aswin1906/github-advisory-2021.csv huggingface dataset:
Consensus flaw during block processing in github.com/ethereum/go-ethereum
Published: 2021-06-29T21:14:16Z
Aliases: CVE-2020-26265

### Impact

A consensus-vulnerability in Geth could cause a chain split, where vulnerable versions refuse to accept the canonical chain. 

### Description


A flaw was repoted at 2020-08-11 by John Youngseok Yang (Software Platform Lab), where a particular sequence of transactions could cause a consensus failure.

- Tx 1:
  - `sender` invokes `caller`.
  - `caller` invokes `0xaa`. `0xaa` has 3 wei, does a self-destruct-to-self
  - `caller` does a  `1 wei` -call to `0xaa`, who thereby has 1 wei (the code in `0xaa` still executed, since the tx is still ongoing, but doesn't redo the selfdestruct, it takes a different path if callvalue is non-zero)

- Tx 2:
  - `sender` does a 5-wei call to 0xaa. No exec (since no code). 

In geth, the result would be that `0xaa` had `6 wei`, whereas OE reported (correctly) `5` wei. Furthermore, in geth, if the second tx was not executed, the `0xaa` would be destructed, resulting in `0 wei`. Thus obviously wrong. 

It was determined that the root cause was this [commit](https://github.com/ethereum/go-ethereum/commit/223b950944f494a5b4e0957fd9f92c48b09037ad) from [this PR](https://github.com/ethereum/go-ethereum/pull/19953). The semantics of `createObject` was subtly changd, into returning a non-nil object (with `deleted=true`) where it previously did not if the account had been destructed. This return value caused the new object to inherit the old `balance`:

```golang
func (s *StateDB) CreateAccount(addr common.Address) {
	newObj, prev := s.createObject(addr)
	if prev != nil {
		newObj.setBalance(prev.data.Balance)
	}
}
```

It was determined that the minimal possible correct fix was

```diff
+++ b/core/state/statedb.go
@@ -589,7 +589,10 @@ func (s *StateDB) createObject(addr common.Address) (newobj, prev *stateObject)
                s.journal.append(resetObjectChange{prev: prev, prevdestruct: prevdestruct})
        }
        s.setStateObject(newobj)
-       return newobj, prev
+       if prev != nil && !prev.deleted {
+               return newobj, prev
+       }
+       return newobj, nil
```

### Patches

See above. The fix was included in Geth `v1.9.20` "Paragade".

### Credits

The bug was found by @johnyangk and reported via bounty@ethereum.org.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)
* Email us at [security@ethereum.org](mailto:security@ethereum.org)
Predictable CSRF tokens in centreon/centreon
Published: 2021-06-08T20:12:56Z
Aliases: CVE-2021-28055

An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. The anti-CSRF token generation is predictable, which might allow CSRF attacks that add an admin user.
Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem
Published: 2021-06-29T03:13:28Z
Aliases: CVE-2021-32708

### Impact

The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely.

The conditions: 

- A user is allowed to supply the path or filename of an uploaded file.
- The supplied path or filename is not checked against unicode chars.
- The supplied pathname checked against an extension deny-list, not an allow-list.
- The supplied path or filename contains a unicode whitespace char in the extension.
- The uploaded file is stored in a directory that allows PHP code to be executed.

Given these conditions are met a user can upload and execute arbitrary code on the system under attack.

### Patches

The unicode whitespace removal has been replaced with a rejection (exception).

The library has been patched in:
- 1.x: https://github.com/thephpleague/flysystem/commit/f3ad69181b8afed2c9edf7be5a2918144ff4ea32
- 2.x: https://github.com/thephpleague/flysystem/commit/a3c694de9f7e844b76f9d1b61296ebf6e8d89d74

### Workarounds

For 1.x users, upgrade to 1.1.4. For 2.x users, upgrade to 2.1.1.
Incorrect Permission Assignment for Critical Resource	in Hashicorp Consul
Published: 2021-06-23T17:52:33Z
Aliases: CVE-2020-12797

HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4.
Session Fixation in Subrion CMS
Published: 2021-06-22T15:23:04Z
Aliases: CVE-2020-12467

Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie.
Header injection possible in Django
Published: 2021-06-09T17:14:51Z
Aliases: CVE-2021-32052

In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.
Authentication Bypass in tyk-identity-broker
Published: 2021-06-23T17:23:30Z
Aliases: CVE-2021-23365

The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass. This is because the XML parser doesn’t guarantee integrity in the XML round-trip (encoding/decoding XML data).
Cross-Site Request Forgery in the Jenkins Claim plugin
Published: 2021-06-16T17:29:43Z
Aliases: CVE-2021-21620

Claim Plugin 2.18.1 and earlier does not require POST requests for the form submission endpoint assigning claims, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to change claims.

Claim Plugin 2.18.2 requires POST requests for the affected HTTP endpoint.
Insufficient Verification of Data Authenticity in Pillow
Published: 2021-06-08T18:49:20Z
Aliases: CVE-2021-28678

An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.
Improper Authentication in Apache Airflow
Published: 2021-06-18T18:30:11Z
Aliases: CVE-2021-26697

The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue only affects Apache Airflow 2.0.0.
Plugin archive directory traversal in Helm
Published: 2021-06-23T18:14:36Z
Aliases: CVE-2020-4053

The Helm core maintainers have identified an information disclosure
vulnerability in Helm 3.0.0-3.2.3. 

### Impact

A traversal attack is possible when installing Helm plugins from a tar
archive over HTTP.  It is possible for a malicious plugin author to inject a relative
path into a plugin archive, and copy a file outside of the intended directory.

Traversal Attacks are a form of a Directory Traversal that can be exploited by
extracting files from an archive. The premise of the Directory Traversal
vulnerability is that an attacker can gain access to parts of the file system
outside of the target folder in which they should reside. The attacker can
then overwrite executable files and either invoke them remotely or wait for
the system or user to call them, thus achieving Remote Command Execution on
the victim's machine. The vulnerability can also cause damage by overwriting
configuration files or other sensitive resources, and can be exploited on both
client (user) machines and servers.

https://snyk.io/research/zip-slip-vulnerability

### Patches

This issue has been fixed in Helm 3.2.4 

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the Helm repository](https://github.com/helm/helm/issues)
* For security-specific issues, email us at [cncf-helm-security@lists.cncf.io](mailto:cncf-helm-security@lists.cncf.io)
Missing Authorization in Jenkins S3 publisher Plugin
Published: 2021-06-16T17:29:17Z
Aliases: CVE-2021-21651

Jenkins S3 publisher Plugin prior to 0.11.7 and 0.11.5.1 does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to obtain the list of configured profiles.

S3 publisher Plugin 0.11.7 and 0.11.5.1 performs permission checks when providing a list of configured profiles.
Catastrophic backtracking in URL authority parser when passed URL containing many @ characters
Published: 2021-06-01T21:19:32Z
Aliases: CVE-2021-33503

### Impact

When provided with a URL containing many `@` characters in the authority component the authority regular expression exhibits catastrophic backtracking causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.


### Patches

The issue has been fixed in urllib3 v1.26.5.

### References

- [CVE-2021-33503](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33503)
- [JVNVU#92413403 (English)](https://jvn.jp/en/vu/JVNVU92413403/)
- [JVNVU#92413403 (Japanese)](https://jvn.jp/vu/JVNVU92413403/)
- [urllib3 v1.26.5](https://github.com/urllib3/urllib3/releases/tag/1.26.5)

### For more information
If you have any questions or comments about this advisory:
* Ask in our [community Discord](https://discord.gg/urllib3)
* Email [sethmichaellarson@gmail.com](mailto:sethmichaellarson@gmail.com)
Remote code execution in Apache Tapestry
Published: 2021-06-16T17:33:19Z
Aliases: CVE-2021-27850

A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL. An attacker was able to download the file `AppModule.class` by requesting the URL `http://localhost:8080/assets/something/services/AppModule.class` which contains a HMAC secret key. The fix for that bug was a blacklist filter that checks if the URL ends with `.class`, `.properties` or `.xml`. Bypass: Unfortunately, the blacklist solution can simply be bypassed by appending a `/` at the end of the URL: `http://localhost:8080/assets/something/services/AppModule.class/` The slash is stripped after the blacklist check and the file `AppModule.class` is loaded into the response. This class usually contains the HMAC secret key which is used to sign serialized Java objects. With the knowledge of that key an attacker can sign a Java gadget chain that leads to RCE (e.g. CommonsBeanUtils1 from ysoserial). Solution for this vulnerability: * For Apache Tapestry 5.4.0 to 5.6.2, upgrade to 5.6.3 or later. * For Apache Tapestry 5.7.0, upgrade to 5.7.1 or later.
Uncontrolled Resource Consumption in locutus
Published: 2021-06-10T17:25:05Z
Aliases: CVE-2021-23392

The package locutus before 2.0.15 is vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function.
Remote Code Execution via traversal in TAL expressions
Published: 2021-06-08T18:45:52Z

This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of TAL expression traversal vulnerabilities.

### Impact
Most Python modules are not available for using in TAL expressions that you can add through-the-web, for example in Zope Page Templates. This restriction avoids file system access, for example via the 'os' module. But some of the untrusted modules are available indirectly through Python modules that are available for direct use.

By default, you need to have the Manager role to add or edit Zope Page Templates through the web. Only sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk.

### Patches
The problem has been fixed in Zope 5.21 and 4.6.1.

### Workarounds
The workaround is the same as for https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36: A site administrator can restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web should be restricted to trusted users only.

### References
* [The previous advisory (GHSA-5pr9-v234-jw36)](https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [Zope issue tracker](https://github.com/zopefoundation/Zope/issues)
* Email us at [security@plone.org](mailto:security@plone.org)
Open redirect in Flask-Unchained
Published: 2021-06-15T15:56:59Z
Aliases: CVE-2021-23393

This affects the package Flask-Unchained before 0.9.0. When using the the _validate_redirect_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False.
Cross-site scripting in PageKit
Published: 2021-06-22T15:17:28Z
Aliases: CVE-2021-32245

In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. These SVG files can contain malicious scripts. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to "/storage/exp.svg" that will point to http://localhost/pagekit/storage/exp.svg. When a user comes along to click that link, it will trigger a XSS attack.
Cross-site Scripting (XSS) in baserCMS
Published: 2021-06-08T20:10:27Z
Aliases: CVE-2021-20681

Improper neutralization of JavaScript input in the page editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.
SnakeYAML Entity Expansion during load operation
Published: 2021-06-04T21:37:45Z
Aliases: CVE-2017-18640

The Alias feature in SnakeYAML 1.18 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
Remote Code Execution vulnerability in PHPMailer 6.4.1 running on Windows
Published: 2021-06-22T15:17:51Z
Aliases: CVE-2021-34551

PHPMailer 6.4.1 contains a possible remote code execution vulnerability through the `$lang_path` parameter of the `setLanguage()` method. If the `$lang_path` parameter is passed unfiltered from user input, it can be set to [a UNC path](https://docs.microsoft.com/en-us/dotnet/standard/io/file-path-formats#unc-paths), and if an attacker is also able to create a remote mount on the server that the UNC path points to, a script file under their control may be executed. 

### Impact
Arbitrary code may be run by a remote attacker under the web server or PHP process running on Window hosts.

### Patches
Mitigated in PHPMailer 6.5.0 by no longer treating translation files as PHP code, but by parsing their text content directly.
This approach avoids the possibility of executing unknown code while retaining backward compatibility. This isn't ideal, so the current translation format is deprecated and will be replaced in the next major release.

### Workarounds
Any of:
* Ensure that calling code does not pass unfiltered user-supplied data to the `$lang_path` parameter of the `setLanguage()` method.
* Block or filter the use of unknown UNC paths in this parameter (or altogether).
* Ensure that unauthorised users do not have the ability to read from unknown remote servers via UNC paths.
* Run on an OS that does not support UNC paths

### References
[CVE-2021-34551](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34551).

Reported by [listensec.com](https://listensec.com) via Tidelift.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [PHPMailer](https://github.com/PHPMailer/PHPMailer)
* [Email the maintainers](mailto:phpmailer@synchromedia.co.uk)
Improper Restriction of Recursive Entity References in Apache XMLBeans
Published: 2021-06-16T17:37:11Z
Aliases: CVE-2021-23926

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.
Cross-site scripting in Plone
Published: 2021-06-08T23:20:11Z
Aliases: CVE-2021-33508

Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item.
SQL Injection in gogs.io/gogs
Published: 2021-06-29T18:32:44Z
Aliases: CVE-2014-8681

SQL injection vulnerability in the GetIssues function in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.6.x before 0.5.6.1025 Beta allows remote attackers to execute arbitrary SQL commands via the label parameter to user/repos/issues.
The Fuck Arbitrary File Deletion via Path Traversal
Published: 2021-06-15T15:49:01Z
Aliases: CVE-2021-34363

The thefuck (aka _The Fuck_) is app that corrects errors in previous console commands. _The Fuck_ python package before 3.31 allows Path Traversal that leads to arbitrary file deletion via the `undo archive operation` feature.
gosaml2 is vulnerable to NULL Pointer Dereference from malformed XML signatures
Published: 2021-06-23T17:25:08Z

This affects all versions less than 0.7.0 of package github.com/russellhaering/gosaml2. There is a crash on null pointer dereference caused by sending malformed XML signatures.
Cross-Site Request Forgery (CSRF) in FastAPI
Published: 2021-06-10T15:43:54Z
Aliases: CVE-2021-32677

### Impact

FastAPI versions lower than `0.65.2` that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF) attack.

In versions lower than `0.65.2`, FastAPI would try to read the request payload as JSON even if the `content-type` header sent was not set to `application/json` or a compatible JSON media type (e.g. `application/geo+json`).

So, a request with a content type of `text/plain` containing JSON data would be accepted and the JSON data would be extracted.

But requests with content type `text/plain` are exempt from [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) preflights, for being considered [Simple requests](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests). So, the browser would execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application.

### Patches

This is fixed in FastAPI `0.65.2`.

The request data is now parsed as JSON only if the `content-type` header is `application/json` or another JSON compatible media type like `application/geo+json`.

### Workarounds

It's best to upgrade to the latest FastAPI.

But still, it would be possible to add a middleware or a dependency that checks the `content-type` header and aborts the request if it is not `application/json` or another JSON compatible content type.

### References

* [CORS on Mozilla web docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)
* [This answer on StackExchange](https://security.stackexchange.com/questions/157528/ways-to-bypass-browsers-cors-policy/157531#157531)
* [OWASP CSRF](https://owasp.org/www-community/attacks/csrf)
* Fixed in PR [#2118](https://github.com/tiangolo/fastapi/pull/2118)

### For more information

If you have any questions or comments, write to [security@tiangolo.com](mailto:security@tiangolo.com)
CSRF vulnerability in Jenkins Xray - Test Management for Jira Plugin allows capturing credentials
Published: 2021-06-16T17:28:58Z
Aliases: CVE-2021-21652

Xray - Test Management for Jira Plugin 2.4.0 and earlier does not require POST requests for a connection test method, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Xray - Test Management for Jira Plugin 2.4.1 requires POST requests for the affected connection test method.
Hugo can execute a binary from the current directory on Windows
Published: 2021-06-23T17:28:26Z
Aliases: CVE-2020-26284

## Impact

Hugo depends on Go's `os/exec` for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system `%PATH%` on Windows. However, if a malicious file with the same name (`exe` or `bat`) is found in the current working directory at the time of running `hugo`, the malicious command will be invoked instead of the system one.

Windows users who run `hugo` inside untrusted Hugo sites are affected.

## Patches
Users should upgrade to Hugo v0.79.1.
set-getter Prototype Pollution Vulnerability
Published: 2021-06-21T17:16:09Z
Aliases: CVE-2021-25949

Prototype pollution vulnerability in ‘set-getter’ version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.
Denial of service in GJSON
Published: 2021-06-23T17:53:05Z
Aliases: CVE-2020-35380

GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON. Due to improper bounds checking, maliciously crafted JSON objects can cause an out-of-bounds panic. If parsing user input, this may be used as a denial of service vector.
Missing Handler in @scandipwa/magento-scripts
Published: 2021-06-21T17:10:02Z
Aliases: CVE-2021-32684

### Impact
After changing the function from synchronous to asynchronous there wasn't implemented handler in the [start](https://docs.create-magento-app.com/getting-started/available-commands/start), [stop](https://docs.create-magento-app.com/getting-started/available-commands/stop), [exec](https://docs.create-magento-app.com/getting-started/available-commands/exec) and [logs](https://docs.create-magento-app.com/getting-started/available-commands/logs) commands, effectively making them unusable.

### Patches
[Version 1.5.3](https://github.com/scandipwa/create-magento-app/releases/tag/%40scandipwa%2Fmagento-scripts%401.5.3) contains patches for the problems described above.

### Workarounds
Upgrade to patched or latest (recommended) version `npm i @scandipwa/magento-scripts@1.5.3` or `npm i @scandipwa/magento-scripts@latest`.

### References
New releases always available here: https://github.com/scandipwa/create-magento-app/releases

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [create-magento-app](https://github.com/scandipwa/create-magento-app/issues)
Prototype pollution in nestie
Published: 2021-06-07T21:49:14Z
Aliases: CVE-2021-25947

Prototype pollution vulnerability in 'nestie' versions 0.0.0 through 1.0.0 allows an attacker to cause a denial of service and may lead to remote code execution.
Auth bypass in SAML provider
Published: 2021-06-23T17:29:06Z

### Impact

The following vulnerabilities have been disclosed, which impact users leveraging the SAML auth provider:

- [`goxmldsig` - Signature Validation Bypass](https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7)
- [`gosaml2` - Authentication Bypass](https://github.com/russellhaering/gosaml2/security/advisories/GHSA-xhqq-x44f-9fgg)

### Patches

[Patch available](https://github.com/netlify/gotrue/pull/274)

Please upgrade to v1.0.0 or commit hash `a2b4dd6bc4ef7562d1df044098b303f564eefa90`

### Workarounds

No known workarounds.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [gotrue](https://github.com/netlify/gotrue/issues)
* Email us at [security@netlify.com](mailto:security@netlify.com)