deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-6677
Published: 2024-02-09
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oduyo Financial Technology Online Collection allows SQL Injection.This issue affects Online Collection: before v.1.0.2.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-24-0100; https://www.usom.gov.tr/bildirim/tr-24-0100
CVE: CVE-2024-25302
Published: 2024-02-09
Description: Sourcecodester Event Student Attendance System 1.0, allows SQL Injection via the 'student' parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/tubakvgc/CVE/blob/main/Event_Student_Attendance_System.md; https://github.com/tubakvgc/CVE/blob/main/Event_Student_Attendance_System.md
CVE: CVE-2024-25307
Published: 2024-02-09
Description: Code-projects Cinema Seat Reservation System 1.0 allows SQL Injection via the 'id' parameter at "/Cinema-Reservation/booking.php?id=1."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/tubakvgc/CVEs/blob/main/Cinema%20Seat%20Reservation%20System/Cinema%20Seat%20Reservation%20System%20-%20SQL%20Injection.md; https://github.com/tubakvgc/CVEs/blob/main/Cinema%20Seat%20Reservation%20System/Cinema%20Seat%20Reservation%20System%20-%20SQL%20Injection.md
CVE: CVE-2024-25310
Published: 2024-02-09
Description: Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'id' parameter at "School/delete.php?id=5."
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/tubakvgc/CVEs/blob/main/Simple%20School%20Management%20System/Simple%20School%20Managment%20System%20-%20SQL%20Injection%20-3.md; https://github.com/tubakvgc/CVEs/blob/main/Simple%20School%20Management%20System/Simple%20School%20Managment%20System%20-%20SQL%20Injection%20-3.md
CVE: CVE-2024-25314
Published: 2024-02-09
Description: Code-projects Hotel Managment System 1.0, allows SQL Injection via the 'sid' parameter in Hotel/admin/show.php?sid=2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/tubakvgc/CVEs/blob/main/Hotel%20Managment%20System/Hotel%20Managment%20System%20-%20SQL%20Injection-2.md; https://github.com/tubakvgc/CVEs/blob/main/Hotel%20Managment%20System/Hotel%20Managment%20System%20-%20SQL%20Injection-2.md
CVE: CVE-2024-25315
Published: 2024-02-09
Description: Code-projects Hotel Managment System 1.0, allows SQL Injection via the 'rid' parameter in Hotel/admin/roombook.php?rid=2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/tubakvgc/CVEs/blob/main/Hotel%20Managment%20System/Hotel%20Managment%20System%20-%20SQL%20Injection-1.md; https://github.com/tubakvgc/CVEs/blob/main/Hotel%20Managment%20System/Hotel%20Managment%20System%20-%20SQL%20Injection-1.md
CVE: CVE-2024-25316
Published: 2024-02-09
Description: Code-projects Hotel Managment System 1.0 allows SQL Injection via the 'eid' parameter in Hotel/admin/usersettingdel.php?eid=2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/tubakvgc/CVEs/blob/main/Hotel%20Managment%20System/Hotel%20Managment%20System%20-%20SQL%20Injection-4.md; https://github.com/tubakvgc/CVEs/blob/main/Hotel%20Managment%20System/Hotel%20Managment%20System%20-%20SQL%20Injection-4.md
CVE: CVE-2024-25318
Published: 2024-02-09
Description: Code-projects Hotel Managment System 1.0 allows SQL Injection via the 'pid' parameter in Hotel/admin/print.php?pid=2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/tubakvgc/CVEs/blob/main/Hotel%20Managment%20System/Hotel%20Managment%20System%20-%20SQL%20Injection-3.md; https://github.com/tubakvgc/CVEs/blob/main/Hotel%20Managment%20System/Hotel%20Managment%20System%20-%20SQL%20Injection-3.md
CVE: CVE-2024-23319
Published: 2024-02-09
Description: Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira connection in Mattermost only by viewing the message.
CVSS Score: 3.5 (LOW)
CWE: CWE-352, CWE-352
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-24774
Published: 2024-02-09
Description: Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Jira issues.


CVSS Score: 3.4 (LOW)
CWE: CWE-863, CWE-863
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-24776
Published: 2024-02-09
Description: Mattermost fails to check the required permissions in the POST /api/v4/channels/stats/member_count API resulting in channel member counts being leaked to a user without permissions.


CVSS Score: 3.1 (LOW)
CWE: CWE-284
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2024-25442
Published: 2024-02-09
Description: An issue in the HuginBase::PanoramaMemento::loadPTScript function of Hugin v2022.0.0 allows attackers to cause a heap buffer overflow via parsing a crafted image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugs.launchpad.net/hugin/+bug/2025032; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NAV7IMHCOIMBEIW42KM2QUJ4MDQLNW3Z/; https://bugs.launchpad.net/hugin/+bug/2025032
CVE: CVE-2024-25443
Published: 2024-02-09
Description: An issue in the HuginBase::ImageVariable<double>::linkWith function of Hugin v2022.0.0 allows attackers to cause a heap-use-after-free via parsing a crafted image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://bugs.launchpad.net/hugin/+bug/2025035; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NAV7IMHCOIMBEIW42KM2QUJ4MDQLNW3Z/; https://bugs.launchpad.net/hugin/+bug/2025035
CVE: CVE-2024-25445
Published: 2024-02-09
Description: Improper handling of values in HuginBase::PTools::Transform::transform of Hugin 2022.0.0 leads to an assertion failure.
CVSS Score: 7.8 (HIGH)
CWE: CWE-617, CWE-617
References: https://bugs.launchpad.net/hugin/+bug/2025038; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NAV7IMHCOIMBEIW42KM2QUJ4MDQLNW3Z/; https://bugs.launchpad.net/hugin/+bug/2025038
CVE: CVE-2024-25446
Published: 2024-02-09
Description: An issue in the HuginBase::PTools::setDestImage function of Hugin v2022.0.0 allows attackers to cause a heap buffer overflow via parsing a crafted image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://bugs.launchpad.net/hugin/+bug/2025037; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NAV7IMHCOIMBEIW42KM2QUJ4MDQLNW3Z/; https://bugs.launchpad.net/hugin/+bug/2025037
CVE: CVE-2024-25447
Published: 2024-02-09
Description: An issue in the imlib_load_image_with_error_return function of imlib2 v1.9.1 allows attackers to cause a heap buffer overflow via parsing a crafted image.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://git.enlightenment.org/old/legacy-imlib2/issues/20; https://github.com/derf/feh/issues/709; https://git.enlightenment.org/old/legacy-imlib2/issues/20
CVE: CVE-2024-25448
Published: 2024-02-09
Description: An issue in the imlib_free_image_and_decache function of imlib2 v1.9.1 allows attackers to cause a heap buffer overflow via parsing a crafted image.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-122, CWE-787
References: https://git.enlightenment.org/old/legacy-imlib2/issues/20; https://github.com/derf/feh/issues/711; https://git.enlightenment.org/old/legacy-imlib2/issues/20
CVE: CVE-2024-25450
Published: 2024-02-09
Description: imlib2 v1.9.1 was discovered to mishandle memory allocation in the function init_imlib_fonts().
CVSS Score: 8.8 (HIGH)
CWE: CWE-401
References: https://git.enlightenment.org/old/legacy-imlib2/issues/20; https://github.com/derf/feh/issues/712; https://git.enlightenment.org/old/legacy-imlib2/issues/20
CVE: CVE-2024-25451
Published: 2024-02-09
Description: Bento4 v1.6.0-640 was discovered to contain an out-of-memory bug via the AP4_DataBuffer::ReallocateBuffer() function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://github.com/axiomatic-systems/Bento4/issues/872; https://github.com/axiomatic-systems/Bento4/issues/872
CVE: CVE-2024-25452
Published: 2024-02-09
Description: Bento4 v1.6.0-640 was discovered to contain an out-of-memory bug via the AP4_UrlAtom::AP4_UrlAtom() function.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://github.com/axiomatic-systems/Bento4/issues/873; https://github.com/axiomatic-systems/Bento4/issues/873
CVE: CVE-2024-25453
Published: 2024-02-09
Description: Bento4 v1.6.0-640 was discovered to contain a NULL pointer dereference via the AP4_StszAtom::GetSampleSize() function.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://github.com/axiomatic-systems/Bento4/issues/204; https://github.com/axiomatic-systems/Bento4/issues/874; https://github.com/axiomatic-systems/Bento4/issues/204
CVE: CVE-2024-25454
Published: 2024-02-09
Description: Bento4 v1.6.0-640 was discovered to contain a NULL pointer dereference via the AP4_DescriptorFinder::Test() function.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://github.com/axiomatic-systems/Bento4/issues/875; https://github.com/axiomatic-systems/Bento4/issues/875
CVE: CVE-2024-1402
Published: 2024-02-09
Description: Mattermost fails to check if a custom emoji reaction exists when sending it to a post and to limit the amount of custom emojis allowed to be added in a post, allowing an attacker sending a huge amount of non-existent custom emojis in a post to crash the mobile app of a user seeing the post and to crash the server due to overloading when clients attempt to retrive the aforementioned post. 


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://mattermost.com/security-updates; https://mattermost.com/security-updates
CVE: CVE-2023-50291
Published: 2024-02-09
Description: Insufficiently Protected Credentials vulnerability in Apache Solr.

This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0.
One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties that had "password" contained in the name.
There are a number of sensitive system properties, such as "basicauth" and "aws.secretKey" do not contain "password", thus their values were published via the "/admin/info/properties" endpoint.
This endpoint populates the list of System Properties on the home screen of the Solr Admin page, making the exposed credentials visible in the UI.

This /admin/info/properties endpoint is protected under the "config-read" permission.
Therefore, Solr Clouds with Authorization enabled will only be vulnerable through logged-in users that have the "config-read" permission.
Users are recommended to upgrade to version 9.3.0 or 8.11.3, which fixes the issue.
A single option now controls hiding Java system property for all endpoints, "-Dsolr.hiddenSysProps".
By default all known sensitive properties are hidden (including "-Dbasicauth"), as well as any property with a name containing "secret" or "password".

Users who cannot upgrade can also use the following Java system property to fix the issue:
  '-Dsolr.redaction.system.pattern=.*(password|secret|basicauth).*'
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2024/02/09/4; https://solr.apache.org/security.html#cve-2023-50291-apache-solr-can-leak-certain-passwords-due-to-system-property-redaction-logic-inconsistencies; http://www.openwall.com/lists/oss-security/2024/02/09/4
CVE: CVE-2023-50292
Published: 2024-02-09
Description: Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr.

This issue affects Apache Solr: from 8.10.0 through 8.11.2, from 9.0.0 before 9.3.0.

The Schema Designer was introduced to allow users to more easily configure and test new Schemas and configSets.
However, when the feature was created, the "trust" (authentication) of these configSets was not considered.
External library loading is only available to configSets that are "trusted" (created by authenticated users), thus non-authenticated users are unable to perform Remote Code Execution.
Since the Schema Designer loaded configSets without taking their "trust" into account, configSets that were created by unauthenticated users were allowed to load external libraries when used in the Schema Designer.

Users are recommended to upgrade to version 9.3.0, which fixes the issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: http://www.openwall.com/lists/oss-security/2024/02/09/3; https://solr.apache.org/security.html#cve-2023-50298-apache-solr-can-expose-zookeeper-credentials-via-streaming-expressions; http://www.openwall.com/lists/oss-security/2024/02/09/3
CVE: CVE-2023-50298
Published: 2024-02-09
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1.

Solr Streaming Expressions allows users to extract data from other Solr Clouds, using a "zkHost" parameter.
When original SolrCloud is setup to use ZooKeeper credentials and ACLs, they will be sent to whatever "zkHost" the user provides.
An attacker could setup a server to mock ZooKeeper, that accepts ZooKeeper requests with credentials and ACLs and extracts the sensitive information,
then send a streaming expression using the mock server's address in "zkHost".
Streaming Expressions are exposed via the "/streaming" handler, with "read" permissions.

Users are recommended to upgrade to version 8.11.3 or 9.4.1, which fix the issue.
From these versions on, only zkHost values that have the same server address (regardless of chroot), will use the given ZooKeeper credentials and ACLs when connecting.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-922
References: http://www.openwall.com/lists/oss-security/2024/02/09/2; http://www.openwall.com/lists/oss-security/2024/02/09/3; https://solr.apache.org/security.html#cve-2023-50298-apache-solr-can-expose-zookeeper-credentials-via-streaming-expressions
CVE: CVE-2023-50386
Published: 2024-02-09
Description: Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1.

In the affected versions, Solr ConfigSets accepted Java jar and class files to be uploaded through the ConfigSets API.
When backing up Solr Collections, these configSet files would be saved to disk when using the LocalFileSystemRepository (the default for backups).
If the backup was saved to a directory that Solr uses in its ClassPath/ClassLoaders, then the jar and class files would be available to use with any ConfigSet, trusted or untrusted.

When Solr is run in a secure way (Authorization enabled), as is strongly suggested, this vulnerability is limited to extending the Backup permissions with the ability to add libraries.
Users are recommended to upgrade to version 8.11.3 or 9.4.1, which fix the issue.
In these versions, the following protections have been added:

  *  Users are no longer able to upload files to a configSet that could be executed via a Java ClassLoader.
  *  The Backup API restricts saving backups to directories that are used in the ClassLoader.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-913
References: http://www.openwall.com/lists/oss-security/2024/02/09/1; https://solr.apache.org/security.html#cve-2023-50386-apache-solr-backuprestore-apis-allow-for-deployment-of-executables-in-malicious-configsets; http://www.openwall.com/lists/oss-security/2024/02/09/1
CVE: CVE-2024-1247
Published: 2024-02-09
Description: Concrete CMS version 9 before 9.2.5 is vulnerable to  stored XSS via the Role Name field since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Role Name field which might be executed when users visit the affected page. The Concrete CMS Security team scored this 2 with CVSS v3 vector  AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator . Concrete versions below 9 do not include group types so they are not affected by this vulnerability. 

CVSS Score: 2.0 (LOW)
CWE: CWE-20, CWE-79
References: https://documentation.concretecms.org/9-x/developers/introduction/version-history/925-release-notes; https://www.concretecms.org/about/project-news/security/2024-02-04-security-advisory; https://documentation.concretecms.org/9-x/developers/introduction/version-history/925-release-notes
CVE: CVE-2024-1245
Published: 2024-02-09
Description: Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes since administrator entered file attributes are not sufficiently sanitized in the Edit Attributes page. A rogue administrator could put malicious code into the file tags or description attributes and, when another administrator opens the same file for editing, the malicious code could execute. The Concrete CMS Security team scored this 2.4 with CVSS v3 vector AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N. 

CVSS Score: 2.4 (LOW)
CWE: CWE-20, CWE-79
References: https://documentation.concretecms.org/9-x/developers/introduction/version-history/925-release-notes; https://www.concretecms.org/about/project-news/security/2024-02-04-security-advisory; https://documentation.concretecms.org/9-x/developers/introduction/version-history/925-release-notes
CVE: CVE-2024-1246
Published: 2024-02-09
Description: Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature due to insufficient validation of administrator provided data. A rogue administrator could inject malicious code when importing images, leading to the execution of the malicious code on the website user’s browser. The Concrete CMS Security team scored this 2 with CVSS v3 vector AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N. This does not affect Concrete versions prior to version 9.

CVSS Score: 2.0 (LOW)
CWE: CWE-20, CWE-79
References: https://documentation.concretecms.org/9-x/developers/introduction/version-history/925-release-notes; https://www.concretecms.org/about/project-news/security/2024-02-04-security-advisory; https://documentation.concretecms.org/9-x/developers/introduction/version-history/925-release-notes
CVE: CVE-2023-50349
Published: 2024-02-09
Description: Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability.  Some REST APIs in the Sametime Proxy application can allow an attacker to perform malicious actions on the application. 

CVSS Score: 5.9 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109082; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109082
CVE: CVE-2023-45716
Published: 2024-02-09
Description: Sametime is impacted by sensitive information passed in URL. 

CVSS Score: 1.7 (LOW)
CWE: CWE-319, CWE-598
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109082; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109082
CVE: CVE-2023-45718
Published: 2024-02-09
Description: Sametime is impacted by a failure to invalidate sessions.  The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session.  

CVSS Score: 3.9 (LOW)
CWE: CWE-384, CWE-613
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109082; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109082
CVE: CVE-2023-6935
Published: 2024-02-09
Description: wolfSSL SP Math All RSA implementation is vulnerable to the Marvin Attack, new variation of a timing Bleichenbacher style attack, when built with the following options to configure:

--enable-all CFLAGS="-DWOLFSSL_STATIC_RSA"

The define “WOLFSSL_STATIC_RSA” enables static RSA cipher suites, which is not recommended, and has been disabled by default since wolfSSL 3.6.6.  Therefore the default build since 3.6.6, even with "--enable-all", is not vulnerable to the Marvin Attack. The vulnerability is specific to static RSA cipher suites, and expected to be padding-independent.

The vulnerability allows an attacker to decrypt ciphertexts and forge signatures after probing with a large number of test observations. However the server’s private key is not exposed.

CVSS Score: 5.9 (MEDIUM)
CWE: CWE-203, CWE-203
References: https://people.redhat.com/~hkario/marvin/; https://www.wolfssl.com/docs/security-vulnerabilities/; https://people.redhat.com/~hkario/marvin/
CVE: CVE-2024-1404
Published: 2024-02-09
Description: A vulnerability was found in Linksys WRT54GL 4.30.18 and classified as problematic. Affected by this issue is some unknown functionality of the file /SysInfo.htm of the component Web Management Interface. The manipulation leads to information disclosure. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-253328. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/leetsun/Hints/tree/main/linksys-wrt54gl/1; https://vuldb.com/?ctiid.253328; https://vuldb.com/?id.253328
CVE: CVE-2024-21624
Published: 2024-02-09
Description: nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak (e.g., environment variables) in instances where developers utilize `MessageTemplate` and incorporate user-provided data into templates. The identified vulnerability has been remedied in pull request #2509 and will be included in versions released from 2.2.0. Users are strongly advised to upgrade to these patched versions to safeguard against the vulnerability. A temporary workaround involves filtering underscores before incorporating user input into the message template.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-200
References: https://github.com/nonebot/nonebot2/pull/2509; https://github.com/nonebot/nonebot2/security/advisories/GHSA-59j8-776v-xxxg; https://github.com/nonebot/nonebot2/pull/2509
CVE: CVE-2024-23322
Published: 2024-02-09
Description: Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happen within the same interval. The crash occurs when the following are true: 1. hedge_on_per_try_timeout is enabled, 2. per_try_idle_timeout is enabled (it can only be done in configuration), 3. per-try-timeout is enabled, either through headers or configuration and its value is equal, or within the backoff interval of the per_try_idle_timeout. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://github.com/envoyproxy/envoy/commit/843f9e6a123ed47ce139b421c14e7126f2ac685e; https://github.com/envoyproxy/envoy/security/advisories/GHSA-6p83-mfmh-qv38; https://github.com/envoyproxy/envoy/commit/843f9e6a123ed47ce139b421c14e7126f2ac685e