hitoshura25/cvefixes huggingface dataset:
CVE-2023-25563 (C, published 2023-02-14T18:15Z)
Description: value: GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, multiple out-of-bounds reads when decoding NTLM fields can trigger a denial of service. A 32-bit integer overflow condition can lead to incorrect checks of consistency of length of internal buffers. Although most applications will error out before accepting a singe input buffer of 4GB in length this could theoretically happen. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point if the application allows tokens greater than 4GB in length. This can lead to a large, up to 65KB, out-of-bounds read which could cause a denial-of-service if it reads from unmapped memory. Version 1.2.0 contains a patch for the out-of-bounds reads.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gssapi/gss-ntlmssp
Files changed:
src/ntlm.c
Commit message: Out-of-bounds read in multiple decode functions

These were reported as:
- Out-of-bounds read in ntlm_decode_oem_str (GHSL-2023-019)
- Out-of-bounds read in ntlm_decode_u16l_str_hdr (GHSL-2023-020)
- Out-of-bounds read in ntlm_decode_field (GHSL-2023-021)

These are lall basically the same identical error replicated in 3
separate functions.

Fixes defects GHSL-2023-019, GHSL-2023-020, GHSL-2023-021 found by
the GitHub Security Lab team via oss-fuzz.

A 32-bit integer overflow condition can lead to incorrect checks of
consistency of length of internal buffers. This leads to a DoS
as the service may end up reading from unmapped memory and crashing.

Although most applications will error out before accepting a singe input
buffer of 4GB in lenght this could theoretically happen, and therefore
we fix it.

Fixes CVE-2023-25563

Signed-off-by: Simo Sorce <simo@redhat.com>


Vulnerable code:

Fixed code:
        (UINT32_MAX - str_offs < str_len) ||
        (UINT32_MAX - str_offs < str_len) ||
        (UINT32_MAX - offs < len) ||
CVE-2023-25564 (C, published 2023-02-14T18:15Z)
Description: value: GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, memory corruption can be triggered when decoding UTF16 strings. The variable `outlen` was not initialized and could cause writing a zero to an arbitrary place in memory if `ntlm_str_convert()` were to fail, which would leave `outlen` uninitialized. This can lead to a denial of service if the write hits unmapped memory or randomly corrupts a byte in the application memory space. This vulnerability can trigger an out-of-bounds write, leading to memory corruption. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point. This issue is fixed in version 1.2.0.
Severity: nan (CVSS v3 base score: 8.2)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gssapi/gss-ntlmssp
Files changed:
src/ntlm.c
Commit message: GHSL-2023-013: Memory corruption decoding UTF16

Memory corruption when decoding UTF16 strings (GHSL-2023-013)

Fixes defect GHSL-2023-013 found by the GitHub Security Lab team via
oss-fuzz.

The variable outlen was not initialized and could cause writing a zero
to an arbitrary place in memory if ntlm_str_convert() were to fail,
which would leave outlen uninitialized.

This can lead to a DoS if the write hits unmapped memory or randomly
corrupting a byte in the application memory space.

Make sure to zero out only if ntlm_str_convert() succeeds, but for good
measure also initialize outlen to 0.

Fixes CVE-2023-25564

Signed-off-by: Simo Sorce <simo@redhat.com>


Vulnerable code:
    size_t outlen;
    /* make sure to terminate output string */
    out[outlen] = '\0';


Fixed code:
    size_t outlen = 0;
    } else {
        /* make sure to terminate output string */
        out[outlen] = '\0';
CVE-2023-25565 (C, published 2023-02-14T18:15Z)
Description: value: GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The error condition incorrectly assumes the `cb` and `sh` buffers contain a copy of the data that needs to be freed. However, that is not the case. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point. This will likely trigger an assertion failure in `free`, causing a denial-of-service. This issue is fixed in version 1.2.0.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-763 \u2014 Release of Invalid Pointer or Reference
The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.
Repository: https://github.com/gssapi/gss-ntlmssp
Files changed:
src/ntlm.c
Commit message: GHSL-2023-012: Incorrect free when decoding target

Incorrect free when decoding target information (GHSL-2023-012)

Fixes defect GHSL-2023-012 found by the GitHub Security Lab team via
oss-fuzz.

The error condition incorrectly assumed the cb and sh buffers would
contain a copy of the data that needed to freed. However that is not the
case.

This will generally cause an assertion when trying to free a pointer
that was never allocated, and potentially memory corruption depending on
the contents fo the target_info buffer.

This may cause a DoS condition.

Signed-off-by: Simo Sorce <simo@redhat.com>


Vulnerable code:
        ntlm_free_buffer_data(&sh);
        ntlm_free_buffer_data(&cb);

Fixed code:
CVE-2023-25566 (C, published 2023-02-14T18:15Z)
Description: value: GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, a memory leak can be triggered when parsing usernames which can trigger a denial-of-service. The domain portion of a username may be overridden causing an allocated memory area the size of the domain name to be leaked. An attacker can leak memory via the main `gss_accept_sec_context` entry point, potentially causing a denial-of-service. This issue is fixed in version 1.2.0.


Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/gssapi/gss-ntlmssp
Files changed:
src/gss_names.c
Commit message: GHSL-2023-010: Memory leak when parsing usernames

Memory leak when parsing usernames (GHSL-2023-010)

Fixes defect GHSL-2023-010 found by the GitHub Security Lab team via
oss-fuzz.

The domain portion may be overridden causing an allocated memory area
the size of the domain name to be lost. This could be used to mount a
DoS by depleeting the server memory.

Signed-off-by: Simo Sorce <simo@redhat.com>


Vulnerable code:
        bool domain_handled = false;
            /* leading domain, copy if domain name is not empty */
            domain_handled = true;

                if (domain_handled) {
            } else if (!domain_handled) {

Fixed code:
                if (*domain) {
            } else if (!*domain) {
CVE-2023-25567 (C, published 2023-02-14T18:15Z)
Description: value: GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication, has an out-of-bounds read when decoding target information prior to version 1.2.0. The length of the `av_pair` is not checked properly for two of the elements which can trigger an out-of-bound read. The out-of-bounds read can be triggered via the main `gss_accept_sec_context` entry point and could cause a denial-of-service if the memory is unmapped. The issue is fixed in version 1.2.0.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/gssapi/gss-ntlmssp
Files changed:
src/ntlm.c
Commit message: GHSL-2023-011: Out-of-bounds read when decoding

Out-of-bounds read when decoding target information (GHSL-2023-011)

Fixes defect GHSL-2023-011 found by the GitHub Security Lab team via
oss-fuzz.

The lenght of the av_pair is not checked properly for two of the
elements. In case the lenght is shorter than requires this may cause an
out-of-bound read that either reads garbage or may cause a crash by
reading unmapped memory.

This can be exploited to crash the service causing a DoS.

Signed-off-by: Simo Sorce <simo@redhat.com>


Vulnerable code:

Fixed code:
            if (av_len < sizeof(timestamp)) {
                ret = ERR_DECODE;
                goto done;
            }
            if (av_len < sizeof(flags)) {
                ret = ERR_DECODE;
                goto done;
            }
CVE-2020-15272 (JavaScript, published 2020-10-26T19:15Z)
Description: value: In the git-tag-annotation-action (open source GitHub Action) before version 1.0.1, an attacker can execute arbitrary (*) shell commands if they can control the value of [the `tag` input] or manage to alter the value of [the `GITHUB_REF` environment variable]. The problem has been patched in version 1.0.1. If you don't use the `tag` input you are most likely safe. The `GITHUB_REF` environment variable is protected by the GitHub Actions environment so attacks from there should be impossible. If you must use the `tag` input and cannot upgrade to `> 1.0.0` make sure that the value is not controlled by another Action.
Severity: MEDIUM (CVSS v3 base score: 9.6)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/ericcornelissen/git-tag-annotation-action
Files changed:
CHANGELOG.md
action.yml
src/main.js
test/main.test.js
Commit message: Fix shell injection bug

Fix a shell injection bug where an attacker controlling the "tag" value
in the code (i.e. the value of `process.env.GITHUB_REF` or of the
`with: tag` input value) can run arbitrary (*) shell commands.

Also, update the Action's branding, changing the Action icon from
"git-commit" to "tag".

(*): provided it is within the limits of the GitHub Actions environment


Vulnerable code:
  icon: 'git-commit'
    exec(`git for-each-ref --format='%(contents)' ${tag}`, (err, stdout) => {
      if (err) {
        core.setFailed(err);
      } else {
        core.setOutput('git-tag-annotation', stdout);
      }
    });
    `git for-each-ref --format='%(contents)' refs/tags/${tag}`,
    `git for-each-ref --format='%(contents)' refs/tags/${tag}`,

Fixed code:
## [1.0.1] - 2020-10-24

- Update Action icon.
- Fix shell injection vulnerability.

  icon: 'tag'
// Based on https://stackoverflow.com/a/22827128
function escapeShellArg(arg) {
  return arg.replace(/'/g, `'\\''`);
}

    exec(
      `git for-each-ref --format='%(contents)' '${escapeShellArg(tag)}'`,
      (err, stdout) => {
        if (err) {
          core.setFailed(err);
        } else {
          core.setOutput('git-tag-annotation', stdout);
        }
      },
    );
    `git for-each-ref --format='%(contents)' 'refs/tags/${tag}'`,
    `git for-each-ref --format='%(contents)' 'refs/tags/${tag}'`,

it('escapes malicious values from the input', () => {
  core.getInput.mockReturnValue(`'; $(cat /etc/shadow)`);

  main();

  expect(child_process.exec).toHaveBeenCalledWith(
    "git for-each-ref --format='%(contents)' 'refs/tags/'\\''; $(cat /etc/shadow)'",
    expect.any(Function),
  );
});
CVE-2016-8637 (Shell, published 2018-08-01T13:29Z)
Description: value: A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.
Severity: LOW (CVSS v3 base score: 7.8)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/dracutdevs/dracut
Files changed:
dracut.sh
Commit message: dracut.sh: create the initramfs non-world readable also if early cpio is used

Fixes: 5f2c30d9bcd614d546d5c55c6897e33f88b9ab90
Previously fixed CVE-2012-4453: e1b48995c26c4f06d1a718539cb1bd5b0179af91

Signed-off-by: Andreas Stieger <astieger@suse.com>


Vulnerable code:
            cd "$early_cpio_dir/d"

Fixed code:
            umask 077; cd "$early_cpio_dir/d"
CVE-2015-4590 (C++, published 2015-06-22T18:59Z)
Description: value: The extractFrom function in Internals/QuotedString.cpp in Arduino JSON before 4.5 allows remote attackers to cause a denial of service (crash) via a JSON string with a \ (backslash) followed by a terminator, as demonstrated by "\\\0", which triggers a buffer overflow and over-read.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/bblanchon/ArduinoJson
Files changed:
CHANGELOG.md
src/Internals/QuotedString.cpp
test/QuotedString_ExtractFrom_Tests.cpp
Commit message: Fix buffer overflow (pull request #81)


Vulnerable code:
  char firstChar = *input;

  if (!isQuote(firstChar)) {
    // must start with a quote
    return NULL;
  }

  char stopChar = firstChar;  // closing quote is the same as opening quote

    if (c == '\0') {
      // premature ending
      return NULL;
    }
    if (c == stopChar) {
      // closing quote
      break;
    }

Fixed code:
v4.5
----

* Fixed buffer overflow when input contains a backslash followed by a terminator (issue #81)

**Upgrading is recommended** since previous versions contain a potential security risk.

  char firstChar = *input;
  char stopChar = firstChar;  // closing quote is the same as opening quote

  if (!isQuote(firstChar)) goto ERROR_OPENING_QUOTE_MISSING;

    if (c == '\0') goto ERROR_CLOSING_QUOTE_MISSING;
    if (c == stopChar) goto SUCCESS;
      if (c == '\0') goto ERROR_ESCAPE_SEQUENCE_INTERRUPTED;
SUCCESS:
  // return pointer to unquoted string

ERROR_OPENING_QUOTE_MISSING:
ERROR_CLOSING_QUOTE_MISSING:
ERROR_ESCAPE_SEQUENCE_INTERRUPTED:
  return NULL;
  void whenInputIs(const char *json, size_t len) {
    memcpy(_jsonString, json, len);
    _result = QuotedString::extractFrom(_jsonString, &_trailing);
  }


TEST_F(QuotedString_ExtractFrom_Tests, UnterminatedEscapeSequence) {
  whenInputIs("\"\\\0\"", 4);
  resultMustBe(0);
}
CVE-2024-27302 (Go, published 2024-03-06T19:15Z)
Description: value: go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the `isOriginAllowed` uses `strings.HasSuffix` to check the origin, which leads to bypass via a malicious domain. This vulnerability is capable of breaking CORS policy and thus allowing any page to make requests and/or retrieve data on behalf of other users. Version 1.4.4 fixes this issue.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/zeromicro/go-zero
Files changed:
rest/internal/cors/handlers.go
rest/internal/cors/handlers_test.go
Commit message: Merge pull request from GHSA-fgxv-gw55-r5fq

* fix: Authorization Bypass Through User-Controlled Key

* chore: add not safe domain test

Vulnerable code:
	for _, o := range allows {
		if o == allOrigins {
		if strings.HasSuffix(origin, o) {

Fixed code:
	origin = strings.ToLower(origin)
	for _, allow := range allows {
		if allow == allOrigins {
		allow = strings.ToLower(allow)
		if origin == allow {
			return true
		}

		if strings.HasSuffix(origin, "."+allow) {
		{
			name:      "not safe origin",
			origins:   []string{"safe.com"},
			reqOrigin: "not-safe.com",
		},
CVE-2022-4731 (Other, published 2022-12-25T11:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in myapnea up to 29.0.x. Affected is an unknown function of the component Title Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 29.1.0 is able to address this issue. The name of the patch is 99934258530d761bd5d09809bfa6c14b598f8d18. It is recommended to upgrade the affected component. VDB-216750 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/myapnea/myapnea.org
Files changed:
CHANGELOG.md
app/views/layouts/application.html.haml
app/views/layouts/full_page.html.haml
app/views/layouts/full_page_custom_header.html.haml
app/views/layouts/full_page_no_header.haml
app/views/layouts/full_page_sidebar.html.haml
Commit message: Fixed a Cross Site Scripting (XSS) issue


Vulnerable code:
    %title= [@title, "MyApnea"].compact.join(" - ").html_safe
    %title= [@title, "MyApnea"].compact.join(" - ").html_safe
    %title= [@title, "MyApnea"].compact.join(" - ").html_safe
    %title= [@title, "MyApnea"].compact.join(" - ").html_safe
    %title= [@title, "MyApnea"].compact.join(" - ").html_safe

Fixed code:
- **Security Changes**
  - Fixed a Cross Site Scripting (XSS) issue
    %title= [@title, "MyApnea"].compact.join(" - ")
    %title= [@title, "MyApnea"].compact.join(" - ")
    %title= [@title, "MyApnea"].compact.join(" - ")
    %title= [@title, "MyApnea"].compact.join(" - ")
    %title= [@title, "MyApnea"].compact.join(" - ")
CVE-2023-45138 (XML, published 2023-10-12T17:15Z)
Description: value: Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly. Starting in version 0.11 and prior to version 1.9.2, it's possible for a user without any specific right to perform script injection and remote code execution just by inserting an appropriate title when creating a new Change Request. This vulnerability is particularly critical as Change Request aims at being created by user without any particular rights. The vulnerability has been fixed in Change Request 1.9.2. It's possible to workaround the issue without upgrading by editing the document `ChangeRequest.Code.ChangeRequestSheet` and by performing the same change as in the fix commit.
Severity: nan (CVSS v3 base score: 9.6)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/xwiki-contrib/application-changerequest
Files changed:
application-changerequest-ui/src/main/resources/ChangeRequest/Code/ChangeRequestSheet.xml
Commit message: CRAPP-298: Bad rendering of title with UTF-8

  * Fix rendering of the title


Vulnerable code:
      &lt;label class="sr-only" for="edit-title-input"&gt;$doc.title&lt;/label&gt;

Fixed code:
      &lt;label class="sr-only" for="edit-title-input"&gt;$services.rendering.escape($doc.title, 'xwiki/2.1')&lt;/label&gt;
CVE-2021-21360 (Python, published 2021-03-09T01:15Z)
Description: value: Products.GenericSetup is a mini-framework for expressing the configured state of a Zope Site as a set of filesystem artifacts. In Products.GenericSetup before version 2.1.1 there is an information disclosure vulnerability - anonymous visitors may view log and snapshot files generated by the Generic Setup Tool. The problem has been fixed in version 2.1.1. Depending on how you have installed Products.GenericSetup, you should change the buildout version pin to 2.1.1 and re-run the buildout, or if you used pip simply do pip install `"Products.GenericSetup>=2.1.1"`.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/zopefoundation/Products.GenericSetup
Files changed:
CHANGES.rst
src/Products/GenericSetup/context.py
src/Products/GenericSetup/tests/test_tool.py
Commit message: Enforce access control on snapshot files and folders.


Vulnerable code:
- Enforce access control on setup tool log files

            current = current._getOb(element)
            rop_info = file_ob.rolesOfPermission(view)
            allowed_roles = sorted([x['name'] for x in rop_info
                                    if x['selected']])
            self.assertEqual(allowed_roles, ['Manager', 'Owner'])
            self.assertFalse(file_ob.acquiredRolesAreUsedBy(view))

Fixed code:
- Enforce access control on setup tool log files and snapshot files and folders.
from AccessControl.Permissions import view
        # Tighten the View permission on the new object.
        # Only the owner and Manager users may view the log.
        # file_ob = self._getOb(name)
        ob.manage_permission(view, ('Manager', 'Owner'), 0)
                current = current._getOb(element)
                current.manage_permission(view, ('Manager', 'Owner'), 0)
            else:
                current = current._getOb(element)
    def check_restricted_access(self, obj):
        # For most objects that we create, we do not want ordinary users to
        # see it, also not when they have View permission on a higher level.
        rop_info = obj.rolesOfPermission(view)
        allowed_roles = sorted([x['name'] for x in rop_info
                                if x['selected']])
        self.assertEqual(allowed_roles, ['Manager', 'Owner'])
        self.assertFalse(obj.acquiredRolesAreUsedBy(view))

            self.check_restricted_access(file_ob)
        # Check access restriction on snapshot files and folders
        self.check_restricted_access(tool.snapshots)
        self.check_restricted_access(snapshot)
        for obj in snapshot.objectValues():
            self.check_restricted_access(obj)
            if hasattr(aq_base(obj), 'objectValues'):
                for child in obj.objectValues():
                    self.check_restricted_access(child)
CVE-2016-6829 (Unknown, published 2016-12-09T20:59Z)
Description: value: The trove service user in (1) Openstack deployment (aka crowbar-openstack) and (2) Trove Barclamp (aka barclamp-trove and crowbar-barclamp-trove) in the Crowbar Framework has a default password, which makes it easier for remote attackers to obtain access via unspecified vectors.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-798 \u2014 Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
Repository: https://github.com/crowbar/barclamp-trove
Files changed:
Commit message: Merge pull request #43 from s-t-e-v-e-n-k/backport-trove-random-password

Backport trove random password

Vulnerable code:

Fixed code: