hitoshura25/cvefixes huggingface dataset:
CVE-2023-42816 (Go, published 2023-11-13T21:15Z)
Description: value: Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. The vulnerability was in Kyvernos Notary verifier. An attacker would need control over the registry from which Kyverno would fetch signatures. With such a position, the attacker could return a malicious response to Kyverno, when Kyverno would send a request to the registry. The malicious response would cause denial of service of Kyverno, such that other users' admission requests would be blocked from being processed. This is a vulnerability in a new component released in v1.11.0. The only users affected by this are those that have been building Kyverno from source at the main branch which is not encouraged. Users consuming official Kyverno releases are not affected. There are no known cases of this vulnerability being exploited in the wild.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/kyverno/kyverno
Files changed:
pkg/notary/notary.go
pkg/notary/repository.go
Commit message: fix: address vulnerability issues in notary implementations (#8428)

* fix: set max limit on referrers count

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

* feat: add limit to max size of payload

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

* feat: add max count limit on listsignatures

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

* feat: add max signature size limit in FetchSignatureBlob

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>

---------

Signed-off-by: Vishal Choudhary <sendtovishalchoudhary@gmail.com>
Co-authored-by: shuting <shuting@nirmata.com>

Vulnerable code:

Fixed code:
var (
	maxReferrersCount = 50
	maxPayloadSize    = 10 * 1000 * 1000 // 10 MB
)

	// See: https://github.com/kyverno/kyverno/security/advisories/GHSA-9g37-h7p2-2c6r
	if len(referrersDescs.Manifests) > maxReferrersCount {
		return nil, fmt.Errorf("failed to fetch referrers: to many referrers found, max limit is %d", maxReferrersCount)
	}

	// See: https://github.com/kyverno/kyverno/security/advisories/GHSA-wc3x-5rfv-hh5v
	if predicateDesc.Size > int64(maxPayloadSize) {
		return nil, fmt.Errorf("payload size is too large, max size is %d: %+v", maxPayloadSize, predicateDesc)
	}

	// See: https://github.com/kyverno/kyverno/security/advisories/GHSA-hjpv-68f4-2262
	if len(referrersDescs.Manifests) > maxReferrersCount {
		return fmt.Errorf("failed to fetch referrers: to many referrers found, max limit is %d", maxReferrersCount)
	}

	// See: https://github.com/kyverno/kyverno/security/advisories/GHSA-4mp4-46gq-hv3r
	if manifestDesc.Size > int64(maxPayloadSize) {
		return nil, ocispec.Descriptor{}, fmt.Errorf("payload size is too large, max size is %d: %+v", maxPayloadSize, manifestDesc)
	}
CVE-2014-125056 (Unknown, published 2023-01-07T10:15Z)
Description: value: A vulnerability was found in Pylons horus and classified as problematic. Affected by this issue is some unknown functionality of the file horus/flows/local/services.py. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitation is known to be difficult. The patch is identified as fd56ccb62ce3cbdab0484fe4f9c25c4eda6c57ec. It is recommended to apply a patch to fix this issue. VDB-217598 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-208 \u2014 Observable Timing Discrepancy
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
Repository: https://github.com/Pylons/horus
Files changed:
Commit message: Merge pull request #1 from tilgovi/passwordtiming

Prevent timing attacks on passwords

Vulnerable code:

Fixed code:
CVE-2021-21371 (Python, published 2021-03-10T22:15Z)
Description: value: Tenable for Jira Cloud is an open source project designed to pull Tenable.io vulnerability data, then generate Jira Tasks and sub-tasks based on the vulnerabilities' current state. It published in pypi as "tenable-jira-cloud". In tenable-jira-cloud before version 1.1.21, it is possible to run arbitrary commands through the yaml.load() method. This could allow an attacker with local access to the host to run arbitrary code by running the application with a specially crafted YAML configuration file. This is fixed in version 1.1.21 by using yaml.safe_load() instead of yaml.load().
Severity: MEDIUM (CVSS v3 base score: 8.6)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/tenable/integration-jira-cloud
Files changed:
tenable_jira/cli.py
Commit message: switched yaml.load() to yaml.safe_load() to not load serialized python objects.


Vulnerable code:
    config_from_file = yaml.load(configfile, Loader=yaml.Loader)

Fixed code:
    config_from_file = yaml.safe_load(configfile)
CVE-2021-46225 (Other, published 2022-01-12T20:15Z)
Description: value: A buffer overflow in the GmfOpenMesh() function of libMeshb v7.61 allows attackers to cause a Denial of Service (DoS) via a crafted MESH file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-120 \u2014 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
Repository: https://github.com/LoicMarechal/libMeshb
Files changed:
examples/test_libmeshb_block_pipeline.f
sources/libmeshb7.c
Commit message: Removed a potential buffer overflow crash in GmfOpenMesh and debugged the test_libmeshb_block_pipeline.f that crashed


Vulnerable code:
c     libmeshb example : transform a quadrilateral mesh into a triangular one
     +                  movver, 1, VerTab,
      res = gmfgetblock(InpMsh, GmfQuadrilaterals, 1_8, NmbQad,0,
     +                  0,%val(0),%val(0),
/*                               LIBMESHB V7.61                               */
/*   Last modification:  sep 27 2021                                          */
            res = fscanf(msh->hdl, "%s", str);
            res = fscanf(msh->hdl, "%s", str);
      while(fscanf(msh->hdl, "%s", str) != EOF)

Fixed code:
c     libmeshb example: transform a quadrilateral mesh into a triangular one
     +                  0, %val(0), movver, 1, VerTab,
      res = gmfgetblock(InpMsh, GmfQuadrilaterals, 1_8, NmbQad,
     +                  0, %val(0), %val(0),
     +                  0,%val(0),
/*                               LIBMESHB V7.62                               */
/*   Last modification:  jan 07 2022                                          */
            res = fscanf(msh->hdl, "%100s", str);
            res = fscanf(msh->hdl, "%100s", str);
      while(fscanf(msh->hdl, "%100s", str) != EOF)
CVE-2022-23126 (Other, published 2022-01-24T19:15Z)
Description: value: TeslaMate before 1.25.1 (when using the default Docker configuration) allows attackers to open doors of Tesla vehicles, start Keyless Driving, and interfere with vehicle operation en route. This occurs because an attacker can leverage Grafana login access to obtain a token for Tesla API calls.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/adriankumpf/teslamate
Files changed:
grafana/Dockerfile
website/docs/installation/docker.md
Commit message: Disable anonymous login to Grafana


Vulnerable code:
    GF_AUTH_ANONYMOUS_ENABLED=true \
3. The Grafana dashboards are available at [http://your-ip-address:3000](http://localhost:3000).

Fixed code:
    GF_AUTH_ANONYMOUS_ENABLED=false \
3. The Grafana dashboards are available at [http://your-ip-address:3000](http://localhost:3000). Log in with the default user `admin` (inital password `admin`) and enter a secure password.
CVE-2023-48311 (Unknown, published 2023-12-08T20:15Z)
Description: value: dockerspawner is a tool to spawn JupyterHub single user servers in Docker containers. Users of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying `DockerSpawner.allowed_images` configuration allow users to launch _any_ pullable docker image, instead of restricting to only the single configured image, as intended. This issue has been addressed in commit `3ba4b665b` which has been included in dockerspawner release version 13. Users are advised to upgrade. Users unable to upgrade should explicitly set `DockerSpawner.allowed_images` to a non-empty list containing only the default image will result in the intended default behavior.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/jupyterhub/dockerspawner
Files changed:
Commit message: Merge pull request from GHSA-hfgr-h3vc-p6c2

allow only configured image by default

Vulnerable code:

Fixed code:
CVE-2022-48623 (Other, published 2024-02-13T05:15Z)
Description: value: The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a denial of service.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/rurban/Cpanel-JSON-XS
Files changed:
XS.xs
Commit message: fix decode out-of-bounds

on hash keys without :
security: could leak secrets.
Fixes GH 208


Vulnerable code:
#define EXPECT_CH(ch) SB \
                  decode_ws (dec); EXPECT_CH (':');
                  decode_ws (dec); if (*p != ':') EXPECT_CH (':');

      COP cop = *PL_curcop;
             dec.cur != dec.end ? SvPV_nolen (uni) : "(end of string)");

Fixed code:
  if (dec->cur >= dec->end)
    return;
#define EXPECT_CH(ch) SB        \
                  decode_ws (dec);
                  EXPECT_CH (':');
                  if (dec->cur >= dec->end)
                    EXPECT_CH (':');
                  decode_ws (dec);
                  if (*p != ':') EXPECT_CH (':');
              if (p > dec->end) {
                dec->cur = p;
                EXPECT_CH (':');
              }
      COP cop = *PL_curcop;
      if (dec.cur >= dec.end) // overshoot
        {
          croak ("%s, at character offset %d",
                 dec.err,
                 (int)ptr_to_index (aTHX_ string, dec.cur - SvPVX(string)));
        }
             dec.cur < dec.end ? SvPV_nolen (uni) : "(end of string)");
CVE-2021-41689 (C++, published 2022-06-28T13:15Z)
Description: value: DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would query its database and copy the result even if the result is null, which can incur a head-based overflow. An attacker can use it to launch a DoS attack.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/DCMTK/dcmtk
Files changed:
dcmnet/libsrc/diutil.cc
Commit message: Fixed possible NULL pointer dereference.

Thanks to Jinsheng Ba <bajinsheng@u.nus.edu> for the report and patch.


Vulnerable code:
            OFStandard::strlcpy(s, aString, bufsize);

Fixed code:
            if (ec == EC_Normal)
                OFStandard::strlcpy(s, aString, bufsize);
CVE-2024-34508 (C++, published 2024-05-05T20:15Z)
Description: value: dcmnet in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/DCMTK/dcmtk
Files changed:
dcmdata/libsrc/dcelem.cc
dcmnet/libsrc/dimcmd.cc
Commit message: Fixed two segmentation faults.

Fixed two segmentations faults that could occur while processing an
invalid incoming DIMSE message due to insufficient error handling
causing a de-referenced NULL pointer.

Thanks to Nils Bars <nils.bars@rub.de> for the bug report and sample files.

This closes DCMTK issue #1114.


Vulnerable code:
 *  Copyright (C) 1994-2023, OFFIS e.V.
 *  Copyright (C) 1994-2022, OFFIS e.V.
            strncpy(s, aString, maxlen);
            if (spacePadded)
                /* before we remove leading and tailing spaces we want to know
                 * whether the string is actually space padded. Required to communicate
                 * with dumb peers which send space padded UIDs and fail if they
                 * receive correct UIDs back.
                 *
                 * This test can only detect space padded strings if
                 * dcmEnableAutomaticInputDataCorrection is false; otherwise the padding
                 * has already been removed by dcmdata at this stage.
                 */
                size_t s_len = strlen(s);
                if ((s_len > 0)&&(s[s_len-1] == ' ')) *spacePadded = OFTrue; else *spacePadded = OFFalse;
            DU_stripLeadingAndTrailingSpaces(s);

Fixed code:
 *  Copyright (C) 1994-2024, OFFIS e.V.
        else
        {
            errorFlag = EC_InvalidStream; // incomplete dataset read from stream
            DCMDATA_ERROR("DcmElement: " << getTagName() << " " << getTag()
                << " larger (" << getLengthField() << ") than remaining bytes ("
                << getTransferredBytes() << ") in file, premature end of stream");
        }
 *  Copyright (C) 1994-2024, OFFIS e.V.
            if (ec.good())
                strncpy(s, aString, maxlen);
                if (spacePadded)
                {
                    /* before we remove leading and tailing spaces we want to know
                     * whether the string is actually space padded. Required to communicate
                     * with dumb peers which send space padded UIDs and fail if they
                     * receive correct UIDs back.
                     *
                     * This test can only detect space padded strings if
                     * dcmEnableAutomaticInputDataCorrection is false; otherwise the padding
                     * has already been removed by dcmdata at this stage.
                     */
                    size_t s_len = strlen(s);
                    if ((s_len > 0)&&(s[s_len-1] == ' ')) *spacePadded = OFTrue; else *spacePadded = OFFalse;
                }
                DU_stripLeadingAndTrailingSpaces(s);
CVE-2024-34509 (C++, published 2024-05-05T20:15Z)
Description: value: dcmdata in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/DCMTK/dcmtk
Files changed:
dcmdata/libsrc/dcelem.cc
dcmnet/libsrc/dimcmd.cc
Commit message: Fixed two segmentation faults.

Fixed two segmentations faults that could occur while processing an
invalid incoming DIMSE message due to insufficient error handling
causing a de-referenced NULL pointer.

Thanks to Nils Bars <nils.bars@rub.de> for the bug report and sample files.

This closes DCMTK issue #1114.


Vulnerable code:
 *  Copyright (C) 1994-2023, OFFIS e.V.
 *  Copyright (C) 1994-2022, OFFIS e.V.
            strncpy(s, aString, maxlen);
            if (spacePadded)
                /* before we remove leading and tailing spaces we want to know
                 * whether the string is actually space padded. Required to communicate
                 * with dumb peers which send space padded UIDs and fail if they
                 * receive correct UIDs back.
                 *
                 * This test can only detect space padded strings if
                 * dcmEnableAutomaticInputDataCorrection is false; otherwise the padding
                 * has already been removed by dcmdata at this stage.
                 */
                size_t s_len = strlen(s);
                if ((s_len > 0)&&(s[s_len-1] == ' ')) *spacePadded = OFTrue; else *spacePadded = OFFalse;
            DU_stripLeadingAndTrailingSpaces(s);

Fixed code:
 *  Copyright (C) 1994-2024, OFFIS e.V.
        else
        {
            errorFlag = EC_InvalidStream; // incomplete dataset read from stream
            DCMDATA_ERROR("DcmElement: " << getTagName() << " " << getTag()
                << " larger (" << getLengthField() << ") than remaining bytes ("
                << getTransferredBytes() << ") in file, premature end of stream");
        }
 *  Copyright (C) 1994-2024, OFFIS e.V.
            if (ec.good())
                strncpy(s, aString, maxlen);
                if (spacePadded)
                {
                    /* before we remove leading and tailing spaces we want to know
                     * whether the string is actually space padded. Required to communicate
                     * with dumb peers which send space padded UIDs and fail if they
                     * receive correct UIDs back.
                     *
                     * This test can only detect space padded strings if
                     * dcmEnableAutomaticInputDataCorrection is false; otherwise the padding
                     * has already been removed by dcmdata at this stage.
                     */
                    size_t s_len = strlen(s);
                    if ((s_len > 0)&&(s[s_len-1] == ' ')) *spacePadded = OFTrue; else *spacePadded = OFFalse;
                }
                DU_stripLeadingAndTrailingSpaces(s);
CVE-2020-26237 (JavaScript, published 2020-11-24T23:15Z)
Description: value: Highlight.js is a syntax highlighter written in JavaScript. Highlight.js versions before 9.18.2 and 10.1.2 are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting. If you allow users to insert custom HTML code blocks into your page/app via parsing Markdown code blocks (or similar) and do not filter the language names the user can provide you may be vulnerable. The pollution should just be harmless data but this can cause problems for applications not expecting these properties to exist and can result in strange behavior or application crashes, i.e. a potential DOS vector. If your website or application does not render user provided data it should be unaffected. Versions 9.18.2 and 10.1.2 and newer include fixes for this vulnerability. If you are using version 7 or 8 you are encouraged to upgrade to a newer release.
Severity: MEDIUM (CVSS v3 base score: 8.7)
Weakness: CWE-471 \u2014 Modification of Assumed-Immutable Data (MAID)
The product does not properly protect an assumed-immutable element from being modified by an attacker.
Repository: https://github.com/highlightjs/highlight.js
Files changed:
CHANGES.md
src/highlight.js
test/api/getLanguage.js
Commit message: (parser) use null prototype objects for languages/aliases (#2636)

Fix: Discord uses getLanguage to validate that a language specified exists in highlightJS and retrieve metadata about the language for code block highlighting in chat. Because highlightJS returns prototype values instead of the highlight languages themselves, the result is a few different bugs in our clients which expect the return type to be only `Language | undefined`.


Vulnerable code:
  var languages = {};
  var aliases = {};

Fixed code:
## Version 10.1.2

Fixes:

- fix(night) Prevent object prototype values from being returned by `getLanguage` (#2636) [night][]

[night]: https://github.com/night


  var languages = Object.create(null);
  var aliases = Object.create(null);

  it('should not succeed for constructor', () => {
    const result = hljs.getLanguage('constructor');

    should.strictEqual(result, undefined);
  });

  it('should not succeed for __proto__', () => {
    const result = hljs.getLanguage('__proto__');

    should.strictEqual(result, undefined);
  });
CVE-2021-36692 (Other, published 2021-08-30T21:15Z)
Description: value: libjxl v0.3.7 is affected by a Divide By Zero in issue in lib/extras/codec_apng.cc jxl::DecodeImageAPNG(). When encoding a malicous APNG file using cjxl, an attacker can trigger a denial of service.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/libjxl/libjxl
Files changed:
AUTHORS
lib/extras/codec_apng.cc
Commit message: Fix handling of APNG with 0 delay_den (#313)



Vulnerable code:

Fixed code:
Alexander Sago <cagelight@gmail.com>
          if (!delay_den) delay_den = 100;
CVE-2018-25060 (Go, published 2022-12-30T12:15Z)
Description: value: A vulnerability was found in Macaron csrf and classified as problematic. Affected by this issue is some unknown functionality of the file csrf.go. The manipulation of the argument Generate leads to sensitive cookie without secure attribute. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The patch is identified as dadd1711a617000b70e5e408a76531b73187031c. It is recommended to apply a patch to fix this issue. VDB-217058 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-311 \u2014 Missing Encryption of Sensitive Data
The product does not encrypt sensitive or critical information before storage or transmission.
Repository: https://github.com/go-macaron/csrf
Files changed:
csrf.go
Commit message: Support secure mode for csrf cookie (#7)

Options struct has Secure flag for csrf cookie, but it's just ignored
and corresponding argument of SetCookie() is hardcodded to false.

This pass Options.Secure to SetCookie in csrf.Generate()

Signed-off-by: Aleksandr Bulyshchenko <A.Bulyshchenko@globallogic.com>

Vulnerable code:
				ctx.SetCookie(opt.Cookie, x.Token, 0, opt.CookiePath, "", false, opt.CookieHttpOnly, time.Now().AddDate(0, 0, 1))

Fixed code:
				ctx.SetCookie(opt.Cookie, x.Token, 0, opt.CookiePath, "", opt.Secure, opt.CookieHttpOnly, time.Now().AddDate(0, 0, 1))
CVE-2020-28874 (PHP, published 2021-01-26T18:15Z)
Description: value: reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic. Errors are not properly considered (an invalid token parameter).
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/projectsend/projectsend
Files changed:
reset-password.php
Commit message: Fix CVE-2020-28874 by @varandinawer


Vulnerable code:

Fixed code:
    /** Fix CVE-2020-28874 */
    if (!empty($errorstate)) {
        unset($user_data);
    }