hitoshura25/cvefixes huggingface dataset:
CVE-2022-39280 (Unknown, published 2022-10-06T18:16Z)
Description: value: dparse is a parser for Python dependency files. dparse in versions before 0.5.2 contain a regular expression that is vulnerable to a Regular Expression Denial of Service. All the users parsing index server URLs with dparse are impacted by this vulnerability. A patch has been applied in version `0.5.2`, all the users are advised to upgrade to `0.5.2` as soon as possible. Users unable to upgrade should avoid passing index server URLs in the source file to be parsed.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/pyupio/dparse
Files changed:
Commit message: Merge pull request #57 from pyupio/security/remove-intensive-regex

Removing index server validation

Vulnerable code:

Fixed code:
CVE-2022-39280 (Python, published 2022-10-06T18:16Z)
Description: value: dparse is a parser for Python dependency files. dparse in versions before 0.5.2 contain a regular expression that is vulnerable to a Regular Expression Denial of Service. All the users parsing index server URLs with dparse are impacted by this vulnerability. A patch has been applied in version `0.5.2`, all the users are advised to upgrade to `0.5.2` as soon as possible. Users unable to upgrade should avoid passing index server URLs in the source file to be parsed.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/pyupio/dparse
Files changed:
dparse/parser.py
dparse/regex.py
Commit message: Removing index server validation


Vulnerable code:
from .regex import URL_REGEX, HASH_REGEX
        matches = URL_REGEX.findall(line)
        if matches:
            url = matches[0]
            return url if url.endswith("/") else url + "/"
import re
# see https://gist.github.com/dperini/729294
URL_REGEX = re.compile(
    # protocol identifier
    "(?:(?:https?|ftp)://)"
    # user:pass authentication
    "(?:\S+(?::\S*)?@)?"
    "(?:"
    # IP address exclusion
    # private & local networks
    "(?!(?:10|127)(?:\.\d{1,3}){3})"
    "(?!(?:169\.254|192\.168)(?:\.\d{1,3}){2})"
    "(?!172\.(?:1[6-9]|2\d|3[0-1])(?:\.\d{1,3}){2})"
    # IP address dotted notation octets
    # excludes loopback network 0.0.0.0
    # excludes reserved space >= 224.0.0.0
    # excludes network & broadcast addresses
    # (first & last IP address of each class)
    "(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])"
    "(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}"
    "(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))"
    "|"
    # host name
    "(?:(?:[a-z\u00a1-\uffff0-9]-?)*[a-z\u00a1-\uffff0-9]+)"
    # domain name
    "(?:\.(?:[a-z\u00a1-\uffff0-9]-?)*[a-z\u00a1-\uffff0-9]+)*"
    # TLD identifier
    "(?:\.(?:[a-z\u00a1-\uffff]{2,}))"
    ")"
    # port number
    "(?::\d{2,5})?"
    # resource path
    "(?:/\S*)?",
    re.UNICODE)

HASH_REGEX = r"--hash[=| ][\w]+:[\w]+"

Fixed code:
from .regex import HASH_REGEX
        groups = re.split(pattern="[=\s]+", string=line.strip(), maxsplit=100)

        if len(groups) >= 2:
            return groups[1] if groups[1].endswith("/") else groups[1] + "/"


HASH_REGEX = r"--hash[=| ]\w+:\w+"
CVE-2018-10856 (Go, published 2018-07-03T01:29Z)
Description: value: It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This results in unnecessary privileges being granted to the container.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-732 \u2014 Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Repository: https://github.com/projectatomic/libpod
Files changed:
pkg/spec/spec.go
test/e2e/run_test.go
Commit message: Clear all caps, except the bounding set, when --user is specified.

Currently we are giving all caps to users when running with podman run --user,
They should get none by default.  If the command line includes --cap-add, then
we need to run with those capabilties.  Similarly we need to drop caps from
bounding set, if user specifies --cap-drop

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

Closes: #851
Approved by: mheon


Vulnerable code:

Fixed code:
	useNotRoot := func(user string) bool {
		if user == "" || user == "root" || user == "0" {
			return false
		}
		return true
	}

	bounding := configSpec.Process.Capabilities.Bounding
	if useNotRoot(config.User) {
		configSpec.Process.Capabilities.Bounding = caplist
	}
	configSpec.Process.Capabilities.Ambient = caplist
	if useNotRoot(config.User) {
		caplist, err = caps.TweakCapabilities(bounding, config.CapAdd, config.CapDrop)
		if err != nil {
			return err
		}
	}
	configSpec.Process.Capabilities.Bounding = caplist
	"strings"
	It("podman run with user, verify caps dropped", func() {
		session := podmanTest.Podman([]string{"run", "--rm", "--user=1234", ALPINE, "grep", "CapEff", "/proc/self/status"})
		session.WaitWithDefaultTimeout()
		Expect(session.ExitCode()).To(Equal(0))
		capEff := strings.Split(session.OutputToString(), " ")
		Expect("0000000000000000").To(Equal(capEff[1]))
	})
CVE-2021-43824 (C++, published 2022-02-22T23:15Z)
Description: value: Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions a crafted request crashes Envoy when a CONNECT request is sent to JWT filter configured with regex match. This provides a denial of service attack vector. The only workaround is to not use regex in the JWT filter. Users are advised to upgrade.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/envoyproxy/envoy
Files changed:
docs/root/version_history/current.rst
source/extensions/filters/http/jwt_authn/matcher.cc
test/extensions/filters/http/jwt_authn/filter_integration_test.cc
test/extensions/filters/http/jwt_authn/test_common.h
Commit message: CVE-2021-43824

jwt_atuhn: fixed the crash when a CONNECT request is sent to JWT filter
configured with regex match.

Signed-off-by: Yan Avlasov <yavlasov@google.com>


Vulnerable code:

Fixed code:
* jwt_authn: fixed the crash when a CONNECT request is sent to JWT filter configured with regex match on the Host header.
      if (headers.Path() == nullptr) {
        return false;
      }
// Verify that JWT config with RegEx matcher can handle CONNECT requests.
TEST_P(LocalJwksIntegrationTest, ConnectRequestWithRegExMatch) {
  config_helper_.prependFilter(getAuthFilterConfig(ExampleConfigWithRegEx, true));
  initialize();

  codec_client_ = makeHttpConnection(lookupPort("http"));

  auto encoder_decoder = codec_client_->startRequest(Http::TestRequestHeaderMapImpl{
      {":method", "CONNECT"},
      {":authority", "host.com:80"},
      {"authorization", "Bearer " + std::string(GoodToken)},
  });
  request_encoder_ = &encoder_decoder.first;
  auto response = std::move(encoder_decoder.second);

  if (downstreamProtocol() == Http::CodecType::HTTP1) {
    // Because CONNECT requests for HTTP/1 do not include a path, they will fail
    // to find a route match and return a 404.
    ASSERT_TRUE(response->waitForEndStream());
    ASSERT_TRUE(response->complete());
    EXPECT_EQ("404", response->headers().getStatusValue());
  } else {
    ASSERT_TRUE(response->waitForReset());
    ASSERT_TRUE(codec_client_->waitForDisconnect());
  }
}

const char ExampleConfigWithRegEx[] = R"(
providers:
  example_provider:
    issuer: https://example.com
    audiences:
    - example_service
    - http://example_service1
    - https://example_service2/
    remote_jwks:
      http_uri:
        uri: https://pubkey_server/pubkey_path
        cluster: pubkey_cluster
        timeout:
          seconds: 5
      cache_duration:
        seconds: 600
    forward_payload_header: sec-istio-auth-userinfo
rules:
- match:
    safe_regex:
      google_re2: {}
      regex: "/somethig/.*"
  requires:
    provider_name: "example_provider"
- match:
    path: "/"
  requires:
    provider_name: "example_provider"
bypass_cors_preflight: true
)";
CVE-2024-23323 (YAML, published 2024-02-09T23:15Z)
Description: value: Envoy is a high-performance edge/middle/service proxy. The regex expression is compiled for every request and can result in high CPU usage and increased request latency when multiple routes are configured with such matchers. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/envoyproxy/envoy
Files changed:
changelogs/current.yaml
Commit message: Cache RE object in uri template matcher.

Fix [CVE-2024-23323](https://github.com/envoyproxy/envoy/security/advisories/GHSA-x278-4w4x-r7ch)

Signed-off-by: Yan Avlasov <yavlasov@google.com>
Signed-off-by: Ryan Northey <ryan@synca.io>


Vulnerable code:

Fixed code:
- area: url matching
  change: |
    Fixed excessive CPU utilization when using regex URL template matcher.
CVE-2024-22405 (Objective-C, published 2024-04-30T10:15Z)
Description: value: XADMaster is an objective-C library for archive and file unarchiving and extraction. When extracting a specially crafted zip archive XADMaster may not apply quarantine attribute correctly. Such behaviour may circumvent Gatekeeper checks on the system. Only macOS installations are affected. This issue was fixed in XADMaster 1.10.8. It is recommended to upgrade to the latest version. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/MacPaw/XADMaster
Files changed:
XADArchive.m
XADSimpleUnarchiver.m
XADUnarchiver.h
XADUnarchiver.m
Commit message: Make sure that quarantine attribute is applied to all directories, not only in the child ones (#157)



Vulnerable code:


	withIntermediateDirectories:NO attributes:nil error:NULL]) return XADNoError;
	if([manager createDirectoryAtPath:path attributes:nil]) return XADNoError;
	else return XADMakeDirectoryError;

Fixed code:
-(void)unarchiver:(XADUnarchiver *)unarchiver didCreateDirectory:(NSString *)directory
{
    if(delegate) {
        [delegate archive:self didCreateDirectory:directory];
    }
}
-(void)archive:(XADArchive *)arc didCreateDirectory:(NSString *)directory
{ [delegate archive:arc didCreateDirectory:directory]; }

-(void)archive:(XADArchive *)archive didCreateDirectory:(NSString *)directory { }
-(void)unarchiver:(XADUnarchiver *)unarchiver didCreateDirectory:(NSString *)directory {
    if(propagatemetadata && metadata) {
        [XADPlatform writeCloneableMetadata:metadata toPath:directory];
    }
}

-(void)unarchiver:(XADUnarchiver *)unarchiver didCreateDirectory:(NSString *)directory;
          withIntermediateDirectories:NO attributes:nil error:NULL]) {
        if (delegate) {
            [delegate unarchiver:self didCreateDirectory:path];
        }
        return XADNoError;
    }
    if([manager createDirectoryAtPath:path attributes:nil]) {
        if (delegate) {
            [delegate unarchiver:self didCreateDirectory:path];
        }
        return XADNoError;
    }
    else return XADMakeDirectoryError;
-(void)unarchiver:(XADUnarchiver *)unarchiver didCreateDirectory:(NSString *)directory { }
CVE-2021-3807 (JavaScript, published 2021-09-17T07:15Z)
Description: value: ansi-regex is vulnerable to Inefficient Regular Expression Complexity
Severity: HIGH (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/chalk/ansi-regex
Files changed:
index.js
Commit message: Fix potential ReDoS (#37)



Vulnerable code:
		'[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:[a-zA-Z\\d]*(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?\\u0007)',

Fixed code:
	    '[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]+)*|[a-zA-Z\\d]+(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?\\u0007)',
CVE-2023-33979 (Python, published 2023-05-31T19:15Z)
Description: value: gpt_academic provides a graphical interface for ChatGPT/GLM. A vulnerability was found in gpt_academic 3.37 and prior. This issue affects some unknown processing of the component Configuration File Handler. The manipulation of the argument file leads to information disclosure. Since no sensitive files are configured to be off-limits, sensitive information files in some working directories can be read through the `/file` route, leading to sensitive information leakage. This affects users that uses file configurations via `config.py`, `config_private.py`, `Dockerfile`. A patch is available at commit 1dcc2873d2168ad2d3d70afcb453ac1695fbdf02. As a workaround, one may use environment variables instead of `config*.py` files to configure this project, or use docker-compose installation to configure this project.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/binary-husky/gpt_academic
Files changed:
main.py
Commit message: 修复Gradio配置泄露的问题


Vulnerable code:
    demo.queue(concurrency_count=CONCURRENT_COUNT).launch(server_name="0.0.0.0", server_port=PORT, auth=AUTHENTICATION, favicon_path="docs/logo.png")

Fixed code:
    demo.queue(concurrency_count=CONCURRENT_COUNT).launch(
        server_name="0.0.0.0", server_port=PORT, auth=AUTHENTICATION,
        favicon_path="docs/logo.png", blocked_paths=["config.py","config_private.py","docker-compose.yml","Dockerfile"])
CVE-2024-31224 (Python, published 2024-04-08T16:15Z)
Description: value: GPT Academic provides interactive interfaces for large language models. A vulnerability was found in gpt_academic versions 3.64 through 3.73. The server deserializes untrustworthy data from the client, which may risk remote code execution. Any device that exposes the GPT Academic service to the Internet is vulnerable. Version 3.74 contains a patch for the issue. There are no known workarounds aside from upgrading to a patched version.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/binary-husky/gpt_academic
Files changed:
themes/theme.py
Commit message: Qhaoduoyu patch 1: pickle to json to increase security (#1648)

* Update theme.py

fix bugs

* Update theme.py

fix bugs

* change var names

---------

Co-authored-by: binary-husky <qingxu.fu@outlook.com>

Vulnerable code:

    # Pickle the dictionary and encode it as a string
    pickled_dict = pickle.dumps(d)
    cookie_value = base64.b64encode(pickled_dict).decode("utf-8")
    # Decode the base64-encoded string and unpickle it into a dictionary
    pickled_dict = base64.b64decode(c.encode("utf-8"))
    return pickle.loads(pickled_dict)

Fixed code:
import json
import json

    # serialize the dictionary and encode it as a string
    serialized_dict = json.dumps(d)
    cookie_value = base64.b64encode(serialized_dict.encode('utf8')).decode("utf-8")
    # Decode the base64-encoded string and unserialize it into a dictionary
    serialized_dict = base64.b64decode(c.encode("utf-8"))
    serialized_dict.decode("utf-8")
    return json.loads(serialized_dict)
CVE-2023-46228 (C, published 2023-10-19T05:15Z)
Description: value: zchunk before 1.3.2 has multiple integer overflows via malformed zchunk files to lib/comp/comp.c, lib/comp/zstd/zstd.c, lib/dl/multipart.c, or lib/header.c.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/zchunk/zchunk
Files changed:
src/lib/comp/comp.c
src/lib/comp/zstd/zstd.c
src/lib/dl/multipart.c
src/lib/header.c
Commit message: Handle overflow errors in malformed zchunk files

Thanks to Agostino Sarubbo of Gentoo for the heads up!

Signed-off-by: Jonathan Dieter <jdieter@gmail.com>


Vulnerable code:
    /* Verify that lead_size and header_length have been set */

Fixed code:
    if((comp->data_size > comp->data_size + src_size) ||
       (src_size > comp->data_size + src_size)) {
        zck_log(ZCK_LOG_ERROR, "Integer overflow when reading data");
        return false;
    }

    if((comp->dc_data_size > comp->dc_data_size + src_size) ||
       (src_size > comp->dc_data_size + src_size)) {
        zck_log(ZCK_LOG_ERROR, "Integer overflow when reading decompressed data");
        return false;
    }

        if((mp->buffer_len > mp->buffer_len + l) ||
           (l > mp->buffer_len + l)) {
            zck_log(ZCK_LOG_ERROR, "Integer overflow when extracting multipart data");
            return 0;
        }

    /* Verify that lead_size and header_length have been set and are legit */
    if((zck->lead_size > zck->lead_size + zck->header_length) ||
       (zck->header_length > zck->lead_size + zck->header_length)) {
        zck_log(ZCK_LOG_ERROR, "Integer overflow when reading header");
        return false;
    }
    /* Verify that we're not going to overflow */
    if(length > length + zck->hash_type.digest_size) {
        zck_log(ZCK_LOG_ERROR, "Integer overflow when reading lead");
        return false;
    }
CVE-2022-3152 (PHP, published 2022-09-07T15:15Z)
Description: value: Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/phpfusion/phpfusion
Files changed:
includes/classes/PHPFusion/UserFieldsInput.php
Commit message: Security fixes

Signed-off-by: deviance <meangczac.chan@gmail.com>


Vulnerable code:
        $a_check = ($this->userData["user_password"] != sanitizer("user_hash", "", "user_hash"));
        $b_check = ($this->userData['user_id'] != fusion_get_userdata('user_id'));
        // for admin with sufficient rights, skip all these formats
        if (iADMIN && checkrights("M")) {
            $a_check = FALSE;
            $b_check = FALSE;
        }
        if ($a_check or $b_check) {
            fusion_stop();

Fixed code:
        if (!(iADMIN && checkrights('M')) ||
            ($this->userData['user_password'] != sanitizer("user_hash", "", "user_hash")) ||
            ($this->data['user_id'] != fusion_get_userdata('user_id'))) {
            fusion_stop($locale['error_request']);

            return FALSE;
CVE-2020-36618 (Other, published 2022-12-19T14:15Z)
Description: value: A vulnerability classified as critical has been found in Furqan node-whois. Affected is an unknown function of the file index.coffee. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible to launch the attack remotely. The name of the patch is 46ccc2aee8d063c7b6b4dee2c2834113b7286076. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216252.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/FurqanSoftware/node-whois
Files changed:
index.coffee
Commit message: fix(vulnerability): Prototype Pollution Vulnerability (#105)

* fix: prevent prototype injection/derivatives bugs

* fix: indent

* fix: indent

Vulnerable code:

Fixed code:
		
      if addr == '__proto__'
              done new Error 'lookup: __proto__ is not allowed to lookup'
		return
CVE-2020-36560 (Unknown, published 2022-12-27T22:15Z)
Description: value: Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
Severity: nan (CVSS v3 base score: 9.1)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/artdarek/go-unzip
Files changed:
Commit message: Merge pull request #2 from snoopysecurity/fix/santize-filename-paths

fix: sanitize filepath names

Vulnerable code:

Fixed code:
CVE-2016-15017 (PHP, published 2023-01-10T15:15Z)
Description: value: A vulnerability has been found in fabarea media_upload on TYPO3 and classified as critical. This vulnerability affects the function getUploadedFileList of the file Classes/Service/UploadFileService.php. The manipulation leads to pathname traversal. Upgrading to version 0.9.0 is able to address this issue. The patch is identified as b25d42a4981072321c1a363311d8ea2a4ac8763a. It is recommended to upgrade the affected component. VDB-217786 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/fabarea/media_upload
Files changed:
Classes/Service/UploadFileService.php
Commit message: [SECURITY] Prevent directory traversal

Resolves #6


Vulnerable code:
     * @throws \Exception

            $temporaryFileNameAndPath = UploadManager::UPLOAD_FOLDER . '/' . $uploadedFileName;
                throw new \Exception($message, 1389550006);
                ->setFileName($uploadedFileName)

Fixed code:
     * @throws \InvalidArgumentException
     * @throws \RuntimeException
            // Protection against directory traversal
            $uploadedFileName = str_replace('..' . DIRECTORY_SEPARATOR, '', $uploadedFileName);
            $temporaryFileNameAndPath = UploadManager::UPLOAD_FOLDER . DIRECTORY_SEPARATOR . $uploadedFileName;
                throw new \RuntimeException($message, 1389550006);
                ->setFileName(basename($uploadedFileName))