deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-36566
Published: 2022-12-27
Description: Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://github.com/whyrusleeping/tar-utils/commit/20a61371de5b51380bbdb0c7935b30b0625ac227; https://pkg.go.dev/vuln/GO-2021-0106; https://snyk.io/research/zip-slip-vulnerability
CVE: CVE-2020-36568
Published: 2022-12-27
Description: Unsanitized input in the query parser in github.com/revel/revel before v1.0.0 allows remote attackers to cause resource exhaustion via memory allocation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/revel/revel/commit/d160ecb[PII_REDACTED]5b19778594cbdc272e8a605; https://github.com/revel/revel/issues/1424; https://github.com/revel/revel/pull/1427
CVE: CVE-2020-36569
Published: 2022-12-27
Description: Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0[PII_REDACTED]2129-ac0cc4484ad4 and v0.0.0[PII_REDACTED]1040-063a3fb69896 if ListenAndServe is called with an empty token.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: https://github.com/nanobox-io/golang-nanoauth/commit/063a3fb69896acf985759f0fe3851f15973993f3; https://github.com/nanobox-io/golang-nanoauth/pull/5; https://pkg.go.dev/vuln/GO-2020-0004
CVE: CVE-2021-4235
Published: 2022-12-27
Description: Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/go-yaml/yaml/commit/bb4e33bf68bf89cad44d386192cbed201f35b241; https://github.com/go-yaml/yaml/pull/375; https://lists.debian.org/debian-lts-announce/2023/07/msg00001.html
CVE: CVE-2021-4236
Published: 2022-12-27
Description: Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not explicitly use WebSockets are not vulnerable.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: https://github.com/ecnepsnai/web/commit/5a78f8d5c41ce60dcf9f61aaf47a7a8dc3e0002f; https://pkg.go.dev/vuln/GO-2021-0107; https://github.com/ecnepsnai/web/commit/5a78f8d5c41ce60dcf9f61aaf47a7a8dc3e0002f
CVE: CVE-2021-4238
Published: 2022-12-27
Description: Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by these functions.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-331
References: https://github.com/Masterminds/goutils/commit/869801f20f9f1e7ecdbdb6422049d8241270d5e1; https://pkg.go.dev/vuln/GO-2022-0411; https://github.com/Masterminds/goutils/commit/869801f20f9f1e7ecdbdb6422049d8241270d5e1
CVE: CVE-2021-4239
Published: 2022-12-27
Description: The Noise protocol implementation suffers from weakened cryptographic security after encrypting 2^64 messages, and a potential denial of service attack. After 2^64 (~18.4 quintillion) messages are encrypted with the Encrypt function, the nonce counter will wrap around, causing multiple messages to be encrypted with the same key and nonce. In a separate issue, the Decrypt function increments the nonce state even when it fails to decrypt a message. If an attacker can provide an invalid input to the Decrypt function, this will cause the nonce state to desynchronize between the peers, resulting in a failure to encrypt all subsequent messages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-311
References: https://github.com/flynn/noise/pull/44; https://pkg.go.dev/vuln/GO-2022-0425; https://github.com/flynn/noise/pull/44
CVE: CVE-2022-2582
Published: 2022-12-27
Description: The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field, but older SDK versions still send it.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-326
References: https://github.com/aws/aws-sdk-go/commit/35fa6ddf45c061e0f08d3a3b5119f8f4da38f6d1; https://pkg.go.dev/vuln/GO-2022-0391; https://github.com/aws/aws-sdk-go/commit/35fa6ddf45c061e0f08d3a3b5119f8f4da38f6d1
CVE: CVE-2022-2583
Published: 2022-12-27
Description: A race condition can cause incorrect HTTP request routing.
CVSS Score: 3.7 (LOW)
CWE: CWE-362
References: https://github.com/ntbosscher/gobase/commit/a8d40bce9c429d324122d18c446924dab809e812; https://pkg.go.dev/vuln/GO-2022-0400; https://github.com/ntbosscher/gobase/commit/a8d40bce9c429d324122d18c446924dab809e812
CVE: CVE-2022-2584
Published: 2022-12-27
Description: The dag-pb codec can panic when decoding invalid blocks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://github.com/ipld/go-codec-dagpb/commit/a17ace35cc760a2698645c09868f9050fa219f57; https://pkg.go.dev/vuln/GO-2022-0422; https://github.com/ipld/go-codec-dagpb/commit/a17ace35cc760a2698645c09868f9050fa219f57
CVE: CVE-2022-3064
Published: 2022-12-27
Description: Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/go-yaml/yaml/commit/f221b8435cfb71e54062f6c6e99e9ade30b124d5; https://github.com/go-yaml/yaml/releases/tag/v2.2.4; https://lists.debian.org/debian-lts-announce/2023/07/msg00001.html
CVE: CVE-2022-45778
Published: 2022-12-27
Description: https://www.hillstonenet.com.cn/ Hillstone Firewall SG-6000 <= 5.0.4.0 is vulnerable to Incorrect Access Control. There is a permission bypass vulnerability in the Hillstone WEB application firewall. An attacker can enter the background of the firewall with super administrator privileges through a configuration error in report.m.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://gist.github.com/yinfei6/6ffff06db3f7d4c24de2f784c0db10df; https://gist.github.com/yinfei6/6ffff06db3f7d4c24de2f784c0db10df
CVE: CVE-2022-45963
Published: 2022-12-27
Description: h3c firewall <= 3.10 ESS6703 has a privilege bypass vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://gist.github.com/yinfei6/fc6478328f8c2e2bf62a631a81afb265; https://gist.github.com/yinfei6/fc6478328f8c2e2bf62a631a81afb265
CVE: CVE-2022-46442
Published: 2022-12-27
Description: dedecms <=V5.7.102 is vulnerable to SQL Injection. In sys_ sql_ n query.php there are no restrictions on the sql query.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://gist.github.com/yinfei6/f2b311374de4b4cec1dc22433d38c92a; https://gist.github.com/yinfei6/f2b311374de4b4cec1dc22433d38c92a
CVE: CVE-2019-25091
Published: 2022-12-27
Description: A vulnerability classified as problematic has been found in nsupdate.info. This affects an unknown part of the file src/nsupdate/settings/base.py of the component CSRF Cookie Handler. The manipulation of the argument CSRF_COOKIE_HTTPONLY leads to cookie without 'httponly' flag. It is possible to initiate the attack remotely. The name of the patch is 60a3fe559c453bc36b0ec3e5dd39c1303640a59a. It is recommended to apply a patch to fix this issue. The identifier VDB-216909 was assigned to this vulnerability.
CVSS Score: 3.7 (LOW)
CWE: CWE-1004
References: https://github.com/nsupdate-info/nsupdate.info/commit/60a3fe559c453bc36b0ec3e5dd39c1303640a59a; https://github.com/nsupdate-info/nsupdate.info/pull/410; https://vuldb.com/?ctiid.216909
CVE: CVE-2020-36635
Published: 2022-12-27
Description: A vulnerability was found in OpenMRS Appointment Scheduling Module up to 1.12.x. It has been classified as problematic. This affects the function validateFieldName of the file api/src/main/java/org/openmrs/module/appointmentscheduling/validator/AppointmentTypeValidator.java. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.13.0 is able to address this issue. The name of the patch is 34213c3f6ea22df427573076fb62744694f601d8. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216915.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://github.com/openmrs/openmrs-module-appointmentscheduling/commit/34213c3f6ea22df427573076fb62744694f601d8; https://github.com/openmrs/openmrs-module-appointmentscheduling/pull/32; https://github.com/openmrs/openmrs-module-appointmentscheduling/releases/tag/1.13.0
CVE: CVE-2020-36636
Published: 2022-12-27
Description: A vulnerability classified as problematic has been found in OpenMRS Admin UI Module up to 1.4.x. Affected is the function sendErrorMessage of the file omod/src/main/java/org/openmrs/module/adminui/page/controller/systemadmin/accounts/AccountPageController.java of the component Account Setup Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.5.0 is able to address this issue. The name of the patch is 702fbfdac7c4418f23bb5f6452482b4a88020061. It is recommended to upgrade the affected component. VDB-216918 is the identifier assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/openmrs/openmrs-module-adminui/commit/702fbfdac7c4418f23bb5f6452482b4a88020061; https://github.com/openmrs/openmrs-module-adminui/pull/57; https://github.com/openmrs/openmrs-module-adminui/releases/tag/1.5.0
CVE: CVE-2021-4290
Published: 2022-12-27
Description: A vulnerability was found in DHBW Fallstudie. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file app/config/passport.js of the component Login. The manipulation of the argument id/email leads to sql injection. The name of the patch is 5c13c6a972ef4c07c5f35b417916e0598af9e123. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216907.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/maboehm/fallstudie/commit/5c13c6a972ef4c07c5f35b417916e0598af9e123; https://vuldb.com/?ctiid.216907; https://vuldb.com/?id.216907
CVE: CVE-2021-4291
Published: 2022-12-27
Description: A vulnerability was found in OpenMRS Admin UI Module up to 1.5.x. It has been declared as problematic. This vulnerability affects unknown code of the file omod/src/main/webapp/pages/metadata/locations/location.gsp. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.6.0 is able to address this issue. The name of the patch is a7eefb5f69f6c50a3bffcb138bb8ea57cb41a9b6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216916.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/openmrs/openmrs-module-adminui/commit/a7eefb5f69f6c50a3bffcb138bb8ea57cb41a9b6; https://github.com/openmrs/openmrs-module-adminui/pull/61; https://github.com/openmrs/openmrs-module-adminui/releases/tag/1.6.0
CVE: CVE-2021-4292
Published: 2022-12-27
Description: A vulnerability was found in OpenMRS Admin UI Module up to 1.4.x. It has been rated as problematic. This issue affects some unknown processing of the file omod/src/main/webapp/pages/metadata/privileges/privilege.gsp of the component Manage Privilege Page. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.5.0 is able to address this issue. The name of the patch is 4f8565425b7c74128dec9ca46dfbb9a3c1c24911. It is recommended to upgrade the affected component. The identifier VDB-216917 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/openmrs/openmrs-module-adminui/commit/4f8565425b7c74128dec9ca46dfbb9a3c1c24911; https://github.com/openmrs/openmrs-module-adminui/pull/58; https://github.com/openmrs/openmrs-module-adminui/releases/tag/1.5.0
CVE: CVE-2022-4768
Published: 2022-12-27
Description: A vulnerability was found in Dropbox merou. It has been classified as critical. Affected is the function add_public_key of the file grouper/public_key.py of the component SSH Public Key Handler. The manipulation of the argument public_key_str leads to injection. It is possible to launch the attack remotely. The name of the patch is d93087973afa26bc0a2d0a5eb5c0fde748bdd107. It is recommended to apply a patch to fix this issue. VDB-216906 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74
References: https://github.com/dropbox/merou/commit/d93087973afa26bc0a2d0a5eb5c0fde748bdd107; https://github.com/dropbox/merou/pull/673; https://vuldb.com/?ctiid.216906
CVE: CVE-2022-4772
Published: 2022-12-27
Description: A vulnerability was found in Widoco and classified as critical. Affected by this issue is the function unZipIt of the file src/main/java/widoco/WidocoUtils.java. The manipulation leads to path traversal. It is possible to launch the attack on the local host. The name of the patch is f2279b76827f32190adfa9bd5229b7d5a147fa92. It is recommended to apply a patch to fix this issue. VDB-216914 is the identifier assigned to this vulnerability.
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/dgarijo/Widoco/commit/f2279b76827f32190adfa9bd5229b7d5a147fa92; https://github.com/dgarijo/Widoco/pull/551; https://vuldb.com/?ctiid.216914
CVE: CVE-2022-23544
Published: 2022-12-28
Description: MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.0 are subject to a Server-Side Request Forgery that leads to Cross-Site Scripting. A Server-Side request forgery in `IssueProxyResourceService::getMdImageByUrl` allows an attacker to access internal resources, as well as executing JavaScript code in the context of Metersphere's origin by a victim of a reflected XSS. This vulnerability has been fixed in v2.5.0. There are no known workarounds. 
CVSS Score: 7.2 (HIGH)
CWE: CWE-79, CWE-918, CWE-918
References: https://github.com/metersphere/metersphere/commit/d0f95b50737c941b29d507a4cc3545f2dc6ab121; https://github.com/metersphere/metersphere/security/advisories/GHSA-vrv6-cg45-rmjj; https://github.com/metersphere/metersphere/commit/d0f95b50737c941b29d507a4cc3545f2dc6ab121
CVE: CVE-2022-41966
Published: 2022-12-28
Description: XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.util.Map and java.util per the code example in the referenced advisory. However, this implies that your application does not care about the implementation of the map and all elements are comparable.
CVSS Score: 8.2 (HIGH)
CWE: CWE-120, CWE-121, CWE-502, CWE-674
References: https://github.com/x-stream/xstream/security/advisories/GHSA-j563-grx4-pjpv; https://x-stream.github.io/CVE-2022-41966.html; https://github.com/x-stream/xstream/security/advisories/GHSA-j563-grx4-pjpv
CVE: CVE-2022-41967
Published: 2022-12-28
Description: Dragonfly is a Java runtime dependency management library. Dragonfly v0.3.0-SNAPSHOT does not configure DocumentBuilderFactory to prevent XML external entity (XXE) attacks. This issue is patched in 0.3.1-SNAPSHOT. As a workaround, since Dragonfly only parses XML `SNAPSHOT` versions are being resolved, this vulnerability may be avoided by not trying to resolve `SNAPSHOT` versions.
CVSS Score: 7.0 (HIGH)
CWE: CWE-611
References: https://github.com/HyperaDev/Dragonfly/commit/9661375e1135127ca6cdb5712e978bec33cc06b3; https://github.com/HyperaDev/Dragonfly/security/advisories/GHSA-6x3m-96qp-mmxv; https://github.com/HyperaDev/Dragonfly/commit/9661375e1135127ca6cdb5712e978bec33cc06b3
CVE: CVE-2022-4773
Published: 2022-12-28
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in cloudsync. Affected by this vulnerability is the function getItem of the file src/main/java/cloudsync/connector/LocalFilesystemConnector.java. The manipulation leads to path traversal. It is possible to launch the attack on the local host. The name of the patch is 3ad796833398af257c28e0ebeade68518e0e612a. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216919. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 2.5 (LOW)
CWE: CWE-22
References: https://github.com/HolgerHees/cloudsync/commit/3ad796833398af257c28e0ebeade68518e0e612a; https://vuldb.com/?ctiid.216919; https://vuldb.com/?id.216919
CVE: CVE-2022-23555
Published: 2022-12-28
Description: authentik is an open-source Identity Provider focused on flexibility and versatility. Versions prior to 2022.11.4 and 2022.10.4 are vulnerable to Improper Authentication. Token reuse in invitation URLs leads to access control bypass via the use of a different enrollment flow than in the one provided. The vulnerability allows an attacker that knows different invitation flows names (e.g. `enrollment-invitation-test` and `enrollment-invitation-admin`) via either different invite links or via brute forcing to signup via a single invitation url for any valid invite link received (it can even be a url for a third flow as long as it's a valid invite) as the token used in the `Invitations` section of the Admin interface does NOT change when a different `enrollment flow` is selected via the interface and it is NOT bound to the selected flow, so it will be valid for any flow when used. This issue is patched in authentik 2022.11.4,2022.10.4 and 2022.12.0. Only configurations that use invitations and have multiple enrollment flows with invitation stages that grant different permissions are affected. The default configuration is not vulnerable, and neither are configurations with a single enrollment flow.  As a workaround, fixed data can be added to invitations which can be checked in the flow to deny requests. Alternatively, an identifier with high entropy (like a UUID) can be used as flow slug, mitigating the attack vector by exponentially decreasing the possibility of discovering other flows.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://github.com/goauthentik/authentik/security/advisories/GHSA-9qwp-jf7p-vr7h; https://github.com/goauthentik/authentik/security/advisories/GHSA-9qwp-jf7p-vr7h
CVE: CVE-2020-36562
Published: 2022-12-28
Description: Due to unchecked type assertions, maliciously crafted messages can cause panics, which may be used as a denial of service vector.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://github.com/shiyanhui/dht/issues/57; https://pkg.go.dev/vuln/GO-2020-0040; https://github.com/shiyanhui/dht/issues/57
CVE: CVE-2020-36563
Published: 2022-12-28
Description: XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-347
References: https://github.com/RobotsAndPencils/go-saml/pull/38; https://pkg.go.dev/vuln/GO-2020-0047; https://github.com/RobotsAndPencils/go-saml/pull/38
CVE: CVE-2022-3346
Published: 2022-12-28
Description: DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. The owner name of RRSIG RRs is not validated, permitting an attacker to present the RRSIG for an attacker-controlled domain in a response for any other domain.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-345
References: https://github.com/peterzen/goresolver/issues/5; https://pkg.go.dev/vuln/GO-2022-0979; https://github.com/peterzen/goresolver/issues/5
CVE: CVE-2022-3347
Published: 2022-12-28
Description: DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. Root DNSSEC public keys are not validated, permitting an attacker to present a self-signed root key and delegation chain.
CVSS Score: 7.5 (HIGH)
CWE: CWE-345
References: https://github.com/peterzen/goresolver/issues/5#issuecomment[PII_REDACTED]; https://pkg.go.dev/vuln/GO-2022-1026; https://github.com/peterzen/goresolver/issues/5#issuecomment[PII_REDACTED]
CVE: CVE-2022-46172
Published: 2022-12-28
Description: authentik is an open-source Identity provider focused on flexibility and versatility. In versions prior to 2022.10.4, and 2022.11.4, any authenticated user can create an arbitrary number of accounts through the default flows. This would circumvent any policy in a situation where it is undesirable for users to create new accounts by themselves. This may also affect other applications as these new basic accounts would exist throughout the SSO infrastructure. By default the newly created accounts cannot be logged into as no password reset exists by default. However password resets are likely to be enabled by most installations. This vulnerability pertains to the user context used in the default-user-settings-flow, /api/v3/flows/instances/default-user-settings-flow/execute/. This issue has been fixed in versions 2022.10.4 and 2022.11.4.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-269, CWE-287, CWE-269, CWE-287
References: https://github.com/goauthentik/authentik/security/advisories/GHSA-hv8r-6w7p-mpc5; https://github.com/goauthentik/authentik/security/advisories/GHSA-hv8r-6w7p-mpc5
CVE: CVE-2022-46173
Published: 2022-12-28
Description: Elrond-GO is a go implementation for the Elrond Network protocol. Versions prior to 1.3.50 are subject to a processing issue where nodes are affected when trying to process a cross-shard relayed transaction with a smart contract deploy transaction data. The problem was a bad correlation between the transaction caches and the processing component. If the above-mentioned transaction was sent with more gas than required, the smart contract result (SCR transaction) that should have returned the leftover gas, would have been wrongly added to a cache that the processing unit did not consider. The node stopped notarizing metachain blocks. The fix was actually to extend the SCR transaction search in all other caches if it wasn't found in the correct (expected) sharded-cache. There are no known workarounds at this time. This issue has been patched in version 1.3.50.

CVSS Score: 7.2 (HIGH)
CWE: CWE-669
References: https://github.com/ElrondNetwork/elrond-go/commit/39d7ddcb08bb34217dab6daef7cd9d287fb8cab3; https://github.com/ElrondNetwork/elrond-go/pull/4718; https://github.com/ElrondNetwork/elrond-go/security/advisories/GHSA-p228-4mrh-ww7r
CVE: CVE-2022-46174
Published: 2022-12-28
Description: efs-utils is a set of Utilities for Amazon Elastic File System (EFS). A potential race condition issue exists within the Amazon EFS mount helper in efs-utils versions v1.34.3 and below. When using TLS to mount file systems, the mount helper allocates a local port for stunnel to receive NFS connections prior to applying the TLS tunnel. In affected versions, concurrent mount operations can allocate the same local port, leading to either failed mount operations or an inappropriate mapping from an EFS customer’s local mount points to that customer’s EFS file systems. This issue is patched in version v1.34.4. There is no recommended work around. We recommend affected users update the installed version of efs-utils to v1.34.4 or later.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-362
References: https://github.com/aws/efs-utils/commit/f3a8f88167d55caa2f78aeb72d4dc1987a9ed62d; https://github.com/aws/efs-utils/issues/125; https://github.com/aws/efs-utils/security/advisories/GHSA-4fv8-w65m-3932