hitoshura25/cvefixes huggingface dataset:
CVE-2022-31307 (C, published 2022-06-21T13:15Z)
Description: value: Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_string_offset at src/njs_string.c.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/nginx/njs
Files changed:
src/njs_iterator.c
src/test/njs_unit_test.c
Commit message: Fixed Array.prototype.lastIndexOf() with unicode string as "this".

Previously, when lastIndexOf() was called with unicode string as "this"
argument and a negative "fromIndex" argument null-pointer dererence
might occur because njs_string_offset() was called with invalid index
value whereas njs_string_offset() should always be called with valid
index argument.

The fix is to verify that from index is valid.

This closes #482 issue on Github.


Vulnerable code:
            p = njs_string_offset(string_prop.start, end, from);
            p = njs_utf8_next(p, end);


Fixed code:
            p = NULL;
            if (i > to) {
                p = njs_string_offset(string_prop.start, end, from);
                p = njs_utf8_next(p, end);
            }

    { njs_str("[1,0,-1,-2].map(v => Array.prototype.lastIndexOf.call('Ф', 'Ф', v))"),
      njs_str("0,0,0,-1") },
CVE-2022-32414 (C, published 2022-06-21T13:15Z)
Description: value: Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_vmcode_interpreter at src/njs_vmcode.c.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/nginx/njs
Files changed:
src/njs_promise.c
src/test/njs_unit_test.c
Commit message: Fixed aggregation methods of Promise ctor with array-like object.

Previously, while iterating over an array-like object the methods may be
resolved with INVALID values. INVALID value is a special internal type which
should never be visible by ordinary functions.

The fix is to ensure that absent elements are represented by undefined value.

The following methods were fixed Promise.all(), Promise.allSettled(),
    Promise.any(), Promise.race().

This closes #483 issue on Github.


Vulnerable code:

Fixed code:
    if (!njs_is_valid(value)) {
        value = njs_value_arg(&njs_value_undefined);
    }

    if (!njs_is_valid(value)) {
        value = njs_value_arg(&njs_value_undefined);
    }

    if (!njs_is_valid(value)) {
        value = njs_value_arg(&njs_value_undefined);
    }

    if (!njs_is_valid(value)) {
        value = njs_value_arg(&njs_value_undefined);
    }


    { njs_str("async function f () {"
              "    var p = await Promise.race({length:1});"
              "    for (const v in 'test') { }"
              "};"
              "f().then(v => $r.retval('done'))"),
      njs_str("done") },
CVE-2024-4140 (Perl, published 2024-05-02T20:15Z)
Description: value: An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The patch set (from 2020 and 2024) limits excessive depth and the total number of parts.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/rjbs/Email-MIME
Files changed:
lib/Email/MIME.pm
Commit message: add MAX_DEPTH to limit depth of parsed emails


Vulnerable code:

Fixed code:
our $MAX_DEPTH = 10;

  our $DEPTH ||= 0;

  Carp::croak("attempted to parse a MIME message more than $MAX_DEPTH deep")
    if $MAX_DEPTH && $DEPTH > $MAX_DEPTH;

    local $DEPTH = $DEPTH + 1;
CVE-2024-4140 (Other, published 2024-05-02T20:15Z)
Description: value: An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The patch set (from 2020 and 2024) limits excessive depth and the total number of parts.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/rjbs/Email-MIME
Files changed:
xt/stupid-big.t
Commit message: hang onto this stupid test for testing


Vulnerable code:

Fixed code:
#!perl
# vim:ft=perl
use strict;
use warnings;

use Test::More;
use Email::MIME;

sub very_deep_email_string {
  my $depth = $_[0] || 250_000;

  my $str = q{};
  my $boundary_prefix = "a" x 77;
  for my $i (1 .. $depth) {
    my $boundary = sprintf "$boundary_prefix%08x", $i;
    $str .= "Content-Type: multipart/mixed; boundary=$boundary\n";
    $str .= "\n";
    $str .= "--$boundary\n\n";
  }

  for my $i (reverse(1 .. $depth)) {
    $str .= sprintf "--${boundary_prefix}%08x--\n\n", $i;
  }

  return $str;
}

sub very_attached_email_string {
  my $parts = $_[0] || 250_000;

  my $str = q{};
  my $boundary_prefix = "a" x 77;
  for my $i (1 .. $parts) {
    my $boundary = sprintf "$boundary_prefix%08x", $i;
    $str .= "Content-Type: text/plain; boundary=$boundary\n";
    $str .= "\n";
    $str .= "--$boundary\n\n";
    $str .= sprintf "--${boundary_prefix}%08x--\n\n", $i;
  }

  return $str;
}

print `ps -o rss -p $$`;

my $VAES = very_attached_email_string;
warn length($VAES) / 1024;
my $email = Email::MIME->new($VAES);

print `ps -o rss -p $$`;

# local $Email::MIME::MAX_DEPTH = 2;

$email = Email::MIME->new( very_deep_email_string() );

print `ps -o rss -p $$`;
CVE-2024-4140 (Perl, published 2024-05-02T20:15Z)
Description: value: An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The patch set (from 2020 and 2024) limits excessive depth and the total number of parts.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/rjbs/Email-MIME
Files changed:
lib/Email/MIME.pm
Commit message: document MAX_DEPTH


Vulnerable code:

Fixed code:
=head1 CONFIGURATION

The variable C<$Email::MIME::MAX_DEPTH> is the maximum depth of parts that will
be processed.  It defaults to 10, already higher than legitimate mail is ever
likely to be.  This value may go up over time as the parser is improved.
CVE-2024-4140 (Perl, published 2024-05-02T20:15Z)
Description: value: An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The patch set (from 2020 and 2024) limits excessive depth and the total number of parts.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/rjbs/Email-MIME
Files changed:
lib/Email/MIME.pm
Commit message: do not allow an excessive number of parts

This is annoying!  It bugs me that making a mere 100,000 parts should lead
to excessive consumption of memory… but really, nobody does that for
a good reason.

This makes top-level (non-recursive) Email::MIME->new set a localized
part counter to 0 and increment before it makes new subpart objects.
If the counter exceeds the max, it will die early.

It would be better to work, but this is better than eating all memory and
crashing, right?

Put together with help from Marc Bradshaw.

Test forthcoming.


Vulnerable code:
our $MAX_DEPTH = 10;

  my $bits = @bits;
    my $email = (ref $self)->new($bit, { encode_check => $self->encode_check });

Fixed code:
our $MAX_DEPTH = 10;

our $CUR_PARTS = 0;
our $MAX_PARTS = 100;

  local $CUR_PARTS = 0;
  my ($class, @rest) = @_;
  $class->_new(@rest);
}

sub _new {
  local $CUR_PARTS = $CUR_PARTS + @bits;
  Carp::croak("attempted to parse a MIME message with more than $MAX_PARTS parts")
    if $MAX_PARTS && $CUR_PARTS > $MAX_PARTS;
    my $email = (ref $self)->_new($bit, { encode_check => $self->encode_check });
CVE-2024-4140 (Perl, published 2024-05-02T20:15Z)
Description: value: An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The patch set (from 2020 and 2024) limits excessive depth and the total number of parts.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/rjbs/Email-MIME
Files changed:
lib/Email/MIME.pm
Commit message: document $MAX_PARTS


Vulnerable code:

Fixed code:
The variable C<$Email::MIME::MAX_PARTS> is the maximum number of parts that
will be processed.  It defaults to 100, already higher than legitimate mail is
ever likely to be.  This value may go up over time as the parser is improved or
as research suggests that our starting position was wrong.

Increasing either of these variables risks significant consumption of memory.
Test before changing things.
CVE-2024-4140 (Other, published 2024-05-02T20:15Z)
Description: value: An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The patch set (from 2020 and 2024) limits excessive depth and the total number of parts.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/rjbs/Email-MIME
Files changed:
Changes
Commit message: Changes: mention $MAX_PARTS


Vulnerable code:

Fixed code:
        - Fix for CVE-2024-4140: An excessive memory use issue (CWE-770)
          exists in Email-MIME, before version 1.954, which can cause denial of
          service when parsing multipart MIME messages.  The fix is the new
          $MAX_PARTS configuration limits how many parts we will consider
          parsing.  The default $MAX_PARTS is 100.
CVE-2022-39237 (Unknown, published 2022-10-06T18:16Z)
Description: value: syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version >= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-327 \u2014 Use of a Broken or Risky Cryptographic Algorithm
The product uses a broken or risky cryptographic algorithm or protocol.
Repository: https://github.com/sylabs/sif
Files changed:
Commit message: Merge pull request from GHSA-m5m3-46gj-wch8

Improve Digital Signature Hash Algorithm Validation

Vulnerable code:

Fixed code:
CVE-2023-45152 (PHP, published 2023-10-17T00:15Z)
Description: value: Engelsystem is a shift planning system for chaos events. A Blind SSRF in the "Import schedule" functionality makes it possible to perform a port scan against the local environment. This vulnerability has been fixed in commit ee7d30b33. If a patch cannot be deployed, operators should ensure that no HTTP(s) services listen on localhost and/or systems only reachable from the host running the engelsystem software. If such services are necessary, they should utilize additional authentication.
Severity: nan (CVSS v3 base score: 2.3)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/engelsystem/engelsystem
Files changed:
src/Helpers/Schedule/XmlParser.php
tests/Unit/Helpers/Schedule/Assets/schedule-invalid.html
tests/Unit/Helpers/Schedule/XmlParserTest.php
Commit message: Schedule import: Show error message on schedule parsing errors


Vulnerable code:
        $scheduleXML = simplexml_load_string($xml);

        libxml_use_internal_errors(true);


Fixed code:
        $scheduleXML = simplexml_load_string($xml, 'SimpleXMLElement', LIBXML_NOWARNING | LIBXML_NOERROR);
<!DOCTYPE html>
<html lang="">
<head>
    <title>I'm HTML!</title>
</head>
<body>
This is not a schedule<br>
and thus must be ignored.
</body>
</html>
        // Invalid schedule
        $this->assertFalse($parser->load(file_get_contents(__DIR__ . '/Assets/schedule-invalid.html')));
CVE-2023-45659 (PHP, published 2023-10-17T00:15Z)
Description: value: Engelsystem is a shift planning system for chaos events.  If a users' password is compromised and an attacker gained access to a users' account, i.e., logged in and obtained a session, an attackers' session is not terminated if the users' account password is reset. This vulnerability has been fixed in the commit `dbb089315ff3d`. Users are advised to update their installations. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 2.8)
Weakness: CWE-613 \u2014 Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Repository: https://github.com/engelsystem/engelsystem
Files changed:
src/Controllers/PasswordResetController.php
tests/Unit/Controllers/PasswordResetControllerTest.php
Commit message: Delete all sessions on password reset


Vulnerable code:

Fixed code:
        $reset->user->sessions()->getQuery()->delete();

use Engelsystem\Models\Session as SessionModel;
        SessionModel::factory()->create(); // Some other session
        SessionModel::factory(3)->create(['user_id' => $user->id]);

        $this->assertEmpty(
            SessionModel::whereUserId($user->id)->get(),
            'All user sessions should be deleted after successful password reset'
        );
        $this->assertCount(1, SessionModel::all()); // Another session should be still there
CVE-2024-31462 (Python, published 2024-04-12T22:15Z)
Description: value: stable-diffusion-webui is a web interface for Stable Diffusion, implemented using Gradio library. Stable-diffusion-webui 1.7.0 is vulnerable to a limited file write affecting Windows systems. The create_ui method (Backup/Restore tab) in modules/ui_extensions.py takes user input into the config_save_name variable on line 653. This user input is later used in the save_config_state method and used to create a file path on line 65, which is afterwards opened for writing on line 67, which leads to a limited file write exploitable on Windows systems. This issue may lead to limited file write. It allows for writing json files anywhere on the server where the web server has access.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/AUTOMATIC1111/stable-diffusion-webui
Files changed:
modules/ui_extensions.py
Commit message: fix limited file write (thanks, Sylwia)


Vulnerable code:
    if not name:
        name = "Config"

Fixed code:

    name = os.path.basename(name or "Config")
CVE-2022-25303 (HTML, published 2022-07-12T15:15Z)
Description: value: The package whoogle-search before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via the query string parameter q. In the case where it does not contain the http string, it is used to build the error_message that is then rendered in the error.html template, using the [flask.render_template](https://flask.palletsprojects.com/en/2.1.x/api/flask.render_template) function. However, the error_message is rendered using the [| safe filter](https://jinja.palletsprojects.com/en/3.1.x/templates/working-with-automatic-escaping), meaning the user input is not escaped.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/benbusby/whoogle-search
Files changed:
app/templates/error.html
Commit message: Render error message w/o `safe` filter

The error message shown in the error template does not need to be
rendered using the safe filter, and furthermore opens up an XSS
vulnerability.


Vulnerable code:
        {{ error_message|safe }}

Fixed code:
        {{ error_message }}
CVE-2024-22203 (Python, published 2024-01-23T18:15Z)
Description: value: Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the `element` method in `app/routes.py` does not validate the user-controlled `src_type` and `element_url` variables and passes them to the `send` method which sends a GET request on lines 339-343 in `request.py`, which leads to a server-side request forgery. This issue allows for crafting GET requests to internal and external resources on behalf of the server. For example, this issue would allow for accessing resources on the internal network that the server has access to, even though these resources may not be accessible on the internet. This issue is fixed in version 0.8.4.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/benbusby/whoogle-search
Files changed:
app/routes.py
Commit message: Validate urls in `element` and `window` endpoints

Domains were previously not validated before being handled, leading to a
potential scenario where someone could pass something like
"element_url=127.0.0.1:<port>/<resource>" to access other resources on a
machine running Whoogle. This change ensures that the resource used in
both endpoints is a valid domain.

This also includes validation of config names to prevent names from
including path values such as "../../(etc)".


Vulnerable code:
        if 'name' in request.args:
            config_pkl = os.path.join(
                app.config['CONFIG_PATH'],
                request.args.get('name'))
                    request.args.get('name')), 'wb'))
    empty_gif = base64.b64decode(
        'R0lGODlhAQABAIAAAP///////yH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==')

Fixed code:
import re
import validators

    name = ''
    if 'name' in request.args:
        name = os.path.normpath(request.args.get('name'))
        if not re.match(r'^[A-Za-z0-9_.+-]+$', name):
            return make_response('Invalid config name', 400)

        if name:
            config_pkl = os.path.join(app.config['CONFIG_PATH'], name)
                    name), 'wb'))
    empty_gif = base64.b64decode(
        'R0lGODlhAQABAIAAAP///////yH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==')
    # Ensure requested element is from a valid domain
    domain = urlparse.urlparse(src_url).netloc
    if not validators.domain(domain):
        return send_file(io.BytesIO(empty_gif), mimetype='image/gif')


    # Ensure requested URL has a valid domain
    if not validators.domain(target.netloc):
        return render_template(
            'error.html',
            error_message='Invalid location'), 400
CVE-2024-22205 (Python, published 2024-01-23T18:15Z)
Description: value: Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `window` endpoint does not sanitize user-supplied input from the `location` variable and passes it to the `send` method which sends a `GET` request on lines 339-343 in `request.py,` which leads to a server-side request forgery. This issue allows for crafting GET requests to internal and external resources on behalf of the server. For example, this issue would allow for accessing resources on the internal network that the server has access to, even though these resources may not be accessible on the internet. This issue is fixed in version 0.8.4.


Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/benbusby/whoogle-search
Files changed:
app/routes.py
Commit message: Validate urls in `element` and `window` endpoints

Domains were previously not validated before being handled, leading to a
potential scenario where someone could pass something like
"element_url=127.0.0.1:<port>/<resource>" to access other resources on a
machine running Whoogle. This change ensures that the resource used in
both endpoints is a valid domain.

This also includes validation of config names to prevent names from
including path values such as "../../(etc)".


Vulnerable code:
        if 'name' in request.args:
            config_pkl = os.path.join(
                app.config['CONFIG_PATH'],
                request.args.get('name'))
                    request.args.get('name')), 'wb'))
    empty_gif = base64.b64decode(
        'R0lGODlhAQABAIAAAP///////yH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==')

Fixed code:
import re
import validators

    name = ''
    if 'name' in request.args:
        name = os.path.normpath(request.args.get('name'))
        if not re.match(r'^[A-Za-z0-9_.+-]+$', name):
            return make_response('Invalid config name', 400)

        if name:
            config_pkl = os.path.join(app.config['CONFIG_PATH'], name)
                    name), 'wb'))
    empty_gif = base64.b64decode(
        'R0lGODlhAQABAIAAAP///////yH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==')
    # Ensure requested element is from a valid domain
    domain = urlparse.urlparse(src_url).netloc
    if not validators.domain(domain):
        return send_file(io.BytesIO(empty_gif), mimetype='image/gif')


    # Ensure requested URL has a valid domain
    if not validators.domain(target.netloc):
        return render_template(
            'error.html',
            error_message='Invalid location'), 400