aswin1906/github-advisory-2021.csv huggingface dataset:
OS command injection in ripgrep
Published: 2021-08-05T19:31:55Z
Aliases: CVE-2021-3013

ripgrep before 13 on Windows allows attackers to trigger execution of arbitrary programs from the current working directory via the -z/--search-zip or --pre flag.
Unexpected panic when decoding tokens in branca
Published: 2021-08-25T20:49:50Z
Aliases: CVE-2020-35918

Prior to 0.10.0 it was possible to have both decoding functions panic unexpectedly, by supplying tokens with an incorrect base62 encoding.
The documentation stated that an error should have been reported instead.
Uncaught Exception in jsoup
Published: 2021-08-23T19:42:38Z
Aliases: CVE-2021-37714

### Impact
_What kind of vulnerability is it? Who is impacted?_
Those using jsoup to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack.

### Patches
_Has the problem been patched? What versions should users upgrade to?_
Users should upgrade to jsoup 1.14.2

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
Users may rate limit input parsing. Users should limit the size of inputs based on system resources. Users should implement thread watchdogs to cap and timeout parse runtimes.
Double free in insert_many
Published: 2021-08-25T20:55:06Z
Aliases: CVE-2021-29933

An issue was discovered in the insert_many crate through 2021-01-26 for Rust. Elements may be dropped twice if a .next() method panics.
Format string vulnerabilities in pancurses
Published: 2021-08-25T20:58:27Z
Aliases: CVE-2019-15546

An issue was discovered in the pancurses crate through 0.16.1 for Rust. printw and mvprintw have format string vulnerabilities.
Mishandling of format strings in rusqlite
Published: 2021-08-25T20:47:18Z
Aliases: CVE-2020-35869

An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because rusqlite::trace::log mishandles format strings.
smallvec creates uninitialized value of any type
Published: 2021-08-25T21:00:25Z

Affected versions of this crate called `mem::uninitialized()` to create values of a user-supplied type `T`.
This is unsound e.g. if `T` is a reference type (which must be non-null and thus may not remain uninitialized).
 
The flaw was corrected by avoiding the use of `mem::uninitialized()`, using `MaybeUninit` instead.
Missing release of memory in sized-chunks
Published: 2021-08-25T20:45:58Z
Aliases: CVE-2020-25794

An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, clone can have a memory-safety issue upon a panic.
Injection in MockServer
Published: 2021-08-30T16:24:38Z
Aliases: CVE-2021-32827

MockServer is open source software which enables easy mocking of any system you integrate with via HTTP or HTTPS. An attacker that can trick a victim into visiting a malicious site while running MockServer locally, will be able to run arbitrary code on the MockServer machine. With an overly broad default CORS configuration MockServer allows any site to send cross-site requests. Additionally, MockServer allows you to create dynamic expectations using Javascript or Velocity templates. Both engines may allow an attacker to execute arbitrary code on-behalf of MockServer. By combining these two issues (Overly broad CORS configuration + Script injection), an attacker could serve a malicious page so that if a developer running MockServer visits it, they will get compromised. For more details including a PoC see the referenced GHSL-2021-059.
Data races in lexer
Published: 2021-08-25T20:58:09Z
Aliases: CVE-2020-36458

lexer is a plugin based lexical reader.Affected versions of this crate implements Sync for ReaderResult<T, E> with the trait bound T: Send, E: Send. Since matching on the public enum ReaderResult<T, E> provides access to &T & &E, allowing data race to a non-Sync type T or E. This can result in a memory corruption when multiple threads concurrently access &T or &E. Suggested fix for the bug is change the trait bounds imposed on T & E to be T: Sync, E: Sync.
WITHDRAWN
Published: 2021-08-25T21:00:30Z

WITHDRAWN
use-after-free vulnerability in Rust array-queue
Published: 2021-08-25T21:00:43Z
Aliases: CVE-2020-35900

An issue was discovered in the array-queue crate through 2020-09-26 for Rust. A pop_back() call may lead to a use-after-free.
Arbitrary code execution due to YAML deserialization
Published: 2021-08-25T14:41:12Z
Aliases: CVE-2021-37678

### Impact
TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format.

```python
from tensorflow.keras import models

payload = '''
!!python/object/new:type
args: ['z', !!python/tuple [], {'extend': !!python/name:exec }]
listitems: "__import__('os').system('cat /etc/passwd')"
'''
  
models.model_from_yaml(payload)
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/python/keras/saving/model_config.py#L66-L104) uses `yaml.unsafe_load` which can perform arbitrary code execution on the input.

### Patches
Given that YAML format support requires a significant amount of work, we have removed it for now.

We have patched the issue in GitHub commit [23d6383eb6c14084a8fc3bdf164043b974818012](https://github.com/tensorflow/tensorflow/commit/23d6383eb6c14084a8fc3bdf164043b974818012).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information 
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Arjun Shibu.
Remote code execution in ChakraCore
Published: 2021-08-02T17:29:01Z
Aliases: CVE-2020-1172

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-1057, CVE-2020-1180.
Data races in multiqueue
Published: 2021-08-25T20:59:56Z

Affected versions of multiqueue unconditionally implemented `Send` for types used in queue implementations (`InnerSend<RW, T>`, `InnerRecv<RW, T>`, `FutInnerSend<RW, T>`, `FutInnerRecv<RW, T>`). This allows users to send non-Send types to other threads, which can lead to data race bugs or other undefined behavior.
Memory exhaustion in asn1_der
Published: 2021-08-25T20:44:56Z
Aliases: CVE-2019-15549

An issue was discovered in the asn1_der crate before 0.6.2 for Rust. Attackers can trigger memory exhaustion by supplying a large value in a length field.
`CHECK`-fail in `MapStage`
Published: 2021-08-25T14:41:36Z
Aliases: CVE-2021-37673

### Impact
An attacker can trigger a denial of service via a `CHECK`-fail in `tf.raw_ops.MapStage`:

```python
import tensorflow as tf
  
tf.raw_ops.MapStage(
  key=tf.constant([], shape=[0, 0, 0, 0], dtype=tf.int64),
  indices=tf.constant((0), dtype=tf.int32),
  values=[tf.constant((0), dtype=tf.int32)],
  dtypes=[tf.int32,
  tf.int64],
  capacity=0,
  memory_limit=0,
  container='',
  shared_name='')
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/map_stage_op.cc#L513) does not check that the `key` input is a valid non-empty tensor.
  
### Patches
We have patched the issue in GitHub commit [d7de67733925de196ec8863a33445b73f9562d1d](https://github.com/tensorflow/tensorflow/commit/d7de67733925de196ec8863a33445b73f9562d1d).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security  guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Heap OOB in `UpperBound` and `LowerBound`
Published: 2021-08-25T14:41:44Z
Aliases: CVE-2021-37670

### Impact
An attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to `tf.raw_ops.UpperBound`:

```python
import tensorflow as tf
  
tf.raw_ops.UpperBound(
  sorted_input=[1,2,3],
  values=tf.constant(value=[[0,0,0],[1,1,1],[2,2,2]],dtype=tf.int64),
  out_type=tf.int64)
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/searchsorted_op.cc#L85-L104) does not validate the rank of `sorted_input` argument:

```cc
  void Compute(OpKernelContext* ctx) override {
    const Tensor& sorted_inputs_t = ctx->input(0);
    // ...
    OP_REQUIRES(ctx, sorted_inputs_t.dim_size(0) == values_t.dim_size(0),
                Status(error::INVALID_ARGUMENT,
                       "Leading dim_size of both tensors must match."));
    // ...
    if (output_t->dtype() == DT_INT32) {
      OP_REQUIRES(ctx,
                  FastBoundsCheck(sorted_inputs_t.dim_size(1), ...));
      // ...
    }
```

As we access the first two dimensions of `sorted_inputs_t` tensor, it must have rank at least 2.

A similar issue occurs in `tf.raw_ops.LowerBound`.

### Patches
We have patched the issue in GitHub commit [42459e4273c2e47a3232cc16c4f4fff3b3a35c38](https://github.com/tensorflow/tensorflow/commit/42459e4273c2e47a3232cc16c4f4fff3b3a35c38).
  
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
  
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
HTTP Request Smuggling in hyper
Published: 2021-08-25T20:46:08Z
Aliases: CVE-2020-35863

Vulnerable versions of hyper allow GET requests to have bodies, even if there is no Transfer-Encoding or Content-Length header. As per the HTTP 1.1 specification, such requests do not have bodies, so the body will be interpreted as a separate HTTP request.

This allows an attacker who can control the body and method of an HTTP request made by hyper to inject a request with headers that would not otherwise be allowed, as demonstrated by sending a malformed HTTP request from a Substrate runtime. This allows bypassing CORS restrictions. In combination with other vulnerabilities, such as an exploitable web server listening on loopback, it may allow remote code execution.

The flaw was corrected in hyper version 0.12.34.
Open Redirect in ActionPack
Published: 2021-08-26T20:36:51Z
Aliases: CVE-2021-22942

# Overview

There is a possible open redirect vulnerability in the Host Authorization
middleware in Action Pack. This vulnerability has been assigned the CVE
identifier CVE-2021-22942.

Versions Affected: >= 6.0.0.
Not affected: < 6.0.0
Fixed Versions: 6.1.4.1, 6.0.4.1

# Impact

Specially crafted “X-Forwarded-Host” headers in combination with certain
“allowed host” formats can cause the Host Authorization middleware in
Action Pack to redirect users to a malicious website.

Impacted applications will have allowed hosts with a leading dot.
For example, configuration files that look like this:

```ruby
config.hosts <<  '.EXAMPLE.com'
```

When an allowed host contains a leading dot, a specially crafted
Host header can be used to redirect to a malicious website.

This vulnerability is similar to CVE-2021-22881, but CVE-2021-22881 did not
take in to account domain name case sensitivity.

# Releases

The fixed releases are available at the normal locations.

# Workarounds

In the case a patch can’t be applied, the following monkey patch can be
used in an initializer:

```ruby
module ActionDispatch
  class HostAuthorization
    HOSTNAME = /[a-z0-9.-]+|\[[a-f0-9]*:[a-f0-9.:]+\]/i
    VALID_ORIGIN_HOST = /\A(#{HOSTNAME})(?::\d+)?\z/
    VALID_FORWARDED_HOST = /(?:\A|,[ ]?)(#{HOSTNAME})(?::\d+)?\z/

    private
      def authorized?(request)
        origin_host =
          request.get_header("HTTP_HOST")&.slice(VALID_ORIGIN_HOST, 1) || ""
        forwarded_host =
          request.x_forwarded_host&.slice(VALID_FORWARDED_HOST, 1) || ""
        @permissions.allows?(origin_host) &&
          (forwarded_host.blank? || @permissions.allows?(forwarded_host))
      end
  end
end
```
Data races in rusqlite
Published: 2021-08-25T20:46:59Z
Aliases: CVE-2020-35871

An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API data race.
Cross-Site Scripting via Rich-Text Content
Published: 2021-08-19T15:53:12Z
Aliases: CVE-2021-32768

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC` (5.7)

### Problem
Failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via TypoScript functionality _[HTMLparser](https://docs.typo3.org/m/typo3/reference-typoscript/10.4/en-us/Functions/Htmlparser.html)_ do not consider all potentially malicious HTML tag & attribute combinations per default.

In addition, the lack of comprehensive default node configuration for rich-text fields in the backend user interface fosters this malfunction.

In default scenarios, a valid backend user account is needed to exploit this vulnerability. In case custom plugins used in the website frontend accept and reflect rich-text content submitted by users, no authentication is required.

### Solution
Update to TYPO3 versions 7.6.53 ELTS, 8.7.42 ELTS, 9.5.29, 10.4.19, 11.3.2 that fix the problem described above.

Custom package _[typo3/html-sanitizer](https://github.com/TYPO3/html-sanitizer)_ - based on allow-lists only - takes care of sanitizing potentially malicious markup. The default behavior is based on safe and commonly used markup - however, this can be extended or restricted further in case it is necessary for individual scenarios.

During the frontend rendering process, sanitization is applied to the default TypoScript path `lib.parseFunc`, which is implicitly used by the Fluid view-helper instruction `f:format.html`. Rich-text data persisted using the backend user interface is sanitized as well. Implementation details are explained in corresponding [ChangeLog documentation](https://docs.typo3.org/c/typo3/cms-core/master/en-us/Changelog/9.5.x/Important-94484-IntroduceHTMLSanitizer.html).

### Credits
Thanks to Benjamin Stiber, Gert-Jan Jansma, Gábor Ács-Kurucz, Alexander Kellner, Richie Lee, Nina Rösch who reported this issue, and to TYPO3 security team member Oliver Hader, as well as TYPO3 contributor Susanne Moog who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-013](https://typo3.org/security/advisory/typo3-core-sa-2021-013)
Out of bounds write in reorder
Published: 2021-08-25T20:54:10Z
Aliases: CVE-2021-29942

swap_index takes an iterator and swaps the items with their corresponding indexes. It reserves capacity and sets the length of the vector based on the .len() method of the iterator.

If the len() returned by the iterator is larger than the actual number of elements yielded, then swap_index creates a vector containing uninitialized members. If the len() returned by the iterator is smaller than the actual number of members yielded, then swap_index can write out of bounds past its allocated vector.

As noted by the Rust documentation, len() and size_hint() are primarily meant for optimization and incorrect values from their implementations should not lead to memory safety violations.
Off-by-one error in simple-slab
Published: 2021-08-25T20:48:33Z
Aliases: CVE-2020-35893

An issue was discovered in the simple-slab crate before 0.3.3 for Rust. remove() has an off-by-one error, causing memory leakage and a drop of uninitialized memory.
FPE in LSH in TFLite
Published: 2021-08-25T14:39:17Z
Aliases: CVE-2021-37691

### Impact
An attacker can craft a TFLite model that would trigger a division by zero error in LSH  [implementation](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/lsh_projection.cc#L118).

```cc
int RunningSignBit(const TfLiteTensor* input, const TfLiteTensor* weight,
                   float seed) {
  int input_item_bytes = input->bytes / SizeOfDimension(input, 0);
  // ...
}
```
          
There is no check that the first dimension of the input is non zero.
      
### Patches
We have patched the issue in GitHub commit [0575b640091680cfb70f4dd93e70658de43b94f9](https://github.com/tensorflow/tensorflow/commit/0575b640091680cfb70f4dd93e70658de43b94f9).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick thiscommit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for  more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang of Baidu Security.
Data race in atomic-option
Published: 2021-08-25T20:51:42Z
Aliases: CVE-2020-36219

An issue was discovered in the atomic-option crate through 2020-10-31 for Rust. Because AtomicOption<T> implements Sync unconditionally, a data race can occur.
Out of bounds read in lazy-init
Published: 2021-08-25T20:52:59Z
Aliases: CVE-2021-25901

An issue was discovered in the lazy-init crate through 2021-01-17 for Rust. Lazy lacks a Send bound, leading to a data race.
Data race in may_queue
Published: 2021-08-25T20:51:47Z
Aliases: CVE-2020-36217

An issue was discovered in the may_queue crate through 2020-11-10 for Rust. Because Queue does not have bounds on its Send trait or Sync trait, memory corruption can occur.
Heap buffer overflow in `FractionalAvgPoolGrad`
Published: 2021-08-25T14:43:21Z
Aliases: CVE-2021-37651

### Impact
The implementation for `tf.raw_ops.FractionalAvgPoolGrad` can be tricked into accessing data outside of bounds of heap allocated buffers:

```python
import tensorflow as tf

tf.raw_ops.FractionalAvgPoolGrad(
  orig_input_tensor_shape=[0,1,2,3],
  out_backprop = np.array([[[[541],[541]],[[541],[541]]]]),
  row_pooling_sequence=[0, 0, 0, 0, 0],
  col_pooling_sequence=[-2, 0, 0, 2, 0],
  overlapping=True)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/fractional_avg_pool_op.cc#L205) does not validate that the input tensor is non-empty. Thus, code constructs an empty `EigenDoubleMatrixMap` and then accesses this buffer with indices that are outside of the empty area.

### Patches
We have patched the issue in GitHub commit [0f931751fb20f565c4e94aa6df58d54a003cdb30](https://github.com/tensorflow/tensorflow/commit/0f931751fb20f565c4e94aa6df58d54a003cdb30).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Rust Failure Crate Vulnerable to Type confusion
Published: 2021-08-25T20:46:38Z
Aliases: CVE-2019-25010

Safe Rust code can implement malfunctioning `__private_get_type_id__` and cause type confusion when downcasting, which is an undefined behavior.

Users who derive Fail trait are not affected.
NULL Pointer Dereference in cbox
Published: 2021-08-25T20:47:16Z
Aliases: CVE-2020-35860

An issue was discovered in the cbox crate through 2020-03-19 for Rust. The CBox API allows dereferencing raw pointers without a requirement for unsafe code.
Layout XML Arbitrary Code Fix 
Published: 2021-08-30T17:20:52Z
Aliases: CVE-2021-32758

### Impact
Layout XML enabled admin users to execute arbitrary commands via block methods.
Privilege escalation via form generator
Published: 2021-08-23T19:41:22Z
Aliases: CVE-2021-37627

### Impact

It is possible for untrusted users to gain administrator rights with the form generator.

Installations are only affected if there are untrusted back end users with access to the form generator.

### Patches

Update to Contao 4.4.56, 4.9.18 or 4.11.7.

### Workarounds

Disable the form generator or disable the login for untrusted back end users.

### References

https://contao.org/en/security-advisories/privilege-escalation-with-the-form-generator

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
quinn invalidly assumes the memory layout of std::net::SocketAddr
Published: 2021-08-25T20:52:05Z
Aliases: CVE-2021-28036

The quinn crate has assumed std::net::SocketAddrV4 and std::net::SocketAddrV6 have the same memory layout as the system C representation sockaddr. It has simply casted the pointers to convert the socket addresses to the system representation. The standard library does not say anything about the memory layout, and this will cause invalid memory access if the standard library changes the implementation. No warnings or errors will be emitted once the change happens.
Division by 0 in `ResourceScatterDiv`
Published: 2021-08-25T14:43:56Z
Aliases: CVE-2021-37642

### Impact
The implementation of `tf.raw_ops.ResourceScatterDiv` is vulnerable to a division by 0 error:

```python
import tensorflow as tf

v= tf.Variable([1,2,3])
tf.raw_ops.ResourceScatterDiv(
  resource=v.handle,
  indices=[1],
  updates=[0])
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/resource_variable_ops.cc#L865) uses a common class for all binary operations but fails to treat the division by 0 case separately.

### Patches
We have patched the issue in GitHub commit [4aacb30888638da75023e6601149415b39763d76](https://github.com/tensorflow/tensorflow/commit/4aacb30888638da75023e6601149415b39763d76).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Workflow re-write vulnerability using input parameter
Published: 2021-08-09T20:37:50Z
Aliases: CVE-2021-37914

### Impact

* Allow end-users to set input parameters, but otherwise expect workflows to be secure.

### Patches

Not yet.

### Workarounds

* Set `EXPRESSION_TEMPLATES=false` for the workflow controller


### References

* https://github.com/argoproj/argo-workflows/issues/6441

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [example link to repo](http://example.com)
* Email us at [example email address](mailto:example@example.com)
Data races in rusqlite
Published: 2021-08-25T20:47:57Z
Aliases: CVE-2020-35867

An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via create_module.