aswin1906/github-advisory-2022 huggingface dataset:
Server-Side Request Forgery in gogs webhook
Advisory: GHSA-w689-557m-2cvq
Aliases: CVE-2022-1285
Published: 2022-06-03T15:35:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

### Impact

The malicious user is able to discover services in the internal network through webhook functionality. All installations accepting public traffic are affected.

### Patches

Webhook payload URLs are revalidated before each delivery to make sure they are not resolved to blocked local network addresses. Users should upgrade to 0.12.8 or the latest 0.13.0+dev.

### Workarounds

Run Gogs in its own private network.

### References

https://huntr.dev/bounties/da1fbd6e-7a02-458e-9c2e-6d226c47046d/

### For more information

If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6901.
Regular expression denial of service in apache tika
Advisory: GHSA-qw3f-w4pf-jh5f
Aliases: CVE-2022-30973
Published: 2022-06-01T00:00:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release.  In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler.  This is fixed in 1.28.3.
containerd CRI plugin: Host memory exhaustion through ExecSync
Advisory: GHSA-5ffw-gxpp-mxpf
Aliases: CVE-2022-31030
Published: 2022-06-06T22:07:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact

A bug was found in containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API.  This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads.  Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an "exec" facility.

### Patches

This bug has been fixed in containerd 1.6.6 and 1.5.13.  Users should update to these versions to resolve the issue.

### Workarounds

Ensure that only trusted images and commands are used. 

### References

* Similar fix in cri-o's CRI implementation https://github.com/cri-o/cri-o/security/advisories/GHSA-fcm2-6c3h-pg6j

### Credits

The containerd project would like to thank David Korczynski and Adam Korczynski of ADA Logics for responsibly disclosing this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/main/SECURITY.md) during a security audit sponsored by CNCF and facilitated by OSTIF.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)
Insufficient HTML Sanitization
Advisory: GHSA-rm89-9g65-4ffr
Published: 2022-06-17T01:16:36Z

### Impact

Affected versions can have malicious javascript code injected into the users browser by other authenticated users, as data fields retrieved from the database are not properly sanitized before displaying in various front-end views.

The problem here stems from multiple issues:

- Insufficient database sanitation on multiple fields allows injection of un-sanitized HTML
- Lack of HTML escaping when rendering data on the front end

The attack vector here is limited, as only authenticated users are able to write data to the database, for it to be subsequently rendered on the front-end. However, it is a vulnerability that the InvenTree development team takes seriously.

### Solution

The proposed patch for this vulnerability is prevents injection of un-escaped fields into front-end UI elements.

A future patch will also address sanitization of database fields on the "back end", however this will require a much larger effort to refactor multiple database tables.

### Patches

- The issue is addressed in the upcoming `0.8.0` release
- This fix will also be back-ported to the `0.7.x` branch, applied to the `0.7.2` release

### Workarounds

There are no workarounds for this issue, users should upgrade to a patched version.

### References

- https://huntr.dev/bounties/4cae8442-c042-43c2-ad89-6f666eaf3d57/
- https://huntr.dev/bounties/9d640ef2-c52c-4106-b043-f7497d577078/
- https://huntr.dev/bounties/b114e82f-6c02-485b-82ea-e242f89169c2/
- https://huntr.dev/bounties/22783cd3-1b2c-48fc-b31f-03b53c86da0b/

Thank you @saharshtapi for bringing this issue to our attention and giving pointers for fixing them.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [github](http://github.com/inventree/inventree)
* Email us at [security@inventree.org](mailto:security@inventree.org)
Command Injection in Nuitka
Advisory: GHSA-4v3r-hqr9-69jf
Aliases: CVE-2022-2054
Published: 2022-06-13T00:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Nuitka 0.8.4 and prior is vulnerable to command injection. A patch is available and anticipated to be part of the `0.9` release.
Hostname confusion in parse-url
Advisory: GHSA-4p35-cfcx-8653
Aliases: CVE-2022-0722
Published: 2022-06-28T00:01:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exposure of Sensitive Information to an Unauthorized Actor via hostname confusion in GitHub repository ionicabizau/parse-url prior to 6.0.1
CSV Injection in inventree
Advisory: GHSA-9hx5-jmxv-x44q
Aliases: CVE-2022-2112
Published: 2022-06-18T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2.
Cross site scripting in parse-url
Advisory: GHSA-q6wq-5p59-983w
Aliases: CVE-2022-2217
Published: 2022-06-28T00:01:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Generic in GitHub repository ionicabizau/parse-url prior to 6.0.1
Uncontrolled Resource Consumption in Spray JSON
Advisory: GHSA-ww3v-6xjf-jv28
Aliases: CVE-2018-18855
Published: 2022-06-28T23:23:20Z

Recursive decent parsers are susceptible too StackOverflowExceptions on too deeply nested structures as currently "open" parsing state is kept on the stack.
Apache Hadoop heap overflow before v2.10.2, v3.2.3, v3.3.2
Advisory: GHSA-rmpj-7c96-mrg8
Aliases: CVE-2021-37404
Published: 2022-06-14T00:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.
Path traversal for local publishers in TechDocs backend
Advisory: GHSA-4jqc-jvh2-pxg9
Published: 2022-06-17T01:11:10Z

### Impact
A malicious actor with the ability to register entities in the Software Catalog is able to write files to arbitrary paths on the techdocs backend host instance when `techdocs.publisher.type` is set to `local`.

This vulnerability is mitigated by the fact that the Software Catalog must be configured with non-standard field format validators and/or non-standard entity policies.

### Patches
Those affected are advised to upgrade to `@backstage/plugin-techdocs-node` version `1.1.2` or higher.

### Workarounds
If patching or upgrading is not possible, it would be sufficient to update any custom Catalog field format validators and/or custom entity policies to disallow entity names, kinds, and namespaces containing `..`

<!--
### References
todo: Link to blog post / published report.
-->

### For more information
If you have any questions or comments about this advisory:

- Open an issue in the [Backstage repository](https://github.com/backstage/backstage)
- Visit our chat, linked to in the [Backstage README](https://github.com/backstage/backstage)
Failed payment recorded has completed in Silverstripe Omnipay
Advisory: GHSA-48f2-m7jg-866x
Aliases: CVE-2022-29254
Published: 2022-06-06T21:24:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

### Impact
For a subset of Omnipay gateways (those that use intermediary states like `isNotification()` or `isRedirect()`), if the payment identifier or success URL is exposed it is possible for payments to be prematurely marked as completed without payment being taken. This is mitigated by the fact that most payment gateways hide this information from users, however some issuing banks offer flawed 3DSecure implementations that may inadvertently expose this data.

### Patches
The following versions have been patched to fix this issue:

- `2.5.2`
- `3.0.2`
- `3.1.4`
- `3.2.1`

### Workarounds
There are no known workarounds for this vulnerability.

### References
N/A.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@silverstripe.org](mailto:security@silverstripe.org)
sharp vulnerable to Command Injection in post-installation over build environment
Advisory: GHSA-gp95-ppv5-3jc5
Aliases: CVE-2022-29256
Published: 2022-06-01T19:58:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

There's a possible vulnerability in logic that is run only at `npm install` time when installing versions of `sharp` prior to the latest v0.30.5.

This is not part of any runtime code, does not affect Windows users at all, and is unlikely to affect anyone that already cares about the security of their build environment. However, out of an abundance of caution, I've created this advisory.

If an attacker has the ability to set the value of the `PKG_CONFIG_PATH` environment variable in a build environment then they might be able to use this to inject an arbitrary command at `npm install` time.

I've used the Common Vulnerability Scoring System (CVSS) calculator to determine the maximum possible impact, which suggests a "medium" score of 5.9, but for most people the real impact will be dealing with the noise from automated security tooling that this advisory will bring.

[`AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C/CR:X/IR:X/AR:X/MAV:X/MAC:X/MPR:X/MUI:R/MS:X/MC:X/MI:X/MA:X`](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C/CR:X/IR:X/AR:X/MAV:X/MAC:X/MPR:X/MUI:R/MS:X/MC:X/MI:X/MA:X&version=3.1)

This problem was fixed in commit a6aeef6 and published as part of `sharp` v0.30.5.

Thank you very much to @dwisiswant0 for the responsible disclosure.

Remember: if an attacker has control over environment variables in your build environment then you have a bigger problem to deal with than this issue.
Argo CD's external URLs for Deployments can include JavaScript
Advisory: GHSA-h4w9-6x78-8vrj
Aliases: CVE-2022-31035
Published: 2022-06-21T20:04:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

### Impact

All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting (XSS) bug allowing a malicious user to inject a `javascript:` link in the UI. When clicked by a victim user, the script will execute with the victim's permissions (up to and including admin).

The script would be capable of doing anything which is possible in the UI or via the API, such as creating, modifying, and deleting Kubernetes resources.

### Patches

A patch for this vulnerability has been released in the following Argo CD versions:

* v2.4.1
* v2.3.5
* v2.2.10
* v2.1.16

### Workarounds

There are no completely-safe workarounds besides upgrading.

**Mitigations:**

1. Avoid clicking external links presented in the UI. Here is an example of an Application node with an external link:

   ![Application node in the Argo CD UI with an external link](https://user-images.githubusercontent.com/350466/171678146-026bbf20-2116-4b9f-8af8-7bb5b7ee8dff.png)

   The link's title is user-configurable. So even if you hover the link, and the tooltip looks safe, the link might be malicious. The only way to be certain that the link is safe is to inspect the page's source.

2. Carefully limit who has permissions to edit resource manifests (this is configured in [RBAC](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/)).

### References

* [Documentation for the external links feature](https://argo-cd.readthedocs.io/en/stable/user-guide/external-url/)

### Credits

Disclosed by ADA Logics in a security audit of the Argo project sponsored by CNCF and facilitated by OSTIF. Thanks to Adam Korczynski and David Korczynski for their work on the audit.

### For more information

* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)
* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd
Arbitrary file write in dragonfly
Advisory: GHSA-fj34-jhjx-xmvv
Aliases: CVE-2021-33473
Published: 2022-06-03T00:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verify_url option is disabled. This vulnerability is exploited via a crafted URL.
Uncontrolled Resource Consumption in pg-native and libpq
Advisory: GHSA-j32j-2hxv-rqf7
Aliases: CVE-2022-25852
Published: 2022-06-18T00:00:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

All versions of package pg-native; all versions of package libpq are vulnerable to Denial of Service (DoS) when the addons attempt to cast the second argument to an array and fail. This happens for every non-array argument passed. **Note:** pg-native is a mere binding to npm's libpq library, which in turn has the addons and bindings to the actual C libpq library. This means that problems found in pg-native may transitively impact npm's libpq.
Space bug in `clean_text`
Advisory: GHSA-p2g9-94wh-65c2
Published: 2022-06-16T23:39:55Z

An incorrect mapping from HTML specification to ASCII codes was used.
Because HTML treats the Form Feed as whitespace, code like this has an injection bug:

    let html = format!("<div title={}>", clean_text(user_supplied_string));

Applications are not affected if they quote their attributes, or if they don't use `clean_text` at all.
Node DOS by way of memory exhaustion through ExecSync request in CRI-O
Advisory: GHSA-fcm2-6c3h-pg6j
Aliases: CVE-2022-1708
Published: 2022-06-06T21:50:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Description
An ExecSync request runs a command in a container and returns the output to the Kubelet. It is used for readiness and liveness probes within a pod. The way CRI-O runs ExecSync commands is through conmon. CRI-O asks conmon to start the process, and conmon writes the output to disk. CRI-O then reads the output and returns it to the Kubelet.

If the output of the command is large enough, it is possible to exhaust the memory (or disk usage) of the node. The following deployment is an example yaml file that will output around 8GB of ‘A’ characters, which would be written to disk by conmon and read by CRI-O.

```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment100
spec:
  selector:
    matchLabels:
      app: nginx
  replicas: 2
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        lifecycle:
          postStart:
            exec:
              command: ["/bin/sh", "-c", "seq 1 50000000`; do echo -n 'aaaaaaaaaaaaaaaa'; done"]
```

### Impact
It is possible for the node to be exhausted of memory or disk space, depending on the node the command is being run on. What is further problematic is that the memory and disk usage aren't attributed to the container, as this file and its processing are implementation details of CRI-O. The consequence of the exhaustion is that other services on the node, e.g. other containers, will be unable to allocate memory and thus causing a denial of service.

### Patches
This vulnerability will be fixed in 1.24.1, 1.23.3, 1.22.5, v1.21.8, v1.20.8, v1.19.7

### Workarounds
At the time of writing, no workaround exists other than ensuring only trusted images are used.

### References
https://github.com/containerd/containerd/security/advisories/GHSA-5ffw-gxpp-mxpf

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the CRI-O repo](http://github.com/cri-o/cri-o/issues)
* To make a report, email your vulnerability to the private
[cncf-crio-security@lists.cncf.io](mailto:cncf-crio-security@lists.cncf.io) list
with the security details and the details expected for [all CRI-O bug
reports](https://github.com/cri-o/cri-o/blob/main/.github/ISSUE_TEMPLATE/bug-report.yml).

### Credits
Disclosed by Ada Logics in a security audit sponsored by CNCF and facilitated by OSTIF.
Neos CMS vulnerable to XSS in various backend modules
Advisory: GHSA-7m9h-v68w-pfw3
Aliases: CVE-2022-30429
Published: 2022-06-03T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Multiple cross-site scripting (XSS) vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script or HTML code using the editor function, the deletion of assets, or a workspace title. The vulnerabilities were found in versions 3.3.29 and 8.0.1 and could also be present in all intermediate versions.
Cross-site Scripting in SEOmatic plugin
Advisory: GHSA-6hjc-m38h-7jhh
Aliases: CVE-2021-41750
Published: 2022-06-13T00:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName parameter containing an arbitrary filename with the intended content-type to be rendered in the user's browser as the extension.
Insufficiently Protected Credentials in PowerJob
Advisory: GHSA-w4q4-jcm7-g4m6
Aliases: CVE-2020-28865
Published: 2022-06-17T00:01:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

An issue was discovered in PowerJob through 3.2.2, allows attackers to change arbitrary user passwords via the id parameter to /appinfo/save.
SQL Injection in RosarioSIS
Advisory: GHSA-3pqv-6pm3-g46j
Aliases: CVE-2022-2067
Published: 2022-06-14T00:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SQL Injection in GitHub repository francoisjacquet/rosariosis prior to 9.0.
Cross-site Scripting in admidio
Advisory: GHSA-qr6m-f3gv-8678
Aliases: CVE-2022-23896
Published: 2022-06-29T00:00:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Admidio 4.1.2 version is affected by stored cross-site scripting (XSS).
Missing permission check in Jenkins vRealize Orchestrator Plugin
Advisory: GHSA-35r9-gfqf-r6cw
Aliases: CVE-2022-34212
Published: 2022-06-24T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A missing permission check in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request to an attacker-specified URL.
`Read` on uninitialized buffer in `fill_buf()` and `read_up_to()`
Advisory: GHSA-hv9v-7w3v-rj6f
Published: 2022-06-16T23:38:37Z

Affected versions of this crate passes an uninitialized buffer to a user-provided `Read` implementation.

Arbitrary `Read` implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer.

Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.
Cross-Site Request Forgery in Elefant CMS
Advisory: GHSA-pq7f-cq6q-94xh
Aliases: CVE-2017-20062
Published: 2022-06-21T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A vulnerability was found in Elefant CMS 1.3.12-RC and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.
Aliased mutable references from `tls_rand` & `TlsWyRand`
Advisory: GHSA-p6gj-gpc8-f8xw
Published: 2022-06-17T00:13:24Z

`TlsWyRand`'s implementation of `Deref` unconditionally dereferences a raw pointer, and returns 
multiple mutable references to the same object, which is undefined behavior.
Use After Free in Context::start_auth_session
Advisory: GHSA-w3vw-ccc5-qr8v
Published: 2022-06-17T01:17:41Z

### Impact

**This issue only applies to applications starting authorization sessions using an explicit initial `nonce`.**

When [`Context::start_auth_session`](https://docs.rs/tss-esapi/7.0.1/tss_esapi/struct.Context.html#method.start_auth_session) was called with a `nonce` argument value of `Some(...)`, the nonce pointer passed down through FFI to `Esys_StartAuthSession` would be a dangling pointer, left over from a defunct instance of `TPM2B_NONCE`. This could lead to an incorrect value being used as a nonce, though whether that value is controllable is unclear (so should be assumed as possible). The error became apparent due to changes in v1.61.0 of the Rust compiler.

Logs indicating a failure due to this issue (with the 1.61.0 version of the Rust toolchain) look as follows:
```
2022-05-24T01:04:41.9131341Z WARNING:esys:src/tss2-esys/api/Esys_StartAuthSession.c:390:Esys_StartAuthSession_Finish() Received TPM Error 
2022-05-24T01:04:41.9132192Z ERROR:esys:src/tss2-esys/api/Esys_StartAuthSession.c:136:Esys_StartAuthSession() Esys Finish ErrorCode (0x000001d5) 
2022-05-24T01:04:41.9145124Z [2022-05-24T01:04:41Z ERROR tss_esapi::context::tpm_commands::session_commands] Error when creating a session: structure is the wrong size (associated with parameter number 1)
2022-05-24T01:04:41.9153816Z thread 'main' panicked at 'Call to start_auth_session failed: Tss2Error(FormatOne(FormatOneResponseCode { .0: 469, error_number: 21, parameter: true, format_selector: true, number: 1 }))', tss-esapi/tests/integration_tests/context_tests/tpm_commands/enhanced_authorization_ea_commands_tests.rs:870:14
```

### Patches
The issue has been patched in versions 6 and 7 of the `tss-esapi` crate. Please update to `7.1.0` or `6.1.2`.

### Workarounds
There is no workaround that achieves the same functionality.

### References
For more information on the cause of the issue and the fix, see [this](https://github.com/parallaxsecond/rust-tss-esapi/pull/344) PR.

For more details about the `TPM2_StartAuthSession` command see section 11.1 of [the TPM spec, part 3](https://trustedcomputinggroup.org/wp-content/uploads/TCG_TPM2_r1p59_Part3_Commands_pub.pdf), and section 19.6.3 of [part 1 of the same spec](https://trustedcomputinggroup.org/wp-content/uploads/TCG_TPM2_r1p59_Part1_Architecture_pub.pdf) for more information regarding session nonces.

### For more information
If you have any questions or comments about this advisory:
* Open an issue or discussion in [our repo](https://github.com/parallaxsecond/rust-tss-esapi)
* Get in touch on [our Slack channel](https://github.com/parallaxsecond/community#community-channel)
Duplicate Advisory: `#[zeroize(drop)]` doesn't implement `Drop` for `enum`s
Advisory: GHSA-r45x-ghr2-qjxc
Published: 2022-06-17T00:30:52Z
Withdrawn: 2022-06-23T17:29:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

## Duplicate Advisory
This advisory is a duplicate of [GHSA-c5hx-w945-j4pq](https://github.com/advisories/GHSA-c5hx-w945-j4pq). This link is preserved to maintain external references.

## Original Description
Affected versions of this crate did not implement `Drop` when `#[zeroize(drop)]` was used on an `enum`.

This can result in memory not being zeroed out after dropping it, which is exactly what is intended when adding this attribute.

The flaw was corrected in version 1.2 and `#[zeroize(drop)]` on `enum`s now properly implements `Drop`.
Login timing attack in ezsystems/ezpublish-kernel
Advisory: GHSA-xfqg-p48g-hh94
Published: 2022-06-02T21:02:00Z

Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replaces this with constant time functionality, configured in the new security.yml parameter 'ibexa.security.authentication.constant_auth_time'. It will log a warning if the constant time is exceeded. If this happens the setting should be increased.
NT auth module vulnerability in OpenAM
Advisory: GHSA-px3r-27qc-hx5g
Aliases: CVE-2022-34298
Published: 2022-06-24T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack."
Denial of Service (DoS) vulnerability in RSSHub
Advisory: GHSA-jvxx-v45p-v5vf
Aliases: CVE-2022-31110
Published: 2022-06-23T06:45:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

### Impact

Passing some special values to the `filter` and `filterout` parameters can cause an abnormally high CPU. Impact on the performance of the servers and RSSHub services.

### Patches

It is fixed in 5c4177441417b44a6e45c3c63e9eac2504abeb5b , please update to this or the later versions as soon as possible.

### References

Full report: https://github.com/DIYgod/RSSHub/issues/10045

### For more information

If you have any questions or comments about this advisory:
* Open an issue in <https://github.com/DIYgod/RSSHub/issues>
* Email us at [i@diygod.me](mailto:i@diygod.me)

### Credits

@Rongronggg9
Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server
Advisory: GHSA-q4w5-4gq2-98vm
Aliases: CVE-2022-31036
Published: 2022-06-21T20:04:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

### Impact

All unpatched versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD's repo-server.

A malicious Argo CD user with write access for a repository which is (or may be) used in a Helm-type Application may commit a symlink which points to an out-of-bounds file. If the target file is a valid YAML file, the attacker can read the contents of that file.

Sensitive files which could be leaked include manifest files from other Applications' source repositories (potentially decrypted files, if you are using a decryption plugin) or any YAML-formatted secrets which have been mounted as files on the repo-server.

### Patches

A patch for this vulnerability has been released in the following Argo CD versions:

* v2.4.1
* v2.3.5
* v2.2.10
* v2.1.16

### Workarounds

* If you are using >=v2.3.0 and do not have any Helm-type Applications, [disable the Helm config management tool](https://argo-cd.readthedocs.io/en/stable/user-guide/tool_detection/#disable-built-in-tools).

#### Mitigations

* Avoid mounting YAML-formatted secrets as files on the repo-server.
* Upgrade to >=2.3.0 to significantly reduce the risk of leaking out-of-bounds manifest files. Starting with 2.3.0, repository paths are randomized, and read permissions are restricted when manifests are not being actively being generated. This makes it very difficult to craft and use a malicious symlink.

#### Best practices which can mitigate risk

* Limit who has push access to manifest repositories.
* Limit who is allowed to configure new source repositories.

### Credits

Disclosed by ADA Logics in a security audit of the Argo project sponsored by CNCF and facilitated by OSTIF. Thanks to Adam Korczynski and David Korczynski for their work on the audit.

### References

* List of [types of Applications](https://argo-cd.readthedocs.io/en/stable/user-guide/application_sources/), including Helm-type
* [RBAC documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/), showing how to limit repository permissions

### For more information

* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)
* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd
Denial of Service in Spring Cloud Function
Advisory: GHSA-q588-3544-8g33
Aliases: CVE-2022-22979
Published: 2022-06-22T00:00:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functionality to cause a denial-of-service condition due to the caching issue in the Function Catalog component of the framework.
AtomicBucket<T> unconditionally implements Send/Sync
Advisory: GHSA-3hxh-7jxm-59x4
Published: 2022-06-17T00:13:03Z

In the affected versions of the crate, `AtomicBucket<T>` unconditionally implements `Send`/`Sync` traits. Therefore, users can create a data race to the inner
`T: !Sync` by using the `AtomicBucket::data_with()` API.
Such data races can potentially cause memory corruption or other undefined behavior.

The flaw was fixed in commit 8e6daab by adding appropriate Send/Sync bounds to the Send/Sync impl of struct `Block<T>` (which is a data type contained inside `AtomicBucket<T>`).
Salt's PAM auth fails to reject locked accounts
Advisory: GHSA-fpxm-fprw-6hxj
Aliases: CVE-2022-22967
Published: 2022-06-25T07:21:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth.
`FixedSizeBinaryArray` does not perform bound checks on accessing values and offsets
Advisory: GHSA-qgrp-8f3v-q85p
Published: 2022-06-16T23:41:45Z

`FixedSizeBinaryArray` performs insufficient bounds checks, which allows out-of-bounds reads in safe code.
OS Command Injection in gitsome
Advisory: GHSA-9v73-x562-wv5x
Aliases: CVE-2021-34081
Published: 2022-06-03T00:00:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

OS Command Injection vulnerability in bbultman gitsome through 0.2.3 allows attackers to execute arbitrary commands via a crafted tag name of the target git repository.
Cross-site Scripting in FacturaScripts
Advisory: GHSA-fp76-f299-v3hj
Aliases: CVE-2022-2065
Published: 2022-06-14T00:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Stored in GitHub repository neorazorx/facturascripts prior to 2022.06.
Improper authorization in Jenkins Embeddable Build Status Plugin bypasses ViewStatus permission requirement
Advisory: GHSA-xxhf-xq6v-c8mj
Aliases: CVE-2022-34180
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Embeddable Build Status Plugin 2.0.3 and earlier does not correctly perform the ViewStatus permission check in the HTTP endpoint it provides for \"unprotected\" status badge access.

This allows attackers without any permissions to obtain the build status badge icon for any attacker-specified job and/or build.

Embeddable Build Status Plugin 2.0.4 requires ViewStatus permission to obtain the build status badge icon.
OS Command Injection in proctree
Advisory: GHSA-cv76-rv4h-4mqc
Aliases: CVE-2021-34082
Published: 2022-06-03T00:00:59Z

OS Command Injection vulnerability in allenhwkim proctree through 0.1.1 and commit 0ac10ae575459457838f14e21d5996f2fa5c7593 for Node.js, allows attackers to execute arbitrary commands via the fix function.
Cross-site Scripting vulnerability in Jenkins
Advisory: GHSA-mhp7-3393-pfqr
Aliases: CVE-2022-34172
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Since Jenkins 2.340, symbol-based icons unescape previously escaped values of `tooltip` parameters.

This vulnerability is known to be exploitable by attackers with Job/Configure permission.

Jenkins 2.356, LTS 2.332.4 and LTS 2.346.1 addresses this vulnerability. Symbol-based icons no longer unescape values of `tooltip` parameters.
Prototype Pollution in mout
Advisory: GHSA-vvv8-xw5f-3f88
Aliases: CVE-2022-21213
Published: 2022-06-18T00:00:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn mixes objects into the target object, recursively mixing existing child objects as well. In both cases, the key used to access the target object recursively is not checked, leading to exploiting this vulnerability. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-7792](https://security.snyk.io/vuln/SNYK-JS-MOUT-1014544).
Infinite loop in jpeg-js
Advisory: GHSA-xvf7-4v9q-58w6
Aliases: CVE-2022-25851
Published: 2022-06-11T00:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The package jpeg-js before 0.4.4 is vulnerable to Denial of Service (DoS) where a particular piece of input will cause the program to enter an infinite loop and never return.
Improper Handling of Exceptional Conditions in Newtonsoft.Json
Advisory: GHSA-5crp-9r3c-p9vr
Published: 2022-06-22T15:08:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Newtonsoft.Json prior to version 13.0.1 is vulnerable to Insecure Defaults due to improper handling of expressions with high nesting level that lead to StackOverFlow exception or high CPU and RAM usage. Exploiting this vulnerability results in Denial Of Service (DoS). 

The serialization and deserialization path have different properties regarding the issue.

Deserializing methods (like `JsonConvert.DeserializeObject`) will process the input that results in burning the CPU, allocating memory, and consuming a thread of execution. Quite high nesting level (>10kk, or 9.5MB of `{a:{a:{...` input) is needed to achieve the latency over 10 seconds, depending on the hardware.

Serializing methods (like `JsonConvert.Serialize` or `JObject.ToString`) will throw StackOverFlow exception with the nesting level of around 20k.

To mitigate the issue one either need to update Newtonsoft.Json to 13.0.1 or set `MaxDepth` parameter in the `JsonSerializerSettings`. This can be done globally with the following statement. After that the parsing of the nested input will fail fast with `Newtonsoft.Json.JsonReaderException`:

``` 
JsonConvert.DefaultSettings = () => new JsonSerializerSettings { MaxDepth = 128 };
```

Repro code:
```
//Create a string representation of an highly nested object (JSON serialized)
int nRep = 25000;
string json = string.Concat(Enumerable.Repeat("{a:", nRep)) + "1" +
 string.Concat(Enumerable.Repeat("}", nRep));

//Parse this object (leads to high CPU/RAM consumption)
var parsedJson = JsonConvert.DeserializeObject(json);

// Methods below all throw stack overflow with nRep around 20k and higher
// string a = parsedJson.ToString();
// string b = JsonConvert.SerializeObject(parsedJson);
```

### Additional affected product and version information
**The original statement about the problem only affecting IIS applications is misleading.** Any application is affected, however the IIS has a behavior that stops restarting the instance after some time resulting in a harder-to-fix DoS.**
User account escalation in Apache Hadoop
Advisory: GHSA-58jx-f5rf-qgqf
Aliases: CVE-2021-33036
Published: 2022-06-16T00:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.
Integer Overflow in HeaderMap::reserve() can cause Denial of Service
Advisory: GHSA-xvc9-xwgj-4cq9
Aliases: CVE-2019-25008
Published: 2022-06-16T23:08:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

HeaderMap::reserve() used usize::next_power_of_two() to calculate the increased capacity. However, next_power_of_two() silently overflows to 0 if given a sufficiently large number in release mode.

If the map was not empty when the overflow happens, the library will invoke self.grow(0) and start infinite probing. This allows an attacker who controls the argument to reserve() to cause a potential denial of service (DoS).

The flaw was corrected in 0.1.20 release of http crate.
Uncaught Exception (due to a data race) leads to process termination in Waitress
Advisory: GHSA-f5x9-8jwc-25rw
Aliases: CVE-2022-31015
Published: 2022-06-02T20:37:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact

Waitress may terminate early due to a thread closing a socket while the main thread is about to call select(). This will lead to the main thread raising an exception that is not handled and then causing the entire application to be killed.

### Patches

This issue has been fixed in Waitress 2.1.2 by no longer allowing the WSGI thread to close the socket, instead it is always delegated to the main thread.

### Workarounds

There is no work-around, however users using waitress behind a reverse proxy server are less likely to have issues if the reverse proxy always reads the full response.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in https://github.com/Pylons/waitress/issues (if not sensitive or security related)
* email the Pylons Security mailing list: [pylons-project-security@googlegroups.com](mailto:pylons-project-security@googlegroups.com) (if security related)
Arrow2 allows double free in `safe` code
Advisory: GHSA-5j8w-r7g8-5472
Published: 2022-06-16T23:42:08Z

The struct `Ffi_ArrowArray` implements `#derive(Clone)` that is inconsistent with
its custom implementation of `Drop`, resulting in a double free when cloned.

Cloning this struct in `safe` results in a segmentation fault, which is unsound.

This derive was removed from this struct. All users are advised to either:
* bump the patch version of this crate (for versions `v0.7,v0.8,v0.9`), or
* migrate to a more recent version of  the crate (when using `<0.7`).

Doing so elimitates this vulnerability (code no longer compiles).
Insufficiently Protected Credentials via Insecure Temporary File in org.apache.nifi:nifi-single-user-utils
Advisory: GHSA-rvp4-r3g6-8hxq
Aliases: CVE-2022-26850
Published: 2022-06-20T22:33:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

### Impact

`org.apache.nifi.authentication.single.user.writer.StandardLoginCredentialsWriter` contains a local information disclosure vulnerability due to writing credentials (username and password) to a file that is readable by all other users on unix-like systems. On unix-like systems, the system's temporary directory is shared between all users on that system. As such, files written to that directory without setting the correct file permissions can allow other users on that system to view the contents of the files written to those temporary files.

### Source

An insecure temporary file is created here:
 - https://github.com/apache/nifi/blob/6a1c7c72d5b91b9ce5d5cb5b86e3155d21e2c19b/nifi-commons/nifi-single-user-utils/src/main/java/org/apache/nifi/authentication/single/user/writer/StandardLoginCredentialsWriter.java#L75

The username and password credentials are written to this file here:
 - https://github.com/apache/nifi/blob/6a1c7c72d5b91b9ce5d5cb5b86e3155d21e2c19b/nifi-commons/nifi-single-user-utils/src/main/java/org/apache/nifi/authentication/single/user/writer/StandardLoginCredentialsWriter.java#L85-L95

### Patches

The vulnerability has been patched in version `1.16`.

### Prerequisites

This vulnerability impacts Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users.

### Workarounds

Setting the `java.io.tmpdir` system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability for all operating systems.

### References

 - https://issues.apache.org/jira/browse/NIFI-9785
 - https://github.com/apache/nifi/commit/859d5fe
 - https://github.com/apache/nifi/pull/5856
 - https://nifi.apache.org/security.html#CVE-2022-26850
 - https://twitter.com/JLLeitschuh/status/1511736635645435904?s=20&t=I3w3zF6Y2DUvWYsEFqERjg
`Read` on uninitialized buffer may cause UB ( `read_entry()` )
Advisory: GHSA-p56p-gq3f-whg8
Published: 2022-06-16T23:54:46Z

Affected versions of this crate passes an uninitialized buffer to a user-provided `Read` implementation.
There are two of such cases (`go_offset_log::read_entry()` & `offset_log::read_entry()`).

Arbitrary `Read` implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer.
Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.
OS Command injection in ssl-utils
Advisory: GHSA-552j-pv39-f3jf
Aliases: CVE-2021-34080
Published: 2022-06-03T00:00:58Z

OS Command Injection vulnerability in es128 ssl-utils 1.0.0 for Node.js allows attackers to execute arbitrary commands via unsanitized shell metacharacters provided to the createCertRequest() and the createCert() functions.
CURLOPT_HTTPAUTH option not cleared on change of origin
Advisory: GHSA-25mq-v84q-4j7r
Aliases: CVE-2022-31090
Published: 2022-06-21T16:57:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

### Impact

`Authorization` headers on requests are sensitive information. When using our Curl handler, it is possible to use the `CURLOPT_HTTPAUTH` option to specify an `Authorization` header. On making a request which responds with a redirect to a URI with a different origin, if we choose to follow it, we should remove the `CURLOPT_HTTPAUTH` and `CURLOPT_USERPWD` options before continuing, stopping curl from appending the `Authorization` header to the new request. Previously, we would only consider a change in host. Now, we consider any change in host, port or scheme to be a change in origin.

### Patches

Affected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.8 or 7.4.5. Note that a partial fix was implemented in Guzzle 7.4.2, where a change in host would trigger removal of the curl-added Authorization header, however this earlier fix did not cover change in scheme or change in port.

### Workarounds

If you do not require or expect redirects to be followed, one should simply disable redirects all together. Alternatively, one can specify to use the Guzzle stream handler backend, rather than curl.

### References

* [RFC9110 Section 15.4](https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx)
* [CVE-2022-27776](https://curl.se/docs/CVE-2022-27776.html)

### For more information

If you have any questions or comments about this advisory, please get in touch with us in `#guzzle` on the [PHP HTTP Slack](https://php-http.slack.com/). Do not report additional security advisories in that public channel, however - please follow our [vulnerability reporting process](https://github.com/guzzle/guzzle/security/policy).
Regular expression denial of service in semver-regex
Advisory: GHSA-4x5v-gmq8-25ch
Aliases: CVE-2021-43307
Published: 2022-06-03T00:01:00Z

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the semver-regex npm package, when an attacker is able to supply arbitrary input to the test() method
SystemDS CPU exhaustion vulnerability
Advisory: GHSA-m43h-hfrq-x8wx
Aliases: CVE-2022-26477
Published: 2022-06-28T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The Security Team noticed that the termination condition of the for loop in the readExternal method is a controllable variable, which, if tampered with, may lead to CPU exhaustion. As a fix, we added an upper bound and termination condition in the read and write logic. We classify it as a "low-priority but useful improvement". SystemDS is a distributed system and needs to serialize/deserialize data but in many code paths (e.g., on Spark broadcast/shuffle or writing to sequence files) the byte stream is anyway protected by additional CRC fingerprints. In this particular case though, the number of decoders is upper-bounded by twice the number of columns, which means an attacker would need to modify two entries in the byte stream in a consistent manner. By adding these checks robustness was strictly improved with almost zero overhead. These code changes are available in versions higher than 2.2.1.
Cross-site Scripting in Jenkins CRX Content Package Deployer Plugin
Advisory: GHSA-hc44-p2qq-cfm9
Aliases: CVE-2022-34184
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins CRX Content Package Deployer Plugin 1.9 and earlier does not escape the name and description of CRX Content Package Choice parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix. Additionally, several plugins have previously been updated to list parameters in a way that prevents exploitation by default, see [SECURITY-2617 in the 2022-04-12 security advisory for a list](https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617).
Cross-Site Request Forgery in Jenkins EasyQA Plugin
Advisory: GHSA-g67p-jvvc-qf54
Aliases: CVE-2022-34203
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins EasyQA Plugin 1.0 and earlier allows attackers to connect to an attacker-specified HTTP server.
Path Traversal in Git HTTP endpoints in Gogs
Advisory: GHSA-6vcc-v9vw-g2x5
Aliases: CVE-2022-1993
Published: 2022-06-08T22:34:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

### Impact

The malicious user is able to craft HTTP requests to access unauthorized Git directories. All installations with are affected.

### Patches

Path cleaning has accommodated for Git HTTP endpoints. Users should upgrade to 0.12.9 or the latest 0.13.0+dev.

### Workarounds

N/A

### References

https://huntr.dev/bounties/22f9c074-cf60-4c67-b5c4-72fdf312609d/

### For more information

If you have any questions or comments about this advisory, please post on #7002.