aswin1906/github-advisory-2021.csv huggingface dataset:
Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile.
Published: 2021-12-08T19:51:36Z
Aliases: CVE-2021-43809

In `bundler` versions before 2.2.33, when working with untrusted and apparently harmless `Gemfile`'s, it is not expected that they lead to execution of external code, unless that's explicit in the ruby code inside the `Gemfile` itself. However, if the `Gemfile` includes `gem` entries that use the `git` option with invalid, but seemingly harmless, values with a leading dash, this can be false.

To handle dependencies that come from a Git repository instead of a registry, Bundler uses various commands, such as `git clone`. These commands are being constructed using user input (e.g. the repository URL). When building the
commands, Bundler versions before 2.2.33 correctly avoid Command Injection vulnerabilities by passing an array of arguments instead of a command string. However, there is the possibility that a user input starts with a dash (`-`) and is therefore treated as an optional argument instead of a positional one. This can lead to Code Execution because some of the commands have options that can be leveraged to run arbitrary executables.

Since this value comes from the `Gemfile` file, it can contain any character, including a leading dash.

### Exploitation

To exploit this vulnerability, an attacker has to craft a directory containing a `Gemfile` file that declares a dependency that is located in a Git repository. This dependency has to have a Git URL in the form of `-u./payload`. This URL
will be used to construct a Git clone command but will be interpreted as the [upload-pack](https://git-scm.com/docs/git-clone#Documentation/git-clone.txt--ultupload-packgt) argument. Then this directory needs to be shared with the victim, who then needs to run a command that evaluates the Gemfile, such as `bundle lock`, inside.

### Impact

This vulnerability can lead to Arbitrary Code Execution, which could potentially lead to the takeover of the system. However, as explained above, the exploitability is very low, because it requires a lot of user interaction. It still could put developers at risk when dealing with untrusted files in a way they think is safe, because the exploit still works when the victim tries to make sure nothing can happen, e.g. by manually reviewing the `Gemfile` (although they would need the weird URL with a leading dash to not raise any flags).

This kind of attack vector [has been used in the past](https://www.cnbc.com/2021/01/26/north-korean-hackers-targeting-security-researchers-on-twitter.html) to target security researchers by sending them projects to collaborate on.

### Patches

Bundler 2.2.33 has patched this problem by inserting `--` as an argument before any positional arguments to those Git commands that were affected by this issue.

### Workarounds

Regardless of whether users can upgrade or not, they should review any untrustred `Gemfile`'s before running any `bundler` commands that may read them, since they can contain arbitrary ruby code.

### References

https://cwe.mitre.org/data/definitions/88.html
Code Injection in total4
Published: 2021-12-10T17:26:33Z
Aliases: CVE-2021-23390

The package total4 before 0.0.43 are vulnerable to Arbitrary Code Execution via the `U.set()` and `U.get()` functions.
Unsafe Deserialization in jackson-databind
Published: 2021-12-09T19:15:54Z
Aliases: CVE-2020-36179

FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related to `oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS`.
Permissions not properly checked in Invenio-Drafts-Resources
Published: 2021-12-06T23:57:59Z
Aliases: CVE-2021-43781

### Impact

Invenio-Drafts-Resources does not properly check permissions when a record is published. The vulnerability is exploitable in a default installation of InvenioRDM. An authenticated user is able via REST API calls to publish draft records of other users if they know the record identifier and the draft validates (e.g. all require fields filled out). An attacker is not able to modify the data in the record, and thus e.g. *cannot* change a record from restricted to public.

### Details

The service's ``publish()`` method contains the following permission check:

```python
def publish(..):
    self.require_permission(identity, "publish")
```
However, the record should have been passed into the permission check so that the need generators have access to e.g. the record owner.

```python
def publish(..):
    self.require_permission(identity, "publish", record=record)
```
The bug is activated in Invenio-RDM-Records which has a need generator called ``RecordOwners()``, which when no record is passed in defaults to allow any authenticated user:

```python
class RecordOwners(Generator):
    def needs(self, record=None, **kwargs):
        if record is None:
            return [authenticated_user]
    # ...
```

### Patches

The problem is patched in Invenio-Drafts-Resources v0.13.7 and 0.14.6+, which is part of InvenioRDM v6.0.1 and InvenioRDM v7.0 respectively.

You can verify the version installed of Invenio-Drafts-Resources via PIP:

```console
cd ~/src/my-site
pipenv run pip freeze | grep invenio-drafts-resources
```

### References

- [Security policy](https://invenio.readthedocs.io/en/latest/community/security-policy.html)

### For more information

If you have any questions or comments about this advisory:
* Chat with us on Discord: https://discord.gg/8qatqBC
Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursion
Published: 2021-12-18T18:00:07Z
Aliases: CVE-2021-45105

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0 and 2.12.3.


# Affected packages
Only the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use.
Deserialization of Untrusted Data in Spring AMQP
Published: 2021-12-01T00:00:40Z
Aliases: CVE-2021-22095

In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message
Unsafe Deserialization in jackson-databind
Published: 2021-12-09T19:16:18Z
Aliases: CVE-2020-36180

FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.
Execution Control List (ECL) Is Insecure in Singularity
Published: 2021-12-20T18:24:30Z
Aliases: CVE-2020-13845

### Impact

The Singularity Execution Control List (ECL) allows system administrators to set up a policy that defines rules about what signature(s) must be (or must not be) present on a SIF container image for it to be permitted to run.

In Singularity 3.x versions below 3.6.0, the following issues allow the ECL to be bypassed by a malicious user:

 * Image integrity is not validated when an ECL policy is enforced.
 * The fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file, rather than to a cryptographically validated signature. Thus, it is trivial to craft an arbitrary payload which will be permitted to run, even if the attacker does not have access to the private key associated with the fingerprint(s) configured in the ECL.

### Patches

These issues are addressed in Singularity 3.6.0.

All users are advised to upgrade to 3.6.0. Note that Singularity 3.6.0 uses a new signature format that is necessarily incompatible with Singularity < 3.6.0 - e.g. Singularity 3.5.3 cannot verify containers signed by 3.6.0.

Version 3.6.0 includes a `legacyinsecure` option that can be set to `legacyinsecure = true` in `ecl.toml` to allow the ECL to perform verification of the older, and insecure, legacy signatures for compatibility with existing containers. This does not guarantee that containers have not been modified since signing, due to other issues in the legacy signature format. The option should be used only to temporarily ease the transition to containers signed with the new 3.6.0 signature format.

### Workarounds

This issue affects any installation of Singularity configured to use the Execution Control List (ECL) functionality. There is no workaround if ECL is required.

### For more information

General questions about the impact of the advisory / changes made in the 3.6.0 release can be asked in the:

* [Singularity Slack Channel](https://bit.ly/2m0g3lX)
* [Singularity Mailing List](https://groups.google.com/a/lbl.gov/forum/??sdf%7Csort:date#!forum/singularity)

Any sensitive security concerns should be directed to: security@sylabs.io

See our Security Policy here: https://sylabs.io/security-policy
SQL injection in jackalope/jackalope-doctrine-dbal
Published: 2021-12-14T21:08:13Z
Aliases: CVE-2021-43822

### Impact

Users can provoke SQL injections if they can specify a node name or query.

### Patches

Upgrade to version 1.7.4

If that is not possible, you can escape all places where `$property` is used to filter `sv:name` in the class `Jackalope\Transport\DoctrineDBAL\Query\QOMWalker`: `XPath::escape($property)`.

### Workarounds

Node names and xpaths can contain `"` or `;` according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection.

If queries are never done from user input, or if you validate the user input to not contain `;`, you are not affected. 

### References

No further references.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [jackalope/jackalope-doctrine-dbal repo](https://github.com/jackalope/jackalope-doctrine-dbal/issues)
yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF)
Published: 2021-12-16T14:14:56Z
Aliases: CVE-2021-4092

yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF).
HashiCorp Vault Incorrect Permission Assignment for Critical Resource
Published: 2021-12-02T17:48:30Z
Aliases: CVE-2021-43998

HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault Enterprise 1.7.6, 1.8.5, and 1.9.0.
Open Redirect in OAuth2 Proxy
Published: 2021-12-20T17:59:10Z
Aliases: CVE-2020-11053

### Impact
As users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access.
This redirect URL is checked within the proxy and validated before redirecting the user to prevent malicious actors providing redirects to potentially harmful sites.

However, by crafting a redirect URL with HTML encoded whitespace characters (eg. `%0a`, `%0b`,`%09`,`%0d`) the validation could be bypassed and allow a redirect to any URL provided.

### Patches
@rootxharsh and @iamnoooob provided this patch as potential solution:
```
From 4b941f56eda310b5c4dc8080b7635a6bfabccad4 Mon Sep 17 00:00:00 2001
From: Harsh Jaiswal <harsh@pop-os.localdomain>
Date: Fri, 1 May 2020 20:38:31 +0530
Subject: [PATCH] Fixes redirect issue

---
 oauthproxy.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/oauthproxy.go b/oauthproxy.go
index 1e9bb7c..f8beb4d 100644
--- a/oauthproxy.go
+++ b/oauthproxy.go
@@ -577,8 +577,9 @@ func validOptionalPort(port string) bool {

 // IsValidRedirect checks whether the redirect URL is whitelisted
 func (p *OAuthProxy) IsValidRedirect(redirect string) bool {
+       matched, _ := regexp.MatchString(`^/\s+/|\\`, redirect)
        switch {
-       case strings.HasPrefix(redirect, "/") && !strings.HasPrefix(redirect, "//") && !strings.HasPrefix(redirect, "/\\"):
+       case strings.HasPrefix(redirect, "/") && !strings.HasPrefix(redirect, "//") && !matched:
                return true
        case strings.HasPrefix(redirect, "http://") || strings.HasPrefix(redirect, "https://"):
                redirectURL, err := url.Parse(redirect)
--
2.17.1
```

This issue was also reported to us separately by @mik317 several hours later

The fix was implemented in [#xxx]() and released as version 5.1.1
Unsafe Deserialization in jackson-databind
Published: 2021-12-09T19:16:42Z
Aliases: CVE-2020-36188

FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related to `com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource`.
Unsafe inline XSS in pasting DOM element into chat
Published: 2021-12-14T21:48:16Z
Aliases: CVE-2021-39183

### Impact

Inline scripts are executed when Javascript is parsed via a paste action.

1. Open https://watch.owncast.online/
2. Copy and then paste `<img src=null onerror=alert('hello')>` into the
chat field.
3. An alert should pop up.

### Patches
```
    ⋮ 13 │    // Content security policy
    ⋮ 14 │    csp := []string{
    ⋮ 15 │        "script-src 'self' 'sha256-2HPCfJIJHnY0NrRDPTOdC7AOSJIcQyNxzUuut3TsYRY='",
    ⋮ 16 │        "worker-src 'self' blob:", // No single quotes around blob:
    ⋮ 17 │    }
```

Will be patched in 0.0.9 by blocking `unsafe-inline` Content Security Policy and specifying the `script-src`.  The `worker-src` is required to be set to `blob` for the video player.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [owncast/owncast](https://github.com/owncast/owncast/issues)
* Email us at [gabek@real-ity.com](mailto:gabek@real-ity.com)
snipe-it is vulnerable to Cross-site Scripting
Published: 2021-12-16T14:13:27Z
Aliases: CVE-2021-4108

snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Hexo Vulnerable to XSS
Published: 2021-12-01T18:27:44Z
Aliases: CVE-2021-25987

Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code.
Prototype Pollution in ts-nodash
Published: 2021-12-10T18:53:42Z
Aliases: CVE-2021-23403

`ts-nodash` before version 1.2.7 is vulnerable to Prototype Pollution via the Merge() function due to lack of validation input.
Opencast publishes global system account credentials
Published: 2021-12-14T21:43:48Z
Aliases: CVE-2018-16153

The issue was mostly mitigated before, drastically reducing the risk. See references below for more information.

### Impact

Opencast before version 10.6 will try to authenticate against any external services listed in a media package when it is trying to access the files, sending the global system user's credentials, regardless of the target being part of the Opencast cluster or not.

Previous mitigations already prevented clear text authentications for such requests (e.g. HTTP Basic authentication), but with enough malicious intent, even hashed credentials can be broken.

### Patches

Opencast 10.6 will now send authentication requests only against servers which are part of the Opencast cluster, preventing external services from getting any form of authentication attempt in the first place.

### Workarounds

No workaround available.

### References

- [Patch fixing the issue](https://github.com/opencast/opencast/commit/776d5588f39c61eb04c03bb955416c4f77629d51)
- [Original security notice](https://groups.google.com/a/opencast.org/g/security-notices/c/XRZzRiqp-NE)
- [Original security mitigation](https://github.com/opencast/opencast/commit/fe8c3d3a60dc5869b468957270dbad5f8c30ead6)

### For more information

If you have any questions or comments about this advisory:
- Open an issue in [our issue tracker](https://github.com/opencast/opencast/issues)
- Email us at [security@opencast.org](mailto:security@opencast.org)
Critical security issues in XML encoding in github.com/dexidp/dex
Published: 2021-12-20T17:53:53Z
Aliases: CVE-2020-26290

### Impact

The following vulnerabilities have been disclosed, which impact users leveraging the SAML connector:

Signature Validation Bypass (CVE-2020-15216): https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7

`encoding/xml` instabilities:
 - [Element namespace prefix instability (CVE-2020-29511)](https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-elements.md)
 - [Attribute namespace prefix instability (CVE-2020-29509)](https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-attributes.md)
 - [Directive comment instability (CVE-2020-29510)](https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.md)

### Patches

Immediately update to [Dex v2.27.0](https://github.com/dexidp/dex/releases/tag/v2.27.0).

### Workarounds

There are no known workarounds.
Unexpected server crash in Next.js.
Published: 2021-12-07T21:12:09Z
Aliases: CVE-2021-43803

Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue. Note that prior version 0.9.9 package `next` hosted a different utility (0.4.1 being the latest version of that codebase), and this advisory does not apply to those versions.
Using JMSAppender in log4j configuration may lead to deserialization of untrusted data
Published: 2021-12-17T20:42:38Z

### Impact

ClickHouse JDBC Bridge uses [slf4j-log4j12 1.7.32](https://repo1.maven.org/maven2/org/slf4j/slf4j-log4j12/1.7.32/), which depends on [log4j 1.2.17](https://repo1.maven.org/maven2/log4j/log4j/1.2.17/). It allows a remote attacker to execute code on the server, if you changed default log4j configuration by adding JMSAppender and an insecure JMS broker.

### Patches

The patch version `2.0.7` removed log4j dependency by replacing `slf4j-log4j12` to `slf4j-jdk14`. Logging configuration is also changed from `log4j.properties` to `logging.properties`.

### Workarounds

1. Do NOT change log4j configuration to use JMSAppender along with insecure JMS broker
2. Alternatively, you can issue below command to remove `JMSAppender.class`:

```(bash)
# install zip command if you don't have
apt-get update && apt-get install -y zip
# remove the class
zip -d clickhouse-jdbc-bridge*.jar ru/yandex/clickhouse/jdbcbridge/internal/log4j/net/JMSAppender.class
```

### References

Please refer to [CVE-2021-4104](https://access.redhat.com/security/cve/CVE-2021-4104) to read more.

### For more information

If you have any questions or comments about this advisory, please feel free to open an issue in the repository.
Serialization gadget exploit in jackson-databind
Published: 2021-12-09T19:15:24Z
Aliases: CVE-2020-35728

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).
OS Command Injection in pixl-class
Published: 2021-12-10T20:04:56Z
Aliases: CVE-2020-7640

pixl-class prior to 1.0.3 allows execution of arbitrary commands. The members argument of the create function can be controlled by users without any sanitization.
An issue in Atomix v3.1.5 allows a malicious Atomix node to remove states of ONOS storage via abuse of primitive operations.
Published: 2021-12-17T20:41:21Z
Aliases: CVE-2020-35214

An issue in Atomix v3.1.5 allows a malicious Atomix node to remove states of ONOS storage via abuse of primitive operations.
snipe-it is vulnerable to Cross-site Scripting
Published: 2021-12-03T20:40:50Z
Aliases: CVE-2021-4018

snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Prototype pollution in supermixer
Published: 2021-12-10T19:03:07Z
Aliases: CVE-2020-24939

Prototype pollution in Stampit supermixer allows an attacker to modify the prototype of a base object which can vary in severity depending on the implementation.
Unsafe Deserialization in jackson-databind
Published: 2021-12-09T19:16:10Z
Aliases: CVE-2020-36181

FasterXML jackson-databind 2.x before 2.9.10.8 and 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related to `org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS`.
YetiForceCRM is vulnerable to Business Logic Errors in the weight of a product
Published: 2021-12-16T21:01:07Z
Aliases: CVE-2021-4117

YetiForceCRM is vulnerable to Business Logic Errors in the Weight of a Product since that value can be a negative number.
Server-Side Request Forgery in ssrf-agent
Published: 2021-12-02T17:51:51Z
Aliases: CVE-2021-23718

The package ssrf-agent before 1.0.5 are vulnerable to Server-side Request Forgery (SSRF) via the defaultIpChecker function. It fails to properly validate if the IP requested is private.
Cross Site Request Forgery in firefly-iii 
Published: 2021-12-10T20:20:08Z
Aliases: CVE-2021-4005

firefly-iii is vulnerable to a Cross-Site Request Forgery (CSRF) attack which can disable two factor authentication for the target user.
Open Redirect in xdLocalStorage
Published: 2021-12-09T19:30:14Z
Aliases: CVE-2020-11611

An issue was discovered in xdLocalStorage through 2.0.5. The buildMessage() function in xdLocalStorage.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the iframe object. Therefore any domain that is currently loaded within the iframe can receive the messages that the client sends.
Cross-site Scripting in Mermaid
Published: 2021-12-10T18:57:41Z
Aliases: CVE-2021-35513

Mermaid before 8.11.0 allows XSS when the antiscript feature is used.
Insecure permissions on user namespace / fakeroot temporary rootfs in Singularity
Published: 2021-12-20T18:25:46Z
Aliases: CVE-2020-25039

### Impact

Insecure permissions on temporary directories used in fakeroot or user namespace container execution.

When a Singularity action command (run, shell, exec) is run with the fakeroot or user namespace option, Singularity will extract a container image to a temporary sandbox directory. Due to insecure permissions on the temporary directory it is possible for any user with access to the system to read the contents of the image. Additionally, if the image contains a world-writable file or directory, it is possible for a user to inject arbitrary content into the running container.

### Patches

This issue is addressed in Singularity 3.6.3.

All users are advised to upgrade to 3.6.3.

### Workarounds

The issue is mitigated if `TMPDIR` is set to a location that is only accessible to the user, as any subdirectories directly under `TMPDIR` cannot then be accessed by others. However, this is difficult to enforce so it is not recommended to rely on this as a mitigation.

### For more information

General questions about the impact of the advisory / changes made in the 3.6.0 release can be asked in the:

* [Singularity Slack Channel](https://bit.ly/2m0g3lX)
* [Singularity Mailing List](https://groups.google.com/a/lbl.gov/forum/??sdf%7Csort:date#!forum/singularity)

Any sensitive security concerns should be directed to: security@sylabs.io

See our Security Policy here: https://sylabs.io/security-policy