aswin1906/github-advisory-2021.csv huggingface dataset:
VecStorage Deserialize Allows Violation of Length Invariant
Published: 2021-08-05T19:58:06Z

The `Deserialize` implementation for `VecStorage` did not maintain the invariant that the number of elements must equal `nrows * ncols`. Deserialization of specially crafted inputs could allow memory access beyond allocation of the vector.

This flaw was introduced in v0.11.0 ([`086e6e`](https://github.com/dimforge/nalgebra/commit/086e6e719f53fecba6dadad2e953a487976387f5)) due to the addition of an automatically derived implementation of `Deserialize` for `MatrixVec`. `MatrixVec` was later renamed to `VecStorage` in v0.16.13 ([`0f66403`](https://github.com/dimforge/nalgebra/commit/0f66403cbbe9eeac15cedd8a906c0d6a3d8841f2)) and continued to use the automatically derived implementation of `Deserialize`.

This flaw was corrected in commit [`5bff536`](https://github.com/dimforge/nalgebra/commit/5bff5368bf38ddfa31416e4ae9897b163031a513) by returning an error during deserialization if the number of elements does not exactly match the expected size.
Unsoundness in bigint
Published: 2021-08-25T20:48:04Z
Aliases: CVE-2020-35880

An issue was discovered in the bigint crate through 2020-05-07 for Rust. It allows a soundness violation.
Segfault on strings tensors with mistmatched dimensions, due to Go code
Published: 2021-08-25T14:38:57Z
Aliases: CVE-2021-37692

### Impact
Under certain conditions, Go code can trigger a segfault in string deallocation.


For string tensors, `C.TF_TString_Dealloc` is called during garbage collection within a finalizer function.  However, tensor structure isn't checked until encoding to avoid a performance penalty.  The current method for dealloc assumes that encoding succeeded, but segfaults when a string tensor is garbage collected whose encoding failed (e.g., due to mismatched dimensions).

To fix this, the call to set the finalizer function is deferred until `NewTensor` returns and, if encoding failed for a string tensor, deallocs are determined based on bytes written.

### Patches
We have patched the issue in GitHub commit [8721ba96e5760c229217b594f6d2ba332beedf22](https://github.com/tensorflow/tensorflow/commit/8721ba96e5760c229217b594f6d2ba332beedf22) (merging [#50508](https://github.com/tensorflow/tensorflow/pull/50508)).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, which is the other affected version.                                                                                                                                               

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported externally via a [fixing PR](https://github.com/tensorflow/tensorflow/pull/50508).
Remote memory exhaustion in ckb
Published: 2021-08-25T21:01:23Z

In the ckb sync protocol, SyncState maintains a HashMap called 'misbehavior' that keeps a score of a peer's violations of the protocol. This HashMap is keyed to PeerIndex (an alias for SessionId), and entries are never removed from it. SessionId is an integer that increases monotonically with every new connection.

A remote attacker can manipulate this HashMap to grow forever, resulting in degraded performance and ultimately a panic on allocation failure or being killed by the OS, depending on the platform.

This is a critical severity security bug. It could be exploited to create a targeted or network-wide denial of service, to reduce the hash power of the network as part of a 51% attack, and perhaps in other creative ways.

An attack is trivial:

1. connect to another node
2. send an invalid sync protocol request, such as `SendHeaders` for non-consecutive blocks
3. disconnect
4. repeat
SafeCurl before 0.9.2 has a DNS rebinding vulnerability.
Published: 2021-08-25T14:49:48Z
Aliases: CVE-2020-36474

SafeCurl before 0.9.2 has a DNS rebinding vulnerability.
Heap overflow or corruption in safe-transmute
Published: 2021-08-25T20:43:23Z
Aliases: CVE-2018-21000

Affected versions of this crate switched the length and capacity arguments in the Vec::from_raw_parts() constructor, which could lead to memory corruption or data leakage.
Data races in rcu_cell
Published: 2021-08-25T20:57:14Z
Aliases: CVE-2020-36451

Affected versions of this crate unconditionally implement Send/Sync for `RcuCell<T>`.
This allows users to send `T: !Send` to other threads (while `T` enclosed within `RcuCell<T>`), and allows users to concurrently access `T: !Sync` by using the APIs of `RcuCell<T>` that provide access to `&T`.

This can result in memory corruption caused by data races.
Remote code execution in better-macro
Published: 2021-08-25T20:56:00Z
Aliases: CVE-2021-38196

An issue was discovered in the better-macro crate through 2021-07-22 for Rust. It intentionally demonstrates that remote attackers can execute arbitrary code via proc-macros, and otherwise has no legitimate purpose.
Out of bounds read in xcb
Published: 2021-08-25T20:53:20Z
Aliases: CVE-2021-26957

An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because there is an out-of-bounds read in xcb::xproto::change_property(), as demonstrated by a format=32 T=u8 situation where out-of-bounds bytes are sent to an X server.
Improper type usage in rusqlite
Published: 2021-08-25T20:47:01Z
Aliases: CVE-2020-35872

An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via the repr(Rust) type.
Cross-site Scripting in video.js
Published: 2021-08-10T16:09:36Z
Aliases: CVE-2021-23414

This affects the package video.js before 7.14.3.
 The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.
Use after free and double free in bitvec
Published: 2021-08-25T20:47:39Z
Aliases: CVE-2020-35862

An issue was discovered in the bitvec crate before 0.17.4 for Rust. BitVec to BitBox conversion leads to a use-after-free or double free.
OS Command Injection in OpenTSDB
Published: 2021-08-02T17:02:21Z
Aliases: CVE-2020-35476

A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. The yrange value is written to a gnuplot file in the /tmp directory. This file is then executed via the mygnuplot.sh shell script. (tsd/GraphHandler.java attempted to prevent command injections by blocking backticks but this is insufficient.)
Algorithms compute incorrect results in blake2
Published: 2021-08-25T20:44:20Z
Aliases: CVE-2019-16143

An issue was discovered in the blake2 crate before 0.8.1 for Rust. The BLAKE2b and BLAKE2s algorithms, when used with HMAC, produce incorrect results because the block sizes are half of the required sizes.
Uncontrolled Search Path Element in sharkdp/bat
Published: 2021-08-25T21:01:37Z
Aliases: CVE-2021-36753

bat on windows before 0.18.2 executes programs named less.exe from the current working directory. This can lead to unintended code execution.
Out of bounds read in fltk
Published: 2021-08-25T20:53:58Z
Aliases: CVE-2021-28308

An issue was discovered in the fltk crate before 0.15.3 for Rust. There is an out-of bounds read because the pixmap constructor lacks pixmap input validation.
Out-of-bounds write in stack
Published: 2021-08-25T20:49:13Z
Aliases: CVE-2020-35895

ArrayVec::insert allows insertion of an element into the array object into the specified index. Due to a missing check on the upperbound of this index, it is possible to write out of bounds.
Integer Overflow in openssl-src
Published: 2021-08-25T20:52:21Z
Aliases: CVE-2021-23841

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Published: 2021-08-25T14:49:58Z
Aliases: CVE-2021-3729

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Uncaught Exception in libpulse-binding
Published: 2021-08-25T20:57:21Z

Affected versions of this crate failed to catch panics crossing FFI boundaries via callbacks, which
is a form of UB. This flaw was corrected by [this commit][1] which was included in version 2.6.0.
Uninitialized buffer use in marc
Published: 2021-08-25T20:53:14Z
Aliases: CVE-2021-26308

Affected versions of this crate passes an uninitialized buffer to a user-provided Read implementation. (Record::read()). Arbitrary Read implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer. Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior. This flaw was fixed in commit 6299af0 by zero-initializing the newly allocated memory (via data.resize(len, 0)) instead of exposing uninitialized memory (unsafe { data.set_len(len) }).
Data races in bunch
Published: 2021-08-25T20:59:18Z
Aliases: CVE-2020-36450

An issue was discovered in the bunch crate through 2020-11-12 for Rust. 
Affected versions of this crate unconditionally implements `Send`/`Sync` for `Bunch<T>`.
This allows users to insert `T: !Sync` to `Bunch<T>`. It is possible to create a data race to a `T: !Sync` by invoking the `Bunch::get()` API (which returns `&T`) from multiple threads. It is also possible to send `T: !Send` to other threads by inserting `T` inside `Bunch<T>` and sending `Bunch<T>` to another thread, allowing to create a data race by inserting types like `T = Rc<_>`.

Such data races can lead to memory corruption.
Remote code execution in ChakraCore
Published: 2021-08-02T17:29:09Z
Aliases: CVE-2020-1180

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-1057, CVE-2020-1172.
Improper Restriction of XML External Entity Reference in Quokka
Published: 2021-08-30T16:25:18Z
Aliases: CVE-2020-18705

XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/core/content/views.py'.
Data races in async-coap
Published: 2021-08-25T20:59:11Z
Aliases: CVE-2020-36444

An issue was discovered in the async-coap crate through 2020-12-08 for Rust. 
Affected versions of this crate implement Send/Sync for `ArcGuard<RC, T>` with no trait bounds on `RC`. This allows users to send `RC: !Send` to other threads and also allows users to concurrently access `Rc: !Sync` from multiple threads.

This can result in memory corruption from data race or other undefined behavior caused by sending `T: !Send` to other threads (e.g. dropping `MutexGuard<T>` in another thread that didn't lock its mutex).
Overflow in libsecp256k1
Published: 2021-08-25T20:56:03Z
Aliases: CVE-2021-38195

An issue was discovered in the libsecp256k1 crate before 0.5.0 for Rust. It can verify an invalid signature because it allows the R or S parameter to be larger than the curve order, aka an overflow.
Overflow in prost-types
Published: 2021-08-25T20:55:53Z
Aliases: CVE-2021-38192

Affected versions of this crate contained a bug in which untrusted input could cause an overflow and panic when converting a Timestamp to SystemTime. It is recommended to upgrade to prost-types v0.8 and switch the usage of From<Timestamp> for SystemTime to TryFrom<Timestamp> for SystemTime.
Insufficient Session Expiration and TOCTOU Race Condition in OPC FOundation UA .Net Standard
Published: 2021-08-02T17:35:42Z
Aliases: CVE-2020-8867

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard 1.04.358.30. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of sessions. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to create a denial-of-service condition against the application. Was ZDI-CAN-10295.
Argo Server TLS requests could be forged by attacker with network access
Published: 2021-08-23T19:41:30Z

### Impact

We are not aware of any exploits. This is a pro-active fix.

Impacted: 

* You are running Argo Server < v3.0 with `--secure=true` or >= v3.0 with `--secure` unspecified (note - running in secure mode is recommended regardless).
* The attacker is within your network. If you expose Argo Server to the Internet then "your network" is "the Internet". 

The Argo Server's keys are packaged within the image. They could be extracted and used to decrypt traffic, or forge requests.

### Patches

https://github.com/argoproj/argo-workflows/pull/6540

### Workarounds

* Make sure that your Argo Server service or pod are not directly accessible outside of your cluster. Put TLS load balancer in front of it.

This was identified by engineers at Jetstack.io
Incomplete validation in `MaxPoolGrad`
Published: 2021-08-25T14:41:33Z
Aliases: CVE-2021-37674

### Impact
An attacker can trigger a denial of service via a segmentation fault in `tf.raw_ops.MaxPoolGrad` caused by missing validation:

```python
import tensorflow as tf
  
tf.raw_ops.MaxPoolGrad(
  orig_input = tf.constant([], shape=[3, 0, 0, 2], dtype=tf.float32),
  orig_output = tf.constant([], shape=[3, 0, 0, 2], dtype=tf.float32),
  grad = tf.constant([], shape=[3, 0, 0, 2], dtype=tf.float32),
  ksize = [1, 16, 16, 1],
  strides = [1, 16, 18, 1],
  padding = "EXPLICIT",
  explicit_paddings = [0, 0, 14, 3, 15, 5, 0, 0])
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/maxpooling_op.cc) misses some validation for the `orig_input` and `orig_output` tensors.

The fixes for [CVE-2021-29579](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-068.md) were incomplete.
                                                                                                                                                                                                                                                                                          
### Patches
We have patched the issue in GitHub commit [136b51f10903e044308cf77117c0ed9871350475](https://github.com/tensorflow/tensorflow/commit/136b51f10903e044308cf77117c0ed9871350475).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang of Baidu Security.
A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
Published: 2021-08-25T14:47:19Z
Aliases: CVE-2021-39150

### Impact
The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39150](https://x-stream.github.io/CVE-2021-39150.html).

### Credits
Lai Han of NSFOCUS security team found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Improper Handling of Length Parameter Inconsistency in Compress
Published: 2021-08-02T16:55:39Z
Aliases: CVE-2021-35517

When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.
Use after free in openssl
Published: 2021-08-25T20:43:45Z
Aliases: CVE-2018-20997

An issue was discovered in the openssl crate before 0.10.9 for Rust. A use-after-free occurs in CMS Signing.
Read of uninitialized memory in cdr
Published: 2021-08-25T20:53:12Z
Aliases: CVE-2021-26305

An issue was discovered in Deserializer::read_vec in the cdr crate before 0.2.4 for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated heap memory, violating soundness.
Data races in unicycle
Published: 2021-08-25T21:00:39Z

Affected versions of this crate unconditionally implemented `Send` & `Sync` for types `PinSlab<T>` & `Unordered<T, S>`. This allows sending non-Send types to other threads and concurrently accessing non-Sync types from multiple threads.

This can result in a data race & memory corruption when types that provide internal mutability without synchronization are contained within `PinSlab<T>` or `Unordered<T, S>` and accessed concurrently from multiple threads.

The flaw was corrected in commits 92f40b4 & 6a6c367 by adding trait bound `T: Send` to `Send` impls for `PinSlab<T>` & `Unordered<T, S>` and adding `T: Sync` to `Sync` impls for `PinSlab<T>` & `Unordered<T, S>`.
Cross-site Scripting in TYPO3 extension
Published: 2021-08-30T17:22:25Z
Aliases: CVE-2021-36785

The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows XSS.
Memory handling issues in xcb
Published: 2021-08-25T20:50:54Z
Aliases: CVE-2020-36205

An issue was discovered in the xcb crate through 2020-12-10 for Rust. base::Error does not have soundness. Because of the public ptr field, a use-after-free or double-free can occur.
Unchecked Return Value in xcb
Published: 2021-08-25T20:53:18Z
Aliases: CVE-2021-26958

An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because transmutation to the wrong type can happen after xcb::base::cast_event uses std::mem::transmute to return a reference to an arbitrary type.
Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault
Published: 2021-08-30T17:22:38Z
Aliases: CVE-2021-38554

HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.
Multiple memory safety issues in actix-web
Published: 2021-08-25T20:42:50Z

Affected versions contain multiple memory safety issues, such as:

 - Unsoundly coercing immutable references to mutable references
 - Unsoundly extending lifetimes of strings
 - Adding the `Send` marker trait to objects that cannot be safely sent between threads

This may result in a variety of memory corruption scenarios, most likely use-after-free.
 
A signficant refactoring effort has been conducted to resolve these issues.
Race condition in Parc
Published: 2021-08-25T21:00:03Z

In the affected versions of this crate, `LockWeak<T>` unconditionally implemented `Send` with no trait bounds on `T`. `LockWeak<T>` doesn't own `T` and only provides `&T`. This allows concurrent access to a non-Sync `T`, which can cause undefined behavior like data races.
JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>
Published: 2021-08-23T19:40:22Z
Aliases: CVE-2021-32797

### Impact

Untrusted notebook can execute code on load. This is a remote code execution, but requires user action to open a notebook.

### Patches

Patched in the following versions: 3.1.4, 3.0.17, 2.3.2, 2.2.10, 1.2.21.

### References

[OWASP Page on Restricting Form Submissions](https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html)

### For more information

If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list security@ipython.org.

Credit: Guillaume Jeanne from Google
Improper Input Validation in once_cell
Published: 2021-08-25T20:44:18Z
Aliases: CVE-2019-16141

If during the first dereference of Lazy the initialization function panics, subsequent dereferences will execute std::hints::unreachable_unchecked. Applications with panic = "abort" are not affected, as there will be no subsequent dereferences.
Unchecked Return Value in xcb
Published: 2021-08-25T20:53:22Z
Aliases: CVE-2021-26955

An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because xcb::xproto::GetAtomNameReply::name() calls std::str::from_utf8_unchecked() on unvalidated bytes from an X server.
Data races in cache
Published: 2021-08-25T20:57:12Z
Aliases: CVE-2020-36448

An issue was discovered in the cache crate through 2020-11-24 for Rust. 
Affected versions of this crate unconditionally implement Send/Sync for `Cache<K>`.
This allows users to insert `K` that is not Send or not Sync.

This allows users to create data races by using non-Send types like `Arc<Cell<T>>` or `Rc<T>` as `K` in `Cache<K>`. It is also possible to create data races by using types like `Cell<T>` or `RefCell<T>` (types that are `Send` but not `Sync`).
Such data races can lead to memory corruption.
Out of bounds read in ordnung
Published: 2021-08-25T20:48:40Z
Aliases: CVE-2020-35890

An issue was discovered in the ordnung crate through version 0.0.1 for Rust. compact::Vec violates memory safety via out-of-bounds access for large capacity.
Null pointer deference in cache
Published: 2021-08-25T20:52:57Z
Aliases: CVE-2021-25903

An issue was discovered in the cache crate through 2021-01-01 for Rust. A raw pointer is dereferenced.
Cross-site Scripting in comrak
Published: 2021-08-25T20:55:43Z
Aliases: CVE-2021-38186

An issue was discovered in the comrak crate before 0.10.1 for Rust. It mishandles & characters, leading to XSS via &# HTML entities.
Regular Expression Denial of Service in path-parse
Published: 2021-08-10T15:33:47Z
Aliases: CVE-2021-23343

Affected versions of npm package `path-parse` are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.
CKEditor 4 vulnerabilities in versions <4.16.1
Published: 2021-08-23T19:42:05Z

Details see: 

https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhc ( CVE-2021-37695 )
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-6226-h7ff-ch6c ( CVE-2021-32808 )
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7889-rm5j-hpgg  ( CVE-2021-32809 )

Patch: 
https://github.com/pimcore/pimcore/pull/10032