aswin1906/github-advisory-2021.csv huggingface dataset:
Insertion of Sensitive Information into Log File in ansible
Published: 2021-06-01T21:38:33Z
Aliases: CVE-2021-20191

A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality.
Reflected cross-site scripting issue in Datasette
Published: 2021-06-07T21:47:41Z

### Impact

The `?_trace=1` debugging feature in Datasette does not correctly escape generated HTML, resulting in a [reflected cross-site scripting](https://owasp.org/www-community/attacks/xss/#reflected-xss-attacks) vulnerability.

This vulnerability is particularly relevant if your Datasette installation includes authenticated features using plugins such as [datasette-auth-passwords](https://datasette.io/plugins/datasette-auth-passwords) as an attacker could use the vulnerability to access protected data.

### Patches

Datasette 0.57 and 0.56.1 both include patches for this issue.

### Workarounds

If you run Datasette behind a proxy you can workaround this issue by rejecting any incoming requests with `?_trace=` or `&_trace=` in their query string parameters.

### References

- [OWASP guide to reflected cross-site scripting](https://owasp.org/www-community/attacks/xss/#reflected-xss-attacks)
- [Datasette issue #1360](https://github.com/simonw/datasette/issues/1360)

### For more information
If you have any questions or comments about this advisory:
* Open a discussion in [simonw/datasette](https://github.com/simonw/datasette/discussions)
* Email us at `swillison+datasette @ gmail.com`
Server-Side Request Forgery in Plone
Published: 2021-06-15T16:11:47Z
Aliases: CVE-2021-33510

Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file.
Cross-site Scripting in Apache Airflow
Published: 2021-06-18T18:43:42Z
Aliases: CVE-2021-28359

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions <1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fix the issue completely. Update to Airflow 1.10.15 or 2.0.2. Please also update your Python version to the latest available PATCH releases of the installed MINOR versions, example update to Python 3.6.13 if you are on Python 3.6. (Those contain the fix for CVE-2021-23336 https://nvd.nist.gov/vuln/detail/CVE-2021-23336).
XXE vulnerability in Launch import
Published: 2021-06-28T16:45:47Z
Aliases: CVE-2020-12642

| Release Date | Affected Projects | Affected Versions | Access Vector| Security Risk |
|--------------|-------------------|-------------------|---------------|---------------|
| Monday, May 4, 2020| [service-api](https://github.com/reportportal/service-api) | Every version, starting from 3.1.0 | Remote | Medium |

### Impact
Starting from version 3.1.0 we introduced a new feature of JUnit XML launch import. Unfortunately XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file that uses external entities for extraction of secrets from Report Portal service-api module or server-side request forgery.

Report Portal versions 4.3.12+ and 5.1.1+ disables external entity resolution for theirs XML parser.

We advise our users install the latest releases we built specifically to address this issue.

### Patches
Fixed with https://github.com/reportportal/service-api/pull/1201

### Binary Download
https://bintray.com/epam/reportportal/service-api/5.1.1
https://bintray.com/epam/reportportal/service-api/4.3.12

### Docker Container Download
* RP v4: `docker pull reportportal/service-api:4.3.12`
* RP v5: `docker pull reportportal/service-api:5.1.1`

### Acknowledgement
The issue was reported to Report Portal Team by an external security researcher.
Our Team thanks Julien M. for reporting the issue.

### For more information
If you have any questions or comments about this advisory email us: [support@reportportal.io](mailto:support@reportportal.io)
Improper Input Validation
Published: 2021-06-08T23:05:19Z
Aliases: CVE-2021-3499

A vulnerability was found in OVN Kubernetes in versions up to and including 0.3.0 where the Egress Firewall does not reliably apply firewall rules when there is multiple DNS rules. It could lead to potentially lose of confidentiality, integrity or availability of a service
Deserialization of Untrusted Data in NukeViet
Published: 2021-06-22T15:24:59Z
Aliases: CVE-2019-7725

includes/core/is_user.php in NukeViet before 4.3.04 deserializes the untrusted nvloginhash cookie (i.e., the code relies on PHP's serialization format when JSON can be used to eliminate the risk).
Erroneous Proof of Work calculation in geth
Published: 2021-06-29T21:12:56Z
Aliases: CVE-2020-26240

### Impact
An ethash mining DAG generation flaw in Geth could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected.

### Patches
This issue is also fixed as of 1.9.24. Thanks to @slavikus for bringing the issue to our attention and writing the fix. 

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)
* Email us at [security@ethereum.org](mailto:security@ethereum.org)
Cryptographically weak CSRF tokens in Apache MyFaces
Published: 2021-06-16T17:31:39Z
Aliases: CVE-2021-26296

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.


Mitigation:
Existing web.xml configuration parameters can be used to direct
MyFaces to use SecureRandom for CSRF token generation:

org.apache.myfaces.RANDOM_KEY_IN_VIEW_STATE_SESSION_TOKEN=secureRandom
org.apache.myfaces.RANDOM_KEY_IN_CSRF_SESSION_TOKEN=secureRandom
org.apache.myfaces.RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN=secureRandom
Shell command injection in Apache Syncope
Published: 2021-06-16T17:19:12Z
Aliases: CVE-2020-11977

In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including but not limited to file read, file write, and code execution.
Insufficiently random values in Ansible
Published: 2021-06-15T16:10:11Z
Aliases: CVE-2020-10729

A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template caching action for the same file since no re-evaluation happens. The highest threat from this vulnerability would be that all passwords are exposed at once for the file. This flaw affects Ansible Engine versions before 2.9.6.
Inconsistent Interpretation of HTTP Requests in github.com/gin-gonic/gin
Published: 2021-06-23T17:53:21Z
Aliases: CVE-2020-28483

When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header. This affects all versions of package github.com/gin-gonic/gin under 1.7.7.
Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint
Published: 2021-06-01T21:21:01Z
Aliases: CVE-2021-32635

### Impact

Due to incorrect use of a default URL, `singularity` action commands (`run`/`shell`/`exec`) specifying a container using a `library://` URI will always attempt to retrieve the container from the default remote endpoint (`cloud.sylabs.io`) rather than the configured remote endpoint.

An attacker may be able to push a malicious container to the default remote endpoint with a URI that is identical to the URI used by a victim with a non-default remote endpoint, thus executing the malicious container.

Only action commands (`run`/`shell`/`exec`) against `library://` URIs are affected. Other commands such as `pull` / `push` respect the configured remote endpoint.

### Patches

All users should upgrade to Singularity 3.7.4 or later.

A patch was applied at: https://github.com/sylabs/singularity/commit/d52ae9d13979733c5e987a566fae59ed6f1bf796

### Workarounds

Users who only interact with the default remote endpoint are not affected.

Installations with an execution control list configured to restrict execution to containers signed with specific secure keys are not affected.

### For more information

General questions about the impact of the advisory can be asked in the:

- [SingularityCE Slack Channel](https://singularityce.slack.com)
- [SingularityCE Mailing List](https://groups.google.com/g/singularity-ce)

Any sensitive security concerns should be directed to: security@sylabs.io

See our Security Policy here: https://sylabs.io/security-policy
Command injection in Apache Unomi
Published: 2021-06-16T17:17:24Z
Aliases: CVE-2021-31164

Apache Unomi prior to version 1.5.5 allows CRLF log injection because of the lack of escaping in the log statements.
Resource exhaustion in socket.io-parser
Published: 2021-06-30T16:51:31Z
Aliases: CVE-2020-36049

The `socket.io-parser` npm package before versions 3.3.2 and 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.
Exposure of sensitive information to an unauthorized actor in HyperKitty
Published: 2021-06-01T21:56:23Z
Aliases: CVE-2021-33038

An issue was discovered in management/commands/hyperkitty_import.py in HyperKitty prior to 1.3.5. When importing a private mailing list's archives, these archives are publicly visible for the duration of the import. For example, sensitive information might be available on the web for an hour during a large migration from Mailman 2 to Mailman 3.
Uncontrolled Resource Consumption in Pillow
Published: 2021-06-08T18:49:36Z
Aliases: CVE-2021-28677

An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.
Open Redirect
Published: 2021-06-29T18:32:39Z
Aliases: CVE-2018-15178

Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via an initial /\ substring in the user/login redirect_to parameter, related to the function isValidRedirect in routes/user/auth.go.
HTTP Request Smuggling in netius
Published: 2021-06-18T18:31:40Z
Aliases: CVE-2020-7655

netius prior to 1.17.58 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Transfer encoding header parsing which could allow for CL:TE or TE:TE attacks.
Deserialization of Untrusted Data in Flask-Caching
Published: 2021-06-18T18:33:40Z
Aliases: CVE-2021-33026

Flask-Cache adds easy cache support to Flask. The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage (e.g., filesystem, Memcached, Redis, etc.), they can construct a crafted payload, poison the cache, and execute Python code.

However, this is not a high-severity issue, as for an attack like this to work, an attacker must:

1. Be able to write arbitrary values to the cache
2. Be able to generate a cache key that will collide with a value being read by the application
3. Cause the application to read a maliciously-injected value

Any situation where all 3 of those is true is a situation where the application has larger problems; for example, if someone's able to inject malicious cached rendered pages into a Flask app's cache, then they can make the website say literally anything they want, regardless of whether it involves the execution of remote code. Basically, the Pickle vulnerability follows from a website already being extremely vulnerable (due to conditions 1 and 2 being met).
Insufficient Session Expiration in OpenStack Keystone
Published: 2021-06-09T17:34:09Z
Aliases: CVE-2020-12690

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.
Helm passes repository credentials to alternate domain
Published: 2021-06-23T18:14:15Z

While working on the Helm source, a Helm core maintainer discovered a situation where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository.

### Impact

The `index.yaml` within a Helm chart repository contains a reference where to get the chart archive for each version of a chart. The reference can be relative to the `index.yaml` file or a URL to location. The URL can point to any domain and this is a feature leveraged by Helm users. For example, an `index.yaml` file can be hosted on GitHub pages while the chart archives are hosted as GitHub releases. These are on different domain names and the `index.yaml` file points to the other domain.

When a username and password were associated with a Helm repository the username and password were also passed on to other domains referenced in the `index.yaml` file. This occurred when Helm went to retrieve a specific chart archive on the other domain.

### Patches

This issue has been resolved in 3.6.1.

There is a slight behavior change to credential handling with regard to repositories. Usernames and passwords are only passed to the URL location of the Helm repository by default. The username and password are scoped to the scheme, host, and port of the Helm repository. To pass the username and password to other domains Helm may encounter when it goes to retrieve a chart, the new `--pass-credentials` flag can be used. This flag restores the old behavior for a single repository as an opt-in behavior.

### Workarounds

If you use a username and password for a Helm repository you can audit the Helm repository in order to check for another domain being used that could have received the credentials. In the `index.yaml` file for that repository, look for another domain in the `urls` list for the chart versions. If there is another domain found and that chart version was pulled or installed the credentials would have been passed on.

### For more information

Helm's security policy is spelled out in detail in our [SECURITY](https://github.com/helm/community/blob/master/SECURITY.md) document.
Cross-Site Request Forgery in Jenkins Credentials Plugin
Published: 2021-06-16T17:24:31Z
Aliases: CVE-2021-21648

Jenkins Credentials Plugin prior to 2.3.19, 2.3.15.1, 2.3.14.1, 2.3.13.1, 2.3.7.1, and 2.3.0.1 does not escape user-controlled information on a view it provides, resulting in a reflected cross-site scripting (XSS) vulnerability.

Credentials Plugin 2.3.19, 2.3.15.1, 2.3.14.1, 2.3.13.1, 2.3.7.1, and 2.3.0.1 restricts the user-controlled information it provides to a safe subset.
Denial of service in go-ethereum due to CVE-2020-28362
Published: 2021-06-29T21:13:54Z

### Impact
Versions of Geth built with Go `<1.15.5` or `<1.14.12` are most likely affected by a critical DoS-related security vulnerability. The golang team has registered the underlying flaw as ‘CVE-2020-28362’.

We recommend all users to rebuild (ideally `v1.9.24`) with Go `1.15.5` or `1.14.12`, to avoid node crashes. Alternatively, if you are running binaries distributed via one of our official channels, we’re going to release `v1.9.24` ourselves built with Go `1.15.5`.

### Patches
This is not an issue in go-ethereum, rebuilding an older version with Go `1.15.5` or `1.14.12` will suffice to address the vulnerability. 

### Workarounds
Rebuilding with Go `1.15.5` or `1.14.12` will suffice to address the vulnerability. 

### References
- https://blog.ethereum.org/2020/11/12/geth_security_release/
- https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)
* Email us at [security@ethereum.org](mailto:security@ethereum.org)
A validation function with the same name as a built-in validator can be called
Published: 2021-06-22T15:18:02Z
Aliases: CVE-2021-3603

If a function is defined that has the same name as the default built-in email address validation scheme (`php`), it will be called in default configuration as when no validation scheme is provided, the default scheme's callable `php` was being called. If an attacker is able to inject such a function into the application (a much bigger issue), it will be called whenever an email address is validated, such as when calling `validateAddress()`.

### Impact
Low impact – exploitation requires that an attacker can already inject code into an application, but it provides a trigger pathway.

### Patches
This is patched in PHPMailer 6.5.0 by denying the use of simple strings as validator function names, which is a very minor BC break.

### Workarounds
Inject your own email validator function.

### References
Reported by [Vikrant Singh Chauhan](mailto:vi@hackberry.xyz) via [huntr.dev](https://www.huntr.dev/).
[CVE-2021-3603](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3603)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)
* [Email us](mailto:phpmailer@synchromedia.co.uk).
Exposure of Sensitive Information to an Unauthorized Actor in foreman_fog_proxmox
Published: 2021-06-10T15:54:43Z
Aliases: CVE-2021-20259

A flaw was found in the Foreman project. The Proxmox compute resource exposes the password through the API to an authenticated local attacker with view_hosts permission. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Versions of foreman_fog_proxmox prior to 0.13.1 are affected.
Denial of service in Valine
Published: 2021-06-21T17:11:25Z
Aliases: CVE-2021-34801

Valine is a fast, simple & powerful comment system. Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a ua (aka User-Agent) value that only specifies the product and version.
XML Processing error in github.com/crewjam/saml
Published: 2021-06-23T17:29:42Z
Aliases: CVE-2020-27846

### Impact

There are three vulnerabilities in the go `encoding/xml` package that can allow an attacker to forge part of a signed XML document. For details on this vulnerability see [xml-roundtrip-validator](https://github.com/mattermost/xml-roundtrip-validator)

### Patches

In version 0.4.3, all XML input is validated prior to being parsed.
Cross-site scripting in Shopizer
Published: 2021-06-08T23:08:20Z
Aliases: CVE-2021-33562

A reflected cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via the ref parameter to a page about an arbitrary product, e.g., a product/insert-product-name-here.html/ref= URL.
elFinder before 2.1.59 contains multiple vulnerabilities leading to RCE
Published: 2021-06-16T17:04:29Z
Aliases: CVE-2021-32682

### Impact

We recently fixed several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with the minimal configuration. 

### Patches

The issues were addressed in our last release, 2.1.59. 

### Workarounds

If you can't update to 2.1.59, make sure your connector is not exposed without authentication.

### Reference

Further technical details will be disclosed on https://blog.sonarsource.com/tag/security after some time.

### For more information

If you have any questions or comments about this advisory, you can contact:
    - The original reporters, by sending an email to vulnerability.research@sonarsource.com;
    - The maintainers, by opening an issue on this repository.
Cross-Site Request Forgery in forkcms
Published: 2021-06-22T15:23:45Z
Aliases: CVE-2020-23264

Cross-site request forgery (CSRF) in Fork-CMS before 5.8.2 allow remote attackers to hijack the authentication of logged administrators.
Access Control Bypass
Published: 2021-06-23T17:57:10Z
Aliases: CVE-2018-20321

An issue was discovered in Rancher 2 through 2.1.5. Any project member with access to the default namespace can mount the netes-default service account in a pod, and then use that pod to execute administrative privileged commands against the k8s cluster. This could be mitigated by isolating the default namespace in a separate project, where only cluster admins can be given permissions to access. As of 2018-12-20, this bug affected ALL clusters created or imported by Rancher.
Arbitrary Command Injection
Published: 2021-06-29T18:26:05Z
Aliases: CVE-2021-23399

This affects all versions of package wincred. If attacker-controlled user input is given to the getCredential function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
Elliptic Curve Key Disclosure in go-jose
Published: 2021-06-23T17:17:52Z
Aliases: CVE-2016-9121

go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making it vulnerable to an invalid curve attack.
Django Access Control Bypass possibly leading to SSRF, RFI, and LFI attacks 
Published: 2021-06-10T17:21:12Z
Aliases: CVE-2021-33571

In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) .
Remote code execution in zendframework and laminas-http
Published: 2021-06-08T20:11:19Z
Aliases: CVE-2021-3007

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized.
OS Command Injection in baserCMS
Published: 2021-06-08T20:10:37Z
Aliases: CVE-2021-20682

baserCMS versions prior to 4.4.5 allows a remote attacker with an administrative privilege to execute arbitrary OS commands via upload of malicious plugins.