-6486bis/00/) and enabling strict validation by default.

Affected packages:
package: ecosystem: Maven, name: net.ripe.rpki:rpki-validator-3, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.2-2020.10.28.23.06, database_specific: last_known_affected_version_range: <= 3.2-2020.10.28.22.25
remote code execution via cache action in MoinMoin
Advisory: GHSA-52q8-877j-gghq (CVE-2020-25074)
Published: 2020-11-11T15:54:51Z

### Impact
The cache action in action/cache.py allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to
the wiki can use this to achieve remote code execution.

### Patches
Users are strongly advised to upgrade to a patched version.

MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.

### Workarounds
It is not advised to work around this, but to upgrade MoinMoin to a patched version.

That said, a work around via disabling the `cache` or the `AttachFile` action might be possible.

Also, it is of course helpful if you give `write` permissions (which include uploading attachments) only to trusted users.

### Credits

This vulnerability was discovered by Michael Chapman.

### For more information
If you have any questions or comments about this advisory, email me at [twaldmann@thinkmo.de](mailto:twaldmann@thinkmo.de).

Affected packages:
package: ecosystem: PyPI, name: moin, ecosystem_specific: affected_functions: moin.action.cache.execute, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.9.11
Remote code execution in dependabot-core branch names when cloning
Advisory: GHSA-23f7-99jx-m54r (CVE-2020-26222)
Published: 2020-11-13T15:47:50Z

### Impact
Remote code execution vulnerability in `dependabot-common` and  `dependabot-go_modules` when a source branch name contains malicious injectable bash code.

For example, if Dependabot is configured to use the following source branch name: `"/$({curl,127.0.0.1})"`, Dependabot will make a HTTP request to the following URL: 127.0.0.1 when cloning the source repository.

When Dependabot is configured to clone the source repository during an update, Dependabot runs a shell command to git clone the repository:

```bash
git clone --no-tags --no-recurse-submodules --depth=1 --branch=<BRANCH> --single-branch <GITHUB_REPO_URL> repo/contents/path
```

Dependabot will always clone the source repository for `go_modules` during the file fetching step and can be configured to clone the repository for other package managers using the `FileFetcher` class from `dependabot-common`.

```ruby
source = Dependabot::Source.new(
  provider: "github",
  repo: "repo/name",
  directory: "/",
  branch: "/$({curl,127.0.0.1})",
)

repo_contents_path = "./file/path"
fetcher = Dependabot::FileFetchers.for_package_manager("bundler").
                  new(source: source, credentials: [],
                  repo_contents_path: repo_contents_path)
fetcher.clone_repo_contents
```

### Patches

The fix was applied to version `0.125.1`: https://github.com/dependabot/dependabot-core/pull/2727

### Workarounds
Escape the branch name prior to passing it to the `Dependabot::Source` class.

For example using `shellwords`:

```ruby
require "shellwords"
branch = Shellwords.escape("/$({curl,127.0.0.1})")
source = Dependabot::Source.new(
  provider: "github",
  repo: "repo/name",
  directory: "/",
  branch: branch,
)
```

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: RubyGems, name: dependabot-omnibus, ranges: type: ECOSYSTEM, events: introduced: 0.119.0.beta1
fixed: 0.125.1
package: ecosystem: RubyGems, name: dependabot-common, ranges: type: ECOSYSTEM, events: introduced: 0.119.0.beta1
fixed: 0.125.1
Template injection in cron-utils
Advisory: GHSA-pfj3-56hm-jwq5 (CVE-2020-26238)
Published: 2020-11-24T23:48:38Z

### Impact
A Template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron annotation to validate untrusted Cron expressions are affected.

### Patches
The issue was patched and a new version released. Please upgrade to version 9.1.3.

### Workarounds
There are no known workarounds up to this moment.

### References
A description of the issue is provided in [issue 461](https://github.com/jmrozanec/cron-utils/issues/461)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [cron-utils Github repository](https://github.com/jmrozanec/cron-utils)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: Maven, name: com.cronutils:cron-utils, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 9.1.3
Memory leak in Nanopb
Advisory: GHSA-85rr-4rh9-hhwh (CVE-2020-26243)
Published: 2020-11-25T16:53:27Z

### Impact
Decoding specifically formed message can leak memory if dynamic allocation is enabled and an oneof field contains a static submessage that contains a dynamic field, and the message being decoded contains the submessage multiple times. This is rare in normal messages, but it is a concern when untrusted data is parsed.

### Patches
Preliminary patch is [available on git](https://github.com/nanopb/nanopb/commit/edf6dcbffee4d614ac0c2c1b258ab95185bdb6e9) and problem will be patched in versions 0.3.9.7 and 0.4.4 once testing has been completed.

### Workarounds
Following workarounds are available:
* Set the option `no_unions` for the oneof field. This will generate fields as separate instead of C union, and avoids triggering the problematic code.
* Set the type of the submessage field inside oneof to `FT_POINTER`. This way the whole submessage will be dynamically allocated and the problematic code is not executed.
* Use an arena allocator for nanopb, to make sure all memory can be released afterwards.

### References
Bug report: https://github.com/nanopb/nanopb/issues/615

### For more information
If you have any questions or comments about this advisory, comment on the bug report linked above.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: PyPI, name: nanopb, ranges: type: ECOSYSTEM, events: introduced: 0.3.2
fixed: 0.3.9.7, database_specific: last_known_affected_version_range: <= 0.3.9.6
package: ecosystem: PyPI, name: nanopb, ranges: type: ECOSYSTEM, events: introduced: 0.4.0
fixed: 0.4.4
datasette-graphql leaks details of the schema of private database files
Advisory: GHSA-74hv-qjjq-h7g5 ()
Published: 2020-11-24T22:59:08Z

### Impact

When running against a Datasette instance with private databases, `datasette-graphql` would expose the schema of those database tables - but not the table contents.

### Patches

Patched in version 1.2.

### Workarounds

This issue is only present if a Datasette instance that includes private databases and has the `datasette-graphql` plugin installed is available on the public internet. Uninstalling the `datasette-graphql` plugin or preventing public access to the instance can workaround this issue.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [datasette-graphql](https://github.com/simonw/datasette-graphql)
* Contact [@simonw](https://twitter.com/simonw) by Twitter direct message

Affected packages:
package: ecosystem: PyPI, name: datasette-graphql, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.2