hitoshura25/cvefixes huggingface dataset:
CVE-2021-43287 (Java, published 2022-04-14T12:15Z)
Description: value: An issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default, leaks all secrets known to the GoCD server to unauthenticated attackers.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/gocd/gocd
Files changed:
server/src/main/java/com/thoughtworks/go/addon/businesscontinuity/primary/controller/PrimaryStatusProviderController.java
server/src/main/java/com/thoughtworks/go/addon/businesscontinuity/standby/controller/DashBoardController.java
Commit message: #000 - Disable business-continuity


Vulnerable code:
@RequestMapping(value = "/add-on/business-continuity/api")
    @RequestMapping(value = "/add-on/business-continuity/admin/dashboard", method = RequestMethod.GET)
    @RequestMapping(value = "/add-on/business-continuity/admin/dashboard.json", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE)

Fixed code:
CVE-2021-43289 (Java, published 2022-04-14T13:15Z)
Description: value: An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into an arbitrary directory of a GoCD server, but does not control the filename.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/gocd/gocd
Files changed:
server/src/main/java/com/thoughtworks/go/server/controller/ArtifactsController.java
server/src/test-fast/java/com/thoughtworks/go/server/controller/ArtifactsControllerTest.java
Commit message: #000 - Validate stage counter in GETs as well.

Continuation of commit c22e0428164af


Vulnerable code:

Fixed code:
        if (!isValidStageCounter(stageCounter)) {
            return buildNotFound(pipelineName, pipelineCounter, stageName, stageCounter, buildName);
        }


        if (!isValidStageCounter(stageCounter)) {
            return buildNotFound(pipelineName, counterOrLabel, stageName, stageCounter, buildName);
        }

    @Test
    void shouldFailToGetConsoleOutWhenStageCounterIsNotAPositiveInteger() throws Exception {
        ModelAndView modelAndView = artifactsController.consoleout("pipeline-1", "1", "stage-1", "job-1", "NOT_AN_INTEGER", 122L);
        assertThat(((ResponseCodeView) modelAndView.getView()).getStatusCode(), is(SC_NOT_FOUND));
    }

    @Test
    void shouldFailToGetArtifactWhenStageCounterIsNotAPositiveInteger() throws Exception {
        ModelAndView modelAndView = artifactsController.getArtifactAsHtml("pipeline-1", "1", "stage-1",  "NOT_AN_INTEGER", "job-1", "some-path", "sha1", "alias");
        assertThat(((ResponseCodeView) modelAndView.getView()).getStatusCode(), is(SC_NOT_FOUND));
    }
CVE-2021-43289 (Java, published 2022-04-14T13:15Z)
Description: value: An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into an arbitrary directory of a GoCD server, but does not control the filename.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/gocd/gocd
Files changed:
server/src/main/java/com/thoughtworks/go/server/controller/ArtifactsController.java
server/src/test-fast/java/com/thoughtworks/go/server/controller/ArtifactsControllerTest.java
Commit message: #000 - Validate stage counter during upload artifacts


Vulnerable code:

Fixed code:
import org.apache.commons.lang3.StringUtils;
        if (!isValidStageCounter(stageCounter)) {
            return buildNotFound(pipelineName, pipelineCounter, stageName, stageCounter, buildName);
        }
        if (!isValidStageCounter(stageCounter)) {
            return buildNotFound(pipelineName, pipelineCounter, stageName, stageCounter, buildName);
        }


    private boolean isValidStageCounter(String stageCounter) {
        if (StringUtils.isEmpty(stageCounter)) {
            return true;
        }

        try {
            int value = Integer.parseInt(stageCounter);
            return value > 0;
        } catch (Exception e) {
            return false;
        }
    }
import static javax.servlet.http.HttpServletResponse.SC_NOT_FOUND;
    @Test
    void shouldFailToPostAndPutWhenStageCounterIsNotAPositiveInteger() throws Exception {
        ModelAndView modelAndView = artifactsController.postArtifact("pipeline-1", "1", "stage-1", "NOT_AN_INTEGER", "job-1", 122L, "some-path", 1, null);
        assertThat(((ResponseCodeView) modelAndView.getView()).getStatusCode(), is(SC_NOT_FOUND));

        modelAndView = artifactsController.postArtifact("pipeline-1", "1", "stage-1", "-123", "job-1", 122L, "some-path", 1, null);
        assertThat(((ResponseCodeView) modelAndView.getView()).getStatusCode(), is(SC_NOT_FOUND));

        modelAndView = artifactsController.putArtifact("pipeline-1", "1", "stage-1", "NOT_AN_INTEGER", "job-1", 122L, "some-path", "1", null);
        assertThat(((ResponseCodeView) modelAndView.getView()).getStatusCode(), is(SC_NOT_FOUND));

        modelAndView = artifactsController.putArtifact("pipeline-1", "1", "stage-1", "-123", "job-1", 122L, "some-path", "1", null);
        assertThat(((ResponseCodeView) modelAndView.getView()).getStatusCode(), is(SC_NOT_FOUND));
    }
CVE-2021-43290 (Java, published 2022-04-14T13:15Z)
Description: value: An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into a directory of a GoCD server. They can control the filename but the directory is placed inside of a directory that they can't control.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/gocd/gocd
Files changed:
server/src/main/java/com/thoughtworks/go/server/controller/ArtifactsController.java
server/src/test-fast/java/com/thoughtworks/go/server/controller/ArtifactsControllerTest.java
Commit message: #000 - Validate stage counter in GETs as well.

Continuation of commit c22e0428164af


Vulnerable code:

Fixed code:
        if (!isValidStageCounter(stageCounter)) {
            return buildNotFound(pipelineName, pipelineCounter, stageName, stageCounter, buildName);
        }


        if (!isValidStageCounter(stageCounter)) {
            return buildNotFound(pipelineName, counterOrLabel, stageName, stageCounter, buildName);
        }

    @Test
    void shouldFailToGetConsoleOutWhenStageCounterIsNotAPositiveInteger() throws Exception {
        ModelAndView modelAndView = artifactsController.consoleout("pipeline-1", "1", "stage-1", "job-1", "NOT_AN_INTEGER", 122L);
        assertThat(((ResponseCodeView) modelAndView.getView()).getStatusCode(), is(SC_NOT_FOUND));
    }

    @Test
    void shouldFailToGetArtifactWhenStageCounterIsNotAPositiveInteger() throws Exception {
        ModelAndView modelAndView = artifactsController.getArtifactAsHtml("pipeline-1", "1", "stage-1",  "NOT_AN_INTEGER", "job-1", "some-path", "sha1", "alias");
        assertThat(((ResponseCodeView) modelAndView.getView()).getStatusCode(), is(SC_NOT_FOUND));
    }
CVE-2021-43290 (Java, published 2022-04-14T13:15Z)
Description: value: An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into a directory of a GoCD server. They can control the filename but the directory is placed inside of a directory that they can't control.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/gocd/gocd
Files changed:
server/src/main/java/com/thoughtworks/go/server/controller/ArtifactsController.java
server/src/test-fast/java/com/thoughtworks/go/server/controller/ArtifactsControllerTest.java
Commit message: #000 - Validate stage counter during upload artifacts


Vulnerable code:

Fixed code:
import org.apache.commons.lang3.StringUtils;
        if (!isValidStageCounter(stageCounter)) {
            return buildNotFound(pipelineName, pipelineCounter, stageName, stageCounter, buildName);
        }
        if (!isValidStageCounter(stageCounter)) {
            return buildNotFound(pipelineName, pipelineCounter, stageName, stageCounter, buildName);
        }


    private boolean isValidStageCounter(String stageCounter) {
        if (StringUtils.isEmpty(stageCounter)) {
            return true;
        }

        try {
            int value = Integer.parseInt(stageCounter);
            return value > 0;
        } catch (Exception e) {
            return false;
        }
    }
import static javax.servlet.http.HttpServletResponse.SC_NOT_FOUND;
    @Test
    void shouldFailToPostAndPutWhenStageCounterIsNotAPositiveInteger() throws Exception {
        ModelAndView modelAndView = artifactsController.postArtifact("pipeline-1", "1", "stage-1", "NOT_AN_INTEGER", "job-1", 122L, "some-path", 1, null);
        assertThat(((ResponseCodeView) modelAndView.getView()).getStatusCode(), is(SC_NOT_FOUND));

        modelAndView = artifactsController.postArtifact("pipeline-1", "1", "stage-1", "-123", "job-1", 122L, "some-path", 1, null);
        assertThat(((ResponseCodeView) modelAndView.getView()).getStatusCode(), is(SC_NOT_FOUND));

        modelAndView = artifactsController.putArtifact("pipeline-1", "1", "stage-1", "NOT_AN_INTEGER", "job-1", 122L, "some-path", "1", null);
        assertThat(((ResponseCodeView) modelAndView.getView()).getStatusCode(), is(SC_NOT_FOUND));

        modelAndView = artifactsController.putArtifact("pipeline-1", "1", "stage-1", "-123", "job-1", 122L, "some-path", "1", null);
        assertThat(((ResponseCodeView) modelAndView.getView()).getStatusCode(), is(SC_NOT_FOUND));
    }
CVE-2022-36088 (Other, published 2022-09-07T23:15Z)
Description: value: GoCD is a continuous delivery server. Windows installations via either the server or agent installers for GoCD prior to 22.2.0 do not adequately restrict permissions when installing outside of the default location. This could allow a malicious user with local access to the server GoCD Server or Agent are installed on to modify executables or components of the installation. This does not affect zip file-based installs, installations to other platforms, or installations inside `Program Files` or `Program Files (x86)`. This issue is fixed in GoCD 22.2.0 installers. As a workaround, if the server or agent is installed outside of `Program Files (x86)`, verify the the permission of the Server or Agent installation directory to ensure the `Everyone` user group does not have `Full Control`, `Modify` or `Write` permissions.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/gocd/gocd
Files changed:
installers/windows/go-base.nsi
Commit message: Add NSIS AccessControl plugin to set permissions on install dir

From https://nsis.sourceforge.io/AccessControl_plug-in adding ANSI version (i386) since that's we are using for now.


Vulnerable code:

Fixed code:
Function "SetupDirectoryPermissions"
    ${LogText} "Setting directory permissions..."

	; Disable inheritance. This breaks the inheritance chain and turns inherited permissions into explicit ones.
	AccessControl::DisableFileInheritance $INSTDIR
	; Make Administrators the owner
	AccessControl::SetFileOwner $INSTDIR "(S-1-5-32-544)"
	; Clear all explicit permissions on the file, leaving Administrators with full access
	AccessControl::ClearOnFile  $INSTDIR "(S-1-5-32-544)" "FullAccess"
	; Give SYSTEM full access.
	AccessControl::SetOnFile    $INSTDIR "(S-1-5-18)"     "FullAccess"
	; Give Everyone only access to read, list dir, and execute.
	AccessControl::SetOnFile    $INSTDIR "(S-1-1-0)"      "GenericRead + GenericExecute + ListDirectory + ReadAttributes"
FunctionEnd

  Call SetupDirectoryPermissions
CVE-2016-3698 (C, published 2016-06-13T19:59Z)
Description: value: libndp before 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor Discovery Protocol (NDP) messages, which allows remote attackers to conduct man-in-the-middle attacks or cause a denial of service (network connectivity disruption) by advertising a node as a router from a non-local network.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/jpirko/libndp
Files changed:
libndp/libndp.c
Commit message: libndb: reject redirect and router advertisements from non-link-local

RFC4861 suggests that these messages should only originate from
link-local addresses in 6.1.2 (RA) and 8.1. (redirect):

Mitigates CVE-2016-3698.

Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
Signed-off-by: Jiri Pirko <jiri@mellanox.com>


Vulnerable code:
	return true;

Fixed code:
	bool (*addrto_validate)(struct in6_addr *addr);
static bool ndp_msg_addrto_validate_link_local(struct in6_addr *addr)
{
	return IN6_IS_ADDR_LINKLOCAL (addr);
}

		.addrto_validate = ndp_msg_addrto_validate_link_local,
		.addrto_validate = ndp_msg_addrto_validate_link_local,

	if (ndp_msg_type_info(msg_type)->addrto_validate)
		return ndp_msg_type_info(msg_type)->addrto_validate(&msg->addrto);
	else
		return true;
CVE-2016-3698 (C, published 2016-06-13T19:59Z)
Description: value: libndp before 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor Discovery Protocol (NDP) messages, which allows remote attackers to conduct man-in-the-middle attacks or cause a denial of service (network connectivity disruption) by advertising a node as a router from a non-local network.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/jpirko/libndp
Files changed:
libndp/libndp.c
Commit message: libndp: validate the IPv6 hop limit

None of the NDP messages should ever come from a non-local network; as
stated in RFC4861's 6.1.1 (RS), 6.1.2 (RA), 7.1.1 (NS), 7.1.2 (NA),
and 8.1. (redirect):

  - The IP Hop Limit field has a value of 255, i.e., the packet
    could not possibly have been forwarded by a router.

This fixes CVE-2016-3698.

Reported by: Julien BERNARD <julien.bernard@viagenie.ca>
Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
Signed-off-by: Jiri Pirko <jiri@mellanox.com>


Vulnerable code:
		       struct in6_addr *addr, uint32_t *ifindex)
	unsigned char cbuf[CMSG_SPACE(sizeof(struct in6_pktinfo))];
		if (cmsghdr->cmsg_level == IPPROTO_IPV6 &&
		    cmsghdr->cmsg_type == IPV6_PKTINFO &&
		    cmsghdr->cmsg_len == CMSG_LEN(sizeof(struct in6_pktinfo))) {
			struct in6_pktinfo *pktinfo;
			pktinfo = (struct in6_pktinfo *) CMSG_DATA(cmsghdr);
			*ifindex = pktinfo->ipi6_ifindex;
			  &msg->addrto, &msg->ifindex);
	dbg(ndp, "rcvd from: %s, ifindex: %u",
		 str_in6_addr(&msg->addrto), msg->ifindex);

Fixed code:
		       struct in6_addr *addr, uint32_t *ifindex, int *hoplimit)
	unsigned char cbuf[2 * CMSG_SPACE(sizeof(struct in6_pktinfo))];
		if (cmsghdr->cmsg_level != IPPROTO_IPV6)
			continue;

		switch(cmsghdr->cmsg_type) {
		case IPV6_PKTINFO:
			if (cmsghdr->cmsg_len == CMSG_LEN(sizeof(struct in6_pktinfo))) {
				struct in6_pktinfo *pktinfo;

				pktinfo = (struct in6_pktinfo *) CMSG_DATA(cmsghdr);
				*ifindex = pktinfo->ipi6_ifindex;
			}
			break;
		case IPV6_HOPLIMIT:
			if (cmsghdr->cmsg_len == CMSG_LEN(sizeof(int))) {
				int *val;
				val = (int *) CMSG_DATA(cmsghdr);
				*hoplimit = *val;
			}
			break;
	val = 1;
	ret = setsockopt(sock, IPPROTO_IPV6, IPV6_RECVHOPLIMIT,
			 &val, sizeof(val));
	if (ret == -1) {
		err(ndp, "Failed to setsockopt IPV6_RECVHOPLIMIT,.");
		err = -errno;
		goto close_sock;
	}

	int				hoplimit;
			  &msg->addrto, &msg->ifindex, &msg->hoplimit);
	dbg(ndp, "rcvd from: %s, ifindex: %u, hoplimit: %d",
		 str_in6_addr(&msg->addrto), msg->ifindex, msg->hoplimit);

	if (msg->hoplimit != 255) {
		warn(ndp, "ignoring packet with bad hop limit (%d)", msg->hoplimit);
		err = 0;
		goto free_msg;
	}
CVE-2020-4072 (Other, published 2020-06-25T20:15Z)
Description: value: In generator-jhipster-kotlin version 1.6.0 log entries are created for invalid password reset attempts. As the email is provided by a user and the api is public this can be used by an attacker to forge log entries. This is vulnerable to https://cwe.mitre.org/data/definitions/117.html This problem affects only application generated with jwt or session authentication. Applications using oauth are not vulnerable. This issue has been fixed in version 1.7.0.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-117 \u2014 Improper Output Neutralization for Logs
The product does not neutralize or incorrectly neutralizes output that is written to logs.
Repository: https://github.com/jhipster/jhipster-kotlin
Files changed:
generators/server/templates/src/main/kotlin/package/web/rest/AccountResource.kt.ejs
Commit message: prevent log forging when doing password reset init request


Vulnerable code:
            log.warn("Password reset requested for non existing mail '$mail'");
                    log.warn("Password reset request for non existing email '$mail'")

Fixed code:
            log.warn("Password reset requested for non existing mail");
                    log.warn("Password reset request for non existing email")
CVE-2012-1836 (Unknown, published 2012-03-22T03:28Z)
Description: value: Heap-based buffer overflow in dns.cpp in InspIRCd 2.0.5 might allow remote attackers to execute arbitrary code via a crafted DNS query that uses compression.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/inspircd/inspircd
Files changed:
Commit message: Merge pull request #1 from nenolod/insp20

DNS resolver hardening (insp20 branch)

Vulnerable code:

Fixed code:
CVE-2012-6696 (C++, published 2017-09-25T21:29Z)
Description: value: inspircd in Debian before 2.0.7 does not properly handle unsigned integers.  NOTE: This vulnerability exists because of an incomplete fix to CVE-2012-1836.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/inspircd/inspircd
Files changed:
src/dns.cpp
Commit message: Fixed out of bounds memory access from malformed DNS queries that have an invalid length label. Introduced in a6a07de0daa353bcd29056a4535a9c4784c113c8.


Vulnerable code:
		if (length - i < 10)

Fixed code:
		if (static_cast<int>(length - i) < 10)
CVE-2015-8702 (C++, published 2016-04-12T14:59Z)
Description: value: The DNS::GetResult function in dns.cpp in InspIRCd before 2.0.19 allows remote DNS servers to cause a denial of service (netsplit) via an invalid character in a PTR response, as demonstrated by a "\032" (whitespace) character in a hostname.
Severity: HIGH (CVSS v3 base score: 8.6)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/inspircd/inspircd
Files changed:
src/dns.cpp
Commit message: Reject replies to DNS PTR requests that contain invalid characters

Fixes issue #1033 reported by @ping86


Vulnerable code:

Fixed code:
			{
				if (resultstr.find_first_not_of("0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ.-") != std::string::npos)
				{
					std::string ro = req->orig;
					delete req;
					return DNSResult(this_id | ERROR_MASK, "Invalid char(s) in reply", 0, ro);
				}
			}
CVE-2016-7142 (C++, published 2016-09-26T15:59Z)
Description: value: The m_sasl module in InspIRCd before 2.0.23, when used with a service that supports SASL_EXTERNAL authentication, allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted SASL message.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/inspircd/inspircd
Files changed:
src/modules/m_sasl.cpp
Commit message: m_sasl: don't allow AUTHENTICATE with mechanisms with a space


Vulnerable code:

Fixed code:
		allow_empty_last_param = false;
			if (parameters[0].find(' ') != std::string::npos || parameters[0][0] == ':')
				return CMD_FAILURE;
CVE-2019-20917 (C++, published 2020-09-11T05:15Z)
Description: value: An issue was discovered in InspIRCd 2 before 2.0.28 and 3 before 3.3.0. The mysql module contains a NULL pointer dereference when built against mariadb-connector-c 3.0.5 or newer. When combined with the sqlauth or sqloper modules, this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/inspircd/inspircd
Files changed:
src/modules/extra/m_mysql.cpp
Commit message: Initialise and deallocate the MySQL library correctly.


Vulnerable code:

Fixed code:
	if (mysql_library_init(0, NULL, NULL))
		throw ModuleException("Unable to initialise the MySQL library!");



	mysql_library_end();