deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-rrw2-px9j-qffj
Package: co.fs2:fs2-io_2.12 (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 2.5.13
Patched in: 2.5.13

Summary: FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side

Details:
### Impact
When establishing a TLS session using `fs2-io` on the JVM using the `fs2.io.net.tls` package, if one side of the connection shuts down write while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. This CPU is consumed until the overall connection is closed.

This could be used as a denial of service attack on an fs2-io powered server -- for example, by opening many connections and putting them in a half-shutdown state.

Note: this issue impacts ember backed http4s servers with HTTPS as a result of ember using fs2's TLS support.

### Patches
Fixed in fs2 3.12.2 and 3.13.0-M7.

### Workarounds
No workarounds.

### For more information

If you have any questions or comments about this advisory:

[Open an issue.](https://github.com/typelevel/fs2/issues/new/choose)
Contact the [Typelevel Security Team](https://github.com/typelevel/.github/blob/main/SECURITY.md).
GitHub Security Advisory: GHSA-rrw2-px9j-qffj
Package: co.fs2:fs2-io_2.13.0-M5 (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 2.5.13
Patched in: unpatched

Summary: FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side

Details:
### Impact
When establishing a TLS session using `fs2-io` on the JVM using the `fs2.io.net.tls` package, if one side of the connection shuts down write while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. This CPU is consumed until the overall connection is closed.

This could be used as a denial of service attack on an fs2-io powered server -- for example, by opening many connections and putting them in a half-shutdown state.

Note: this issue impacts ember backed http4s servers with HTTPS as a result of ember using fs2's TLS support.

### Patches
Fixed in fs2 3.12.2 and 3.13.0-M7.

### Workarounds
No workarounds.

### For more information

If you have any questions or comments about this advisory:

[Open an issue.](https://github.com/typelevel/fs2/issues/new/choose)
Contact the [Typelevel Security Team](https://github.com/typelevel/.github/blob/main/SECURITY.md).
GitHub Security Advisory: GHSA-rrw2-px9j-qffj
Package: co.fs2:fs2-io_2.12.0-RC2 (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 2.5.13
Patched in: unpatched

Summary: FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side

Details:
### Impact
When establishing a TLS session using `fs2-io` on the JVM using the `fs2.io.net.tls` package, if one side of the connection shuts down write while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. This CPU is consumed until the overall connection is closed.

This could be used as a denial of service attack on an fs2-io powered server -- for example, by opening many connections and putting them in a half-shutdown state.

Note: this issue impacts ember backed http4s servers with HTTPS as a result of ember using fs2's TLS support.

### Patches
Fixed in fs2 3.12.2 and 3.13.0-M7.

### Workarounds
No workarounds.

### For more information

If you have any questions or comments about this advisory:

[Open an issue.](https://github.com/typelevel/fs2/issues/new/choose)
Contact the [Typelevel Security Team](https://github.com/typelevel/.github/blob/main/SECURITY.md).
GitHub Security Advisory: GHSA-rrw2-px9j-qffj
Package: co.fs2:fs2-io_2.12.0-M5 (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 2.5.13
Patched in: unpatched

Summary: FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side

Details:
### Impact
When establishing a TLS session using `fs2-io` on the JVM using the `fs2.io.net.tls` package, if one side of the connection shuts down write while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. This CPU is consumed until the overall connection is closed.

This could be used as a denial of service attack on an fs2-io powered server -- for example, by opening many connections and putting them in a half-shutdown state.

Note: this issue impacts ember backed http4s servers with HTTPS as a result of ember using fs2's TLS support.

### Patches
Fixed in fs2 3.12.2 and 3.13.0-M7.

### Workarounds
No workarounds.

### For more information

If you have any questions or comments about this advisory:

[Open an issue.](https://github.com/typelevel/fs2/issues/new/choose)
Contact the [Typelevel Security Team](https://github.com/typelevel/.github/blob/main/SECURITY.md).
GitHub Security Advisory: GHSA-rrw2-px9j-qffj
Package: co.fs2:fs2-io_2.12.0-RC1 (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 2.5.13
Patched in: unpatched

Summary: FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side

Details:
### Impact
When establishing a TLS session using `fs2-io` on the JVM using the `fs2.io.net.tls` package, if one side of the connection shuts down write while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. This CPU is consumed until the overall connection is closed.

This could be used as a denial of service attack on an fs2-io powered server -- for example, by opening many connections and putting them in a half-shutdown state.

Note: this issue impacts ember backed http4s servers with HTTPS as a result of ember using fs2's TLS support.

### Patches
Fixed in fs2 3.12.2 and 3.13.0-M7.

### Workarounds
No workarounds.

### For more information

If you have any questions or comments about this advisory:

[Open an issue.](https://github.com/typelevel/fs2/issues/new/choose)
Contact the [Typelevel Security Team](https://github.com/typelevel/.github/blob/main/SECURITY.md).
GitHub Security Advisory: GHSA-rrw2-px9j-qffj
Package: co.fs2:fs2-io_2.12.0-M4 (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 2.5.13
Patched in: unpatched

Summary: FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side

Details:
### Impact
When establishing a TLS session using `fs2-io` on the JVM using the `fs2.io.net.tls` package, if one side of the connection shuts down write while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. This CPU is consumed until the overall connection is closed.

This could be used as a denial of service attack on an fs2-io powered server -- for example, by opening many connections and putting them in a half-shutdown state.

Note: this issue impacts ember backed http4s servers with HTTPS as a result of ember using fs2's TLS support.

### Patches
Fixed in fs2 3.12.2 and 3.13.0-M7.

### Workarounds
No workarounds.

### For more information

If you have any questions or comments about this advisory:

[Open an issue.](https://github.com/typelevel/fs2/issues/new/choose)
Contact the [Typelevel Security Team](https://github.com/typelevel/.github/blob/main/SECURITY.md).
GitHub Security Advisory: GHSA-rrw2-px9j-qffj
Package: co.fs2:fs2-io_2.11 (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 2.5.13
Patched in: unpatched

Summary: FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side

Details:
### Impact
When establishing a TLS session using `fs2-io` on the JVM using the `fs2.io.net.tls` package, if one side of the connection shuts down write while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. This CPU is consumed until the overall connection is closed.

This could be used as a denial of service attack on an fs2-io powered server -- for example, by opening many connections and putting them in a half-shutdown state.

Note: this issue impacts ember backed http4s servers with HTTPS as a result of ember using fs2's TLS support.

### Patches
Fixed in fs2 3.12.2 and 3.13.0-M7.

### Workarounds
No workarounds.

### For more information

If you have any questions or comments about this advisory:

[Open an issue.](https://github.com/typelevel/fs2/issues/new/choose)
Contact the [Typelevel Security Team](https://github.com/typelevel/.github/blob/main/SECURITY.md).
GitHub Security Advisory: GHSA-rrw2-px9j-qffj
Package: co.fs2:fs2-io_0.27 (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 2.5.13
Patched in: unpatched

Summary: FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side

Details:
### Impact
When establishing a TLS session using `fs2-io` on the JVM using the `fs2.io.net.tls` package, if one side of the connection shuts down write while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. This CPU is consumed until the overall connection is closed.

This could be used as a denial of service attack on an fs2-io powered server -- for example, by opening many connections and putting them in a half-shutdown state.

Note: this issue impacts ember backed http4s servers with HTTPS as a result of ember using fs2's TLS support.

### Patches
Fixed in fs2 3.12.2 and 3.13.0-M7.

### Workarounds
No workarounds.

### For more information

If you have any questions or comments about this advisory:

[Open an issue.](https://github.com/typelevel/fs2/issues/new/choose)
Contact the [Typelevel Security Team](https://github.com/typelevel/.github/blob/main/SECURITY.md).
GitHub Security Advisory: GHSA-rrw2-px9j-qffj
Package: co.fs2:fs2-io_0.26 (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 2.5.13
Patched in: unpatched

Summary: FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side

Details:
### Impact
When establishing a TLS session using `fs2-io` on the JVM using the `fs2.io.net.tls` package, if one side of the connection shuts down write while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. This CPU is consumed until the overall connection is closed.

This could be used as a denial of service attack on an fs2-io powered server -- for example, by opening many connections and putting them in a half-shutdown state.

Note: this issue impacts ember backed http4s servers with HTTPS as a result of ember using fs2's TLS support.

### Patches
Fixed in fs2 3.12.2 and 3.13.0-M7.

### Workarounds
No workarounds.

### For more information

If you have any questions or comments about this advisory:

[Open an issue.](https://github.com/typelevel/fs2/issues/new/choose)
Contact the [Typelevel Security Team](https://github.com/typelevel/.github/blob/main/SECURITY.md).
GitHub Security Advisory: GHSA-rrw2-px9j-qffj
Package: co.fs2:fs2-io_3 (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 3.0.0-M1, < 3.12.2
Patched in: 3.12.2

Summary: FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side

Details:
### Impact
When establishing a TLS session using `fs2-io` on the JVM using the `fs2.io.net.tls` package, if one side of the connection shuts down write while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. This CPU is consumed until the overall connection is closed.

This could be used as a denial of service attack on an fs2-io powered server -- for example, by opening many connections and putting them in a half-shutdown state.

Note: this issue impacts ember backed http4s servers with HTTPS as a result of ember using fs2's TLS support.

### Patches
Fixed in fs2 3.12.2 and 3.13.0-M7.

### Workarounds
No workarounds.

### For more information

If you have any questions or comments about this advisory:

[Open an issue.](https://github.com/typelevel/fs2/issues/new/choose)
Contact the [Typelevel Security Team](https://github.com/typelevel/.github/blob/main/SECURITY.md).
GitHub Security Advisory: GHSA-rrw2-px9j-qffj
Package: co.fs2:fs2-io_2.13 (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 3.0.0-M1, < 3.12.2
Patched in: 3.12.2

Summary: FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side

Details:
### Impact
When establishing a TLS session using `fs2-io` on the JVM using the `fs2.io.net.tls` package, if one side of the connection shuts down write while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. This CPU is consumed until the overall connection is closed.

This could be used as a denial of service attack on an fs2-io powered server -- for example, by opening many connections and putting them in a half-shutdown state.

Note: this issue impacts ember backed http4s servers with HTTPS as a result of ember using fs2's TLS support.

### Patches
Fixed in fs2 3.12.2 and 3.13.0-M7.

### Workarounds
No workarounds.

### For more information

If you have any questions or comments about this advisory:

[Open an issue.](https://github.com/typelevel/fs2/issues/new/choose)
Contact the [Typelevel Security Team](https://github.com/typelevel/.github/blob/main/SECURITY.md).
GitHub Security Advisory: GHSA-rrw2-px9j-qffj
Package: co.fs2:fs2-io_2.12 (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 3.0.0-M1, < 3.12.2
Patched in: 3.12.2

Summary: FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side

Details:
### Impact
When establishing a TLS session using `fs2-io` on the JVM using the `fs2.io.net.tls` package, if one side of the connection shuts down write while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. This CPU is consumed until the overall connection is closed.

This could be used as a denial of service attack on an fs2-io powered server -- for example, by opening many connections and putting them in a half-shutdown state.

Note: this issue impacts ember backed http4s servers with HTTPS as a result of ember using fs2's TLS support.

### Patches
Fixed in fs2 3.12.2 and 3.13.0-M7.

### Workarounds
No workarounds.

### For more information

If you have any questions or comments about this advisory:

[Open an issue.](https://github.com/typelevel/fs2/issues/new/choose)
Contact the [Typelevel Security Team](https://github.com/typelevel/.github/blob/main/SECURITY.md).
GitHub Security Advisory: GHSA-8rx4-fxq5-vj4v
Package: org.apereo.cas:cas-management-webapp-support (MAVEN)
Severity: MODERATE (CVSS 2.7)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: <= 5.2.6
Patched in: unpatched

Summary: Apereo CAS has inefficient regular expression complexity

Details:
A vulnerability was found in Apereo CAS 5.2.6. It has been classified as problematic. This affects the function ResponseEntity of the file cas-5.2.6\webapp-mgmt\cas-management-webapp-support\src\main\java\org\apereo\cas\mgmt\services\web\ManageRegisteredServicesMultiActionController.java. The manipulation of the argument Query leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-fvfq-q238-j7j3
Package: org.wso2.carbon.mediation:org.wso2.carbon.localentry (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: < 4.7.259
Patched in: unpatched

Summary: WSO2 Carbon Mediation vulnerable to XML External Entity (XXE) attacks

Details:
An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applying sufficient restrictions, allowing resolution of external entities.

A successful attack could enable a remote, unauthenticated attacker to read sensitive files from the server's filesystem or perform denial-of-service (DoS) attacks that render affected services unavailable.
GitHub Security Advisory: GHSA-m494-w24q-6f7w
Package: com.microsoft.sqlserver:mssql-jdbc (MAVEN)
Severity: HIGH (CVSS 8.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 13.2.0.jre11, < 13.2.1.jre11
Patched in: 13.2.1.jre11

Summary: JDBC Driver for SQL Server has improper input validation issue

Details:
Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.
GitHub Security Advisory: GHSA-m494-w24q-6f7w
Package: com.microsoft.sqlserver:mssql-jdbc (MAVEN)
Severity: HIGH (CVSS 8.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 12.10.0.jre11, < 12.10.2.jre11
Patched in: 12.10.2.jre11

Summary: JDBC Driver for SQL Server has improper input validation issue

Details:
Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.
GitHub Security Advisory: GHSA-m494-w24q-6f7w
Package: com.microsoft.sqlserver:mssql-jdbc (MAVEN)
Severity: HIGH (CVSS 8.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 12.8.0.jre11, < 12.8.2.jre11
Patched in: 12.8.2.jre11

Summary: JDBC Driver for SQL Server has improper input validation issue

Details:
Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.
GitHub Security Advisory: GHSA-m494-w24q-6f7w
Package: com.microsoft.sqlserver:mssql-jdbc (MAVEN)
Severity: HIGH (CVSS 8.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 12.6.0.jre11, < 12.6.5.jre11
Patched in: 12.6.5.jre11

Summary: JDBC Driver for SQL Server has improper input validation issue

Details:
Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.
GitHub Security Advisory: GHSA-m494-w24q-6f7w
Package: com.microsoft.sqlserver:mssql-jdbc (MAVEN)
Severity: HIGH (CVSS 8.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 12.2.0.jre11, < 12.2.1.jre11
Patched in: 12.2.1.jre11

Summary: JDBC Driver for SQL Server has improper input validation issue

Details:
Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.
GitHub Security Advisory: GHSA-m494-w24q-6f7w
Package: com.microsoft.sqlserver:mssql-jdbc (MAVEN)
Severity: HIGH (CVSS 8.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 11.2.0.jre11, < 11.2.4.jre11
Patched in: 11.2.4.jre11

Summary: JDBC Driver for SQL Server has improper input validation issue

Details:
Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.
GitHub Security Advisory: GHSA-qw4h-3xjj-84cc
Package: struts:struts (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Vulnerable versions: >= 1.1, <= 1.2.9
Patched in: unpatched

Summary: Apache Tiles: Unvalidated input may lead to path traversal and XXE

Details:
The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to this key may be relatively common, as it was also used like that to set the language in the 'tiles-test' application shipped with Tiles.

This issue affects Apache Tiles from version 2 onwards.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
GitHub Security Advisory: GHSA-qw4h-3xjj-84cc
Package: org.apache.struts:struts-tiles (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Vulnerable versions: >= 1.3.0, <= 1.3.10
Patched in: unpatched

Summary: Apache Tiles: Unvalidated input may lead to path traversal and XXE

Details:
The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to this key may be relatively common, as it was also used like that to set the language in the 'tiles-test' application shipped with Tiles.

This issue affects Apache Tiles from version 2 onwards.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
GitHub Security Advisory: GHSA-j2pc-v64r-mv4f
Package: io.github.ascopes:protobuf-maven-plugin (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-354: Improper Validation of Integrity Check Value, CWE-693: Protection Mechanism Failure
Vulnerable versions: < 3.10.2
Patched in: 3.10.2

Summary: Protobuf Maven Plugin protocDigest is ignored when using protoc from PATH

Details:
### Summary
The expected `protocDigest` is ignored when protoc is taken from the `PATH`.

### Details
The documentation for the `protocDigest` parameter says:
> ... Users may wish to specify this if using a `PATH`-based binary ...

However, when specifying `<protoc>PATH</protoc>` the `protocDigest` is not actually checked because the code returns here already
https://github.com/ascopes/protobuf-maven-plugin/blob/59097aae8062c461129a13dcda2f4116b90a8765/protobuf-maven-plugin/src/main/java/io/github/ascopes/protobufmavenplugin/protoc/ProtocResolver.java#L91-L93

before the digest check:
https://github.com/ascopes/protobuf-maven-plugin/blob/59097aae8062c461129a13dcda2f4116b90a8765/protobuf-maven-plugin/src/main/java/io/github/ascopes/protobufmavenplugin/protoc/ProtocResolver.java#L106

### PoC
Specify:
```xml
<protoc>PATH</protoc>
<protocDigest>sha256:[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0000</protocDigest>
```

And notice how the `protoc` on the `PATH` is not rejected, despite a digest mismatch.

### Impact
Users who have an untrusted `protoc` executable on their `PATH` and rely `<protocDigest>` as protection are affected.