aswin1906/github-advisory-2022 huggingface dataset:
.NET Core Information Disclosure Vulnerability
Advisory: GHSA-vgwq-hfqc-58wv
Aliases: CVE-2021-34485
Published: 2022-10-20T21:34:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0, .NET Core 3.1 and .NET Core 2.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

An information disclosure vulnerability exists in .NET 5.0, .NET Core 3.1 and .NET Core 2.1 when dumps created by the tool to collect crash dumps and dumps on demand are created with global read permissions on Linux and macOS.

### Patches

* If you're using .NET 5.0, you should download and install Runtime 5.0.9 or SDK 5.0.206 (for Visual Studio 2019 v16.8) or SDK 5.0.303 (for Visual Studio 2019 V16.10) from https://dotnet.microsoft.com/download/dotnet-core/5.0.

* If you're using .NET Core 3.1, you should download and install Runtime 3.1.18 or SDK 3.1.118 (for Visual Studio 2019 v16.4) or 3.1.412 (for Visual Studio 2019 v16.7 or later) from https://dotnet.microsoft.com/download/dotnet-core/3.1.

* If you're using .NET Core 2.1, you should download and install Runtime 2.1.29 or SDK 2.1.525 (for Visual Studio 2019 v15.9) or 2.1.817 from https://dotnet.microsoft.com/download/dotnet-core/2.1.


#### Other Details

- Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/196
- An Issue for this can be found at https://github.com/dotnet/runtime/issues/57174
- MSRC details for this can be found at https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-34485
protobuf-java has a potential Denial of Service issue
Advisory: GHSA-h4h5-3hr4-j3g2
Aliases: CVE-2022-3171
Published: 2022-10-04T22:17:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

## Summary
A potential Denial of Service issue in `protobuf-java` core and lite was discovered in the parsing procedure for binary and text format data. Input streams containing multiple instances of non-repeated [embedded messages](http://developers.google.com/protocol-buffers/docs/encoding#embedded) with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. 

Reporter: [OSS Fuzz](https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48771)

Affected versions: This issue affects both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.

## Severity

[CVE-2022-3171](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3171) Medium - CVSS Score: 5.7 (NOTE: there may be a delay in publication)

## Remediation and Mitigation

Please update to the latest available versions of the following packages:

protobuf-java (3.21.7, 3.20.3, 3.19.6, 3.16.3)
protobuf-javalite (3.21.7, 3.20.3, 3.19.6, 3.16.3)
protobuf-kotlin (3.21.7, 3.20.3, 3.19.6, 3.16.3)
protobuf-kotlin-lite (3.21.7, 3.20.3, 3.19.6, 3.16.3)
google-protobuf [JRuby gem only] (3.21.7, 3.20.3, 3.19.6)
.NET Core Elevation of Privilege Vulnerability
Advisory: GHSA-rh58-r7jh-xhx3
Aliases: CVE-2021-26423
Published: 2022-10-25T17:33:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0 and .NET Core 3.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A denial of service vulnerability exists in .NET 5.0, .NET Core 3.1 and .NET Core 2.1 where .NET (Core) server applications providing WebSocket endpoints could be tricked into endlessly looping while trying to read a single WebSocket frame. 

### Patches

* If you're using .NET 5.0, you should download and install Runtime 5.0.9 or SDK 5.0.206 (for Visual Studio 2019 v16.8) or SDK 5.0.303 (for Visual Studio 2019 V16.10) from https://dotnet.microsoft.com/download/dotnet-core/5.0.

* If you're using .NET Core 3.1, you should download and install Runtime 3.1.18 or SDK 3.1.118 (for Visual Studio 2019 v16.4) or 3.1.412 (for Visual Studio 2019 v16.7 or later) from https://dotnet.microsoft.com/download/dotnet-core/3.1.

* If you're using .NET Core 2.1, you should download and install Runtime 2.1.29 or SDK 2.1.525 (for Visual Studio 2019 v15.9) or 2.1.817 from https://dotnet.microsoft.com/download/dotnet-core/2.1.


#### Other Details

- Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/194
- An Issue for this can be found at https://github.com/dotnet/runtime/issues/57175
- MSRC details for this can be found at https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26423
Agent-to-controller security bypass vulnerabilities in Jenkins Compuware Topaz for Total Test Plugin
Advisory: GHSA-xp3r-9wx8-q2mm
Aliases: CVE-2022-43428
Published: 2022-10-19T19:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.

These vulnerabilities are only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the [LTS upgrade guide](https://www.jenkins.io/doc/upgrade-guide/2.303/#upgrading-to-jenkins-lts-2-303-3).
Cross-site Scripting in actionpack
Advisory: GHSA-9chr-4fjh-5rgw
Aliases: CVE-2022-3704
Published: 2022-10-27T12:00:27Z
Withdrawn: 2023-01-23T20:44:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

actionpack from the Ruby on Rails project is vulnerable to Cross-site Scripting in the Route Error Page. This issue has been patched with this [commit](https://github.com/rails/rails/commit/be177e4566747b73ff63fd5f529fab564e475ed4). 

This vulnerability is disputed by the Rails security team. It requires that the developer is tricked into copy pasting a malicious javascript-containing string into a development-only error page accessible only via localhost.
SQLite3 addresses vulnerability in packaged version of libsqlite
Advisory: GHSA-mgvv-5mxp-xq67
Published: 2022-10-03T22:12:28Z

### Summary

The rubygem sqlite3 v1.5.1 upgrades the packaged version of libsqlite from v3.39.3 to [v3.39.4](https://sqlite.org/releaselog/3_39_4.html).

libsqlite v3.39.4 addresses a vulnerability described as follows in the release notification:

> Version 3.39.4 is a minimal patch against the prior release that addresses issues found since the
> prior release. In particular, a potential vulnerability in the FTS3 extension has been fixed, so
> this should be considered a security update.
>
> In order to exploit the vulnerability, an attacker must have full SQL access and must be able to
> construct a corrupt database with over 2GB of FTS3 content. The problem arises from a 32-bit
> signed integer overflow.

This vulnerability has not been assigned a CVE and does not have a severity declared.

Please note that this advisory only applies to the sqlite3 gem v1.5.0, and only if the packaged libsqlite is being used. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's libsqlite release announcements.


### Mitigation

Upgrade to the rubygem sqlite3 v1.5.1 or later.

Users who are unable to upgrade the sqlite3 gem may also choose a more complicated mitigation: compile and link sqlite3 against external libsqlite >= 3.39.4 which will also address these same issues.


### References

- Upstream release notes: https://sqlite.org/releaselog/3_39_4.html
- Instructions for compiling against system libraries: https://github.com/sparklemotion/sqlite3-ruby
free5GC vulnerable to malformed NGAP message crashing the AMF and NGAP decoders
Advisory: GHSA-59hj-62f5-fgmc
Aliases: CVE-2022-43677
Published: 2022-10-24T19:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

In free5GC 3.2.1, a malformed NGAP message can crash the AMF and NGAP decoders via an index-out-of-range panic in `aper.GetBitString`.
v8n vulnerable to Inefficient Regular Expression Complexity
Advisory: GHSA-xrx9-gj26-5wx9
Aliases: CVE-2022-35923
Published: 2022-10-07T07:33:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
Inefficient regular expression complexity of `lowercase()` and `uppercase()` regex could lead to a denial of service attack. With a formed payload `'a' + 'a'.repeat(i) + 'A'`, only 32 characters payload could take 29443 ms time execution when testing `lowercase()`. The same issue happens with `uppercase()`.

### Patches
v1.5.1

### References
[huntr.dev report](https://huntr.dev/bounties/2d92f644-593b-43b4-bfd1-c8042ac60609)
[_Regular Expression Denial of Service (ReDoS) and Catastrophic Backtracking_](https://snyk.io/blog/redos-and-catastrophic-backtracking/)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [v8n issues list](https://github.com/imbrn/v8n)
* Email us at [brunodev02221@gmail.com](mailto:brunodev02221@gmail.com)
django-mfa2 vulnerable to MFA Replay attack
Advisory: GHSA-vw39-2wj9-4q86
Aliases: CVE-2022-42731
Published: 2022-10-11T19:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage.
YetiForce CRM vulnerable to stored Cross-site Scripting
Advisory: GHSA-v9fj-h8g6-4w9q
Aliases: CVE-2022-3002
Published: 2022-10-06T18:52:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

YetiForce CRM version 6.4.0 and prior is vulnerable to stored cross-site scripting. A [patch](https://github.com/yetiforcecompany/yetiforcecrm/commit/54728becfdad9b6e686bbe336007cba2ce518248) is available on the `developer` branch.
Non-constant time webhook token comparison in Jenkins GitLab Plugin
Advisory: GHSA-f9f9-4r63-4qcc
Aliases: CVE-2022-43411
Published: 2022-10-19T19:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

GitLab Plugin 1.5.35 and earlier does not use a constant-time comparison when checking whether the provided and expected webhook token are equal.

This could potentially allow attackers to use statistical methods to obtain a valid webhook token.

GitLab Plugin 1.5.36 uses a constant-time comparison when validating the webhook token.
Poetry vulnerable to Untrusted Search Path leading to Local Code Execution on Windows
Advisory: GHSA-j4j9-7hg9-97g6
Aliases: CVE-2022-36070
Published: 2022-10-11T20:41:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

### Observation

To handle dependencies that come from a Git repository, Poetry executes various commands, e.g. `git config`. These commands are being executed using the executable’s name and not its absolute path.

This can lead to the execution of untrusted code due to the way Windows resolves executable names to paths. Unlike Linux-based operating systems, Windows searches for the executable in the current directory first and looks in the paths that are defined in the `PATH` environment variable afterward. If the current directory contains unknown and thus potentially malicious files, the directory could contain an executable named `git.exe` which would be executed by Poetry.

Poetry calls executables by name when handling dependencies from Git. Note that there might be even more places where Poetry calls executables by name.

### Impact

This vulnerability can lead to Arbitrary Code Execution, which would lead to the takeover of the system. If a developer is exploited, the attacker could steal credentials or persist their access. If the exploit happens on a server, the attackers could use their access to attack other internal systems.
Since this vulnerability requires a fair amount of user interaction, it is not as dangerous as a remotely exploitable one. However, it still puts developers at risk when dealing with untrusted files in a way they think is safe, because the exploit still works when the victim tries to make
 
sure nothing can happen, e.g. by checking that the referenced Git dependency is not malicious and points to a trusted Git repository.
The victim could also not protect themself by vetting any Git or Poetry config files that might be present in the directory, because the behavior is undocumented. This kind of attack vector has been used in the past to target security researchers by sending them projects to collaborate on, so we believe that there is a non-negligible risk.

### Patches

1.1.9 || 1.2.0b1

### Remediation

Upgrade to version 1.1.9 || 1.2.0b1

### References

[Fix PR](https://github.com/python-poetry/poetry-core/pull/204)

### For more information

If you have any questions or comments about this advisory:
* Email us at [security@python-poetry.org](mailto:security@python-poetry.org)
Jenkins Job Import Plugin allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins
Advisory: GHSA-4g29-r7vj-2rpv
Aliases: CVE-2022-43413
Published: 2022-10-19T19:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Job Import Plugin 3.5 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. An enumeration of credentials IDs in Job Import Plugin 3.6 requires Job Import/Import Jobs permission.
Sandbox bypass vulnerability in Jenkins Pipeline: Deprecated Groovy Libraries Plugin
Advisory: GHSA-7qw2-h9gj-hcvh
Aliases: CVE-2022-43406
Published: 2022-10-19T19:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Pipeline: Groovy Libraries Plugin and older releases of the Pipeline: Deprecated Groovy Libraries Plugin (formerly Pipeline: Shared Groovy Libraries Plugin) define the l`ibrary` Pipeline step, which allows Pipeline authors to dynamically load Pipeline libraries. The return value of this step can be used to instantiate classes defined in the loaded library.

In Pipeline: Groovy Libraries Plugin 612.v84da_9c54906d and earlier and in Pipeline: Deprecated Groovy Libraries Plugin 583.vf3b_454e43966 and earlier, the `library` step can be used to invoke sandbox-generated synthetic constructors in crafted untrusted libraries and construct any subclassable type. This is similar to SECURITY-582 in the [2017-08-07 security advisory](https://www.jenkins.io/security/advisory/2017-08-07/#multiple-groovy-language-features-allowed-script-security-plugin-sandbox-bypass), but in a different plugin.

This vulnerability allows attackers with permission to define untrusted Pipeline libraries and to define and run sandboxed Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Pipeline: Groovy Libraries Plugin 613.v9c41a_160233f rejects improper calls to sandbox-generated synthetic constructors when using the `library` step.

Pipeline: Deprecated Groovy Libraries Plugin 588.v576c103a_ff86 no longer contains the `library` step. It has been moved into the Pipeline: Groovy Libraries Plugin.
loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)
Advisory: GHSA-hhq3-ff78-jv3g
Aliases: CVE-2022-37599
Published: 2022-10-12T12:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils via the resourcePath variable in interpolateName.js. A badly or maliciously formed string could be used to send crafted requests that cause a system to crash or take a disproportional amount of time to process. This issue has been patched in versions 1.4.2, 2.0.4 and 3.2.1.
API keys stored in plain text by Jenkins Katalon Plugin
Advisory: GHSA-35rx-7pc8-6963
Aliases: CVE-2022-43419
Published: 2022-10-19T19:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Katalon Plugin 1.0.32 and earlier stores API keys unencrypted in job `config.xml` files on the Jenkins controller as part of its configuration.

These API keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Katalon Plugin 1.0.33 no longer stores the API keys directly, instead accessing them through its [Credentials Plugin](https://plugins.jenkins.io/credentials) integration, once affected job configurations are saved again.
com.enonic.xp:lib-auth vulnerable to Session Fixation
Advisory: GHSA-4m5p-5w5w-3jcf
Published: 2022-10-12T20:13:46Z

### Impact
All id-providers using lib-auth `login` method. lib-auth should invalidate old session after login and replicate session attributes in a new one, however this is not the behavior in affected versions.

### Workarounds
Don't use lib-auth for `login`. 
Java API uses low-level structures and allows to invalidate previous session before auth-info is added.

### References

https://github.com/enonic/xp/issues/9253
XXE vulnerability in Jenkins Compuware Topaz for Total Test Plugin
Advisory: GHSA-vhwv-8897-jm7q
Aliases: CVE-2022-43430
Published: 2022-10-19T19:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control the input files for the 'Topaz for Total Test - Execute Total Test scenarios' build step to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
xmlquery lacks check for whether LoadURL response is in XML format, causing denial of service
Advisory: GHSA-93m7-c69f-5cfj
Aliases: CVE-2020-25614
Published: 2022-10-07T07:20:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause a denial of service (SIGSEGV) at xmlquery.(*Node).InnerText or possibly have unspecified other impact.
Origin Validation Error in rdiffweb
Advisory: GHSA-824x-jcxf-hpfg
Aliases: CVE-2022-3457
Published: 2022-10-14T12:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ikus060/rdiffweb prior to 2.5.0a5 did not enforce origin validation in web traffic. Users are advised to upgrade to version 2.5.0a5.
Bifrost vulnerable to authentication check flaw that leads to authentication bypass
Advisory: GHSA-mxrx-fg8p-5p5j
Aliases: CVE-2022-39267
Published: 2022-10-18T19:57:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact
The admin and monitor user groups need to be authenticated by username and password. If we delete the X-Requested-With: XMLHttpRequest field in the request header,the authentication will be bypassed.

### Patches
https://github.com/brockercap/Bifrost/pull/201

### Workarounds
Upgrade to the latest version
feathers-sequelize contains improper input validation leading to SQL injection
Advisory: GHSA-qpv8-4pjq-qqh7
Aliases: CVE-2022-2422
Published: 2022-10-26T12:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Due to improper input validation in the Feathers js library, it is possible to perform a SQL injection attack on the back-end database, in case the feathers-sequelize package is used.
melisplatform/melis-front vulnerable to deserialization of untrusted data
Advisory: GHSA-h479-2mv4-5c26
Aliases: CVE-2022-39298
Published: 2022-10-11T20:45:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

### Impact

Attackers can deserialize arbitrary data on affected versions of `melisplatform/melis-front`, and ultimately leads to the execution of arbitrary PHP code on the system. Conducting this attack does not require authentication.

Users should immediately upgrade to `melisplatform/melis-front` >= 5.0.1.

### Patches

This issue was addressed by restricting allowed classes when deserializing user-controlled data. 

### References

- https://github.com/melisplatform/melis-front/commit/89ae612d5f1f7aa2fb621ee8de27dffe1feb851e

### For more information

If you have any questions or comments about this advisory, you can contact:
- The original reporters, by sending an email to vulnerability.research [at] sonarsource.com;
- The maintainers, by opening an issue on this repository.
Django denial-of-service vulnerability in internationalized URLs
Advisory: GHSA-qrw5-5h28-6cmg
Aliases: CVE-2022-41323
Published: 2022-10-16T12:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.
Denial of service in golang.org/x/text/language
Advisory: GHSA-69ch-w2m2-3vjp
Aliases: CVE-2022-32149
Published: 2022-10-14T19:00:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The BCP 47 tag parser has quadratic time complexity due to inherent aspects of its design. Since the parser is, by design, exposed to untrusted user input, this can be leveraged to force a program to consume significant time parsing Accept-Language headers. The parser cannot be easily rewritten to fix this behavior for various reasons. Instead the solution implemented in this CL is to limit the total complexity of tags passed into ParseAcceptLanguage by limiting the number of dashes in the string to 1000. This should be more than enough for the majority of real world use cases, where the number of tags being sent is likely to be in the single digits.
Execution with Unnecessary Privileges in JupyterApp
Advisory: GHSA-m678-f26j-3hrp
Aliases: CVE-2022-39286
Published: 2022-10-26T22:07:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact
_What kind of vulnerability is it? Who is impacted?_
We’d like to disclose an arbitrary code execution vulnerability in `jupyter_core` that stems from `jupyter_core` executing untrusted files in the current working directory. This vulnerability allows one user to run code as another.


### Patches
_Has the problem been patched? What versions should users upgrade to?_
Users should upgrade to `jupyter_core>=4.11.2`.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
No

### References
_Are there any links users can visit to find out more?_
Similar advisory in [IPython](https://github.com/advisories/GHSA-pq7m-3gw7-gq5x)
matrix-sdk 0.6.0 logs access tokens
Advisory: GHSA-fc4h-xcf3-qj5f
Published: 2022-10-25T20:22:19Z

When sending Matrix requests using an affected version of `matrix-sdk` in an application that writes logs using `tracing-subscriber` (in a way that includes fields of tracing spans such as `tracing_subscriber`s default text output from the `fmt` module), these logs will contain the user's access token.
Duplicate Advisory: Improper Restriction of XML External Entity Reference in pikepdf
Advisory: GHSA-x58j-j539-w8mv
Aliases: CVE-2021-46849
Published: 2022-10-24T19:00:20Z
Withdrawn: 2023-08-03T22:53:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-29421, GHSA-ccgm-3xw4-h5p8. Reason: This candidate is a duplicate of CVE-2021-29421. Notes: All CVE users should reference CVE-2021-29421 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable
Advisory: GHSA-3rfm-jhwj-7488
Aliases: CVE-2022-37603
Published: 2022-10-14T19:00:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js. A badly or maliciously formed string could be used to send crafted requests that cause a system to crash or take a disproportional amount of time to process. This issue has been patched in versions 1.4.2, 2.0.4 and 3.2.1.
HyperSQL DataBase vulnerable to remote code execution when processing untrusted input
Advisory: GHSA-77xx-rxvh-q682
Aliases: CVE-2022-41853
Published: 2022-10-06T18:52:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Those using `java.sql.Statement` or `java.sql.PreparedStatement` in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property "hsqldb.method_class_names" to classes which are allowed to be called. For example, `System.setProperty("hsqldb.method_class_names", "abc")` or Java argument `-Dhsqldb.method_class_names="abc"` can be used. From version 2.7.1 all classes by default are not accessible except those in `java.lang.Math` and need to be manually enabled.
Stored XSS vulnerability in Jenkins Custom Checkbox Parameter Plugin
Advisory: GHSA-vf5v-6wjm-vr7v
Aliases: CVE-2022-43425
Published: 2022-10-19T19:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Custom Checkbox Parameter Plugin 1.4 and earlier does not escape the name and description of the parameter types it provides.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix. Additionally, several plugins have previously been updated to list parameters in a way that prevents exploitation by default, see [SECURITY-2617 in the 2022-04-12 security advisory for a list](https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617).
Gitea vulnerable to Argument Injection
Advisory: GHSA-w8xw-7crf-h23x
Aliases: CVE-2022-42968
Published: 2022-10-16T12:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Gitea before 1.17.3 does not sanitize and escape refs in the git backend. Arguments to git commands are mishandled.
etcd vulnerable to TOCTOU of gateway endpoint authentication
Advisory: GHSA-h8g9-6gvh-5mrc
Published: 2022-10-06T23:12:38Z

### Vulnerability type
Authentication

### Workarounds
Refer to the [gateway documentation](https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.md). The vulnerability was spotted due to unclear documentation of how the gateway handles endpoints validation. 

### Detail
The gateway only authenticates endpoints detected from DNS SRV records, and it only authenticates the detected endpoints once. Therefore, if an endpoint changes its authentication settings, the gateway will continue to assume the endpoint is still authenticated. The auditors has noted that appropriate documentation of this validation functionality plus deprecation of this misleading functionality is an acceptable path forward.

### References
Find out more on this vulnerability in the [security audit report](https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDIT.pdf)

### For more information
If you have any questions or comments about this advisory:
* Contact the [etcd security committee](https://github.com/etcd-io/etcd/blob/master/security/security-release-process.md#product-security-committee-psc)
OctoPrint vulnerable to Special Element Injection
Advisory: GHSA-rj5f-vm79-5j84
Aliases: CVE-2022-3607
Published: 2022-10-19T19:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

OctoPrint prior to 1.8.3 is vulnerable to Special Element Injection.
Signature bypass via multiple root elements
Advisory: GHSA-5p8w-2mvw-38pv
Aliases: CVE-2022-39300
Published: 2022-10-12T22:05:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact

A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered.

### Patches

Users should upgrade to node-saml v4.0.0-beta5 or newer. 

### Workarounds

Disable SAML authentication.

### References
_Are there any links users can visit to find out more?_

### For more information
If you have any questions or comments about this advisory:
* Open a discussion in the [node-saml repo](https://github.com/node-saml/node-saml/discussions)

### Credits

* Felix Wilhelm of Google Project Zero
Inefficient Regular Expression Complexity in shescape 
Advisory: GHSA-cr84-xvw4-qx3c
Aliases: CVE-2022-25918
Published: 2022-10-25T22:27:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact

This impacts users that use shescape to escape arguments:

- for the Unix shell Bash, or any not-officially-supported Unix shell;
- using the `escape` or `escapeAll` functions with the `interpolation` option set to `true`.

An attacker can cause polynomial backtracking in terms of the input string length due to a Regular Expression in shescape that is vulnerable to Regular Expression Denial of Service (ReDoS). Example:

```javascript
import * as shescape from "shescape";

/* 1. Prerequisites */
const options = {
  interpolation: true,
  // and
  shell: "/bin/bash",
  // or
  shell: "some-not-officially-supported-shell",
  // or
  shell: undefined, // Only if the system's default shell is bash or an unsupported shell.
};

/* 2. Attack */
let userInput = '{,'.repeat(150_000); // polynomial backtracking

/* 3. Usage */
shescape.escape(userInput, options);
// or
shescape.escapeAll([userInput], options);
```

### Patches

This bug has been patched in [v1.6.1](https://github.com/ericcornelissen/shescape/releases/tag/v1.6.1) which you can upgrade to now. No further changes required.

### Workarounds

Alternatively, a maximum length can be enforced on input strings to shescape to reduce the impact of the vulnerability. It is not recommended to try and detect vulnerable input strings, as the logic for this may end up being vulnerable to ReDoS itself.

### References

- Shescape commit [552e8ea](https://github.com/ericcornelissen/shescape/commit/552e8eab56861720b1d4e5474fb65741643358f9)
- Shescape Release [v1.6.1](https://github.com/ericcornelissen/shescape/releases/tag/v1.6.1)

### For more information

- Comment on commit [552e8ea](https://github.com/ericcornelissen/shescape/commit/552e8eab56861720b1d4e5474fb65741643358f9)
- Open an issue at [https://github.com/ericcornelissen/shescape/issues](https://github.com/ericcornelissen/shescape/issues?q=is%3Aissue+is%3Aopen) (New issue > Question > Get started)
JXPath Out-of-bounds Write vulnerability
Advisory: GHSA-mf2h-6mg2-px9x
Aliases: CVE-2022-40158
Published: 2022-10-06T18:52:04Z
Withdrawn: 2022-11-10T22:39:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

## Withdrawn

This advisory has been withdrawn because the original report was found to be invalid. This link is maintained to preserve external references.

## Original Description

Those using JXPath to interpret XPath may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
TensorFlow vulnerable to heap out of bounds read in filesystem glob matching
Advisory: GHSA-9jjw-hf72-3mxw
Aliases: CVE-2020-26269
Published: 2022-10-07T07:22:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
The general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out of bounds of [the array holding the directories](https://github.com/tensorflow/tensorflow/blob/458c6260265c46ebaf18052d6c61aea4b6b40926/tensorflow/core/platform/file_system_helper.cc#L127):

```cc
if (!fs->Match(child_path, dirs[dir_index])) { ... }
```

Since `dir_index` is [unconditionaly incremented](https://github.com/tensorflow/tensorflow/blob/458c6260265c46ebaf18052d6c61aea4b6b40926/tensorflow/core/platform/file_system_helper.cc#L106) outside of the lambda function where the vulnerable pattern occurs, this results in an access out of bounds issue under certain scenarios. For example, if `/tmp/x` is a directory that only contains a single file `y`, then the following scenario will cause a crash due to the out of bounds read:

```python
>>> tf.io.gfile.glob('/tmp/x/')
Segmentation fault
```

There are multiple invariants and preconditions that are assumed by the parallel implementation of `GetMatchingPaths` but are not verified by the PRs introducing it ([#40861](https://github.com/tensorflow/tensorflow/pull/40861) and [#44310](https://github.com/tensorflow/tensorflow/pull/44310)). Thus, we are completely rewriting the implementation to fully specify and validate these.

### Patches
We have patched the issue in GitHub commit [8b5b9dc96666a3a5d27fad7179ff215e3b74b67c](https://github.com/tensorflow/tensorflow/commit/8b5b9dc96666a3a5d27fad7179ff215e3b74b67c) and will release TensorFlow 2.4.0 containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.

This issue only impacts master branch and the release candidates for TF version 2.4. The final release of the 2.4 release will be patched.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
melisplatform/melis-asset-manager vulnerable to Path Traversal
Advisory: GHSA-7fj2-rrq6-rphq
Aliases: CVE-2022-39296
Published: 2022-10-11T20:46:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

### Impact

Attackers can read arbitrary files on affected versions of `melisplatform/melis-asset-manager`, leading to the disclosure of sensitive information. Conducting this attack does not require authentication.

Users should immediately upgrade to `melisplatform/melis-asset-manager` >= 5.0.1.

### Patches

This issue was addressed by restricting access to files to intended directories only.

### References

- https://github.com/melisplatform/melis-asset-manager/commit/a0f75918c049aff78953a0bc91c585153595d1bd

### For more information

If you have any questions or comments about this advisory, you can contact:
- The original reporters, by sending an email to vulnerability.research [at] sonarsource.com;
- The maintainers, by opening an issue on this repository.
AWS secrets displayed without masking by Jenkins S3 Explorer Plugin
Advisory: GHSA-mf4p-wjrm-cmjp
Aliases: CVE-2022-43426
Published: 2022-10-19T19:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

S3 Explorer Plugin stores AWS_SECRET_ACCESS_KEY in its global configuration file `s3explorer.xml` on the Jenkins controller as part of its configuration.

While this secret is stored encrypted on disk, in S3 Explorer Plugin 1.0.8 and earlier the global configuration form does not mask the AWS_SECRET_ACCESS_KEY form field, increasing the potential for attackers to observe and capture it.
etcd having a negative value for cluster node size results in an index out-of-bound panic during service discovery
Advisory: GHSA-9gp7-6833-wv89
Published: 2022-10-06T23:18:35Z

### Vulnerability type
Data Validation

### Detail
When an etcd instance attempts to perform service discovery, if a cluster size is provided as a negative value, the etcd instance will panic without recovery.

### References
Find out more on this vulnerability in the [security audit report](https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDIT.pdf)

### For more information
If you have any questions or comments about this advisory:
* Contact the [etcd security committee](https://github.com/etcd-io/etcd/blob/master/security/security-release-process.md#product-security-committee-psc)
Traefik HTTP/2 connections management could cause a denial of service
Advisory: GHSA-c6hx-pjc3-7fqr
Aliases: CVE-2022-39271
Published: 2022-10-10T21:23:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact

There is a potential vulnerability in Traefik managing HTTP/2 connections.
A closing HTTP/2 server connection could hang forever because of a subsequent fatal error. This failure mode could be exploited to cause a denial of service.

### Patches

Traefik v2.8.x: https://github.com/traefik/traefik/releases/tag/v2.8.8
Traefik v2.9.x: https://github.com/traefik/traefik/releases/tag/v2.9.0-rc5

### Workarounds

No workaround.

### For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).
JXPath Out-of-bounds Write vulnerability
Advisory: GHSA-c7mc-q43h-5672
Aliases: CVE-2022-40157
Published: 2022-10-06T18:52:04Z
Withdrawn: 2022-11-10T22:39:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

## Withdrawn

This advisory has been withdrawn because the original report was found to be invalid. This link is maintained to preserve external references.

## Original Description

Those using JXPath to interpret XPath may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
Jenkins Pipeline: Groovy Plugin allows sandbox protection bypass and arbitrary code execution
Advisory: GHSA-mqc2-w9r8-mmxm
Aliases: CVE-2022-43402
Published: 2022-10-19T19:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. Pipeline: Groovy Plugin 2803.v1a_f77ffcc773 intercepts Groovy casts performed implicitly by the Groovy language runtime
Withdrawn: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in @xmldom/xmldom and xmldom
Advisory: GHSA-9pgh-qqpf-7wqj
Aliases: CVE-2022-37616
Published: 2022-10-11T20:42:57Z
Withdrawn: 2022-11-08T19:35:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

## Withdrawn

This advisory has been withdrawn because the maintainers of `@xmldom/xmldom` and multiple third parties disputed the validity of the issue. Attempts to create or replicate a proof of concept have been unsuccessful.

## Original Description

### Impact
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package.

### Patches
Update to `@xmldom/xmldom@~0.7.6`, `@xmldom/xmldom@~0.8.3` (dist-tag `latest`) or `@xmldom/xmldom@>=0.9.0-beta.2` (dist-tag `next`).

### Workarounds
None

### References
https://github.com/xmldom/xmldom/pull/437

### For more information
If you have any questions or comments about this advisory:
* Email us at security@xmldom.org
* Add information to https://github.com/xmldom/xmldom/issues/436
Incorrect default cookie name and recommendation
Advisory: GHSA-jjmg-x456-w976
Published: 2022-10-10T20:59:02Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

The default cookie name (and documentation recommendation) was prefixed with `Host__` instead of `__Host-`. The point of this prefix is for additional security, to ensure that, when no domain option is provided in the cookie options, we can guarantee the cookie came from the correct domain.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Yes, the problem is patched from version 2.2.1, this will not be back ported, but you can use the workaround described below.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

You can work around this by providing a custom `cookieName` as part of the options, which is correctly prefixed with `__Host-`.

### References
_Are there any links users can visit to find out more?_

https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#cookie-with-__host-prefix

### For more information
If you have any questions or comments about this advisory:
* Reach out on the [Psifi Solutions Discord](https://psifisolutions.com/discord) in the `#psifi-support` channel
Skipper vulnerable to SSRF via X-Skipper-Proxy
Advisory: GHSA-f2rj-m42r-6jm2
Aliases: CVE-2022-38580
Published: 2022-10-25T20:22:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact

Skipper prior to version v0.13.236 is vulnerable to server-side request forgery (SSRF). An attacker can exploit a vulnerable version of proxy to access the internal metadata server or other unauthenticated URLs by adding an specific header (X-Skipper-Proxy) to the http request.

### Patches
The problem was patched in version https://github.com/zalando/skipper/releases/tag/v0.13.237.
Users need to upgrade to skipper `>=v0.13.237`.

### Workarounds

Use `dropRequestHeader("X-Skipper-Proxy")` filter

### References

https://github.com/zalando/skipper/releases/tag/v0.13.237

### For more information
If you have any questions or comments about this advisory:

* Open an issue in https://github.com/zalando/skipper/issues/new/choose
* Chat with us in slack: https://app.slack.com/client/T029RQSE6/C82Q5JNH5
gajira-create GitHub action vulnerable to arbitrary code execution
Advisory: GHSA-4xqx-pqpj-9fqw
Aliases: CVE-2020-14188
Published: 2022-10-07T07:20:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact
An attacker can execute arbitrary code in the context of a GitHub runner by creating a specially crafted GitHub issue.

### Patches
This issue is patched in gajira-create version 2.0.1.

### Workarounds
There are no known workarounds.

### References
[GitHub Security Lab advisory GHSL-2020-172](https://securitylab.github.com/advisories/GHSL-2020-172-gajira-create-action)
Withdrawn: CVE Rejected: JXPath vulnerable to remote code execution when interpreting untrusted XPath expressions
Advisory: GHSA-wrx5-rp7m-mm49
Aliases: CVE-2022-41852
Published: 2022-10-06T18:52:05Z
Withdrawn: 2023-03-06T22:41:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

## This advisory has been withdrawn due to the CVE being rejected.

## Original advisory text
Those using JXPath to interpret untrusted XPath expressions may be vulnerable to a remote code execution attack. All JXPathContext class functions processing a XPath string are vulnerable except `compile()` and `compilePath()` function. The XPath expression can be used by an attacker to load any Java class from the classpath resulting in code execution.
Powerline Gitstatus vulnerable to arbitrary code execution
Advisory: GHSA-w67g-6gjv-c599
Aliases: CVE-2022-42906
Published: 2022-10-13T12:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changing to a directory automatically runs git commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory to one controlled by the attacker, such as in a shared filesystem or extracted archive, powerline-gitstatus will run arbitrary commands under the attacker's control. NOTE: this is similar to CVE-2022-20001.
Nomad Panics On Job Submission With Bad Artifact Stanza Source URL
Advisory: GHSA-7v3g-4878-5qrf
Aliases: CVE-2022-41606
Published: 2022-10-12T12:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 1.3.5 jobs submitted with an artifact stanza using invalid S3 or GCS URLs can be used to crash client agents. Fixed in 1.2.13, 1.3.6, and 1.4.0.
NocoDB vulnerable to Denial of Service
Advisory: GHSA-grv6-m753-3w2g
Aliases: CVE-2022-3423
Published: 2022-10-07T18:16:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NocoDB prior to 0.92.0 allows actors to insert large characters into the input field `New Project` on the create field, which can cause a Denial of Service (DoS) via a crafted HTTP request. Version 0.92.0 fixes this issue.
Heron allows CRLF log injection
Advisory: GHSA-95w5-q9vp-5vrm
Aliases: CVE-2021-42010
Published: 2022-10-24T19:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Heron versions <= 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating which addresses this issue.