aswin1906/github-advisory-2021.csv huggingface dataset:
Authorization Policy Bypass Due to Case Insensitive Host Comparison
Published: 2021-08-30T16:15:56Z
Aliases: CVE-2021-39155

### Impact
According to [RFC 4343](https://datatracker.ietf.org/doc/html/rfc4343), Istio authorization policy should compare the hostname in the HTTP Host header in a case insensitive way, but currently the comparison is case sensitive.  The Envoy proxy will route the request hostname in a case-insensitive way which means the authorization policy could be bypassed.
 
As an example, the user may have an authorization policy that rejects request with hostname "httpbin.foo" for some source IPs, but the attacker can bypass this by sending the request with hostname "Httpbin.Foo".

### Patches
* Istio 1.11.1 and above
* Istio 1.10.4 and above
* Istio 1.9.8 and above

### Workarounds
A Lua filter may be written to normalize Host header before the authorization check.  This is similar to the Path normalization presented in the [Security Best Practices](https://istio.io/latest/docs/ops/best-practices/security/#case-normalization) guide.

### References
More details can be found in the [Istio Security Bulletin](https://istio.io/latest/news/security/istio-security-2021-008).

### For more information
If you have any questions or comments about this advisory, please email us at istio-security-vulnerability-reports@googlegroups.com
Free of uninitialized memory in autorand
Published: 2021-08-25T20:50:41Z
Aliases: CVE-2020-36210

An issue was discovered in the autorand crate before 0.2.3 for Rust. Because of impl Random on arrays, uninitialized memory can be dropped when a panic occurs, leading to memory corruption.
Code injection issue for java-spring-cloud-stream-template
Published: 2021-08-25T14:45:52Z
Aliases: CVE-2021-37694

The following was initially reported by @jonaslagoni:

Given the following command:
`ag ./dummy.json @asyncapi/java-spring-cloud-stream-template --force-write --output ./output`

With the following AsyncAPI document:
```json
{
  "asyncapi": "2.0.0",
  "info": {
    "title": "Streetlight",
    "version": "1.0.0"
  },
  "defaultContentType": "json",
  "channels": {
    "security/audit/channel": {
      "description": "Channel for the turn on command which should turn on the streetlight",
      "parameters": {
        "streetlight_id": {
          "description": "The ID of the streetlight",
          "schema": {
            "type": "string"
          }
        }
      },
      "publish": {
        "operationId": "test() { System.out.println(\"injected\"); return test(0); }\n public Consumer<CustomClass> someothername",
        "message": {
          "name": "TurnonCommand",
          "payload": {
            "$ref": "#/components/schemas/CustomClass"
          }
        }
      }
    }
  },
  "components": {
    "schemas" : {
      "CustomClass": {
        "type": "object",
        "properties": {
          "prop": { 
              "type": "string"
          }
        }
      }
    }
  }
}
```

Which changes the following output: 

```java
...
  @Bean
  public Consumer<CustomClass> test() {
    // Add business logic here.
    return null;
  }
...
```
To
```java
...
  @Bean
  public Consumer<CustomClass> test() { System.out.println("injected"); return someothername(); }
  public Consumer<CustomClass> someothername() {
    // Add business logic here.
    return null;
  }
...
```
Out of bounds write in stackvector
Published: 2021-08-25T20:54:14Z
Aliases: CVE-2021-29939

StackVec::extend used the lower and upper bounds from an Iterator's size_hint to determine how many items to push into the stack based vector. If the size_hint implementation returned a lower bound that was larger than the upper bound, StackVec would write out of bounds and overwrite memory on the stack. As mentioned by the size_hint documentation, size_hint is mainly for optimization and incorrect implementations should not lead to memory safety issues.
Data Flow Sanitation Issue Fix 
Published: 2021-08-30T17:20:41Z
Aliases: CVE-2021-32759

### Impact
Due to missing sanitation in data flow it was possible for admin users to upload arbitrary executable files to the server.
Miner fails to get block template when a cell used as a cell dep has been destroyed.
Published: 2021-08-25T21:01:21Z

### Impact

The RPC `get_block_template` fails when a cell has been used as a cell dep and an input in the different transactions.

Say cell C is used as a dep group in the transaction A, and is destroyed in the transaction B.

The node adds transaction A first, then B into the transaction pool. They are both valid. But when generating the block template, if the fee rate of B is higher, it comes before A, which will invalidate A. Currently the RPC `get_block_template` will fail instead of dropping A.

### Patch

First, the `get_block_template` should not fail but dropping the conflict transactions.

Then we can propose solution to this issue. Here is an example. When a transaction is added to the pool, the pool must consider it depending on all the transactions which dep cell (direct or indirect via dep group) has been destroyed in this transaction. Because future transactions using the destroyed cells as dep will be rejected, the spending transaction only need to wait for all the existing dep transactions on chain.

### Workaround

1. Submit transaction B when A is already on chain.
2. Let B depend on A explicitly, there are several solutions:
    * a. Add any output cell on A as a dep cell or input in B.
    * b. Merge A and B. CKB allows using the same cell as both dep and input in the same transaction.
3. Ensure the fee rate of B is less than A so A always has higher priority.
Data races in tiny_future
Published: 2021-08-25T21:00:32Z

`tiny_future` contains a light-weight implementation of `Future`s. The `Future` type it has lacked bound on its `Send` and `Sync` traits. This allows for a bug where non-thread safe types such as `Cell` can be used in `Future`s and cause data races in concurrent programs. The flaw was corrected in commit `c791919` by adding trait bounds to `Future`'s `Send` and `Sync`.
Command injection in Yamale
Published: 2021-08-11T15:19:23Z
Aliases: CVE-2021-38305

23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale.
Wrong memory orderings violates mutual exclusion in spin
Published: 2021-08-25T20:44:46Z
Aliases: CVE-2019-16137

Wrong memory orderings inside the RwLock implementation allow for two writers to acquire the lock at the same time. The drop implementation used Ordering::Relaxed, which allows the compiler or CPU to reorder a mutable access on the locked data after the lock has been yielded.

Only users of the RwLock implementation are affected. Users of Once (including users of lazy_static with the spin_no_std feature enabled) are NOT affected.

On strongly ordered CPU architectures like x86, the only real way that this would lead to a memory corruption is if the compiler reorders an access after the lock is yielded, which is possible but in practice unlikely. It is a more serious issue on weakly ordered architectures such as ARM which, except in the presence of certain instructions, allow the hardware to decide which accesses are seen at what times. Therefore on an ARM system it is likely that using the wrong memory ordering would result in a memory corruption, even if the compiler itself doesn't reorder the memory accesses in a buggy way.
Reference binding to nullptr in map operations
Published: 2021-08-25T14:41:42Z
Aliases: CVE-2021-37671

### Impact
An attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.Map*` and `tf.raw_ops.OrderedMap*` operations:

```python
import tensorflow as tf
  
tf.raw_ops.MapPeek(
  key=tf.constant([8],dtype=tf.int64),
  indices=[],
  dtypes=[tf.int32],
  capacity=8,
  memory_limit=128)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/map_stage_op.cc#L222-L248) has a check in place to ensure that `indices` is in ascending order, but does not check that `indices` is not empty.
    
### Patches
We have patched the issue in GitHub commit [532f5c5a547126c634fefd43bbad1dc6417678ac](https://github.com/tensorflow/tensorflow/commit/532f5c5a547126c634fefd43bbad1dc6417678ac).
                       
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
    
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Observable Discrepancy in libsecp256k1-rs
Published: 2021-08-25T21:01:27Z
Aliases: CVE-2019-20399

A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel attack.
Unaligned memory allocation in chunky
Published: 2021-08-25T20:58:13Z
Aliases: CVE-2020-36433

An issue was discovered in the chunky crate through 2020-08-25 for Rust. The Chunk API does not honor an alignment requirement.
Improper Input Validation in cookie
Published: 2021-08-25T20:43:02Z
Aliases: CVE-2017-18589

Affected versions of this crate use the time crate and the method Duration::seconds to parse the Max-Age duration cookie setting. This method will panic if the value is greater than 2^64/1000 and less than or equal to 2^64, which can result in denial of service for a client or server.

This flaw was corrected by explicitly checking for the Max-Age being in this integer range and clamping the value to the maximum duration value.
TimelockController vulnerability in OpenZeppelin Contracts 
Published: 2021-08-30T16:12:38Z
Aliases: CVE-2021-39167

### Impact

A vulnerability in `TimelockController` allowed an actor with the executor role to take immediate control of the timelock, by resetting the delay to 0 and escalating privileges, thus gaining unrestricted access to assets held in the contract. Instances with the executor role set to "open" allow anyone to use the executor role, thus leaving the timelock at risk of being taken over by an attacker.

### Patches

A fix is included in the following releases of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`:
- 4.3.1
- 3.4.2
- 3.4.2-solc-0.7

Deployed instances of `TimelockController` should be replaced with a fixed version by migrating all assets, ownership, and roles.

### Workarounds

Revoke the executor role from accounts not strictly under the team's control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining.

### References

[Post-mortem](https://forum.openzeppelin.com/t/timelockcontroller-vulnerability-postmortem/14958).

### Credits

The issue was identified by an anonymous white hat hacker through [Immunefi](https://immunefi.com/).

### For more information

If you have any questions or comments about this advisory, or need assistance executing the mitigation, email us at security@openzeppelin.com.
Cross-site Scripting in ammonia
Published: 2021-08-25T20:55:56Z
Aliases: CVE-2021-38193

An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.
Arbitrary return types in xcb
Published: 2021-08-25T20:53:27Z
Aliases: CVE-2021-26956

The function xcb::xproto::GetPropertyReply::value() returns a slice of type T where T is an unconstrained type parameter. The raw bytes received from the X11 server are interpreted as the requested type. The users of the xcb crate are advised to only call this function with the intended types. These are u8, u16, and u32.

This issue is tracked here: https://github.com/rust-x-bindings/rust-xcb/issues/95
Flaw in streaming state in orion
Published: 2021-08-25T20:43:18Z
Aliases: CVE-2018-20999

Affected versions of this crate did not properly reset a streaming state. Resetting a streaming state, without finalising it first, creates incorrect results. The flaw was corrected by not first checking if the state had already been reset, when calling reset().
Null pointer deference in openssl-src 
Published: 2021-08-25T20:45:15Z
Aliases: CVE-2020-1967

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).
October CMS auth bypass and account takeover
Published: 2021-08-30T16:13:50Z
Aliases: CVE-2021-29487

### Impact

An attacker can exploit this vulnerability to bypass authentication using a specially crafted persist cookie.

- To exploit this vulnerability, an attacker must obtain a Laravel’s secret key for cookie encryption and signing.
- Due to the logic of how this mechanism works, a targeted user account must be logged in while
the attacker is exploiting the vulnerability.
- Authorization via persist cookie not shown in access logs.

### Patches

- Issue has been patched in Build 472 and v1.1.5
- [Shortened patch instructions](https://github.com/daftspunk/CVE-2021-32648)

### Workarounds

Apply https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374 and https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9 to your installation manually if you are unable to upgrade.

[**Update 2022-01-20**] [Shortened patch instructions](https://github.com/daftspunk/CVE-2021-32648) can be found here.

### Recommendations

We recommend the following steps to make sure your server stays secure:

- Keep server OS and system software up to date.
- Keep October CMS software up to date.
- Use a multi-factor authentication plugin.
- Change the [default backend URL](https://github.com/octobercms/october/blob/1.1/config/cms.php#L39) or block public access to the backend area.
- Include the [Roave/SecurityAdvisories](https://github.com/Roave/SecurityAdvisories) Composer package to ensure that your application doesn't have installed dependencies with known security vulnerabilities.

### References

Bugs found as part of Solar Security CMS Research. Credits to:
• Andrey Basarygin
• Andrey Guzei
• Mikhail Khramenkov
• Alexander Sidukov
• Maxim Teplykh

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)
Cross-Site Request Forgery in express-cart
Published: 2021-08-30T17:22:15Z
Aliases: CVE-2020-22403

The express-cart package through 1.1.10 for Node.js allows CSRF.
FPE in TFLite pooling operations
Published: 2021-08-25T14:40:13Z
Aliases: CVE-2021-37684

### Impact
The implementations of pooling in TFLite are vulnerable to division by 0 errors as there are no checks for divisors not being 0.

### Patches 
We have patched the issue in GitHub commit [dfa22b348b70bb89d6d6ec0ff53973bacb4f4695](https://github.com/tensorflow/tensorflow/commit/dfa22b348b70bb89d6d6ec0ff53973bacb4f4695).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Unlimited transforms allowed for signed nodes
Published: 2021-08-30T16:11:57Z
Aliases: CVE-2021-39171

### Impact
A malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an effective way to perform a denial-of-service attack.

### Patches
This has been resolved in version 3.1.0. The resolution is to limit the number of allowable transforms to 2.

### References
https://github.com/node-saml/passport-saml/pull/595
Cross Site Scripting (XSS) in Quokka
Published: 2021-08-30T16:23:26Z
Aliases: CVE-2020-18702

Cross Site Scripting (XSS) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the 'Username' parameter in the component 'quokka/admin/actions.py'.
Uncontrolled recursion in ammonia
Published: 2021-08-25T20:44:03Z
Aliases: CVE-2019-15542

An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.
Use after free in string-interner
Published: 2021-08-25T20:44:15Z
Aliases: CVE-2019-16882

Affected versions of this crate did not clone contained strings when an interner is cloned. Interners have raw pointers to the contained strings, and they keep pointing the strings which the old interner owns, after the interner is cloned. If a new cloned interner is alive and the old original interner is dead, the new interner has dangling pointers to the old interner's storage, which is already dropped.

This allows an attacker to read the already freed memory. The dangling pointers are used by the interners to check a string is already interned. An attacker can do brute force attack to get the data pointed by the dangling pointer.
qiita-markdown Cross-site Scripting vulnerability
Published: 2021-08-02T17:22:07Z
Aliases: CVE-2021-28833

Increments Qiita::Markdown before 0.34.0 allows XSS via a crafted gist link, a different vulnerability than CVE-2021-28796.
Reference binding to nullptr in unicode encoding
Published: 2021-08-25T14:42:09Z
Aliases: CVE-2021-37667

### Impact
An attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.UnicodeEncode`:

```python
import tensorflow as tf
from tensorflow.python.ops import gen_string_ops

gen_string_ops.unicode_encode(
  input_values=[],
  input_splits=[],
  output_encoding='UTF-8',
  errors='ignore',
  replacement_char='a')
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/unicode_ops.cc#L533-L539) reads the first dimension of the `input_splits` tensor before validating that this tensor is not empty: 

```cc
  const Tensor& input_splits = context->input(1);
  const auto input_splits_flat = input_splits.flat<SPLITS_TYPE>();
  TensorShape output_shape({input_splits.dim_size(0) - 1});
```

### Patches
We have patched the issue in GitHub commit [2e0ee46f1a47675152d3d865797a18358881d7a6](https://github.com/tensorflow/tensorflow/commit/2e0ee46f1a47675152d3d865797a18358881d7a6).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
File exposure in pleaser
Published: 2021-08-25T21:01:41Z
Aliases: CVE-2021-31153

pleaser before 0.4.0 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.
OS Command Injection in bikeshed
Published: 2021-08-30T16:25:35Z
Aliases: CVE-2021-23422

This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing Inline Tag Command metadata is processed. When an arbitrary OS command is executed, the command output would be included in the HTML output.
Race condition in tokio
Published: 2021-08-25T20:55:51Z
Aliases: CVE-2021-38191

When aborting a task with JoinHandle::abort, the future is dropped in the thread calling abort if the task is not currently being executed. This is incorrect for tasks spawned on a LocalSet. This can easily result in race conditions as many projects use Rc or RefCell in their Tokio tasks for better performance.
Clipboard-based DOM-XSS
Published: 2021-08-12T20:42:17Z
Aliases: CVE-2021-37700

### Impact

A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown library. If the clipboard data contains the string `<table>`, a **div** is dynamically created, and the clipboard content is copied into its **innerHTML** property without any sanitization, resulting in improper execution of JavaScript in the browser of the victim (the user who pasted the code). Users directed to copy text from a malicious website and paste it into pages that utilize this library are affected.

The following @github/paste-markdown code snippet is triggered when the user pastes something and the browser's clipboard data contains an entry whose content-type is **text/HTML**.

```typescript
function generateText(transfer: DataTransfer): string | undefined {
  if (Array.from(transfer.types).indexOf('text/html') === -1) return

  let html = transfer.getData('text/html')
  if (!/<table/i.test(html)) return

  html = html.replace(/<meta.*?>/, '')

  const el = document.createElement('div')
  el.innerHTML = html
  const tables = el.querySelectorAll('table')

  for (const table of tables) {
    if (table.closest('[data-paste-markdown-skip]')) {
      table.replaceWith(new Text(table.textContent || ''))
    }
    const formattedTable = tableMarkdown(table)
    table.replaceWith(new Text(formattedTable))
  }

  return el.innerHTML
}
```

### Patches
A security patch was released in [version 0.3.4](https://github.com/github/paste-markdown/releases/tag/v0.3.4).

### Workarounds
A Content Security Policy that prevents `unsafe-inline` helps reduce the likelihood of this vulnerability being exploited in modern browsers.

<!--
### References
_Are there any links users can visit to find out more?_

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [example link to repo](http://example.com)
* Email us at [example email address](mailto:example@example.com)
*
-->
Manipulation of product reviews via API
Published: 2021-08-30T16:14:00Z
Aliases: CVE-2021-37707

### Impact
Manipulation of product reviews via API

### Patches
We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
Use-after-free in actix-http
Published: 2021-08-25T20:49:39Z
Aliases: CVE-2020-35901

An issue was discovered in the actix-http crate before 2.0.0-alpha.1 for Rust. There is a use-after-free in BodyStream.