aswin1906/github-advisory-2021.csv huggingface dataset:
Regular Expression Denial of Service in Addressable templates
Published: 2021-07-12T16:58:33Z
Aliases: CVE-2021-32740

### Impact

Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected.

### Patches

The vulnerability was introduced in version 2.3.0 (previously yanked) and has been present in all subsequent versions up to, and including, 2.7.0. It is fixed in version 2.8.0.

### Workarounds

The vulnerability can be avoided by only creating Template objects from trusted sources that have been validated not to produce catastrophic backtracking.

### References

- https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
- https://cwe.mitre.org/data/definitions/1333.html
- https://www.regular-expressions.info/catastrophic.html

### For more information
If you have any questions or comments about this advisory:
* [Open an issue](https://github.com/sporkmonger/addressable/issues)
Lenient Parsing of Content-Length Header When Prefixed with Plus Sign
Published: 2021-07-12T16:54:20Z
Aliases: CVE-2021-32715

### Summary

hyper's HTTP/1 server code had a flaw that incorrectly parses and accepts requests with a `Content-Length` header with a prefixed plus sign, when it should have been rejected as illegal. This combined with an upstream HTTP proxy that doesn't parse such `Content-Length` headers, but forwards them, can result in "request smuggling" or "desync attacks".

### Vulnerability

The flaw exists in all prior versions of hyper, if built with [`rustc` v1.5.0 or newer](https://github.com/rust-lang/rust/pull/28826/commits/123a83326fb95366e94a3be1a74775df4db97739).

Example:

```
GET / HTTP/1.1
Host: example.com
Content-Length: +3

abc
```

This request gets accepted and hyper reads the body as abc. The request _should_ be rejected, according to RFC 7230, since the ABNF for `Content-Length` only allows for `DIGIT`s. This is due to using the `FromStr` implementation for `u64` in the standard library. By differing from the spec, it is possible to send requests like these to endpoints that have different HTTP implementations, with different interpretations of the payload semantics, and cause "desync attacks".

In this particular case, an upstream proxy would need to error when parsing the `Content-Length`, but _not_ reject the request (swallowing its own error), and forwarding the request as-is with the `Content-Length` still included. _Then_ the upstream proxy and hyper would disagree on the length of the request body. The combination of these factors would be extremely rare.

Read more about desync attacks: https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn

### Impact

To determine if vulnerable, all these things must be true:

- **Using hyper as an HTTP server**. While the lenient decoder also exists in the client, a vulnerability does not exist around _responses_.
- **Using HTTP/1**. The HTTP/2 code uses a stricter parser.
- **Using a vulnerable HTTP proxy upstream to hyper**. If an upstream proxy correctly rejects the illegal `Content-Length` header, *OR* can parse the length with the plus sign, the desync attack cannot succeed.

### Patches

We have released the following patch versions:

- v0.14.10 (to be released when this advisor is published)

### Workarounds

Besides upgrading hyper, you can take the following options:

- Reject requests manually that contain a plus sign prefix in the `Content-Length` header.
- Ensure any upstream proxy handles `Content-Length` headers with a plus sign prefix.

### Credits
This issue was initially reported by [Mattias Grenfeldt](https://grenfeldt.dev/) and Asta Olofsson.
Out-of-bounds write in ChakraCore
Published: 2021-07-28T18:57:27Z
Aliases: CVE-2020-0832

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0768, CVE-2020-0823, CVE-2020-0825, CVE-2020-0826, CVE-2020-0827, CVE-2020-0828, CVE-2020-0829, CVE-2020-0830, CVE-2020-0831, CVE-2020-0833, CVE-2020-0848.
Denial of Service in SheetJS Pro
Published: 2021-07-22T19:48:17Z
Aliases: CVE-2021-32012

SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js (issue 1 of 2).
Incorrect Authorization in HashiCorp Consul
Published: 2021-07-28T17:57:57Z
Aliases: CVE-2020-7955

HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. Fixed in 1.6.3.
Buildah processes using chroot isolation may leak environment values to intermediate processes
Published: 2021-07-19T15:19:09Z
Aliases: CVE-2021-3602

### Impact
When running processes using "chroot" isolation, the process being run can examine the environment variables of its immediate parent and grandparent processes (CVE-2021-3602).  This isolation type is often used when running `buildah` in unprivileged containers, and it is often used to do so in CI/CD environments.  If sensitive information is exposed to the original `buildah` process through its environment, that information will unintentionally be shared with child processes which it starts as part of handling RUN instructions or during `buildah run`.  The commands that `buildah` is instructed to run can read that information if they choose to.

### Patches
Users should upgrade packages, or images which contain packages, to include version 1.21.3 or later.

### Workarounds
As a workaround, invoking `buildah` in a container under `env -i` to have it started with a reinitialized environment should prevent the leakage.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [buildah](https://github.com/containers/buildah/issues)
* Email us at [the buildah general mailing list](mailto:buildah@lists.buildah.io), or [the podman security mailing list](mailto:security@lists.podman.io) if it's sensitive.
SMTP command injection in lettre
Published: 2021-07-12T17:03:27Z
Aliases: CVE-2021-38189

### Impact

Affected versions of lettre allowed SMTP command injection through an attacker's controlled message body. The module for escaping lines starting with a period wouldn't catch a period that was placed after a double CRLF sequence, allowing the attacker to end the current message and write arbitrary SMTP commands after it.

### Fix

The flaw is fixed by correctly handling consecutive CRLF sequences.

### References

* [RUSTSEC-2021-0069](https://rustsec.org/advisories/RUSTSEC-2021-0069.html)
Out-of-bounds write in ChakraCore
Published: 2021-07-28T18:57:02Z
Aliases: CVE-2020-0825

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0768, CVE-2020-0823, CVE-2020-0826, CVE-2020-0827, CVE-2020-0828, CVE-2020-0829, CVE-2020-0830, CVE-2020-0831, CVE-2020-0832, CVE-2020-0833, CVE-2020-0848.
Cross-Site Scripting in Backend Grid View
Published: 2021-07-22T19:37:41Z
Aliases: CVE-2021-32669

### Problem
Failing to properly encode settings for _backend layouts_, the corresponding grid view is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability.

### Solution
Update to TYPO3 versions 8.7.41 ELTS, 9.5.28, 10.4.18, 11.3.1 that fix the problem described.

### Credits
Thanks to TYPO3 core merger Oliver Bartsch who reported and fixed the issue.
Resource Exhaustion in Spring Security
Published: 2021-07-02T18:33:34Z
Aliases: CVE-2021-22119

Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session or multiple sessions.
Denial of Service in SheetJS Pro
Published: 2021-07-22T19:47:15Z
Aliases: CVE-2021-32014

SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (CPU consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js.
Argo CD Insecure default administrative password
Published: 2021-07-26T21:19:27Z
Aliases: CVE-2020-8828

In Argo CD versions 1.8.0 and prior, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be kept secret and could wind up just about anywhere.

#### Workaround:

The recommended mitigation as described in the user documentation is to use SSO integration. The default admin password should only be used for initial configuration and then [disabled](https://argo-cd.readthedocs.io/en/stable/operator-manual/user-management/#disable-admin-user) or at least changed to a more secure password.
Ratpack's default client side session signing key is highly predictable
Published: 2021-07-01T17:02:26Z
Aliases: CVE-2021-29480

### Impact

The client side session module uses the application startup time as the signing key by default. This means that if an attacker can determine this time, and if encryption is not also used (which is recommended, but is not on by default), the session data could be tampered with by someone with the ability to write cookies. 

The default configuration is unsuitable for production use as an application restart renders all sessions invalid and is not multi-host compatible, but its use is not actively prevented.

### Vulnerability Location

https://github.com/ratpack/ratpack/blob/29434f7ac6fd4b36a4495429b70f4c8163100332/ratpack-session/src/main/java/ratpack/session/clientside/ClientSideSessionConfig.java#L29

### Patches

As of Ratpack 1.9.0 the default value is a securely randomly generated value, generated at application startup time. 

### Workarounds

Supply an alternative signing key, as per the documentation's recommendation.
Missing Authorization in TeamPass
Published: 2021-07-26T21:22:13Z
Aliases: CVE-2020-11671

Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to become a TeamPass administrator and read/modify all passwords via authenticated api/index.php REST API calls. NOTE: the API is not available by default.
Out-of-bounds write in ChakraCore
Published: 2021-07-28T18:56:52Z
Aliases: CVE-2020-0827

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0768, CVE-2020-0823, CVE-2020-0825, CVE-2020-0826, CVE-2020-0828, CVE-2020-0829, CVE-2020-0830, CVE-2020-0831, CVE-2020-0832, CVE-2020-0833, CVE-2020-0848.
Cross-Site Scripting in Query Generator & Query View
Published: 2021-07-22T19:36:58Z
Aliases: CVE-2021-32668

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.5)

### Problem
Failing to properly encode error messages, the components _QueryGenerator_ and _QueryView_ are vulnerable to both reflected and persistent cross-site scripting. A valid backend user account having administrator privileges is needed to exploit this vulnerability.

### Solution
Update to TYPO3 versions 8.7.41 ELTS, 9.5.28, 10.4.18, 11.3.1 that fix the problem described.

### Credits
Thanks to Richie Lee who reported this issue and to TYPO3 security team member Oliver Hader who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-010](https://typo3.org/security/advisory/typo3-core-sa-2021-010)
HashiCorp Consul L7 deny intention results in an allow action
Published: 2021-07-19T21:21:12Z
Aliases: CVE-2021-36213

In HashiCorp Consul before 1.10.1 (and Consul Enterprise), xds can generate a situation where a single L7 deny intention (with a default deny policy) results in an allow action.
Improper Restriction of Excessive Authentication Attempts in Argo API
Published: 2021-07-26T21:19:37Z
Aliases: CVE-2020-8827

As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence.
XSS Injection in Media Collection Title was possible
Published: 2021-07-02T18:32:18Z
Aliases: CVE-2021-32737

### Impact

A logged in admin user was possible to add a script injection (XSS) in the collection title which was executed.

### Workarounds

Manual patching the js files.

### For more information

If you have any questions or comments about this advisory:'

 - Email us at [security@sulu.io](mailto:security@sulu.io)
Missing Authentication for Critical Function in Saleor
Published: 2021-07-28T17:57:09Z
Aliases: CVE-2020-7964

An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data (e.g., name, address, and previous orders of any other customer).
A user without PR can reset user authentication failures information
Published: 2021-07-02T19:19:31Z
Aliases: CVE-2021-32729

### Impact
The script service method used to reset the authentication failures record can be executed by any user with Script rights and does not require Programming rights as it should have.
Note that being able to reset the authentication failure record mean that an attacker with script right might use it to try performing a bruteforce attack since she'd been able to virtually deactivate the mechanism introduced to mitigate those attacks.

### Patches
The problem has been patched in version 12.6.8, 12.10.4 and 13.0.

### Workarounds
There's no workaround besides upgrading and being careful on which user should have Script right access. Note that any bruteforce attack on the authentication should be visible in the logs since the authentication failures are logged.

### References
https://jira.xwiki.org/browse/XWIKI-18276

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira](http://jira.xwiki.org)
* Email us at [the security mailing-list](mailto:security@xwiki.org)
Basic-auth app bundle credential exposure in gatsby-source-wordpress
Published: 2021-07-19T15:21:41Z
Aliases: CVE-2021-32770

### Impact
The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time.  Users who are not initializing basic authentication credentials in the gatsby-config.js are not affected.

Example affected gatsby-config.js:
```
      resolve: 'gatsby-source-wordpress',
        auth: {
          htaccess: {
            username: leaked_username
            password: leaked_password,
          },
        },
```

### Patches
A patch has been introduced in gatsby-source-wordpress@4.0.8 and gatsby-source-wordpress@5.9.2 which mitigates the issue by filtering all variables specified in the `auth: { }` section.  Users that depend on this functionality are advised to upgrade to the latest release of gatsby-source-wordpress, run `gatsby clean` followed by a `gatsby build`.


### Workarounds
There is no known workaround at this time, other than manually editing the app.js file post-build.


### For more information
Email us at [security@gatsbyjs.com](mailto:security@gatsbyjs.com)
Denial of Service in SheetsJS Pro
Published: 2021-07-22T19:48:13Z
Aliases: CVE-2021-32013

SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js (issue 2 of 2).
Prototype Pollution in think-helper
Published: 2021-07-01T17:01:59Z
Aliases: CVE-2021-32736

### Impact

The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

### Patches

`think-helper@1.1.3` patched it, anyone used `think-helper` should upgrade to `>=1.1.3` version.

### References

https://cwe.mitre.org/data/definitions/1321.html

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [thinkjs/thinkjs](https://github.com/thinkjs/thinkjs)
* Email us at [i@imnerd.org](mailto:i@imnerd.org)
Integer Overflow in Chunked Transfer-Encoding
Published: 2021-07-12T16:55:37Z
Aliases: CVE-2021-32714

### Summary

hyper's HTTP server and client code had a flaw that could trigger an integer overflow when decoding chunk sizes that are too big. This allows possible data loss, or if combined with an upstream HTTP proxy that allows chunk sizes larger than hyper does, can result in "request smuggling" or "desync attacks".

### Vulnerability

Example:

```
GET / HTTP/1.1
Host: example.com
Transfer-Encoding: chunked

f0000000000000003
abc
0

```

hyper only reads the rightmost 64-bit integer as the chunk size. So it reads `f0000000000000003` as `3`. A loss of data can occur since hyper would then read only 3 bytes of the body. Additionally, an HTTP request smuggling vulnerability would occur if using a proxy which instead has prefix truncation in the chunk size, or that understands larger than 64-bit chunk sizes.

Read more about desync attacks: https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn

### Impact

To determine if vulnerable to _data loss_, these things must be true:

- **Using HTTP/1.1.** Since HTTP/2 does not use chunked encoding, it is not vulnerable.
- **Using hyper as a server or client.** The body would be improperly truncated in either case.
- **Users send requests or responses with chunk sizes greater than 18 exabytes**.

To determine if vulnerable to _desync attacks_, these things must be true:

- **Using an upstream proxy that allows chunks sizes larger than 64-bit.** If the proxy rejects chunk sizes that are too large, that request won't be forwarded to hyper.

### Patches

We have released the following patch versions:

 - v0.14.10 (to be released when this advisory is published)

### Workarounds

Besides upgrading hyper, you can take the following options:

- Reject requests manually that contain a `Transfer-Encoding` header.
- Ensure any upstream proxy rejects `Transfer-Encoding` chunk sizes greater than what fits in 64-bit unsigned integers.


### Credits
This issue was initially reported by [Mattias Grenfeldt](https://grenfeldt.dev/) and Asta Olofsson.
XML External Entity (XXE) Injection in JDOM
Published: 2021-07-27T19:02:56Z
Aliases: CVE-2021-33813

An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.  At this time there is not released fixed version of JDOM.  As a workaround, to avoid external entities being expanded, one can call `builder.setExpandEntities(false)` and they won't be expanded.
Cross-Site Scripting in Page Preview
Published: 2021-07-22T19:34:43Z
Aliases: CVE-2021-32667

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC` (5.0)

### Problem
Failing to properly encode _Page TSconfig_ settings, corresponding page preview module (_Web>View_) is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability.

### Solution
Update to TYPO3 versions 9.5.28, 10.4.18, 11.3.1 that fix the problem described.

### Credits
Thanks to TYPO3 core merger Oliver Bartsch who reported and fixed the issue.

### References
* [TYPO3-CORE-SA-2021-009](https://typo3.org/security/advisory/typo3-core-sa-2021-009)
Improper Input Validation in Centreon Web
Published: 2021-07-28T17:52:45Z
Aliases: CVE-2019-16405

Centreon Web 19.04.4 allows Remote Code Execution by an administrator who can modify Macro Expression location settings.
Allocation of resources without limits or throttling in keycloak-model-infinispan
Published: 2021-07-13T17:43:23Z
Aliases: CVE-2021-3637

A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in RootAuthenticationSessionEntity grows boundlessly which could lead to a DoS attack.
OS Command Injection in Locutus
Published: 2021-07-26T21:21:43Z
Aliases: CVE-2020-13619

php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution.
Information Disclosure in User Authentication
Published: 2021-07-26T21:16:28Z
Aliases: CVE-2021-32767

> ### Meta
> * CVSS: `AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C` (4.9)

### Problem
It has been discovered that user credentials have been logged as plaintext when explicitly using log level debug, which is not the _default_ configuration.

### Solution
Update to TYPO3 versions 7.6.52 ELTS, 8.7.41 ELTS, 9.5.28, 10.4.18, 11.3.1 that fix the problem described.

### Credits
Thanks to Ingo Schmitt who reported this issue, and to TYPO3 core & security team member Benni Mack who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-012](https://typo3.org/security/advisory/typo3-core-sa-2021-012)
Command injection in gitlogplus
Published: 2021-07-26T21:23:35Z
Aliases: CVE-2021-23412

All versions of package gitlogplus are vulnerable to Command Injection via the main functionality, as options attributes are appended to the command to be executed without sanitization.
Incorrect Authorization in TYPO3 extension
Published: 2021-07-26T21:41:22Z
Aliases: CVE-2020-25025

The l10nmgr (aka Localization Manager) extension before 7.4.0, 8.x before 8.7.0, and 9.x before 9.2.0 for TYPO3 allows Information Disclosure (translatable fields).
Missing Authorization in TYPO3 extension
Published: 2021-07-26T21:34:58Z
Aliases: CVE-2020-12700

The direct_mail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query.
XXE vulnerability in Jenkins Selenium HTML report Plugin
Published: 2021-07-02T18:36:13Z
Aliases: CVE-2021-21672

Selenium HTML report Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers with the ability to control the report files parsed using this plugin to have Jenkins parse a crafted report file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Selenium HTML report Plugin 1.1 disables external entity resolution for its XML parser.
Out-of-bounds write in ChakraCore
Published: 2021-07-28T18:57:47Z
Aliases: CVE-2020-0830

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0768, CVE-2020-0823, CVE-2020-0825, CVE-2020-0826, CVE-2020-0827, CVE-2020-0828, CVE-2020-0829, CVE-2020-0831, CVE-2020-0832, CVE-2020-0833, CVE-2020-0848.
Out-of-bounds write in ChakraCore
Published: 2021-07-28T18:57:55Z
Aliases: CVE-2020-0833

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0768, CVE-2020-0823, CVE-2020-0825, CVE-2020-0826, CVE-2020-0827, CVE-2020-0828, CVE-2020-0829, CVE-2020-0830, CVE-2020-0831, CVE-2020-0832, CVE-2020-0848.