hitoshura25/cvefixes huggingface dataset:
CVE-2024-36114 (Java, published 2024-05-29T21:15Z)
Description: value: Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. All decompressor implementations of Aircompressor (LZ4, LZO, Snappy, Zstandard) can crash the JVM for certain input, and in some cases also leak the content of other memory of the Java process (which could contain sensitive information). When decompressing certain data, the decompressors try to access memory outside the bounds of the given byte arrays or byte buffers. Because Aircompressor uses the JDK class `sun.misc.Unsafe` to speed up memory access, no additional bounds checks are performed and this has similar security consequences as out-of-bounds access in C or C++, namely it can lead to non-deterministic behavior or crash the JVM. Users should update to Aircompressor 0.27 or newer where these issues have been fixed. When decompressing data from untrusted users, this can be exploited for a denial-of-service attack by crashing the JVM, or to leak other sensitive information from the Java process. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/airlift/aircompressor
Files changed:
src/main/java/io/airlift/compress/snappy/SnappyRawDecompressor.java
src/test/java/io/airlift/compress/snappy/TestSnappy.java
Commit message: Verify length is positive


Vulnerable code:

Fixed code:
        if (result < 0) {
            throw new MalformedInputException(compressedAddress, "negative compressed length");
        }

    @Test
    public void testNegativeLength()
    {
        byte[] data = {(byte) 255, (byte) 255, (byte) 255, (byte) 255, 0b0000_1000};

        assertThatThrownBy(() -> SnappyDecompressor.getUncompressedLength(data, 0))
                .isInstanceOf(MalformedInputException.class)
                .hasMessageStartingWith("negative compressed length");
    }
CVE-2024-36114 (Java, published 2024-05-29T21:15Z)
Description: value: Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. All decompressor implementations of Aircompressor (LZ4, LZO, Snappy, Zstandard) can crash the JVM for certain input, and in some cases also leak the content of other memory of the Java process (which could contain sensitive information). When decompressing certain data, the decompressors try to access memory outside the bounds of the given byte arrays or byte buffers. Because Aircompressor uses the JDK class `sun.misc.Unsafe` to speed up memory access, no additional bounds checks are performed and this has similar security consequences as out-of-bounds access in C or C++, namely it can lead to non-deterministic behavior or crash the JVM. Users should update to Aircompressor 0.27 or newer where these issues have been fixed. When decompressing data from untrusted users, this can be exploited for a denial-of-service attack by crashing the JVM, or to leak other sensitive information from the Java process. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/airlift/aircompressor
Files changed:
src/main/java/io/airlift/compress/zstd/ZstdFrameDecompressor.java
src/test/java/io/airlift/compress/zstd/TestZstd.java
Commit message: Fix bounds checks


Vulnerable code:
                        verify(inputAddress + blockSize <= inputLimit, input, "Not enough input bytes");
                        verify(inputAddress + 1 <= inputLimit, input, "Not enough input bytes");
                        verify(inputAddress + blockSize <= inputLimit, input, "Not enough input bytes");
                .hasMessageStartingWith("Input is corrupted");

Fixed code:
                        verify(input + blockSize <= inputLimit, input, "Not enough input bytes");
                        verify(input + 1 <= inputLimit, input, "Not enough input bytes");
                        verify(input + blockSize <= inputLimit, input, "Not enough input bytes");
                .hasMessageStartingWith("Not enough input bytes");
CVE-2024-36114 (Java, published 2024-05-29T21:15Z)
Description: value: Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. All decompressor implementations of Aircompressor (LZ4, LZO, Snappy, Zstandard) can crash the JVM for certain input, and in some cases also leak the content of other memory of the Java process (which could contain sensitive information). When decompressing certain data, the decompressors try to access memory outside the bounds of the given byte arrays or byte buffers. Because Aircompressor uses the JDK class `sun.misc.Unsafe` to speed up memory access, no additional bounds checks are performed and this has similar security consequences as out-of-bounds access in C or C++, namely it can lead to non-deterministic behavior or crash the JVM. Users should update to Aircompressor 0.27 or newer where these issues have been fixed. When decompressing data from untrusted users, this can be exploited for a denial-of-service attack by crashing the JVM, or to leak other sensitive information from the Java process. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/airlift/aircompressor
Files changed:
src/main/java/io/airlift/compress/lz4/Lz4RawDecompressor.java
src/main/java/io/airlift/compress/lzo/LzoRawDecompressor.java
src/main/java/io/airlift/compress/zstd/ZstdFrameDecompressor.java
Commit message: Add missing bounds checks


Vulnerable code:
                    if (literalOutputLimit > outputLimit) {
        output = copyLastLiteral(outputBase, literalsBase, literalsLimit, output, literalsInput);
    private static long copyLastLiteral(Object outputBase, Object literalsBase, long literalsLimit, long output, long literalsInput)

Fixed code:
                if (input >= inputLimit) {
                    throw new MalformedInputException(input - inputAddress);
                }
                    if (literalOutputLimit > outputLimit || input + literalLength > inputLimit) {
                verify(input + SIZE_OF_INT <= inputLimit, input, "Not enough input bytes");
        output = copyLastLiteral(input, literalsBase, literalsInput, literalsLimit, outputBase, output, outputLimit);
    private static long copyLastLiteral(long input, Object literalsBase, long literalsInput, long literalsLimit, Object outputBase, long output, long outputLimit)
        verify(output + lastLiteralsSize <= outputLimit, input, "Output buffer too small");
CVE-2020-4070 (Java, published 2020-06-22T16:15Z)
Description: value: In CSS Validator less than or equal to commit 54d68a1, there is a cross-site scripting vulnerability in handling URIs. A user would have to click on a specifically crafted validator link to trigger it. This has been patched in commit e5c09a9.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/w3c/css-validator
Files changed:
org/w3c/css/css/StyleSheetParser.java
Commit message: escape also the throwable message, see #278


Vulnerable code:
                    -1, e));

Fixed code:
                    -1, new Exception(Messages.escapeString(e.getMessage()))));
CVE-2022-39200 (Go, published 2022-09-12T20:15Z)
Description: value: Dendrite is a Matrix homeserver written in Go. In affected versions events retrieved from a remote homeserver using the `/get_missing_events` path did not have their signatures verified correctly. This could potentially allow a remote homeserver to provide invalid/modified events to Dendrite via this endpoint. Note that this does not apply to events retrieved through other endpoints (e.g. `/event`, `/state`) as they have been correctly verified. Homeservers that have federation disabled are not vulnerable. The problem has been fixed in Dendrite 0.9.8. Users are advised to upgrade. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/matrix-org/dendrite
Files changed:
roomserver/internal/input/input_missing.go
Commit message: Fix missing signature check on the `/get_missing_events` response


Vulnerable code:
	logger.Debugf("get_missing_events returned %d events", len(missingResp.Events))

Fixed code:
		if err = ev.VerifyEventSignatures(ctx, t.keys); err != nil {
			continue
		}
	logger.Debugf("get_missing_events returned %d events (%d passed signature checks)", len(missingResp.Events), len(missingEvents))
CVE-2020-36567 (Go, published 2022-12-27T21:15Z)
Description: value: Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/gin-gonic/gin
Files changed:
logger.go
logger_test.go
Commit message: removing log injection (#2277)

Co-authored-by: thinkerou <thinkerou@gmail.com>

Vulnerable code:
	return fmt.Sprintf("[GIN] %v |%s %3d %s| %13v | %15s |%s %-7s %s %s\n%s",
		return fmt.Sprintf("[FORMATTER TEST] %v | %3d | %13v | %15s | %-7s %s\n%s",
	assert.Equal(t, "[GIN] 2018/12/07 - 09:11:42 | 200 |            5s |     20.20.20.20 | GET      /\n", defaultLogFormatter(termFalseParam))
	assert.Equal(t, "[GIN] 2018/12/07 - 09:11:42 | 200 |    2743h29m3s |     20.20.20.20 | GET      /\n", defaultLogFormatter(termFalseLongDurationParam))
	assert.Equal(t, "[GIN] 2018/12/07 - 09:11:42 |\x1b[97;42m 200 \x1b[0m|            5s |     20.20.20.20 |\x1b[97;44m GET     \x1b[0m /\n", defaultLogFormatter(termTrueParam))
	assert.Equal(t, "[GIN] 2018/12/07 - 09:11:42 |\x1b[97;42m 200 \x1b[0m|    2743h29m3s |     20.20.20.20 |\x1b[97;44m GET     \x1b[0m /\n", defaultLogFormatter(termTrueLongDurationParam))

Fixed code:
	return fmt.Sprintf("[GIN] %v |%s %3d %s| %13v | %15s |%s %-7s %s %#v\n%s",
		return fmt.Sprintf("[FORMATTER TEST] %v | %3d | %13v | %15s | %-7s %#v\n%s",
	assert.Equal(t, "[GIN] 2018/12/07 - 09:11:42 | 200 |            5s |     20.20.20.20 | GET      \"/\"\n", defaultLogFormatter(termFalseParam))
	assert.Equal(t, "[GIN] 2018/12/07 - 09:11:42 | 200 |    2743h29m3s |     20.20.20.20 | GET      \"/\"\n", defaultLogFormatter(termFalseLongDurationParam))
	assert.Equal(t, "[GIN] 2018/12/07 - 09:11:42 |\x1b[97;42m 200 \x1b[0m|            5s |     20.20.20.20 |\x1b[97;44m GET     \x1b[0m \"/\"\n", defaultLogFormatter(termTrueParam))
	assert.Equal(t, "[GIN] 2018/12/07 - 09:11:42 |\x1b[97;42m 200 \x1b[0m|    2743h29m3s |     20.20.20.20 |\x1b[97;44m GET     \x1b[0m \"/\"\n", defaultLogFormatter(termTrueLongDurationParam))
CVE-2023-37471 (Java, published 2023-07-20T17:15Z)
Description: value: Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security. OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-On process. Attackers can use this fact to impersonate any OpenAM user, including the administrator, by sending a specially crafted SAML response to the SAMLPOSTProfileServlet servlet. This problem has been patched in  OpenAM 14.7.3-SNAPSHOT and later. User unable to upgrade should comment servlet `SAMLPOSTProfileServlet` from their pom file. See the linked GHSA for details.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/OpenIdentityPlatform/OpenAM
Files changed:
openam-federation/openam-federation-library/src/main/java/com/sun/identity/saml/common/SAMLUtils.java
Commit message: GHSL-2023-143, GHSL-2023-144, deny unsigned SAML response (#624)



Vulnerable code:
        if (samlResponse.isSigned()) {
            // verify the signature
            boolean isSignedandValid = verifySignature(samlResponse);
            if (!isSignedandValid) {
                throw new SAMLException(bundle.getString("invalidResponse"));
            }

Fixed code:
        if(!response.isSigned()) {
            debug.message("verifyResponse: Response is not signed");
            return false;
        }

        // verify the signature
        boolean isSignedandValid = verifySignature(samlResponse);
        if (!isSignedandValid) {
            throw new SAMLException(bundle.getString("invalidResponse"));
CVE-2023-0341 (C, published 2023-02-01T00:15Z)
Description: value: A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/editorconfig/editorconfig-core-c
Files changed:
src/lib/ec_glob.c
Commit message: Fix potential buffer overflow in ec_glob (#87)

CVE-2023-0341

Co-authored-by: David Fernandez Gonzalez <david.fernandezgonzalez@canonical.com>

Vulnerable code:
                *(p_pcre ++) = *(c++);
                *(p_pcre ++) = *c;
                *(p_pcre ++) = '[';
            *(p_pcre ++) = *c;
                *(p_pcre ++) = *c;
            *(p_pcre ++) = ')';
                *(p_pcre ++) = '|';
                *(p_pcre ++) = '\\';
            *(p_pcre ++) = *c;

Fixed code:
/* safely add a char to a string then move the pointer to the end */
#define ADD_CHAR(string, new_chr, end)  do {    \
    if (string + 1 >= end) \
        return -1; \
    *(string ++) = new_chr; \
} while(0)

                ADD_CHAR(p_pcre, *(c++), pcre_str_end);
                ADD_CHAR(p_pcre, *c, pcre_str_end);
                STRING_CAT(p_pcre, "[", pcre_str_end);
            ADD_CHAR(p_pcre, *c, pcre_str_end);
                ADD_CHAR(p_pcre, *c, pcre_str_end);
            STRING_CAT(p_pcre, ")", pcre_str_end);
                STRING_CAT(p_pcre, "|", pcre_str_end);
                STRING_CAT(p_pcre, "\\", pcre_str_end);
            ADD_CHAR(p_pcre, *c, pcre_str_end);
CVE-2020-35846 (PHP, published 2020-12-30T01:15Z)
Description: value: Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/agentejo/cockpit
Files changed:
lib/MongoLite/Database.php
Commit message: remove $fn, $func, $f as field filter ... add $where as an alternative (MongoLite)


Vulnerable code:
                    if (\is_callable($value)) {

                        // need implementation
            case '$func' :
            case '$fn' :
            case '$f' :
                if (\is_string($b) || !\is_callable($b))
                    throw new \InvalidArgumentException('Function should be callable');
                $r = $b($a);
                break;


Fixed code:
    protected static $closures = [];

    public static function closureCall($uid, $doc) {
        return call_user_func_array(self::$closures[$uid], [$doc]);
    }

                    if (\is_string($value) || !\is_callable($value)) {
                        throw new \InvalidArgumentException($key.' Function should be callable');
                    $uid = \uniqid('mongoliteCallable').bin2hex(random_bytes(5));

                    self::$closures[$uid] = $value;

                    $fn[] = '\\MongoLite\\UtilArrayQuery::closureCall("'.$uid.'", $document)';
CVE-2020-35846 (PHP, published 2020-12-30T01:15Z)
Description: value: Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/agentejo/cockpit
Files changed:
lib/MongoLite/Database.php
Commit message: don't allow callable strings for $func (MongoLite)


Vulnerable code:
                if (! \is_callable($b))

Fixed code:
                if (\is_string($b) || !\is_callable($b))
CVE-2020-35846 (PHP, published 2020-12-30T01:15Z)
Description: value: Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/agentejo/cockpit
Files changed:
modules/Cockpit/Controller/Auth.php
Commit message: fix possible security issue for login


Vulnerable code:
            $user['md5email'] = md5($user['email']);

Fixed code:
            if (!\is_string($data['user']) || !\is_string($data['password'])) {
                return ['success' => false, 'error' => 'Pre-condition failed'];
            }

            if (!\is_string($token)) {
                return false;
            }

            $user = [
                'md5email' => md5($user['email']),
                'user' => $user['name'],
                'name' => $user['user'],
            ];
            if (!\is_string($token)) {
                return false;
            }
CVE-2020-35847 (PHP, published 2020-12-30T01:15Z)
Description: value: Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/agentejo/cockpit
Files changed:
lib/MongoLite/Database.php
Commit message: remove $fn, $func, $f as field filter ... add $where as an alternative (MongoLite)


Vulnerable code:
                    if (\is_callable($value)) {

                        // need implementation
            case '$func' :
            case '$fn' :
            case '$f' :
                if (\is_string($b) || !\is_callable($b))
                    throw new \InvalidArgumentException('Function should be callable');
                $r = $b($a);
                break;


Fixed code:
    protected static $closures = [];

    public static function closureCall($uid, $doc) {
        return call_user_func_array(self::$closures[$uid], [$doc]);
    }

                    if (\is_string($value) || !\is_callable($value)) {
                        throw new \InvalidArgumentException($key.' Function should be callable');
                    $uid = \uniqid('mongoliteCallable').bin2hex(random_bytes(5));

                    self::$closures[$uid] = $value;

                    $fn[] = '\\MongoLite\\UtilArrayQuery::closureCall("'.$uid.'", $document)';
CVE-2020-35847 (PHP, published 2020-12-30T01:15Z)
Description: value: Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/agentejo/cockpit
Files changed:
lib/MongoLite/Database.php
Commit message: don't allow callable strings for $func (MongoLite)


Vulnerable code:
                if (! \is_callable($b))

Fixed code:
                if (\is_string($b) || !\is_callable($b))