aswin1906/github-advisory-2021.csv huggingface dataset:
Command Injection Vulnerability in Mechanize
Published: 2021-02-02T18:50:27Z
Aliases: CVE-2021-21289

This security advisory has been created for public disclosure of a Command Injection vulnerability that was responsibly reported by @kyoshidajp (Katsuhiko YOSHIDA).

### Impact

Mechanize `>= v2.0`, `< v2.7.7` allows for OS commands to be injected using several classes' methods which implicitly use Ruby's `Kernel.open` method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls:

- `Mechanize::CookieJar#load`: since v2.0 (see 208e3ed)
- `Mechanize::CookieJar#save_as`: since v2.0 (see 5b776a4)
- `Mechanize#download`: since v2.2 (see dc91667)
- `Mechanize::Download#save` and `#save!` since v2.1 (see 98b2f51, bd62ff0)
- `Mechanize::File#save` and `#save_as`: since v2.1 (see 2bf7519)
- `Mechanize::FileResponse#read_body`: since v2.0 (see 01039f5)


### Patches

These vulnerabilities are patched in Mechanize v2.7.7.


### Workarounds

No workarounds are available. We recommend upgrading to v2.7.7 or later.


### References

See https://docs.rubocop.org/rubocop/cops_security.html#securityopen for background on why `Kernel.open` should not be used with untrusted input.


### For more information

If you have any questions or comments about this advisory, please open an issue in [sparklemotion/mechanize](https://github.com/sparklemotion/mechanize/issues/new).
Command injection in samba-client
Published: 2021-02-11T20:47:27Z
Aliases: CVE-2021-27185

The samba-client package before 4.0.0 for Node.js allows command injection because of the use of process.exec.
Denial of Service in uap-core
Published: 2021-02-02T15:46:38Z
Aliases: CVE-2021-21317

## Impact

Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.

## Patches

Please update uap-core to >= v0.11.0

Downstream packages such as uap-python, uap-ruby etc which depend upon uap-core follow different version schemes.
Backdoor / Malicious code
Published: 2021-02-23T21:23:16Z

lita-coin 0.0.3 contains a backdoor mechanism that allows launching of hidden cryptocurrency mining operations inside the project. The code also contained a backdoor mechanism that allowed the attacker to send a cookie file back to a compromised project, and allow the attacker to execute malicious commands.
vrana/adminer via XSS in the history parameter in SQL command
Published: 2021-02-11T20:42:28Z
Aliases: CVE-2020-35572

### Impact
Users of Adminer versions supporting SQL command (most versions, e.g. MySQL) using browsers not encoding URL parameters before sending to server (likely Edge, not Chrome, not Firefox) are affected.

### Patches
Patched by 5c395afc, included in version [4.7.9](https://github.com/vrana/adminer/releases/tag/v4.7.9).

### Workarounds
Use browser which encodes URL parameters (e.g. Chrome or Firefox).

### References
https://sourceforge.net/p/adminer/bugs-and-features/775/

### For more information
If you have any questions or comments about this advisory:
* Comment at https://sourceforge.net/p/adminer/bugs-and-features/775/
Key Caching behavior in the DynamoDB Encryption Client.
Published: 2021-02-08T17:43:49Z

### Impact
This advisory concerns users of MostRecentProvider in the DynamoDB Encryption Client with a key provider like AWS Key Management Service that allows for permissions on keys to be modified.

When key usage permissions were changed at the key provider, time-based key reauthorization logic in MostRecentProvider did not reauthorize the use of the key. This created the potential for keys to be used in the DynamoDB Encryption Client after permissions to do so were revoked at the key provider.

### Patches
Fixed as of 1.3.0.  We recommend users to modify their code and adopt `CachingMostRecentProvider`.


### Workarounds
Users who cannot upgrade to use the `CachingMostRecentProvider` can call `clear()` on the cache to manually flush all of its contents. Next use of the key will force a re-validation to occur with the key provider.
XSS in Adminer
Published: 2021-02-11T20:46:53Z

**Withdrawn:** Duplicate of GHSA-9pgx-gcph-mpqr.

Adminer before 4.7.9 allows XSS via the history parameter to the default URI.
Leak of information via Store-API
Published: 2021-02-10T02:32:21Z

### Impact
Leak of information via Store-API

### Patches
We recommend to update to the current version 6.3.5.1. You can get the update to 6.3.5.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

The vulnerability could only be fixed by changing the API system, which involves a non-backward-compatible change. Only consumers of the Store-API should be affected by this change. Please check your plugins if you have it in use. Detailed technical information can be found in the upgrade information.

https://github.com/shopware/platform/blob/v6.3.5.1/UPGRADE-6.3.md#6351

### Workarounds
For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-02-2021
vrana/adminer vulnerable to SSRF by connecting to privileged ports
Published: 2021-02-11T21:20:40Z
Aliases: CVE-2018-7667

### Impact
All users are affected.

### Patches
* Unsuccessfully patched by 0fae40fb, included in version [4.4.0](https://github.com/vrana/adminer/releases/tag/v4.4.0).
* Patched by 35bfaa75, included in version [4.7.8](https://github.com/vrana/adminer/releases/tag/v4.7.8).

### Workarounds
Protect access to Adminer also by other means, e.g. by HTTP password, IP address limiting or by OTP [plugin](https://www.adminer.org/plugins/).

### References
* http://hyp3rlinx.altervista.org/advisories/ADMINER-UNAUTHENTICATED-SERVER-SIDE-REQUEST-FORGERY.txt
* https://sourceforge.net/p/adminer/bugs-and-features/769/
* https://gusralph.info/adminer-ssrf-bypass-cve-2018-7667/ (CVE-2020-28654)

### For more information
If you have any questions or comments about this advisory:
* Comment at 35bfaa75.
Regular Expression Denial of Service
Published: 2021-02-25T01:20:42Z

A vulnerability was descovered in eslint before 4.18.2. One of the regexes in eslint is vulnerable to catastrophic backtracking.
Improper Access Control in Lightning Network Daemon
Published: 2021-05-18T15:30:22Z
Aliases: CVE-2019-12999

Lightning Network Daemon (lnd) before 0.7 allows attackers to trigger loss of funds because of Incorrect Access Control.
Infinite Loop in Apache Tika
Published: 2021-05-07T15:54:00Z
Aliases: CVE-2020-1951

A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23.
Prototype Pollution in nodee-utils
Published: 2021-05-06T18:26:21Z
Aliases: CVE-2020-7722

All versions of package nodee-utils below version 1.2.3 are vulnerable to Prototype Pollution via the deepSet function.
Improper Restriction of XML External Entity Reference in MPXJ
Published: 2021-05-07T15:54:36Z
Aliases: CVE-2020-25020

"MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components."
Predictable SIF UUID Identifiers in github.com/sylabs/sif
Published: 2021-05-18T18:30:38Z
Aliases: CVE-2021-29499

### Impact

The `siftool new` command and [func siftool.New()](https://pkg.go.dev/github.com/sylabs/sif/pkg/siftool#New) produce predictable UUID identifiers due to insecure randomness in the version of the `github.com/satori/go.uuid` module used as a dependency.

### Patches

A patch is available in version >= v1.2.3 of the module. Users are encouraged to upgrade.

The patch is commit https://github.com/sylabs/sif/commit/193962882122abf85ff5f5bcc86404933e71c07d

### Workarounds
Users passing [CreateInfo struct](https://pkg.go.dev/github.com/sylabs/sif/pkg/sif#CreateInfo) should ensure the `ID` field is generated using a version of `github.com/satori/go.uuid` that is not vulnerable to this issue. Unfortunately, the latest tagged release is vulnerable to this issue. One way to obtain a non-vulnerable version is:

```
go get github.com/satori/go.uuid@75cca531ea763666bc46e531da3b4c3b95f64557
```

### References
* https://github.com/satori/go.uuid/issues/73

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [github.com/sylabs/sif](https://github.com/sylabs/sif/issues/new)
* Email us at [security@sylabs.io](mailto:security@sylabs.io)
github.com/tidwall/gjson is vulnerable to Denial of service
Published: 2021-05-18T21:07:54Z
Aliases: CVE-2020-36066

GJSON <1.6.5 allows attackers to cause a denial of service (remote) via crafted JSON.
Improper Locking in github.com/containers/storage
Published: 2021-05-10T19:35:07Z
Aliases: CVE-2021-20291

A deadlock vulnerability was found in `github.com/containers/storage` in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS).
Cross-site scripting in jspdf
Published: 2021-05-17T21:01:32Z
Aliases: CVE-2020-7690

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It's possible to inject JavaScript code via the `html` method.
Information leakage in Error Handler
Published: 2021-05-21T14:29:33Z

### Impact
Information leakage in Error Handler

### Patches
We recommend updating to the current version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html


### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-05-2021
eivindfjeldstad-dot contains prototype pollution vulnerability
Published: 2021-05-25T15:59:14Z
Aliases: CVE-2020-7639

eivindfjeldstad-dot below 1.0.3 is vulnerable to Prototype Pollution.The function 'set' could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.
SQL Injection in Cloud Native Computing Foundation Harbor
Published: 2021-05-18T18:27:36Z
Aliases: CVE-2019-19029

Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Registry for the Pivotal Platform.
Undefined behavior in `MaxPool3DGradGrad`
Published: 2021-05-21T14:26:10Z
Aliases: CVE-2021-29574

### Impact
The implementation of `tf.raw_ops.MaxPool3DGradGrad` exhibits undefined behavior by dereferencing null pointers backing attacker-supplied empty tensors:

```python
import tensorflow as tf

orig_input = tf.constant([0.0], shape=[1, 1, 1, 1, 1], dtype=tf.float32)
orig_output = tf.constant([0.0], shape=[1, 1, 1, 1, 1], dtype=tf.float32)
grad = tf.constant([], shape=[0, 0, 0, 0, 0], dtype=tf.float32)
ksize = [1, 1, 1, 1, 1]
strides = [1, 1, 1, 1, 1]
padding = "SAME"

tf.raw_ops.MaxPool3DGradGrad(
    orig_input=orig_input, orig_output=orig_output, grad=grad, ksize=ksize,
    strides=strides, padding=padding)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/72fe792967e7fd25234342068806707bbc116618/tensorflow/core/kernels/pooling_ops_3d.cc#L679-L703) fails to validate that the 3 tensor inputs are not empty. If any of them is empty, then accessing the elements in the tensor results in dereferencing a null pointer.

### Patches
We have patched the issue in GitHub commit [a3d9f9be9ac2296615644061b40cefcee341dcc4](https://github.com/tensorflow/tensorflow/commit/a3d9f9be9ac2296615644061b40cefcee341dcc4).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Authorization bypass in Strapi
Published: 2021-05-10T18:43:59Z
Aliases: CVE-2020-27664

`admin/src/containers/InputModalStepperProvider/index.js` in Strapi before 3.2.5 has unwanted `/proxy?url=` functionality.
Privilege escalation in spring security
Published: 2021-05-10T15:22:39Z
Aliases: CVE-2021-22112

Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.
Possible DoS Vulnerability in Action Controller Token Authentication
Published: 2021-05-05T19:49:12Z
Aliases: CVE-2021-22904

There is a possible DoS vulnerability in the Token Authentication logic in Action Controller.

Versions Affected:  >= 4.0.0
Not affected:       < 4.0.0
Fixed Versions:     6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6

Impact
------
Impacted code uses `authenticate_or_request_with_http_token` or `authenticate_with_http_token` for request authentication.  Impacted code will look something like this:

```
class PostsController < ApplicationController
  before_action :authenticate

  private

  def authenticate
    authenticate_or_request_with_http_token do |token, options|
      # ...
    end
  end
end
```

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases
--------
The fixed releases are available at the normal locations.

Workarounds
-----------
The following monkey patch placed in an initializer can be used to work around the issue:

```ruby
module ActionController::HttpAuthentication::Token
  AUTHN_PAIR_DELIMITERS = /(?:,|;|\t)/
end
```

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

* 5-2-http-authentication-dos.patch - Patch for 5.2 series
* 6-0-http-authentication-dos.patch - Patch for 6.0 series
* 6-1-http-authentication-dos.patch - Patch for 6.1 series

Please note that only the 6.1.Z, 6.0.Z, and 5.2.Z series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits
-------
Thank you to https://hackerone.com/wonda_tea_coffee for reporting this issue!
Null dereference in Grappler's `TrySimplify`
Published: 2021-05-21T14:28:47Z
Aliases: CVE-2021-29616

### Impact
The implementation of [`TrySimplify`](https://github.com/tensorflow/tensorflow/blob/c22d88d6ff33031aa113e48aa3fc9aa74ed79595/tensorflow/core/grappler/optimizers/arithmetic_optimizer.cc#L390-L401) has undefined behavior due to dereferencing a null pointer in corner cases that
result in optimizing a node with no inputs.

### Patches
We have patched the issue in GitHub commit [e6340f0665d53716ef3197ada88936c2a5f7a2d3](https://github.com/tensorflow/tensorflow/commit/e6340f0665d53716ef3197ada88936c2a5f7a2d3).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Insecure deserialization in Wire
Published: 2021-05-19T23:02:38Z
Aliases: CVE-2021-29508

Due to how Wire handles type information in its serialization format, malicious payloads can be passed to a deserializer. e.g. using a surrogate on the sender end, an attacker can pass information about a different type for the receiving end. And by doing so allowing the serializer to create any type on the deserializing end.

**This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300?view=vs-2019**

This also applies to the fork of Wire, AkkaDotNet/Hyperion.
Division by zero in TFLite's implementation of `SVDF`
Published: 2021-05-21T14:27:58Z
Aliases: CVE-2021-29598

### Impact
The implementation of the `SVDF` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/7f283ff806b2031f407db64c4d3edcda8fb9f9f5/tensorflow/lite/kernels/svdf.cc#L99-L102):

```cc
const int rank = params->rank;
...
TF_LITE_ENSURE_EQ(context, num_filters % rank, 0);
```

An attacker can craft a model such that `params->rank` would be 0.

### Patches
We have patched the issue in GitHub commit [6841e522a3e7d48706a02e8819836e809f738682](https://github.com/tensorflow/tensorflow/commit/6841e522a3e7d48706a02e8819836e809f738682).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Improper Handling of Highly Compressed Data (Data Amplification) and Memory Allocation with Excessive Size Value in eventlet
Published: 2021-05-07T15:50:36Z
Aliases: CVE-2021-21419

### Impact
A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame.

### Patches
Version 0.31.0 restricts websocket frame to reasonable limits.

### Workarounds
Restricting memory usage via OS limits would help against overall machine exhaustion. No workaround to protect Eventlet process.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [eventlet](https://github.com/eventlet/eventlet/issues)
* Contact current maintainers. At 2021-03: temotor@gmail.com or https://t.me/temotor
Incomplete validation in `SparseAdd`
Published: 2021-05-21T14:28:29Z
Aliases: CVE-2021-29609

### Impact
Incomplete validation in `SparseAdd` results in allowing attackers to exploit undefined behavior (dereferencing null pointers) as well as write outside of bounds of heap allocated data:

```python
import tensorflow as tf

a_indices = tf.zeros([10, 97], dtype=tf.int64)
a_values = tf.zeros([10], dtype=tf.int64)
a_shape = tf.zeros([0], dtype=tf.int64)

b_indices = tf.zeros([0, 0], dtype=tf.int64)
b_values = tf.zeros([0], dtype=tf.int64)
b_shape = tf.zeros([0], dtype=tf.int64)
  
thresh = 0

tf.raw_ops.SparseAdd(a_indices=a_indices,
                    a_values=a_values,
                    a_shape=a_shape,
                    b_indices=b_indices,
                    b_values=b_values,
                    b_shape=b_shape,
                    thresh=thresh)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/656e7673b14acd7835dc778867f84916c6d1cac2/tensorflow/core/kernels/sparse_add_op.cc) has a large set of validation for the two sparse tensor inputs (6 tensors in total), but does not validate that the tensors are not empty or that the second dimension of `*_indices` matches the size of corresponding `*_shape`. This allows attackers to send tensor triples that represent invalid sparse tensors to abuse code assumptions that are not protected by validation.

### Patches
We have patched the issue in GitHub commit [6fd02f44810754ae7481838b6a67c5df7f909ca3](https://github.com/tensorflow/tensorflow/commit/6fd02f44810754ae7481838b6a67c5df7f909ca3) followed by GitHub commit  [41727ff06111117bdf86b37db198217fd7a143cc](https://github.com/tensorflow/tensorflow/commit/41727ff06111117bdf86b37db198217fd7a143cc).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Path traversal in url-parse
Published: 2021-05-06T16:10:51Z
Aliases: CVE-2021-27515

url-parse before 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.