hitoshura25/cvefixes huggingface dataset:
CVE-2023-43804 (Python, published 2023-10-04T17:15Z)
Description: value: urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/urllib3/urllib3
Files changed:
CHANGES.rst
docs/user-guide.rst
src/urllib3/util/retry.py
test/test_retry.py
test/with_dummyserver/test_poolmanager.py
Commit message: Merge pull request from GHSA-v845-jxx5-vc9f



Vulnerable code:
    DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset(["Authorization"])
        assert list(retry.remove_headers_on_redirect) == ["authorization"]
        assert list(retry.remove_headers_on_redirect) == ["x-api-secret"]
                headers={"Authorization": "foo"},
                headers={"authorization": "foo"},
                headers={"Authorization": "foo"},
                headers={"X-API-Secret": "foo", "Authorization": "bar"},
            headers = {"x-api-secret": "foo", "authorization": "bar"}
            assert headers == {"x-api-secret": "foo", "authorization": "bar"}

Fixed code:
2.0.6 (2023-10-02)
==================

* Added the ``Cookie`` header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via ``Retry.remove_headers_on_redirect``.

Note that the ``Cookie`` header will be stripped if the server redirects to a
different host.

    DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset(["Cookie", "Authorization"])
        assert retry.remove_headers_on_redirect == {"authorization", "cookie"}
        assert retry.remove_headers_on_redirect == {"x-api-secret"}
                headers={"Authorization": "foo", "Cookie": "foo=bar"},
            assert "Cookie" not in data
                headers={"authorization": "foo", "cookie": "foo=bar"},
            assert "cookie" not in data
            assert "Cookie" not in data
                headers={"Authorization": "foo", "Cookie": "foo=bar"},
            assert data["Cookie"] == "foo=bar"
                headers={
                    "X-API-Secret": "foo",
                    "Authorization": "bar",
                    "Cookie": "foo=bar",
                },
            assert data["Cookie"] == "foo=bar"
            headers = {
                "x-api-secret": "foo",
                "authorization": "bar",
                "cookie": "foo=bar",
            }
            assert data["Cookie"] == "foo=bar"
            assert headers == {
                "x-api-secret": "foo",
                "authorization": "bar",
                "cookie": "foo=bar",
            }
CVE-2020-14213 (Ruby, published 2020-06-16T23:15Z)
Description: value: In Zammad before 3.3.1, a Customer has ticket access that should only be available to an Agent (e.g., read internal data, split, or merge).
Severity: MEDIUM (CVSS v3 base score: 5.4)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/zammad/zammad
Files changed:
app/controllers/tickets_controller.rb
app/policies/controllers/tickets_controller_policy.rb
spec/requests/ticket_spec.rb
Commit message: Enhancement: Added authorization checks for ticket controller actions: ticket_customer ticket_history ticket_related ticket_recent ticket_merge ticket_split.


Vulnerable code:
  prepend_before_action -> { authorize! }, only: %i[create selector import_example import_start]
        include_examples 'has access'

Fixed code:
  prepend_before_action -> { authorize! }, only: %i[create selector import_example import_start ticket_customer ticket_history ticket_related ticket_recent ticket_merge ticket_split]
  permit! %i[ticket_customer ticket_history ticket_related ticket_recent ticket_merge ticket_split], to: 'ticket.agent'
      authenticated_as(customer_user)
      get "/api/v1/ticket_split?ticket_id=#{ticket.id}&article_id=#{article.id}&form_id=new_form_id123", params: {}, as: :json
      expect(response).to have_http_status(:unauthorized)

      authenticated_as(customer_user)
      get "/api/v1/ticket_merge/#{ticket2.id}/#{ticket1.id}", params: {}, as: :json
      expect(response).to have_http_status(:unauthorized)


      authenticated_as(customer_user)
      get "/api/v1/ticket_history/#{ticket1.id}", params: {}, as: :json
      expect(response).to have_http_status(:unauthorized)
    end

    it 'does ticket related' do
      ticket1 = create(
        :ticket,
        title:       'some title',
        group:       ticket_group,
        customer_id: customer_user.id,
      )

      authenticated_as(agent_user)
      get "/api/v1/ticket_related/#{ticket1.id}", params: {}, as: :json
      expect(response).to have_http_status(:ok)

      authenticated_as(customer_user)
      get "/api/v1/ticket_related/#{ticket1.id}", params: {}, as: :json
      expect(response).to have_http_status(:unauthorized)
    end

    it 'does ticket recent' do
      authenticated_as(agent_user)
      get '/api/v1/ticket_recent', params: {}, as: :json
      expect(response).to have_http_status(:ok)

      authenticated_as(customer_user)
      get '/api/v1/ticket_recent', params: {}, as: :json
      expect(response).to have_http_status(:unauthorized)

        include_examples 'has no access'
CVE-2020-29158 (Ruby, published 2020-12-28T08:15Z)
Description: value: An issue was discovered in Zammad before 3.5.1. An Agent with Customer permissions in a Group can bypass intended access control on internal Articles via the Ticket detail view.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/zammad/zammad
Files changed:
app/policies/ticket/article_policy.rb
app/policies/ticket_policy.rb
spec/factories/role.rb
spec/policies/ticket/article_policy_spec.rb
Commit message: Maintenance: Improved article view for agent customer.


Vulnerable code:
    return false if record.internal == true && !user.permissions?('ticket.agent')


Fixed code:
    return false if record.internal == true && !TicketPolicy.new(user, ticket).agent_read_access?

  def agent_read_access?
    agent_access?('read')
  end

    trait :customer do
      permissions { Permission.where(name: 'ticket.customer') }
    end

    context 'when agent and customer but no agent group access' do
      let(:user) do
        customer_role = create(:role, :customer)
        create(:agent_and_customer, roles: [customer_role])
      end

      it { is_expected.not_to permit_actions(%i[show]) }
    end
CVE-2020-29160 (Ruby, published 2020-12-28T08:15Z)
Description: value: An issue was discovered in Zammad before 3.5.1. A REST API call allows an attacker to change Ticket Article data in a way that defeats auditing.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/zammad/zammad
Files changed:
app/controllers/ticket_articles_controller.rb
spec/requests/ticket/article_spec.rb
spec/requests/ticket_spec.rb
Commit message: Maintenance: Sync Article REST API capabilities with the ones of the frontend.


Vulnerable code:
    clean_params = Ticket::Article.association_name_to_id_convert(params)
    clean_params = Ticket::Article.param_cleanup(clean_params, true)

    # only apply preferences changes (keep not updated keys/values)
    clean_params = article.param_preferences_merge(clean_params)
      expect(json_response['body']).to eq('some body 2')
      expect(json_response['preferences']['some_key2']).to eq('abc')
      expect(json_response['subject']).to eq('new subject')
      expect(json_response['subject']).to eq('new subject')

Fixed code:
    # only update internal and highlight info
    clean_params = {}
    if !params[:internal].nil?
      clean_params[:internal] = params[:internal]
    end
    if params.dig(:preferences, :highlight).present?
      clean_params = article.param_preferences_merge(clean_params.merge(
                                                       preferences: {
                                                         highlight: params[:preferences][:highlight].to_s
                                                       }
                                                     ))
    end
        internal:     false,
          highlight: '123',
      expect(json_response['internal']).to eq(false)
      expect(json_response['preferences']['highlight']).to eq('123')
        internal:    true,
          highlight: '234',
      expect(json_response['body']).not_to eq('some body 2')
      expect(json_response['internal']).to eq(true)
      expect(json_response['preferences']['some_key2']).not_to eq('abc')
      expect(json_response['preferences']['highlight']).to eq('234')
      expect(json_response['subject']).not_to eq('new subject')
      expect(json_response['subject']).not_to eq('new subject')
CVE-2021-25915 (JavaScript, published 2021-03-09T15:15Z)
Description: value: Prototype pollution vulnerability in 'changeset' versions 0.0.1 through 0.2.5 allows an attacker to cause a denial of service and may lead to remote code execution.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/eugeneware/changeset
Files changed:
index.js
test/index.js
Commit message: Fix against prototype pollution


Vulnerable code:
            if (i < len - 1) {
            } else {
              } else {

Fixed code:
            if (i < len - 1 && ptr.hasOwnProperty(prop)) {
            } else if (prop !== '__proto__') {
              } else if (ptr.hasOwnProperty(prop)) {

  it('should not allow prototype pollution', function(done) {
    var changeset = [
      { type: 'put', key: ['__proto__','polluted'], value: 'Yes! Its Polluted'}
    ];
    diff.apply(changeset, {}, true);
    expect({}.polluted).to.not.equal('Yes! Its Polluted');
    done();
  })
CVE-2021-42341 (C, published 2021-10-14T05:15Z)
Description: value: checkpath in OpenRC before 0.44.7 uses the direct output of strlen() to allocate strings, which does not account for the '\0' byte at the end of the string. This results in memory corruption. CVE-2021-42341 was introduced in git commit 63db2d99e730547339d1bdd28e8437999c380cae, which was introduced as part of OpenRC 0.44.0 development.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/OpenRC/openrc
Files changed:
src/rc/checkpath.c
Commit message: checkpath: fix allocation size of path buffer

strlen's return value isn't enough to be used
directly for (x)malloc; it doesn't include
the null byte at the end of the string.

X-Gentoo-Bug: 816900
X-Gentoo-Bug-URL: https://bugs.gentoo.org/816900
Fixes: #459
Fixes: #462


Vulnerable code:
	str = xmalloc(strlen(path));

Fixed code:
	str = xmalloc(strlen(path) + 1);
CVE-2021-42341 (C, published 2021-10-14T05:15Z)
Description: value: checkpath in OpenRC before 0.44.7 uses the direct output of strlen() to allocate strings, which does not account for the '\0' byte at the end of the string. This results in memory corruption. CVE-2021-42341 was introduced in git commit 63db2d99e730547339d1bdd28e8437999c380cae, which was introduced as part of OpenRC 0.44.0 development.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/OpenRC/openrc
Files changed:
src/rc/checkpath.c
Commit message: checkpath: remove extra slashes from paths

This fixes #418.


Vulnerable code:
	path_dupe = xstrdup(path);
	ch = path_dupe;
			item = strtok(NULL, "/");
			components--;
	if (linkpath) {
		free(linkpath);
		linkpath = NULL;
	}
			exit(!is_writable(argv[optind]));
		if (do_check(argv[optind], uid, gid, mode, type, trunc, chowner,

Fixed code:
	ch = path;
	path_dupe = xstrdup(path);
		item = strtok(NULL, "/");
		components--;
	free(linkpath);
static char *clean_path(char *path)
{
	char *ch;
	char *ch2;
	char *str;
	str = xmalloc(strlen(path));
	ch = path;
	ch2 = str;
	while (true) {
		*ch2 = *ch;
		ch++;
		ch2++;
		if (!*(ch-1))
			break;
		while (*(ch - 1) == '/' && *ch == '/')
			ch++;
	}
	/* get rid of trailing / characters */
	while ((ch = strrchr(str, '/'))) {
		if (ch == str)
			break;
		if (!*(ch+1))
			*ch = 0;
		else
			break;
	}
	return str;
}

	char *path = NULL;
		path = clean_path(argv[optind]);
			exit(!is_writable(path));
		if (do_check(path, uid, gid, mode, type, trunc, chowner,
		free(path);
CVE-2021-32795 (C#, published 2021-07-26T20:15Z)
Description: value: ArchiSteamFarm is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. In versions prior to 4.3.1.0 a Denial of Service (aka DoS) vulnerability which allows attacker to remotely crash running ASF instance through sending a specifically-crafted Steam chat message exists. The user sending the message does not need to be authorized within the bot or ASF process. The attacker needs to know ASF's `CommandPrefix` in advance, but majority of ASF setups run with an unchanged default value. This attack does not allow attacker to gain any potentially-sensitive information, such as logins or passwords, does not allow to execute arbitrary commands and otherwise exploit the crash further. The issue is patched in ASF V4.3.1.0. The only workaround which guarantees complete protection is running all bots with `OnlineStatus` of `0` (Offline). In this setup, ASF is able to ignore even the specifically-crafted message without attempting to interpret it.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/JustArchiNET/ArchiSteamFarm
Files changed:
ArchiSteamFarm/Bot.cs
ArchiSteamFarm/Commands.cs
Commit message: Avoid crash on commandPrefix message + hardening


Vulnerable code:
				message = message.Substring(commandPrefix!.Length);
				message = message.Substring(commandPrefix!.Length);

Fixed code:
			if ((notification.chat_group_id == 0) || (notification.chat_id == 0) || (notification.steamid_sender == 0)) {
				ArchiLogger.LogNullError(nameof(notification.chat_group_id) + " || " + nameof(notification.chat_id) + " || " + nameof(notification.steamid_sender));

				return;
			}

			if (notification.steamid_friend == 0) {
				ArchiLogger.LogNullError(nameof(notification.steamid_friend));

				return;
			}

				if (message.Length == commandPrefix!.Length) {
					// If the message starts with command prefix and is of the same length as command prefix, then it's just empty command trigger, useless
					return;
				}

				message = message.Substring(commandPrefix.Length);
				if (message.Length == commandPrefix!.Length) {
					// If the message starts with command prefix and is of the same length as command prefix, then it's just empty command trigger, useless
					return;
				}

				message = message.Substring(commandPrefix.Length);
CVE-2021-43827 (JavaScript, published 2021-12-14T23:15Z)
Description: value: discourse-footnote is a library providing footnotes for posts in Discourse. ### Impact When posting an inline footnote wrapped in `<a>` tags (e.g. `<a>^[footnote]</a>`, the resulting rendered HTML would include a nested `<a>`, which is stripped by Nokogiri because it is not valid. This then caused a javascript error on topic pages because we were looking for an `<a>` element inside the footnote reference span and getting its ID, and because it did not exist we got a null reference error in javascript. Users are advised to update to version 0.2. As a workaround editing offending posts from the rails console or the database console for self-hosters, or disabling the plugin in the admin panel can mitigate this issue.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/discourse/discourse-footnote
Files changed:
assets/javascripts/initializers/inline-footnotes.js
assets/vendor/javascripts/markdown-it-footnote.js
plugin.rb
spec/pretty_text_spec.rb
Commit message: SECURITY: Fix malicious footnote causing clientside errors (#27)

Some malformed/malicious footnote markup could cause
clientside errors.

Vulnerable code:
    expandableFootnote.dataset.footnoteId = footnoteRef
      .querySelector("a")
      .id.replace("footnote-ref-", "");
# version: 0.1

Fixed code:
    const refLink = footnoteRef.querySelector("a");
    if (!refLink) {
      return;
    }

    expandableFootnote.dataset.footnoteId = refLink.id.replace(
      "footnote-ref-",
      ""
    );
      // Having a rendered footnote inside a link creates a nested link, which
      // is not valid HTML, so close the parent tag first before proceeding.
      const previousToken = state.tokens[state.tokens.length - 1];
      if (previousToken?.content.includes("<a")) {
        const linkCloseToken = state.push("html_inline", "", 0);
        linkCloseToken.content = "</a>";
        linkCloseToken.block = false;
      }

# version: 0.2
  it "supports inline footnotes wrapped in <a> elements by ending the elements early" do
    raw = <<~MD
      I have a point, see footnote. <a>^[the point]</a>

      <a>^[footnote]</a>
    MD

    post = create_post(raw: raw)
    post.reload

    html = <<~HTML
      <p>I have a point, see footnote. <a></a><sup class="footnote-ref"><a href="#footnote-#{post.id}-1" id="footnote-ref-#{post.id}-1">[1]</a></sup></p>
      <p><a></a><sup class="footnote-ref"><a href="#footnote-#{post.id}-2" id="footnote-ref-#{post.id}-2">[2]</a></sup></p>
      <hr class="footnotes-sep">

      <ol class="footnotes-list">
      <li id="footnote-#{post.id}-1" class="footnote-item">
      <p>the point <a href="#footnote-ref-#{post.id}-1" class="footnote-backref">↩︎</a></p>
      </li>
      <li id="footnote-#{post.id}-2" class="footnote-item">
      <p>footnote <a href="#footnote-ref-#{post.id}-2" class="footnote-backref">↩︎</a></p>
      </li>
      </ol>
    HTML

    expect(post.cooked.strip).to eq(html.strip)
  end
CVE-2020-36661 (Unknown, published 2023-02-12T21:15Z)
Description: value: A vulnerability was found in Kong lua-multipart 0.5.8-1. It has been declared as problematic. This vulnerability affects the function is_header of the file src/multipart.lua. The manipulation leads to inefficient regular expression complexity. Upgrading to version 0.5.9-1 is able to address this issue. The patch is identified as d632e5df43a2928fd537784a99a79dec288bf01b. It is recommended to upgrade the affected component. VDB-220642 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/Kong/lua-multipart
Files changed:
Commit message: Merge pull request #34 from Kong/fix/vulnerable-pattern

replace `is_header()` check pattern

Vulnerable code:

Fixed code:
CVE-2015-5302 (C, published 2015-12-07T18:59Z)
Description: value: libreport 2.0.7 before 2.6.3 only saves changes to the first file when editing a crash report, which allows remote attackers to obtain sensitive information via unspecified vectors related to the (1) backtrace, (2) cmdline, (3) environ, (4) open_fds, (5) maps, (6) smaps, (7) hostname, (8) remote, (9) ks.cfg, or (10) anaconda-tb file attachment included in a Red Hat Bugzilla bug report.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/abrt/libreport
Files changed:
src/gui-wizard-gtk/wizard.c
Commit message: wizard: fix save users changes after reviewing dump dir files

If the user reviewed the dump dir's files during reporting the crash, the
changes was thrown away and original data was passed to the bugzilla bug
report.

report-gtk saves the first text view buffer and then reloads data from the
reported problem directory, which causes that the changes made to those text
views are thrown away.

Function save_text_if_changed(), except of saving text, also reload the files
from dump dir and update gui state from the dump dir. The commit moves the
reloading and updating gui functions away from this function.

Related to rhbz#1270235

Signed-off-by: Matej Habrnal <mhabrnal@redhat.com>


Vulnerable code:
        problem_data_reload_from_dump_dir();
        update_gui_state_from_problem_data(/* don't update selected event */ 0);


Fixed code:
        {
            problem_data_reload_from_dump_dir();
            update_gui_state_from_problem_data(/* don't update selected event */ 0);
        }
    problem_data_reload_from_dump_dir();
    update_gui_state_from_problem_data(/* don't update selected event */ 0);
CVE-2024-37312 (PHP, published 2024-06-14T15:15Z)
Description: value: user_oidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventually getting access to data that is available to all registered users. It is recommended that the OpenID Connect user backend is upgraded to 3.0.0 (Nextcloud 20-23), 4.0.0 (Nexcloud 24) or 5.0.0 (Nextcloud 25-28).

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/nextcloud/user_oidc
Files changed:
lib/Controller/Id4meController.php
Commit message: prevent using ID4ME routes if ID4ME is disabled

Signed-off-by: Julien Veyssier <julien-nc@posteo.net>


Vulnerable code:

Fixed code:
use OCA\UserOIDC\Service\ID4MeService;
	/** @var ID4MeService */
	private $id4MeService;
		ID4MeService $id4MeService,
		$this->id4MeService = $id4MeService;
		if (!$this->id4MeService->getID4ME()) {
			$message = $this->l10n->t('ID4Me is disabled');
			return $this->build403TemplateResponse($message, Http::STATUS_FORBIDDEN, [], false);
		}

		if (!$this->id4MeService->getID4ME()) {
			$message = $this->l10n->t('ID4Me is disabled');
			return $this->build403TemplateResponse($message, Http::STATUS_FORBIDDEN, [], false);
		}

		if (!$this->id4MeService->getID4ME()) {
			$message = $this->l10n->t('ID4Me is disabled');
			return $this->build403TemplateResponse($message, Http::STATUS_FORBIDDEN, [], false);
		}