hitoshura25/cvefixes huggingface dataset:
CVE-2023-46853 (Other, published 2023-10-27T20:15Z)
Description: value: In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-193 \u2014 Off-by-one Error
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
Repository: https://github.com/memcached/memcached
Files changed:
proxy.h
proxy_request.c
t/proxy.t
Commit message: proxy: fix off-by-one if \r is missing

A bunch of the parser assumed we only had \r\n, but I didn't actually
have that strictness set. Some commands worked and some broke in subtle
ways when just "\n" was being submitted.

I'm not 100% confident in this change yet so I'm opening a PR to stage
it while I run some more thorough tests.


Vulnerable code:
    int len = pr->reqlen - 2;
    int remain = pr->reqlen - pr->parsed - 2;
    const char *end = pr->request + pr->reqlen - 2;
    const char *s = memchr(command, ' ', cmdlen-2);
        cl = cmdlen - 2;
    pr->parsed = cl + 1;
# Proxy is more strict than normal server in this case.
    like(<$p_sock>, qr/CLIENT_ERROR/, "proxy version cmd with just newline");

Fixed code:
    uint32_t endlen; // index to the start of \r\n or \n
    int len = pr->endlen;
    int remain = pr->endlen - pr->parsed;
    const char *end = pr->request + pr->endlen;
    // Commands can end with bare '\n's. Depressingly I intended to be strict
    // with a \r\n requirement but never did this and need backcompat.
    // In this case we _know_ \n is at cmdlen because we can't enter this
    // function otherwise.
    if (cm[cmdlen-2] == '\r') {
        pr->endlen = cmdlen - 2;
    } else {
        pr->endlen = cmdlen - 1;
    }

    const char *s = memchr(command, ' ', pr->endlen);
        cl = pr->endlen;
    pr->parsed = cl;
# Note a bug lead me to believe that the proxy was more strict, we accept any
# \n or \r\n terminated commands.
    like(<$p_sock>, qr/VERSION/, "proxy version cmd with just newline");
CVE-2021-41232 (Go, published 2021-11-02T18:15Z)
Description: value: Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in version 1.16.3. If users are unable to update they should disable the LDAP feature if in use.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/StevenWeathers/thunderdome-planning-poker
Files changed:
auth.go
Commit message: Fix LDAP vulnerability


Vulnerable code:
		fmt.Sprintf(viper.GetString("auth.ldap.filter"), UserName),

Fixed code:
		fmt.Sprintf(viper.GetString("auth.ldap.filter"), ldap.EscapeFilter(UserName)),
CVE-2021-41232 (Go, published 2021-11-02T18:15Z)
Description: value: Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in version 1.16.3. If users are unable to update they should disable the LDAP feature if in use.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/StevenWeathers/thunderdome-planning-poker
Files changed:
auth.go
Commit message: Fix LDAP vulnerability


Vulnerable code:
		fmt.Sprintf(viper.GetString("auth.ldap.filter"), UserName),

Fixed code:
		fmt.Sprintf(viper.GetString("auth.ldap.filter"), ldap.EscapeFilter(UserName)),
CVE-2013-7378 (Other, published 2020-02-12T14:15Z)
Description: value: scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/github/hubot-scripts
Files changed:
src/scripts/email.coffee
Commit message: Fix code execution issue in email command.


Vulnerable code:
exec = child_process.exec
    mailCommand = """echo '#{msg}' | mail -s '#{subject}' -r '#{from}' '#{recipients}'"""
    exec mailCommand, (error, stdout, stderr) ->
    sendEmail msg.match[1], msg.match[2], msg.match[3], msg.message.user.id

Fixed code:
    mailArgs = ['-s', subject, '-a', "From: #{from}", '--']
    mailArgs = mailArgs.concat recipients
    p = child_process.execFile 'mail', mailArgs, {}, (error, stdout, stderr) ->
    p.stdin.write "#{msg}\n"
    p.stdin.end()
    sendEmail msg.match[1].split(" "), msg.match[2], msg.match[3], msg.message.user.id
CVE-2020-15862 (C, published 2020-08-20T01:17Z)
Description: value: Net-SNMP through 5.8 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB provides the ability to run arbitrary commands as root.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/net-snmp/net-snmp
Files changed:
agent/mibgroup/agent/extend.c
Commit message: make the extend mib read-only by default


Vulnerable code:
#ifndef NETSNMP_NO_WRITE_SUPPORT
#endif /* !NETSNMP_NO_WRITE_SUPPORT */ 
#ifndef NETSNMP_NO_WRITE_SUPPORT
#endif /* !NETSNMP_NO_WRITE_SUPPORT */
#ifndef NETSNMP_NO_WRITE_SUPPORT
#endif /* !NETSNMP_NO_WRITE_SUPPORT */

Fixed code:
/*  This mib is potentially dangerous to turn on by default, since it
 *  allows arbitrary commands to be set by anyone with SNMP WRITE
 *  access to the MIB table.  If all of your users are "root" level
 *  users, then it may be safe to turn on. */
#define ENABLE_EXTEND_WRITE_ACCESS 0

#if !defined(NETSNMP_NO_WRITE_SUPPORT) && ENABLE_EXTEND_WRITE_ACCESS
#endif /* !NETSNMP_NO_WRITE_SUPPORT and ENABLE_EXTEND_WRITE_ACCESS */
#if !defined(NETSNMP_NO_WRITE_SUPPORT) && ENABLE_EXTEND_WRITE_ACCESS
#endif /* !NETSNMP_NO_WRITE_SUPPORT && ENABLE_EXTEND_WRITE_ACCESS */
#if !defined(NETSNMP_NO_WRITE_SUPPORT) && ENABLE_EXTEND_WRITE_ACCESS
#endif /* !NETSNMP_NO_WRITE_SUPPORT && ENABLE_EXTEND_WRITE_ACCESS */
CVE-2022-24805 (C, published 2024-04-16T20:15Z)
Description: value: net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a buffer overflow in the handling of the `INDEX` of             `NET-SNMP-VACM-MIB` can cause an out-of-bounds memory access. A user with read-only credentials can exploit the issue. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/net-snmp/net-snmp
Files changed:
agent/mibgroup/agent/nsLogging.c
agent/mibgroup/agent/nsVacmAccessTable.c
agent/mibgroup/mibII/vacm_vars.c
agent/mibgroup/snmpv3/usmUser.c
Commit message: CHANGES: snmpd: fix bounds checking in NET-SNMP-AGENT-MIB, NET-SNMP-VACM-MIB, SNMP-VIEW-BASED-ACM-MIB, SNMP-USER-BASED-SM-MIB

Reported by: Yu Zhang of VARAS@IIE, Nanyu Zhong of VARAS@IIE
Fixes by: Arista Networks


Vulnerable code:
                         entry->storageType = ST_NONVOLATILE;
                         netsnmp_insert_iterator_context(request, (void*)entry);
                    SNMP_FREE(engineID);
                    SNMP_FREE(newName);

Fixed code:
            if (!table_info || !table_info->indexes)
                continue;
            if (!table_info || !table_info->indexes)
                continue;
            if (!table_info || !table_info->indexes)
                continue;
            if (!table_info || !table_info->indexes)
                continue;
            if (idx->val_len >= sizeof(atype))
                continue;
            if (!table_info || !table_info->indexes)
                continue;
                if (idx->val_len >= sizeof(atype))
                    continue;
                         if (entry) {
                             entry->storageType = ST_NONVOLATILE;
                             netsnmp_insert_iterator_context(request, (void*)entry);
                         }
            if (idx->val_len >= sizeof(atype))
                continue;
    if ((groupNameL + 1) > (int) oidLen) {
        return 1;
    }
CVE-2022-24807 (C, published 2024-04-16T20:15Z)
Description: value: net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a malformed OID in a SET request to `SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable` can cause an out-of-bounds memory access. A user with read-write credentials can exploit the issue. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/net-snmp/net-snmp
Files changed:
agent/mibgroup/agent/nsLogging.c
agent/mibgroup/agent/nsVacmAccessTable.c
agent/mibgroup/mibII/vacm_vars.c
agent/mibgroup/snmpv3/usmUser.c
Commit message: CHANGES: snmpd: fix bounds checking in NET-SNMP-AGENT-MIB, NET-SNMP-VACM-MIB, SNMP-VIEW-BASED-ACM-MIB, SNMP-USER-BASED-SM-MIB

Reported by: Yu Zhang of VARAS@IIE, Nanyu Zhong of VARAS@IIE
Fixes by: Arista Networks


Vulnerable code:
                         entry->storageType = ST_NONVOLATILE;
                         netsnmp_insert_iterator_context(request, (void*)entry);
                    SNMP_FREE(engineID);
                    SNMP_FREE(newName);

Fixed code:
            if (!table_info || !table_info->indexes)
                continue;
            if (!table_info || !table_info->indexes)
                continue;
            if (!table_info || !table_info->indexes)
                continue;
            if (!table_info || !table_info->indexes)
                continue;
            if (idx->val_len >= sizeof(atype))
                continue;
            if (!table_info || !table_info->indexes)
                continue;
                if (idx->val_len >= sizeof(atype))
                    continue;
                         if (entry) {
                             entry->storageType = ST_NONVOLATILE;
                             netsnmp_insert_iterator_context(request, (void*)entry);
                         }
            if (idx->val_len >= sizeof(atype))
                continue;
    if ((groupNameL + 1) > (int) oidLen) {
        return 1;
    }
CVE-2022-24808 (C, published 2024-04-16T20:15Z)
Description: value: net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can use a malformed OID in a `SET` request to `NET-SNMP-AGENT-MIB::nsLogTable` to cause a NULL pointer dereference. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/net-snmp/net-snmp
Files changed:
agent/mibgroup/agent/nsLogging.c
agent/mibgroup/agent/nsVacmAccessTable.c
agent/mibgroup/mibII/vacm_vars.c
agent/mibgroup/snmpv3/usmUser.c
Commit message: CHANGES: snmpd: fix bounds checking in NET-SNMP-AGENT-MIB, NET-SNMP-VACM-MIB, SNMP-VIEW-BASED-ACM-MIB, SNMP-USER-BASED-SM-MIB

Reported by: Yu Zhang of VARAS@IIE, Nanyu Zhong of VARAS@IIE
Fixes by: Arista Networks


Vulnerable code:
                         entry->storageType = ST_NONVOLATILE;
                         netsnmp_insert_iterator_context(request, (void*)entry);
                    SNMP_FREE(engineID);
                    SNMP_FREE(newName);

Fixed code:
            if (!table_info || !table_info->indexes)
                continue;
            if (!table_info || !table_info->indexes)
                continue;
            if (!table_info || !table_info->indexes)
                continue;
            if (!table_info || !table_info->indexes)
                continue;
            if (idx->val_len >= sizeof(atype))
                continue;
            if (!table_info || !table_info->indexes)
                continue;
                if (idx->val_len >= sizeof(atype))
                    continue;
                         if (entry) {
                             entry->storageType = ST_NONVOLATILE;
                             netsnmp_insert_iterator_context(request, (void*)entry);
                         }
            if (idx->val_len >= sizeof(atype))
                continue;
    if ((groupNameL + 1) > (int) oidLen) {
        return 1;
    }
CVE-2023-3153 (C, published 2023-10-04T12:15Z)
Description: value: A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit. This issue could allow an attacker to cause a denial of service, including on deployments with CoPP enabled and properly configured.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-770 \u2014 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
Repository: https://github.com/ovn-org/ovn
Files changed:
lib/copp.c
lib/copp.h
northd/northd.c
ovn-nb.xml
tests/ovn-northd.at
tests/system-ovn.at
Commit message: northd, controller: Add CoPP for SVC monitor

The SVC monitor was exposed without any limitation.
Add CoPP for the SVC monitor flow, which adds a way
for CMSs to limit the traffic that this flow accepts.

Signed-off-by: Ales Musil <amusil@redhat.com>


Vulnerable code:
        ovn_lflow_add(lflows, od, S_SWITCH_IN_L2_LKUP, 110,
                      "eth.dst == $svc_monitor_mac && (tcp || icmp || icmp6)",
                      "handle_svc_check(inport);");
ovn-nbctl: Invalid control protocol. Allowed values: arp, arp-resolve, dhcpv4-opts, dhcpv6-opts, dns, event-elb, icmp4-error, icmp6-error, igmp, nd-na, nd-ns, nd-ns-resolve, nd-ra-opts, tcp-reset, bfd, reject.
/.*terminating with signal 15.*/d"])

Fixed code:
    [COPP_SVC_MONITOR]   = "svc-monitor",
    COPP_SVC_MONITOR,
        ovn_lflow_metered(lflows, od, S_SWITCH_IN_L2_LKUP, 110, "eth.dst == "
                          "$svc_monitor_mac && (tcp || icmp || icmp6)",
                          "handle_svc_check(inport);",
                          copp_meter_get(COPP_SVC_MONITOR, od->nbs->copp,
                                         meter_groups));
    <column name="meters" key="svc-monitor">
      Rate limiting meter for packets that are arriving to service
      monitor MAC address.
    </column>
ovn-nbctl: Invalid control protocol. Allowed values: arp, arp-resolve, dhcpv4-opts, dhcpv6-opts, dns, event-elb, icmp4-error, icmp6-error, igmp, nd-na, nd-ns, nd-ns-resolve, nd-ra-opts, tcp-reset, bfd, reject, svc-monitor.
check ovn-nbctl set nb_global . options:svc_monitor_mac="33:33:33:33:33:33"
check ovn-nbctl meter-add svc-meter drop 1 pktps 0
check ovn-nbctl --wait=hv copp-add copp4 svc-monitor svc-meter
check ovn-nbctl --wait=hv ls-copp-add copp4 sw0
check ovn-appctl -t ovn-controller vlog/set vconn:dbg
AT_CHECK([ovn-nbctl copp-list copp4], [0], [dnl
svc-monitor: svc-meter
])

ip netns exec sw01 scapy -H <<-EOF
p = Ether(dst="33:33:33:33:33:33", src="f0:00:00:01:02:03") /\
    IP(dst="192.168.1.100", src="192.168.1.2") / TCP(dport=1234, sport=1234)
sendp(p, iface='sw01', loop=0, verbose=0, count=20)
EOF

OVS_WAIT_UNTIL([test "1" = "$(grep -c "dl_dst=33:33:33:33:33:33" ovn-controller.log)"])

/.*terminating with signal 15.*/d
/.*Service monitor not found/d"])
CVE-2020-5238 (Unknown, published 2020-07-01T23:15Z)
Description: value: The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse certain inputs. An attacker could craft a markdown table which would take an unreasonably long time to process, causing a denial of service. This issue does not affect the upstream cmark project. The issue has been fixed in version 0.29.0.gfm.1.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/github/cmark-gfm
Files changed:
Commit message: Merge pull request from GHSA-7gc6-9qr5-hc85

Fix pathological table parsing

Vulnerable code:

Fixed code:
CVE-2022-39209 (Unknown, published 2022-09-15T18:15Z)
Description: value: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. Users may verify the patch by running `python3 -c 'print("![l"* 100000 + "\n")' | ./cmark-gfm -e autolink`, which will resource exhaust on unpatched cmark-gfm but render correctly on patched cmark-gfm. This vulnerability has been patched in 0.29.0.gfm.6. Users are advised to upgrade. Users unable to upgrade should disable the use of the autolink extension.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-407 \u2014 Inefficient Algorithmic Complexity
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
Repository: https://github.com/github/cmark-gfm
Files changed:
Commit message: Merge pull request from GHSA-cgh3-p57x-9q7q

0.29.0.gfm.6

Vulnerable code:

Fixed code:
CVE-2023-24824 (Unknown, published 2023-03-31T23:15Z)
Description: value: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `>` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/github/cmark-gfm
Files changed:
Commit message: Merge pull request from GHSA-66g8-4hjf-77xh

Keep a count of the number of open blocks (WIP)

Vulnerable code:

Fixed code:
CVE-2023-24824 (Unknown, published 2023-03-31T23:15Z)
Description: value: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `>` or `-` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-407 \u2014 Inefficient Algorithmic Complexity
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
Repository: https://github.com/github/cmark-gfm
Files changed:
Commit message: Merge pull request from GHSA-66g8-4hjf-77xh

Keep a count of the number of open blocks (WIP)

Vulnerable code:

Fixed code:
CVE-2023-26485 (Unknown, published 2023-03-31T23:15Z)
Description: value: cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service. This CVE covers quadratic complexity issues when parsing text which leads with either large numbers of `_` characters. This issue has been addressed in version 0.29.0.gfm.10. Users are advised to upgrade. Users unable to upgrade should validate that their input comes from trusted sources.




### Impact

A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service.

### Proof of concept

```
$ ~/cmark-gfm$ python3 -c 'pad = "_" * 100000; print(pad + "." + pad, end="")' | time ./build/src/cmark-gfm --to plaintext
```

Increasing the number 10000 in the above commands causes the running time to increase quadratically.

### Patches

This vulnerability have been patched in 0.29.0.gfm.10.

### Note on cmark and cmark-gfm

XXX: TBD

[cmark-gfm](https://github.com/github/cmark-gfm) is a fork of [cmark](https://github.com/commonmark/cmark) that adds the GitHub Flavored Markdown extensions. The two codebases have diverged over time, but share a common core. These bugs affect both `cmark` and `cmark-gfm`. 

### Credit

We would like to thank @gravypod for reporting this vulnerability.

### References

https://en.wikipedia.org/wiki/Time_complexity

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [github/cmark-gfm](https://github.com/github/cmark-gfm)

Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/github/cmark-gfm
Files changed:
Commit message: Merge pull request from GHSA-r8vr-c48j-fcc5

Fix quadratic behavior in rendering

Vulnerable code:

Fixed code: