hitoshura25/cvefixes huggingface dataset:
CVE-2011-0469 (Other, published 2017-08-17T16:29Z)
Description: value: Code injection in openSUSE when running some source services used in the open build service 2.1 before March 11 2011.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/openSUSE/open-build-service
Files changed:
src/backend/bs_srcserver
Commit message: [backend] verify file names return by source service (do not allow files with new lines #679151)


Vulnerable code:

Fixed code:
      BSVerify::verify_filename($pfile);
CVE-2011-0469 (Shell, published 2017-08-17T16:29Z)
Description: value: Code injection in openSUSE when running some source services used in the open build service 2.1 before March 11 2011.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/openSUSE/open-build-service
Files changed:
src/backend/call-service-in-lxc.sh
Commit message: [backend] fix argument handling in lxc command execution


Vulnerable code:
MODE=""
WITH_NET=""
COMMAND=""
     COMMAND="$COMMAND \"${1/\"/_}\" "
     if [ -z "$MODE" ]; then
        case "$1" in
          */download_url|*/tar_scm|*/download_src_package|*/update_source|*/download_files)
            WITH_NET="1"
            ;;
        esac
     fi
echo -n "su $RUNUSER -c '" >> "$MOUNTDIR/$INNERSCRIPT"
echo "$COMMAND --outdir $INNEROUTDIR'" >> "$MOUNTDIR/$INNERSCRIPT"
chmod 0755 "$MOUNTDIR/$INNERSCRIPT"
LXC_CONF="/tmp/obs.service.$$"

Fixed code:
WITH_NET="0"
COMMAND="$1"
shift
case "$COMMAND" in
  */download_url|*/tar_scm|*/download_src_package|*/update_source|*/download_files)
    WITH_NET="1"
    ;;
esac
     COMMAND="$COMMAND '${1//\'/_}'"
echo -n "su $RUNUSER -s ${INNERSCRIPT}.command" >> "$MOUNTDIR/$INNERSCRIPT"
echo "#!/bin/bash"               >  "$MOUNTDIR/${INNERSCRIPT}.command"
echo "${COMMAND[@]} --outdir $OUTDIR" >> "$MOUNTDIR/${INNERSCRIPT}.command"
chmod 0755 "$MOUNTDIR/$INNERSCRIPT" "$MOUNTDIR/${INNERSCRIPT}.command"
LXC_CONF="/obs.service.$$"
CVE-2011-3178 (Ruby, published 2018-03-20T18:29Z)
Description: value: In the web ui of the openbuildservice before 2.3.0 a code injection of the project rebuildtimes statistics could be used by authorized attackers to execute shellcode.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/openSUSE/open-build-service
Files changed:
src/webui/app/controllers/project_controller.rb
Commit message: [webui] check the value of the scheduler parameter


Vulnerable code:
    cmd="perl ./mkdiststats '--srcdir=#{indir}' '--destdir=#{outdir}' --outfmt=xml #{@project.name}/#{@repository}/#{@arch} --width=910 --buildhosts=#{@hosts} --scheduler=#{@scheduler}"
    logger.debug "cd #{RAILS_ROOT}/vendor/diststats && #{cmd}"
    system("cd #{RAILS_ROOT}/vendor/diststats && #{cmd}")

Fixed code:
    unless ["fifo", "lifo", "random", "btime", "needed", "neededb", "longest_data", "longested_triedread", "longest"].include? @scheduler
      flash[:error] = "Invalid scheduler type, check mkdiststats docu - aehm, source"
      redirect_to :action => :show, :project => @project
      return
    end
    logger.debug "cd #{RAILS_ROOT}/vendor/diststats && perl ./mkdiststats --srcdir=#{indir} --destdir=#{outdir} 
             --outfmt=xml #{@project.name}/#{@repository}/#{@arch} --width=910
             --buildhosts=#{@hosts} --scheduler=#{@scheduler}"
    fork do
      Dir.chdir("#{RAILS_ROOT}/vendor/diststats")
      system("perl", "./mkdiststats", "--srcdir=#{indir}", "--destdir=#{outdir}", 
             "--outfmt=xml", "#{@project.name}/#{@repository}/#{@arch}", "--width=910",
             "--buildhosts=#{@hosts}", "--scheduler=#{@scheduler}")
    end
    Process.wait
CVE-2011-4181 (Ruby, published 2018-06-11T15:29Z)
Description: value: A vulnerability in open build service allows remote attackers to gain access to source files even though source access is disabled. Affected releases are SUSE open build service up to and including version 2.1.15 (for 2.1) and before version 2.3.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/openSUSE/open-build-service
Files changed:
src/api/app/controllers/build_controller.rb
src/api/test/functional/build_controller_test.rb
Commit message: [api] support binary package upload for the admin


Vulnerable code:
    valid_http_methods :get, :post, :put
    pass_to_backend 
  # /build/:prj/:repo/:arch/:pkg
  def package_index
    valid_http_methods :get
    required_parameters :project, :repository, :arch, :package

    # read access permission check
    if params[:package] == "_repository"
      prj = DbProject.get_by_name params[:project], use_source=false
    else
      pkg = DbPackage.get_by_project_and_name params[:project], params[:package], use_source=false
    end

    pass_to_backend
  end


Fixed code:
    valid_http_methods :get, :post
    if request.get?
      pass_to_backend 
      return
    end

    if @http_user.is_admin?
      # check for a local package instance
      DbPackage.get_by_project_and_name( params[:project], params[:package], follow_project_links=false )
      pass_to_backend
    else
      render_error :status => 403, :errorcode => "execute_cmd_no_permission",
        :message => "Upload of binaries is only permitted for administrators"
    end
  def test_upload_binaries
    ActionController::IntegrationTest::reset_auth
    post "/build/home:Iggy/10.2/i586/TestPack", nil
    assert_response 401

    prepare_request_with_user "adrian", "so_alone"
    post "/build/home:Iggy/10.2/i586/TestPack", nil
    assert_response 403

    prepare_request_with_user "king", "sunflower"
    post "/build/home:Iggy/10.2/i586/TestPack", nil
    assert_response 400 # actually a success, it reached the backend
    assert_tag :tag => "status", :attributes => { :code => "400", :origin => "backend" }

    # check not supported methods
    post "/build/home:Iggy/10.2/i586/_repository", nil
    assert_response 404
    assert_tag :tag => "status", :attributes => { :code => "unknown_package" }
    put "/build/home:Iggy/10.2/i586/TestPack", nil
    assert_response 400
    assert_tag :tag => "status", :attributes => { :code => "invalid_http_method" }
    delete "/build/home:Iggy/10.2/i586/TestPack"
    assert_response 400
    assert_tag :tag => "status", :attributes => { :code => "invalid_http_method" }
  end
CVE-2011-4183 (Ruby, published 2018-06-13T13:29Z)
Description: value: A vulnerability in open build service allows remote attackers to upload arbitrary RPM files. Affected releases are SUSE open build service prior to 2.1.16.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/openSUSE/open-build-service
Files changed:
src/api/app/controllers/build_controller.rb
src/api/test/functional/build_controller_test.rb
Commit message: [api] support binary package upload for the admin


Vulnerable code:
    valid_http_methods :get, :post, :put
    pass_to_backend 
  # /build/:prj/:repo/:arch/:pkg
  def package_index
    valid_http_methods :get
    required_parameters :project, :repository, :arch, :package

    # read access permission check
    if params[:package] == "_repository"
      prj = DbProject.get_by_name params[:project], use_source=false
    else
      pkg = DbPackage.get_by_project_and_name params[:project], params[:package], use_source=false
    end

    pass_to_backend
  end


Fixed code:
    valid_http_methods :get, :post
    if request.get?
      pass_to_backend 
      return
    end

    if @http_user.is_admin?
      # check for a local package instance
      DbPackage.get_by_project_and_name( params[:project], params[:package], follow_project_links=false )
      pass_to_backend
    else
      render_error :status => 403, :errorcode => "execute_cmd_no_permission",
        :message => "Upload of binaries is only permitted for administrators"
    end
  def test_upload_binaries
    ActionController::IntegrationTest::reset_auth
    post "/build/home:Iggy/10.2/i586/TestPack", nil
    assert_response 401

    prepare_request_with_user "adrian", "so_alone"
    post "/build/home:Iggy/10.2/i586/TestPack", nil
    assert_response 403

    prepare_request_with_user "king", "sunflower"
    post "/build/home:Iggy/10.2/i586/TestPack", nil
    assert_response 400 # actually a success, it reached the backend
    assert_tag :tag => "status", :attributes => { :code => "400", :origin => "backend" }

    # check not supported methods
    post "/build/home:Iggy/10.2/i586/_repository", nil
    assert_response 404
    assert_tag :tag => "status", :attributes => { :code => "unknown_package" }
    put "/build/home:Iggy/10.2/i586/TestPack", nil
    assert_response 400
    assert_tag :tag => "status", :attributes => { :code => "invalid_http_method" }
    delete "/build/home:Iggy/10.2/i586/TestPack"
    assert_response 400
    assert_tag :tag => "status", :attributes => { :code => "invalid_http_method" }
  end
CVE-2014-0594 (Ruby, published 2018-06-08T17:29Z)
Description: value: In the Open Build Service (OBS) before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/openSUSE/open-build-service
Files changed:
src/api/app/controllers/webui/webui_controller.rb
src/api/config/application.rb
Commit message: [webui] Reintroduce CSRF protection for the webui. AUA!


Vulnerable code:

Fixed code:
  protect_from_forgery

  # We execute both strategies here. The default rails strategy (resetting the session)
  # and throwing an exception if the session is handled elswhere (e.g. proxy_auth_mode: :on)
  def handle_unverified_request
    super
    raise ActionController::InvalidAuthenticityToken
  end

    config.action_dispatch.rescue_responses.merge!('ActionController::InvalidAuthenticityToken' => 403)
CVE-2015-0796 (Other, published 2018-03-02T20:29Z)
Description: value: In open buildservice 2.6 before 2.6.3, 2.5 before 2.5.7 and 2.4 before 2.4.8 the source service patch application could generate non-standard files like symlinks or device nodes, which could allow buildservice users to break of confinement or cause denial of service attacks on the source service.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/openSUSE/open-build-service
Files changed:
src/backend/bs_srcserver
Commit message: [backend] sanity check the result of the external patch command

Simple files only, please.


Vulnerable code:
    if ($?) {
      $failed = "could not apply patch '$pn'";
      last;

Fixed code:
    $failed = "could not apply patch '$pn'" if $?;
    # clean up patch fallout...
    for my $f (ls($tmpdir)) {
      my @s = lstat("$tmpdir/$f");
      die("$tmpdir/$f: $!\n") unless @s;
      if (-l _ || ! -f _) {
        unlink("$tmpdir/$f");
	$failed = "patch created a non-file";
	next;
      }
      eval {
	die("cannot create a link from a patch") if $f eq '_link';
	BSVerify::verify_filename($f) unless $f eq '.log';
      };
      if ($@) {
        unlink("$tmpdir/$f");
	$failed = "patch created an illegal file";
	next;
      }
      chmod(($s[2] & 077) | 0600, "$tmpdir/$f") if ($s[2] & 07700) != 0600;
    last if $failed;
CVE-2017-5188 (Perl, published 2018-03-01T20:29Z)
Description: value: The bs_worker code in open build service before 20170320 followed relative symlinks, allowing reading of files outside of the package source directory during build, allowing leakage of private information.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/openSUSE/open-build-service
Files changed:
src/backend/BSHTTP.pm
Commit message: [backend] only allow plain files in cpio_sender

No devices, sockets, directories, symlinks please...


Vulnerable code:
      } elsif (!open(F, '<', $filename)) {
	$errors->{'data'} .= "$file->{'name'}: $filename: $!\n";
	next;
	$errors->{'data'} .= "$file->{'name'}: stat: $!\n";

Fixed code:
      } else {
	@s = lstat($filename);
	if (!@s) {
	  $errors->{'data'} .= "$file->{'name'}: $filename: $!\n";
	  next;
	}
	if (-l _ || ! -f _) {
	  $errors->{'data'} .= "$file->{'name'}: $filename: not a plain file\n";
	  next;
	}
	if (!open(F, '<', $filename)) {
	  $errors->{'data'} .= "$file->{'name'}: $filename: $!\n";
	  next;
	}
	$errors->{'data'} .= "$file->{'name'}: fstat: $!\n";
CVE-2017-5188 (Perl, published 2018-03-01T20:29Z)
Description: value: The bs_worker code in open build service before 20170320 followed relative symlinks, allowing reading of files outside of the package source directory during build, allowing leakage of private information.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/openSUSE/open-build-service
Files changed:
src/backend/BSHTTP.pm
Commit message: [backend] only allow plain files in cpio_sender

No devices, sockets, directories, symlinks please...


Vulnerable code:
      } elsif (!open(F, '<', $filename)) {
	$errors->{'data'} .= "$file->{'name'}: $filename: $!\n";
	next;
	$errors->{'data'} .= "$file->{'name'}: stat: $!\n";

Fixed code:
      } else {
	@s = lstat($filename);
	if (!@s) {
	  $errors->{'data'} .= "$file->{'name'}: $filename: $!\n";
	  next;
	}
	if (-l _ || ! -f _) {
	  $errors->{'data'} .= "$file->{'name'}: $filename: not a plain file\n";
	  next;
	}
	if (!open(F, '<', $filename)) {
	  $errors->{'data'} .= "$file->{'name'}: $filename: $!\n";
	  next;
	}
	$errors->{'data'} .= "$file->{'name'}: fstat: $!\n";
CVE-2018-12466 (Ruby, published 2018-08-01T15:29Z)
Description: value: openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/openSUSE/open-build-service
Files changed:
src/api/app/models/bs_request_action_submit.rb
Commit message: Ignore a project link in BsRequestAction.check_action_permission!

This makes sure that we check the permissions of the correct package. For
instance, assume that the project "Staging" is a link project where the
link points to the "Base" project. Also, assume that there exists a
"Base/foo" package, but there exists no explicit "Staging/foo" package.
Moreover, assume we check the permissions for the following "submit"
action:

<action type="submit">
  <source project="Staging" package="foo"/>
  <target project="an_arbitrary_project" package="foo"/>
</action>

In this case, the old code checks if request acceptor can modify the
"Base/foo" package (since it follows the project link). This is wrong
because the "Staging/foo" package would be turned into a branch during
accept.
The new code checks the correct package because it does not follow the
project link and requires that the source package exists in the source
project. Requiring the existence of the source package potentially
breaks artificial requests (for instance, a request where the "submit"
action from above is preceded by a "submit" action that creates a
"Staging/foo" package).

Note: so far I was unable to exploit the old code - so this is just
to avoid a potential future headache.

Fixes: commit 990ef7ccc ("[api][webui] Check access to source package")


Vulnerable code:
    source_package = Package.get_by_project_and_name(source_project, self.source_package)
    return if !source_package || User.current.can_modify?(source_package)

Fixed code:
    opts = { follow_project_links: false }
    source_package = Package.get_by_project_and_name!(source_project,
                                                      self.source_package,
                                                      opts)
    return if User.current.can_modify?(source_package)
CVE-2018-12467 (Ruby, published 2018-08-01T15:29Z)
Description: value: Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage attribute, a similar issue to CVE-2018-7689.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/openSUSE/open-build-service
Files changed:
src/api/app/models/bs_request_action_submit.rb
Commit message: Ignore a project link in BsRequestAction.check_action_permission!

This makes sure that we check the permissions of the correct package. For
instance, assume that the project "Staging" is a link project where the
link points to the "Base" project. Also, assume that there exists a
"Base/foo" package, but there exists no explicit "Staging/foo" package.
Moreover, assume we check the permissions for the following "submit"
action:

<action type="submit">
  <source project="Staging" package="foo"/>
  <target project="an_arbitrary_project" package="foo"/>
</action>

In this case, the old code checks if request acceptor can modify the
"Base/foo" package (since it follows the project link). This is wrong
because the "Staging/foo" package would be turned into a branch during
accept.
The new code checks the correct package because it does not follow the
project link and requires that the source package exists in the source
project. Requiring the existence of the source package potentially
breaks artificial requests (for instance, a request where the "submit"
action from above is preceded by a "submit" action that creates a
"Staging/foo" package).

Note: so far I was unable to exploit the old code - so this is just
to avoid a potential future headache.

Fixes: commit 990ef7ccc ("[api][webui] Check access to source package")


Vulnerable code:
    source_package = Package.get_by_project_and_name(source_project, self.source_package)
    return if !source_package || User.current.can_modify?(source_package)

Fixed code:
    opts = { follow_project_links: false }
    source_package = Package.get_by_project_and_name!(source_project,
                                                      self.source_package,
                                                      opts)
    return if User.current.can_modify?(source_package)
CVE-2018-7688 (Ruby, published 2018-06-07T13:29Z)
Description: value: A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have write permissions.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/openSUSE/open-build-service
Files changed:
src/api/app/models/review.rb
src/api/spec/models/review_spec.rb
src/api/test/unit/bs_request_test.rb
Commit message: [api] Initialize review state with :new

to have the request review always in a sane state.

https://bugzilla.suse.com/show_bug.cgi?id=1094820

Signed-off-by: Christian Bruckmayer <cbruckmayer@suse.com>
Co-authored-by: Christian Bruckmayer <cbruckmayer@suse.com>


Vulnerable code:
    r.state = hash.delete('state') { raise ArgumentError, 'no state' }
    r.state = r.state.to_sym
    assert_equal xml, newxml

Fixed code:
    r.state = :new
    hash.delete('state')

  describe '.new_from_xml_hash' do
    let(:request_xml) do
      "<request>
        <review state='accepted' by_user='#{user}'/>
      </request>"
    end
    let(:request_hash) { Xmlhash.parse(request_xml) }
    let(:review_hash) { request_hash['review'] }

    subject { Review.new_from_xml_hash(review_hash) }

    it 'initalizes the review in state :new' do
      expect(subject.state).to eq(:new)
    end
  end
    expected = <<-XML.strip_heredoc
      <request id="1027" creator="Iggy">
        <action type="submit">
          <source project="home:Iggy" package="TestPack" rev="1"/>
          <target project="kde4" package="mypackage"/>
          <options>
            <sourceupdate>cleanup</sourceupdate>
          </options>
          <acceptinfo rev="1" srcmd5="806a6e27ed7915d1bb8d8a989404fd5a" osrcmd5="d41d8cd98f00b204e9800998ecf8427e"/>
        </action>
        <priority>critical</priority>
        <state name="review" who="Iggy" when="2012-11-07T21:13:12">
          <comment>No comment</comment>
        </state>
        <review state="new" when="2017-09-01T09:11:11" by_user="adrian"/>
        <review state="new" when="2017-09-01T09:11:11" by_group="test_group"/>
        <review state="new" when="2012-11-07T21:13:12" who="tom" by_user="tom">
          <comment>review1</comment>
        </review>
        <review state="new" when="2012-11-07T21:13:13" who="tom" by_user="tom">
          <comment>please accept</comment>
        </review>
        <description>Left blank</description>
      </request>
    XML
    assert_equal expected, newxml
CVE-2016-5104 (C, published 2016-06-13T14:59Z)
Description: value: The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass intended access restrictions and communicate with services on iOS devices by connecting to an IPv4 TCP socket.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/libimobiledevice/libimobiledevice
Files changed:
common/socket.c
Commit message: common: [security fix] Make sure sockets only listen locally


Vulnerable code:
	saddr.sin_addr.s_addr = htonl(INADDR_ANY);
	addr.sin_addr.s_addr = htonl(INADDR_ANY);

Fixed code:
	saddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
	addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);