aswin1906/github-advisory-2021.csv huggingface dataset:
Attack on Kubernetes via Misconfigured Argo Workflows
Published: 2021-08-02T17:19:52Z

### Impact

Users running using the Argo Server with `--auth-mode=server` (which is the default < v3.0.0) AND have exposed their UI to the Internet may allow remote users to execute arbitrary code on their cluster, e.g. crypto-mining.

### Resolution

* Do not expose your user interface to the Internet. 
* Change configuration. `--auth-mode=client`. 

For users using an older 2.x version of Argo Server, consider upgrading to Argo Server version 3.x or later.
openssl-src NULL pointer Dereference in signature_algorithms processing
Published: 2021-08-25T20:54:02Z
Aliases: CVE-2021-3449

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).
Multiple security issues including data race, buffer overflow, and uninitialized memory drop in arr
Published: 2021-08-25T20:48:54Z
Aliases: CVE-2020-35887

arr crate contains multiple security issues. Specifically,

1.  It incorrectly implements Sync/Send bounds, which allows to smuggle non-Sync/Send types across the thread boundary.
2. Index and IndexMut implementation does not check the array bound.
3. Array::new_from_template() drops uninitialized memory.
Improper Handling of Length Parameter Inconsistency in Apache Ant
Published: 2021-08-02T16:56:31Z
Aliases: CVE-2021-36374

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
Unchecked vector pre-allocation
Published: 2021-08-25T21:00:09Z

Affected versions of this crate pre-allocate memory on deserializing raw buffers without checking whether there is sufficient data available. This allows an attacker to do denial-of-service attacks by sending small msgpack messages that allocate gigabytes of memory.
Use of Uninitialized Resource in truetype
Published: 2021-08-25T20:51:58Z
Aliases: CVE-2021-28030

An issue was discovered in the truetype crate before 0.30.1 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation within Tape::take_bytes.
Bad alloc in `StringNGrams` caused by integer conversion
Published: 2021-08-25T14:43:34Z
Aliases: CVE-2021-37646

### Impact
The implementation of `tf.raw_ops.StringNGrams` is vulnerable to an integer overflow issue caused by converting a signed integer value to an unsigned one and then allocating memory based on this value.

```python
import tensorflow as tf

tf.raw_ops.StringNGrams(
  data=['',''],
  data_splits=[0,2],
  separator=' '*100,
  ngram_widths=[-80,0,0,-60],
  left_pad=' ',
  right_pad=' ',
  pad_width=100,
  preserve_short_sequences=False)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/string_ngrams_op.cc#L184) calls `reserve` on a `tstring` with a value that sometimes can be negative if user supplies negative `ngram_widths`. The `reserve` method calls `TF_TString_Reserve` which has an `unsigned long` argument for the size of the buffer. Hence, the implicit conversion transforms the negative value to a large integer.

### Patches
We have patched the issue in GitHub commit [c283e542a3f422420cfdb332414543b62fc4e4a5](https://github.com/tensorflow/tensorflow/commit/c283e542a3f422420cfdb332414543b62fc4e4a5).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
MvccRwLock allows data races & aliasing violations
Published: 2021-08-25T20:59:59Z

Affected versions of the `noise_search` crate unconditionally implement Send/Sync for `MvccRwLock`.
This can lead to data races when types that are either `!Send` or `!Sync` (e.g. `Rc<T>`, `Arc<Cell<_>>`) are contained inside `MvccRwLock` and sent across thread boundaries. The data races can potentially lead to memory corruption (as demonstrated in the PoC from the original report issue).

Also, safe APIs of `MvccRwLock` allow aliasing violations by allowing `&T` and `LockResult<MutexGuard<Box<T>>>` to co-exist in conflicting lifetime regions. The APIs of `MvccRwLock` should either be marked as `unsafe` or `MbccRwLock` should be changed to private or pub(crate).
Remote Code Execution via unsafe classes in otherwise permitted modules
Published: 2021-08-05T17:01:30Z
Aliases: CVE-2021-32807

### Impact
The module `AccessControl` defines security policies for Python code used in restricted code within Zope applications. Restricted code is any code that resides in Zope's object database, such as the contents of `Script (Python)` objects. 

The policies defined in `AccessControl` severely restrict access to Python modules and only exempt a few that are deemed safe, such as Python's `string` module. However, full access to the `string` module also allows access to the class `Formatter`, which can be overridden and extended within `Script (Python)` in a way that provides access to other unsafe Python libraries. Those unsafe Python libraries can be used for remote code execution.

By default, you need to have the admin-level Zope "Manager" role to add or edit `Script (Python)` objects through the web. Only sites that allow untrusted users to add/edit these scripts through the web - which would be a very unusual configuration to begin with - are at risk.

### Patches
The problem has been fixed in AccessControl 4.3 and 5.2.
Only AccessControl versions 4 and 5 are vulnerable, and only on Python 3, not Python 2.7.

### Workarounds
A site administrator can restrict adding/editing `Script (Python)` objects through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing these scripts through the web should be restricted to trusted users only. This is the default configuration in Zope.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [AccessControl issue tracker](https://github.com/zopefoundation/AccessControl/issues)
* Email us at [security@plone.org](mailto:security@plone.org)
Directory Traversal in Archive_Tar
Published: 2021-08-09T20:40:06Z
Aliases: CVE-2021-32610

In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.
Integer overflow due to conversion to unsigned
Published: 2021-08-25T14:43:37Z
Aliases: CVE-2021-37645

### Impact
The implementation of `tf.raw_ops.QuantizeAndDequantizeV4Grad` is vulnerable to an integer overflow issue caused by converting a signed integer value to an unsigned one and then allocating memory based on this value.

```python
import tensorflow as tf

tf.raw_ops.QuantizeAndDequantizeV4Grad(
  gradients=[1.0,2.0],
  input=[1.0,1.0],
  input_min=[0.0],
  input_max=[10.0],
  axis=-100)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/quantize_and_dequantize_op.cc#L126) uses the `axis` value as the size argument to `absl::InlinedVector` constructor. But, the constructor uses an unsigned type for the argument, so the implicit conversion transforms the negative value to a large integer.

### Patches
We have patched the issue in GitHub commit [96f364a1ca3009f98980021c4b32be5fdcca33a1](https://github.com/tensorflow/tensorflow/commit/96f364a1ca3009f98980021c4b32be5fdcca33a1).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, and TensorFlow 2.4.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Out of bounds access in compact_arena
Published: 2021-08-25T20:44:48Z
Aliases: CVE-2019-16139

Affected versions of this crate did not properly implement the generativity, because the invariant lifetimes were not necessarily dropped.

This allows an attacker to mix up two arenas, using indices created from one arena with another one. This might lead to an out-of-bounds read or write access into the memory reserved for the arena.

The flaw was corrected by implementing generativity correctly in version 0.4.0.
Improper Certificate Validation in openssl
Published: 2021-08-25T20:43:11Z
Aliases: CVE-2016-10931

All versions of rust-openssl prior to 0.9.0 contained numerous insecure defaults including off-by-default certificate verification and no API to perform hostname verification. Unless configured correctly by a developer, these defaults could allow an attacker to perform man-in-the-middle attacks. The problem was addressed in newer versions by enabling certificate verification by default and exposing APIs to perform hostname verification. Use the SslConnector and SslAcceptor types to take advantage of these new features (as opposed to the lower-level SslContext type).
Heap OOB in boosted trees
Published: 2021-08-25T14:42:20Z
Aliases: CVE-2021-37664

### Impact
An attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to `BoostedTreesSparseCalculateBestFeatureSplit`:

```python
import tensorflow as tf

tf.raw_ops.BoostedTreesSparseCalculateBestFeatureSplit(
  node_id_range=[0,10],
  stats_summary_indices=[[1, 2, 3, 0x1000000]],
  stats_summary_values=[1.0],
  stats_summary_shape=[1,1,1,1],
  l1=l2=[1.0],
  tree_complexity=[0.5],
  min_node_weight=[1.0],
  logits_dimension=3,
  split_type='inequality')                                                                                                                                                                                                                                                                
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/boosted_trees/stats_ops.cc) needs to validate that each value in `stats_summary_indices` is in range.
  
### Patches
We have patched the issue in GitHub commit [e84c975313e8e8e38bb2ea118196369c45c51378](https://github.com/tensorflow/tensorflow/commit/e84c975313e8e8e38bb2ea118196369c45c51378).
  
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
  
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Data races in reffers
Published: 2021-08-25T20:51:40Z
Aliases: CVE-2020-36203

ARefss<'a, V> is a type that is assumed to contain objects that are Send + Sync.

In the affected versions of this crate, Send/Sync traits are unconditionally implemented for ARefss<'a, V>.

By using the ARefss::map() API, we can insert a !Send or !Sync object into ARefss<'a, V>. After that, it is possible to create a data race to the inner object of ARefss<'a, V>, which can lead to undefined behavior & memory corruption.

The flaw was corrected in commit `6dd7ca0` by adding trait bound V: Send + Sync to ARefss::map() API.
Data races in lock_api
Published: 2021-08-25T20:49:37Z
Aliases: CVE-2020-35914

An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of RwLockWriteGuard unsoundness.
Directory Traversal in elFinder.AspNet
Published: 2021-08-09T20:42:13Z
Aliases: CVE-2021-23415

This affects the package elFinder.AspNet before 1.1.1.
 The user-controlled file name is not properly sanitized before it is used to create a file system path.
Out of bounds read in Ozone
Published: 2021-08-25T20:47:46Z
Aliases: CVE-2020-35877

An issue was discovered in the ozone crate through version 0.1.0 for Rust. Memory safety is violated because of out-of-bounds access.
Unexpected panic in multihash
Published: 2021-08-25T20:49:41Z
Aliases: CVE-2020-35909

In versions prior 0.11.3 it's possible to make from_slice panic by feeding it certain malformed input. It's never documented that from_slice (and from_bytes which wraps it) can panic, and its' return type (Result<Self, DecodeError>) suggests otherwise. In practice, from_slice/from_bytes is frequently used in networking code and is being called with unsanitized data from untrusted sources. This can allow attackers to cause DoS by causing an unexpected panic in the network client's code..
HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0
Published: 2021-08-30T17:22:53Z
Aliases: CVE-2021-38553

HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in Vault and Vault Enterprise 1.8.0.
Unaligned references in Obstack
Published: 2021-08-25T20:48:12Z
Aliases: CVE-2020-35894

Obstack generates unaligned references for types that require a large alignment.
Free of uninitialized memory in telemetry
Published: 2021-08-25T20:54:22Z
Aliases: CVE-2021-29937

An issue was discovered in the telemetry crate through 0.1.2 for Rust. There is a drop of uninitialized memory if a value.clone() call panics within misc::vec_with_size()
Memory corruption in smallvec
Published: 2021-08-25T20:43:58Z
Aliases: CVE-2019-15554

Attempting to call grow on a spilled SmallVec with a value less than the current capacity causes corruption of memory allocator data structures. An attacker that controls the value passed to grow may exploit this flaw to obtain memory contents or gain remote code execution.
Certificate check bypass in openssl-src
Published: 2021-08-25T20:54:00Z
Aliases: CVE-2021-3450

The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a "purpose" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named "purpose" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j).
Free of uninitialized memory in adtensor
Published: 2021-08-25T20:54:18Z
Aliases: CVE-2021-29936

An issue was discovered in the adtensor crate through 0.0.3 for Rust. There is a drop of uninitialized memory via the FromIterator implementation for Vector and Matrix.
Division by 0 in `ResourceGather`
Published: 2021-08-25T14:43:04Z
Aliases: CVE-2021-37653

### Impact
An attacker can trigger a crash via a floating point exception in `tf.raw_ops.ResourceGather`:

```python
import tensorflow as tf

tensor = tf.constant(value=[[]],shape=(0,1),dtype=tf.uint32)
v = tf.Variable(tensor)
tf.raw_ops.ResourceGather(
  resource=v.handle,
  indices=[0],
  dtype=tf.uint32,
  batch_dims=1,
  validate_indices=False)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/resource_variable_ops.cc#L725-L731) computes the value of a value, `batch_size`, and then divides by it without checking that this value is not 0. 

### Patches
We have patched the issue in GitHub commit  [ac117ee8a8ea57b73d34665cdf00ef3303bc0b11](https://github.com/tensorflow/tensorflow/commit/ac117ee8a8ea57b73d34665cdf00ef3303bc0b11).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions. 

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Cachet vulnerable to forced reinstall
Published: 2021-08-30T16:11:33Z
Aliases: CVE-2021-39173

### Impact

Authenticated users, regardless of their privileges (_User_ or _Admin_), can trick Cachet and install the instance again, leading to arbitrary code execution on the server.

### Patches

This issue was addressed by improving the middleware `ReadyForUse`, which now performs a stricter validation of the instance name. 

### Workarounds

Only allow trusted source IP addresses to access to the administration dashboard.

### References

- https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection

### For more information

If you have any questions or comments about this advisory, you can contact:
- The original reporters, by sending an email to vulnerability.research [at] sonarsource.com;
- The maintainers, by opening an issue on this repository.
Update unsound DrainFilter and RString::retain
Published: 2021-08-25T21:01:35Z
Aliases: CVE-2020-36212

An issue was discovered in the abi_stable crate before 0.9.1 for Rust. DrainFilter lacks soundness because of a double drop.
Uncontrolled recursion leads to abort in deserialization
Published: 2021-08-25T21:00:18Z

Affected versions of this crate did not properly check for recursion while deserializing aliases. This allows an attacker to make a YAML file with an alias referring to itself causing an abort. The flaw was corrected by checking the recursion depth.
ordered_float:NotNan may contain NaN after panic in assignment operators
Published: 2021-08-25T20:50:30Z
Aliases: CVE-2020-35923

After using an assignment operators such as NotNan::add_assign, NotNan::mul_assign, etc., it was possible for the resulting NotNan value to contain a NaN. This could cause undefined behavior in safe code, because the safe NotNan::cmp method contains internal unsafe code that assumes the value is never NaN. (It could also cause undefined behavior in third-party unsafe code that makes the same assumption, as well as logic errors in safe code.)

This was mitigated starting in version 0.4.0, by panicking if the assigned value is NaN. However, in affected versions from 0.4.0 onward, code that uses the NotNan value during unwinding, or that continues after catching the panic, could still observe the invalid value and trigger undefined behavior.

The flaw is fully corrected in versions 1.1.1 and 2.0.1, by ensuring that the assignment operators panic without modifying the operand, if the result would be NaN.
Out of bounds read in bra
Published: 2021-08-25T20:52:53Z
Aliases: CVE-2021-25905

Buffered Random Access (BRA) provides easy random memory access to a sequential source of data in Rust. This is achieved by greedily retaining all memory read from a given source. Buffered Random Access (BRA) provides easy random memory access to a sequential source of data in Rust. An issue was discovered in the bra crate before 0.1.1 for Rust. It lacks soundness because it can read uninitialized memory.
Data races in generator
Published: 2021-08-25T20:57:05Z
Aliases: CVE-2020-36471

The `Generator` type is an iterable which uses a generator function that yields
values. In affected versions of the crate, the provided function yielding values
had no `Send` bounds despite the `Generator` itself implementing `Send`.

The generator function lacking a `Send` bound means that types that are
dangerous to send across threads such as `Rc` could be sent as part of a
generator, potentially leading to data races.

This flaw was fixed in commit [`f7d120a3b`](https://github.com/Xudong-Huang/generator-rs/commit/f7d120a3b724d06a7b623d0a4306acf8f78cb4f0)
by enforcing that the generator function be bound by `Send`.
Padding oracle attacks
Published: 2021-08-13T15:22:24Z
Aliases: CVE-2010-3300

It was found that all OWASP ESAPI for Java up to version 2.0 RC2 are vulnerable to padding oracle attacks.
Improper Input Validation in renderdoc
Published: 2021-08-25T20:44:51Z
Aliases: CVE-2019-16142

Affected versions of this crate exposed several methods which took self by immutable reference, despite the requesting the RenderDoc API to set a mutable value internally. This is technically unsound and calling these methods from multiple threads without synchronization could lead to unexpected and unpredictable behavior. The flaw was corrected in release 0.5.0.
Double-free in id-map
Published: 2021-08-25T20:55:11Z
Aliases: CVE-2021-30455

The clone_from implementation for IdMap drops the values present in the map and then begins cloning values from the other map. If a .clone() call pancics, then the afformentioned dropped elements can be freed again.
get_or_insert

get_or_insert reserves space for a value, before calling the user provided insertion function f. If the function f panics then uninitialized or previously freed memory can be dropped.
remove_set

When removing a set of elements, ptr::drop_in_place is called on each of the element to be removed. If the Drop impl of one of these elements panics then the previously dropped elements can be dropped again.
Cross-site scripting in imgURL
Published: 2021-08-30T16:25:26Z
Aliases: CVE-2021-38713

imgURL 2.31 allows XSS via an X-Forwarded-For HTTP header.
Counter overflow in chacha20
Published: 2021-08-25T20:45:20Z
Aliases: CVE-2019-25005

An issue was discovered in the chacha20 crate before 0.2.3 for Rust. A ChaCha20 counter overflow makes it easier for attackers to determine plaintext.